Fix hash-to-curve comment.
511S + 3M isn't even enough operations to get up to 2^519-1. I dropped a
a bunch of terms. (We can get up to 2^512-1 with 511S + 9M. Then an
additional 7S + 3M finishes it up.)
Change-Id: Ibb1bc3491dfb09ab8a917498e99deb66e4894cf0
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40644
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
diff --git a/crypto/ec_extra/hash_to_curve.c b/crypto/ec_extra/hash_to_curve.c
index 16a0932..52dbd9c 100644
--- a/crypto/ec_extra/hash_to_curve.c
+++ b/crypto/ec_extra/hash_to_curve.c
@@ -300,8 +300,8 @@
// specializing it to the curve:
//
// - c1 = (p-3)/4 = 2^519-1. |felem_exp| costs 515S + 119M for this exponent.
- // A more efficient addition chain for c1 would cost 511S + 3M, but it would
- // require specializing the particular exponent.
+ // A more efficient addition chain for c1 would cost 518S + 12M, but it
+ // would require specializing the particular exponent.
//
// - P-521, while large, is a Mersenne prime, so we can likely do better than
// the generic Montgomery implementation if we specialize the field
