xLimbs[i] = shiftedLimbs[i] >> shift if i+1 < len(shiftedLimbs) { xLimbs[i] |= shiftedLimbs[i+1] << (_W - shift) } } return x } // BitLenVarTime returns the actual size of x in bits. // // The actual size of x (but nothing more) leaks through timing side-channels. // Note that this is ordinarily secret, as opposed to the announced size of x. func (x *Nat) BitLenVarTime() int { // Eliminate bounds checks in the loop. size := len(x.limbs) xLimbs := x.limbs[:size] for i := size - 1; i >= 0; i-- { if...