Explore pitfalls when generating random number modulo the ec group order

[zanebeckwith]

AMCL's randomnum function generates a random number and then reduces it modulo the group order. If the maximum value of a BIG (AMCL's mpi type) isn't a multiple of the group order, this might cause biased random numbers.

I say "might", because the AMCL code has a comment right before modular reduction in the randomnum code that says: "/* reduce modulo a BIG. Removes bias */". I'm just not yet sure if that saves us.

If we need to, we can of course pull the classic move of only taking random numbers from the rng if they fit in a window that is a multiple of the group order (this is what libsodium's randombytes_uniform does:

/* upper_bound is the group order */
uint32_t min = (1U + ~upper_bound) % upper_bound; /* = 2**32 mod upper_bound */
do {
    r = randombytes_random();
} while (r < min);
/* r is now clamped to a set whose size mod upper_bound == 0
 * the worst case (2**31+1) requires ~ 2 attempts */

return r % upper_bound;