> * On architectures where nistz256 is not implemented, a default > OpenSSL build will use the generic Weierstrass implementation. I > haven't been able to determine whether there are significant timing > channels in that implementation. Researches have been beating up "the generic Weierstrass implementation" since 2009. BBB