crypto/elliptic: specific unreduced P-256 scalars produce incorrect results (CVE-2023-24532) #58647
Description
In particular (in psuedocode)
x = 48439561293906451759052585252797914202762949526041747995844080717082404635286
y = 36134250956749795798585127919587881956611106672985015071877198253568414405109
P256().ScalarMult(x, y, 30) != P256().ScalarMult(x, y, N + 30)
Thanks to Guido Vranken for reporting this issue via the Ethereum Foundation bug
bounty program.
This is CVE-2023-24532 and Go issue https://go.dev/issue/58647 (this one).