bigmod.NewNat().InverseVarTime(e, λ) if !ok { // This checks that GCD(e, lcm(p-1, q-1)) = 1, which is equivalent // to checking GCD(e, p-1) = 1 and GCD(e, q-1) = 1 separately in // FIPS 186-5, Appendix A.1.3, steps 4.5 and 5.6. // // We waste a prime by retrying the whole process, since 65537 is // probably only a factor of one of p-1 or q-1, but the probability // of this check failing is only 1/65537, so it doesn't matter. continue } if e.ExpandFor(λ).Mul(d, λ).IsOne() == 0 { return nil, errors.New("rsa:...