tree 8855feaed3ad3a38bb8b2e5e024b57ced25cb228
parent 1c55e54eda2cb8d099c047cac43db3f3f0680aef
author David Benjamin <davidben@google.com> 1546198066 +0000
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1546472011 +0000

Add a comment about ecp_nistz256_point_add_affine's limitations.

ecp_nistz256_point_add_affine does not support the doubling case and,
unlike ecp_nistz256_point_add which does a tail call, computes the wrong
answer. Note TestPointAdd in the unit tests skips this case.

This works fine because we only use ecp_nistz256_point_add_affine for
the g_scalar term, which is fully computed before the p_scalar term.
(Additionally it requires that the windowing pattern never hit the
doubling case for single multiplication.)

But this is not obvious from reading the multiplication functions, so
leave a comment at the call site to point this out.

Change-Id: I08882466d98030cdc882a5be9e702ee404e80cce
Reviewed-on: https://boringssl-review.googlesource.com/c/33945
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>