tree ce0d5e770e750acae01b148c1cadeba5f9e56ecf
parent 8db94be1d6459d8a74d76ae30735a21aef237dd6
author David Benjamin <davidben@google.com> 1510270337 -0800
committer Adam Langley <agl@google.com> 1511194689 +0000

Fix timing leak in BN_from_montgomery_word.

BN_from_montgomery_word doesn't have a constant memory access pattern.
Replace the pointer trick with constant_time_select_w. There is, of
course, still the bn_correct_top leak pervasive in BIGNUM itself.

I wasn't able to measure a performance on RSA operations before or after
this change, but the benchmarks would vary wildly run to run. But one
would assume the logic here is nothing compared to the actual reduction.

Change-Id: Ide761fde3a091a93679f0a803a287aa5d0d4600d
Reviewed-on: https://boringssl-review.googlesource.com/22904
Reviewed-by: Adam Langley <agl@google.com>