shiftedLimbs[i+1] << (_W - shift) } } return x } // BitLenVarTime returns the actual size of x in bits. // // The actual size of x (but nothing more) leaks through timing side-channels. // Note that this is ordinarily secret, as opposed to the announced size of x. func (x *Nat) BitLenVarTime() int { // Eliminate bounds checks in the loop. size := len(x.limbs) xLimbs := x.limbs[:size] for i := size - 1; i >= 0; i-- { if xLimbs[i] != 0 { return i*_W + bitLen(xLimbs[i]) } } return 0 } // bitLen is a version of bits.Len...