ECDSA signature verification is missing a modular operation about mbedtls

[DualTachyon]

I forgot to mention I'm using the 1.3.1 release of PolarSSL.

[mpg]

Thanks for your report! Indeed you're right, and reduction mod n should be performed. This just got fixed in the internal development branch and will be in the next minor release.

I'm rather surprised you ran into this issue, since heuristically it seems to me it should happen roughly with probability 2^(-l/2) where l is the bit length of "the curve" (that is, of P or N), so it should be very unlikely with the kind of curve size used in cryptographic applications.

[pjbakker]

Updated in private branch ready for 1.3.2 release