tree e1d969b89d8512d55f2c4e0074453258e64f2a6a
parent c3b236d325bbdcbb4621815704c7e7e927923042
author David Benjamin <davidben@google.com> 1691794576 -0400
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1692047448 +0000

Align DH keygen with NIST's formulation when q is available

Section 5.6.1.1.4 of SP 800-56A Rev 3 and Appendix B.1.2 of FIPS 186-4
select the private key out of the range [1, q-1]. We used [2, q-1]. This
distinction is unimportant. 0, 1, 2, 3, 4, etc. all make equally bad
private keys. The defense against each of these is their negligible
probability, not rejection sampling.

Nonetheless, we may as well align with *some* specification, and NIST's
formulation works fine.

Change-Id: I33352061f3fbdbec5b14b576d15be98464a57536
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/62227
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>