left-most bits for P-521 we have to do a right shift. if size := c.N.Size(); len(hash) >= size { hash = hash[:size] if excess := len(hash)*8 - c.N.BitLen(); excess > 0 { hash = rightShift(hash, excess) } } _, err := e.SetOverflowingBytes(hash, c.N) if err != nil { panic("ecdsa: internal error: truncated hash is too long") } } // rightShift implements the right shift necessary for bits2int, which takes the // leftmost bits of either the hash or HMAC_DRBG output. // // Note how taking the rightmost bits would...