only used for randomly-selected w in the // context of RSA key generation, we can use a smaller number of iterations. // The exact number depends on the size of the prime (and the implied // security level). See BoringSSL for the full formula. // https://cs.opensource.google/boringssl/boringssl/+/master:crypto/fipsmodule/bn/prime.c.inc;l=208-283;drc=3a138e43 bits := mr.w.BitLen() var iterations int switch { case bits >= 3747: iterations = 3 case bits >= 1345: iterations = 4 case bits >= 476: iterations...