Fix hash-to-curve comment.

511S + 3M isn't even enough operations to get up to 2^519-1. I dropped a
a bunch of terms. (We can get up to 2^512-1 with 511S + 9M. Then an
additional 7S + 3M finishes it up.)

Change-Id: Ibb1bc3491dfb09ab8a917498e99deb66e4894cf0
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40644
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

crypto/ec_extra/hash_to_curve.c

diff --git a/crypto/ec_extra/hash_to_curve.c b/crypto/ec_extra/hash_to_curve.c
index 16a0932..52dbd9c 100644
--- a/crypto/ec_extra/hash_to_curve.c
+++ b/crypto/ec_extra/hash_to_curve.c
@@ -300,8 +300,8 @@
   // specializing it to the curve:
   //
   // - c1 = (p-3)/4 = 2^519-1. |felem_exp| costs 515S + 119M for this exponent.
-  //   A more efficient addition chain for c1 would cost 511S + 3M, but it would
-  //   require specializing the particular exponent.
+  //   A more efficient addition chain for c1 would cost 518S + 12M, but it
+  //   would require specializing the particular exponent.
   //
   // - P-521, while large, is a Mersenne prime, so we can likely do better than
   //   the generic Montgomery implementation if we specialize the field