aclocal.m4 | 2 1 + 1 - 0 !
configure | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

---

aclocal.m4 | 4 0 + 4 - 0 !
configure | 4 0 + 4 - 0 !
2 files changed, 8 deletions(-)

---

curve25519-eh-to-x.c | 6 1 + 5 - 0 !
ecc-eh-to-a.c | 8 2 + 6 - 0 !
ecc-internal.h | 15 15 + 0 - 0 !
ecc-j-to-a.c | 14 3 + 11 - 0 !
ecc-mod-arith.c | 24 24 + 0 - 0 !
5 files changed, 45 insertions(+), 22 deletions(-)

 [patch] new functions ecc_mod_mul_canonical and
 ecc_mod_sqr_canonical.

* ecc-mod-arith.c (ecc_mod_mul_canonical, ecc_mod_sqr_canonical):
New functions.
* ecc-internal.h: Declare and document new functions.
* curve448-eh-to-x.c (curve448_eh_to_x): Use ecc_mod_sqr_canonical.
* curve25519-eh-to-x.c (curve25519_eh_to_x): Use ecc_mod_mul_canonical.
* ecc-eh-to-a.c (ecc_eh_to_a): Likewise.
* ecc-j-to-a.c (ecc_j_to_a): Likewise.
* ecc-mul-m.c (ecc_mul_m): Likewise.

(cherry picked from commit 2bf497ba4d6acc6f352bca015837fad33008565c)

eddsa-verify.c | 9 2 + 7 - 0 !
1 file changed, 2 insertions(+), 7 deletions(-)

 [patch] use ecc_mod_mul_canonical for point comparison.

* eddsa-verify.c (equal_h): Use ecc_mod_mul_canonical.

(cherry picked from commit 5b7608fde3a6d2ab82bffb35db1e4e330927c906)

ecc-ecdsa-verify.c | 4 2 + 2 - 0 !
testsuite/ecdsa-sign-test.c | 13 13 + 0 - 0 !
testsuite/ecdsa-verify-test.c | 20 20 + 0 - 0 !
3 files changed, 35 insertions(+), 2 deletions(-)

 [patch] fix bug in ecc_ecdsa_verify.

* ecc-ecdsa-verify.c (ecc_ecdsa_verify): Use ecc_mod_mul_canonical
to compute the scalars used for ecc multiplication.
* testsuite/ecdsa-verify-test.c (test_main): Add test case that
triggers an assert on 64-bit platforms, without above fix.
* testsuite/ecdsa-sign-test.c (test_main): Test case generating
the same signature.

(cherry picked from commit 2397757b3f95fcae1e2d3011bf99ca5b5438378f)

ecc-ecdsa-sign.c | 3 1 + 2 - 0 !
1 file changed, 1 insertion(+), 2 deletions(-)

 [patch] ensure ecdsa_sign output is canonically reduced.

* ecc-ecdsa-sign.c (ecc_ecdsa_sign): Ensure s output is reduced to
canonical range.

(cherry picked from commit c24b36160dc5303f7541dd9da1429c4046f27398)

eddsa-hash.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 [patch] similar fix for eddsa.

* eddsa-hash.c (_eddsa_hash): Ensure result is canonically
reduced. Two of the three call sites need that.

(cherry picked from commit d9b564e4b3b3a5691afb9328c7342b3f7ca64288)

pkcs1-sec-decrypt.c | 4 3 + 1 - 0 !
rsa-decrypt-tr.c | 11 7 + 4 - 0 !
rsa-decrypt.c | 10 10 + 0 - 0 !
rsa-internal.h | 4 2 + 2 - 0 !
rsa-sec-decrypt.c | 13 10 + 3 - 0 !
rsa-sign-tr.c | 61 29 + 32 - 0 !
rsa.h | 5 3 + 2 - 0 !
testsuite/rsa-encrypt-test.c | 40 39 + 1 - 0 !
testsuite/rsa-sec-decrypt-test.c | 17 16 + 1 - 0 !
9 files changed, 119 insertions(+), 46 deletions(-)

 fix for cve-2021-3580 - potential crash on invalid input to the rsa decryption functions.