apply RSA-CRT hardening for PKCS1 sign operations; use eqaf for comparing cstructs in constant time

[hannesm]

No description provided.

[hannesm]

the remaining Z.powm occurences only use the public keys, and are thus not timing sensitive.

[dinosaure]

I'm not really aware about powm_sec and pown and I did not get the real diff between them on my side with bechamel (and see how many times they need to compute same arguments). But according the documentation, it seems ok!

[emillon]

Thanks! Just a small metadata remark.

[cfcs]

Would like to review this more in-depth, but here's my feedback so far :)

[hannesm]

rebased on master and force-pushed

[cfcs]

Just found this, which does not sound so good: https://lists.lysator.liu.se/pipermail/nettle-bugs/2016/003104.html

The function mpz_powm_sec() is not a drop in replacement for mpz_powm(),
although it may sound like it. If you look at the docs [1] a
requirement for mpz_powm_sec() is that the modulus must be odd.
If the modulus is even / divisible by 2 then mpz_powm_sec() will crash
with a floating point exception.

# Z.powm_sec (Z.of_int 2) (Z.of_int 2) (Z.of_int 2);;
Exception: Invalid_argument "Z.powm_sec: modulus must be odd".

This is (and other things like caml_invalid_argument("Z.powm_sec: exponent must be positive"); is handled with exceptions in Zarith, is that OK for us in this context?
https://github.com/ocaml/Zarith/blob/a9a309d0596d93b6c0c902951e1cae13d661bebd/caml_z.c#L2710-L2714

[hannesm]

I removed the usage of powm_sec from this PR, it looks a bit too controversial of (a) when to use (b) whether to use (failure semantics -- raises if modulus is even). Hope this PR is less controversial for @cfcs, and we can move on by merging this PR.