diff -up ./doc/doxygen/Doxyfile.orig ./doc/doxygen/Doxyfile

diff -up ./lib/nettle/ecc/ecc-gostdsa-verify.c.orig ./lib/nettle/ecc/ecc-gostdsa-verify.c

--- ./lib/nettle/ecc/ecc-gostdsa-verify.c.orig	2020-06-03 15:05:27.000000000 +0200

+++ ./lib/nettle/ecc/ecc-gostdsa-verify.c	2021-04-01 11:24:42.820992320 +0200

@@ -63,6 +63,8 @@ ecc_gostdsa_verify (const struct ecc_cur

 		  const mp_limb_t *rp, const mp_limb_t *sp,

 		  mp_limb_t *scratch)

 {

+  mp_limb_t cy;

+

   /* Procedure, according to GOST R 34.10. q denotes the group

      order.

@@ -101,11 +103,17 @@ ecc_gostdsa_verify (const struct ecc_cur

   ecc->q.invert (&ecc->q, vp, hp, vp + 2*ecc->p.size);

   /* z1 = s / h, P1 = z1 * G */

-  ecc_mod_mul (&ecc->q, z1, sp, vp);

+  ecc_mod_mul (&ecc->q, z1 + ecc->q.size, sp, vp);

+  /* Ensure canonical reduction */

+  cy = mpn_sub_n (z1, z1 + ecc->q.size, ecc->q.m, ecc->q.size);

+  cnd_copy (cy, z1, z1 + ecc->q.size, ecc->q.size);

   /* z2 = - r / h, P2 = z2 * Y */

-  ecc_mod_mul (&ecc->q, z2, rp, vp);

-  mpn_sub_n (z2, ecc->q.m, z2, ecc->p.size);

+  mpn_sub_n (hp, ecc->q.m, rp, ecc->p.size);

+  ecc_mod_mul (&ecc->q, z2 + ecc->q.size, hp, vp);

+  /* Ensure canonical reduction */

+  cy = mpn_sub_n (z2, z2 + ecc->q.size, ecc->q.m, ecc->q.size);

+  cnd_copy (cy, z2, z2 + ecc->q.size, ecc->q.size);

    /* Total storage: 5*ecc->p.size + ecc->mul_itch */

   ecc->mul (ecc, P2, z2, pp, z2 + ecc->p.size);

diff -up ./lib/nettle/ecc/eddsa-hash.c.orig ./lib/nettle/ecc/eddsa-hash.c

--- ./lib/nettle/ecc/eddsa-hash.c.orig	2020-06-03 15:05:28.000000000 +0200

+++ ./lib/nettle/ecc/eddsa-hash.c	2021-04-01 11:24:42.821992314 +0200

@@ -43,13 +43,14 @@

 #include <nettle/ecc.h>

 #include "ecc-internal.h"

-/* Convert hash digest to integer, and reduce modulo q, to m->size

-   limbs. Needs space for 2*m->size + 1 at rp. */

+/* Convert hash digest to integer, and reduce canonically modulo q.

+   Needs space for 2*m->size + 1 at rp. */

 void

 _eddsa_hash (const struct ecc_modulo *m,

 	     mp_limb_t *rp, size_t digest_size, const uint8_t *digest)

 {

   mp_size_t nlimbs = (8*digest_size + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS;

+  mp_limb_t cy;

   mpn_set_base256_le (rp, nlimbs, digest, digest_size);

@@ -74,4 +75,8 @@ _eddsa_hash (const struct ecc_modulo *m,

       assert (hi == 0);

     }

   m->mod (m, rp);

+  /* Ensure canonical reduction. */

+  cy = mpn_sub_n (rp + m->size, rp, m->m, m->size);

+  cnd_copy (cy, rp + m->size, rp, m->size);

+  mpn_copyi (rp, rp + m->size, m->size);

 }

diff -up ./lib/nettle/ecc/gostdsa-vko.c.orig ./lib/nettle/ecc/gostdsa-vko.c

--- ./lib/nettle/ecc/gostdsa-vko.c.orig	2020-06-03 15:05:28.000000000 +0200

+++ ./lib/nettle/ecc/gostdsa-vko.c	2021-04-01 11:24:42.821992314 +0200

@@ -64,6 +64,7 @@ gostdsa_vko (const struct ecc_scalar *pr

   mp_size_t size = ecc->p.size;

   mp_size_t itch = 4*size + ecc->mul_itch;

   mp_limb_t *scratch;

+  mp_limb_t cy;

   if (itch < 5*size + ecc->h_to_a_itch)

       itch = 5*size + ecc->h_to_a_itch;

@@ -87,7 +88,11 @@ gostdsa_vko (const struct ecc_scalar *pr

   if (mpn_zero_p (UKM, size))

     UKM[0] = 1;

-  ecc_mod_mul (&ecc->q, TEMP, priv->p, UKM); /* TEMP = UKM * priv */

+  ecc_mod_mul (&ecc->q, TEMP + ecc->q.size, priv->p, UKM); /* TEMP = UKM * priv */

+  /* Ensure canonical reduction */

+  cy = mpn_sub_n (TEMP, TEMP + ecc->q.size, ecc->q.m, ecc->q.size);

+  cnd_copy (cy, TEMP, TEMP + ecc->q.size, ecc->q.size);

+

   ecc->mul (ecc, XYZ, TEMP, pub->p, scratch + 4*size); /* XYZ = UKM * priv * pub */

   ecc->h_to_a (ecc, 0, TEMP, XYZ, scratch + 5*size); /* TEMP = XYZ */

   mpn_get_base256_le (out, bsize, TEMP, size);