FCMOVBE F2, F0                          // dad2
	FCMOVBE F3, F0                          // dad3
	FCMOVE F2, F0                           // daca
	FCMOVE F3, F0                           // dacb
	FCMOVNB F2, F0                          // dbc2
	FCMOVNB F3, F0                          // dbc3
	FCMOVNBE F2, F0                         // dbd2
	FCMOVNBE F3, F0                         // dbd3

it's not adaptive, an // attacker only learns the magnitude of p - q. if diff.BitLenVarTime() <= N.BitLen()/2-100 { return errors.New("crypto/rsa: |p - q| too small") } // Check that d > 2^(nlen/2). // // See section 3 of https://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf // for more details about attacks on small d values. // // Likewise, the leakage of the magnitude of d is not adaptive. if priv.d.BitLenVarTime() <= N.BitLen()/2 { return errors.New("crypto/rsa: d too small") } return nil } func...

it's not adaptive, an // attacker only learns the magnitude of p - q. if diff.BitLenVarTime() <= N.BitLen()/2-100 { return errors.New("crypto/rsa: |p - q| too small") } // Check that d > 2^(nlen/2). // // See section 3 of https://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf // for more details about attacks on small d values. // // Likewise, the leakage of the magnitude of d is not adaptive. if priv.d.BitLenVarTime() <= N.BitLen()/2 { return errors.New("crypto/rsa: d too small") } return nil } func...