 Address a timing side channel whereby it is possible to determine some
 Address a timing side channel whereby it is possible to determine some

information about the length of a value used in DSA operations from
a large number of signatures.

This doesn't rate as a CVE because:

* For the non-constant time code, there are easier ways to extract
  more information.

* For the constant time code, it requires a significant number of signatures
  to leak a small amount of information.

Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for
reporting this issue.

Reviewed-by: Andy Polyakov <015edf36635e030d5e009e08808a59984e629740@openssl.org>
Reviewed-by: Matt Caswell <1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4576)

openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl,openssl/openssl