tree 63d01096257d1e7501a69b0fa899f123c412b45f
parent 6e678eeb6e76171712ae00d467321b6fe196152d
author David Benjamin <davidben@google.com> 1525288096 -0400
committer Adam Langley <agl@google.com> 1525289040 +0000

Small curve25519 cleanups.

Per Brian, x25519_ge_frombytes_vartime does not match the usual
BoringSSL return value convention, and we're slightly inconsistent about
whether to mask the last byte with 63 or 127. (It then gets ANDed with
64, so it doesn't matter which.) Use 127 to align with the curve25519
RFC. Finally, when we invert the transformation, use the same constants
inverted so that they're parallel.

Bug: 243, 244
Change-Id: I0e3aca0433ead210446c58d86b2f57526bde1eac
Reviewed-on: https://boringssl-review.googlesource.com/27984
Reviewed-by: Adam Langley <agl@google.com>