Update to NSS 3.14.3 Beta 1 for the TLS CBC constant-time

mozilla/security/nss/lib/freebl/ecl/ecp_aff.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "ecp.h"
 #include "mplogic.h"
 #include <stdlib.h>
 
 /* Checks if point P(px, py) is at infinity.  Uses affine coordinates. */
 mp_err
@@ skipping 267 matching lines @@
     /* 3: Verify that publicValue is on the curve. */
         if (group->meth->field_enc) {
                 group->meth->field_enc(px, &pxt, group->meth);
                 group->meth->field_enc(py, &pyt, group->meth);
         } else {
                 mp_copy(px, &pxt);
                 mp_copy(py, &pyt);
         }
         /* left-hand side: y^2  */
         MP_CHECKOK( group->meth->field_sqr(&pyt, &accl, group->meth) );
-        /* right-hand side: x^3 + a*x + b */
+        /* right-hand side: x^3 + a*x + b = (x^2 + a)*x + b by Horner's rule */
         MP_CHECKOK( group->meth->field_sqr(&pxt, &tmp, group->meth) );
-        MP_CHECKOK( group->meth->field_mul(&pxt, &tmp, &accr, group->meth) );
-        MP_CHECKOK( group->meth->field_mul(&group->curvea, &pxt, &tmp, group->meth) );
-        MP_CHECKOK( group->meth->field_add(&tmp, &accr, &accr, group->meth) );
+        MP_CHECKOK( group->meth->field_add(&tmp, &group->curvea, &tmp, group->meth) );
+        MP_CHECKOK( group->meth->field_mul(&tmp, &pxt, &accr, group->meth) );
         MP_CHECKOK( group->meth->field_add(&accr, &group->curveb, &accr, group->meth) );
         /* check LHS - RHS == 0 */
         MP_CHECKOK( group->meth->field_sub(&accl, &accr, &accr, group->meth) );
         if (mp_cmp_z(&accr) != 0) {
                 res = MP_NO;
                 goto CLEANUP;
         }
     /* 4: Verify that the order of the curve times the publicValue
      *    is the point at infinity.
      */
         MP_CHECKOK( ECPoint_mul(group, &group->order, px, py, &pxt, &pyt) );
         if (ec_GFp_pt_is_inf_aff(&pxt, &pyt) != MP_YES) {
                 res = MP_NO;
                 goto CLEANUP;
         }
 
         res = MP_YES;
 
 CLEANUP:
         mp_clear(&accl);
         mp_clear(&accr);
         mp_clear(&tmp);
         mp_clear(&pxt);
         mp_clear(&pyt);
         return res;
 }