p.Nat().Bytes(p), q) if err != nil { return errors.New("crypto/rsa: p == q") } // diff = 0 - p mod q = q - p diff.ExpandFor(q).Sub(pQ, q) } else { // p > q // diff = 0 - q mod p = p - q diff.ExpandFor(p).Sub(qP, p) } // A tiny bit of leakage is acceptable because it's not adaptive, an // attacker only learns the magnitude of p - q. if diff.BitLenVarTime() <= N.BitLen()/2-100 { return errors.New("crypto/rsa: |p - q| too small") } // Check that d > 2^(nlen/2). // // See section 3 of https://crypto...