tree 9d5e1f8a41603996419a92b5f1ef0af18ca811d8
parent 2b63addf6ac2cc0f07f9542f33fe1361fa6fd6d5
author David Benjamin <davidben@google.com> 1512075936 -0500
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1512755754 +0000

Fully reduce scalars in EC_POINT_mul.

Along the way, this allows us to tidy up the invariants associated with
EC_SCALAR. They were fuzzy around ec_point_mul_scalar and some
computations starting from the digest in ECDSA. The latter I've put into
the type system with EC_LOOSE_SCALAR.

As for the former, Andres points out that particular EC implementations
are only good for scalars within a certain range, otherwise you may need
extra work to avoid the doubling case. To simplify curve
implementations, we reduce them fully rather than do the looser bit size
check, so they can have the stronger precondition to work with.

Change-Id: Iff9a0404f89adf8f7f914f8e8246c9f3136453f1
Reviewed-on: https://boringssl-review.googlesource.com/23664
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>