by watsonbladd:

ECDSA.go uses Math.BigInt to invert k. However, the inversion is not constant time as it
uses the Euclidean algorithm without blinding. This leaks information about k, which is
fairly bad for ECDSA security. In particular the runtime gives me the length of the
continued fraction expansion of k/q. Whether or not this is enough information to
compromise the private key remains to be seen.

Two possible solutions are to blind the inversion, or to use modular exponentiation to
compute the inverse instead.

Credit belongs to Martin Rex of SAP for informing me that this sort of leakage had been
used to compromise smart cards in the past.

Sincerely,
Watson Ladd