tree fad4b8d8e95cc125f8d959a0021563bcd8a8bb75
parent d1f99cc9ad77f953a3ae26592d5a8f195fd9ac12
author David Benjamin <davidben@google.com> 1782572986 -0400
committer boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1782594374 -0700

Fix ML-KEM constant-time validation regression

https://boringssl-review.googlesource.com/c/boringssl/+/92828
declassified the result of (s0 | s1) >= kPrime, but that is not the same
as s0 >= kPrime || s1 >= kPrime. Instead, just write this more
straightforwardly.

Change-Id: I68e12a38d074db754daf46d60bb061d80a95f2da
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/98108
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>