out.assign(not(ctEq(k, 0)), tmp) } } return out.montgomeryReduction(m) } // ExpShortVarTime calculates out = x^e mod m. // // The output will be resized to the size of m and overwritten. x must already // be reduced modulo m. This leaks the exponent through timing side-channels. // // m must be odd, or ExpShortVarTime will panic. func (out *Nat) ExpShortVarTime(x *Nat, e uint, m *Modulus) *Nat { if !m.odd { panic("bigmod: modulus for ExpShortVarTime must be odd") } // For short exponents, precomputing a table and...