Avoid creating too-large values during ECDSA signing

It would cause the Barrett reduction to fallback to schoolbook
division. Small but noticable speedup (2-3%)

1 files changed, 5 insertions, 3 deletions

diff --git a/src/lib/pubkey/ecdsa/ecdsa.cpp b/src/lib/pubkey/ecdsa/ecdsa.cpp
index 57bc197c5..d473e466c 100644
--- a/src/lib/pubkey/ecdsa/ecdsa.cpp
+++ b/src/lib/pubkey/ecdsa/ecdsa.cpp
@@ -89,9 +89,11 @@ ECDSA_Signature_Operation::raw_sign(const uint8_t msg[], size_t msg_len,
 #endif
 
    const BigInt k_inv = inverse_mod(k, m_group.get_order());
-   const PointGFp k_times_P = m_group.blinded_base_point_multiply(k, rng, m_ws);
-   const BigInt r = m_group.mod_order(k_times_P.get_affine_x());
-   const BigInt s = m_group.multiply_mod_order(k_inv, mul_add(m_x, r, m));
+   const BigInt r = m_group.mod_order(
+      m_group.blinded_base_point_multiply(k, rng, m_ws).get_affine_x());
+
+   const BigInt xrm = m_group.mod_order(m_group.multiply_mod_order(m_x, r) + m);
+   const BigInt s = m_group.multiply_mod_order(k_inv, xrm);
 
    // With overwhelming probability, a bug rather than actual zero r/s
    if(r.is_zero() || s.is_zero())