Timing side-channel in ECDSA signature computation

Issue summary: A timing side-channel which could potentially allow recovering

the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations

could allow recovering the private key by an attacker. However, measuring

the timing would require either local access to the signing application or

a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of

the inverted ECDSA nonce value is zero. This can happen with significant

probability only for some of the supported elliptic curves. In particular

the NIST P-521 curve is affected. To be able to measure this leak, the attacker

process must either be located in the same physical computer or must

have a very fast network connection with low latency. For that reason

the severity of this vulnerability is Low.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.