David Benjamin
6c428307d1
While it appears that we internally support constant-time dual multiplication, it is not actually constant-time. Integrating the two operations means we hit the doubling branch. Instead, replace the constant-time functions with single multiplication functions, one for arbitrary points and one for the base point. This simplifies timing analysis of the EC_METHODs. This CL only changes the wrapper functions. A subsequent CL will change the EC_METHOD hooks. We conservatively assume EC_POINT_mul callers expect secret scalars and split it into two multiplications and an addition if needed. Update-Note: EC_POINT_mul may get slower if called with both g_scalar and p_scalar non-NULL. If the scalars were secret, this plugs a timing leak (note neither ECDH nor ECDSA signing use such an operation). If acting on public scalars, notably ECDSA verify, this slowdown is not inherently necessary. If necessary, we can expose a public version of ec_point_mul_scalar_public, but callers should be using BoringSSL's ECDSA verify API instead. Change-Id: I9c20b660ce4b58dc633588cfd5b2e97a40203ec3 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/36224 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>