Apply nonce bit-length mitigation to stop timing leakage.

[J08nY]

This should be a mitigation for the Minerva attack. See https://minerva.crocs.fi.muni.cz for more info. Some tests would be nice to see this is really constant time (and wasn't before), but I am not that well versed in JavaScript.

[coveralls]

Coverage increased (+0.03%) to 89.152% when pulling c36942b on J08nY:fix/minerva into 71e4e8e on indutny:master.

[J08nY]

Hi @indutny, is there any movement on this? This project is used by many others and remains likely vulnerable and not fixed months after our disclosure.

[Rob-pw]

Thanks for the PR, just wandering by (edit: bump & witness)

[indutny]

LGTM. Thank you for submitting this and sorry for delay. There are few minor changes that I'd like to request before landing it, though!

[J08nY]

LGTM. Thank you for submitting this and sorry for delay. There are few minor changes that I'd like to request before landing it, though!

Fixed those. Please test the changes (and timing).

[indutny]

Hey, I've went ahead and applied alternative "fix": ec735ed . However, as bad as it sounds it must be said that this library was never meant to be timing-leak free. Architecture of elliptic and bn.js was designed to provide the fastest possible pure JS implementation of elliptic curve so that it would be usable in browsers. Patching this one particular loophole doesn't mean that there are no other side-channels (in fact, there are many through the source code).