bitLen is a version of bits.Len that only leaks the bit length of n, but not // its value. bits.Len and bits.LeadingZeros use a lookup table for the // low-order bits on some architectures. func bitLen(n uint) int { len := 0 // We assume, here and elsewhere, that comparison to zero is constant time // with respect to different non-zero values. for n != 0 { len++ n >>= 1 } return len } // Modulus is used for modular arithmetic, precomputing relevant constants. // // A Modulus can leak the exact number...