Add ECDSA P-384 signing.

[briansmith]

This is similar to #207, but harder because we don't have any good (constant-time) code for ECC operations on the P-384 curve at all.

See #205 for general concerns/requirements on signing APIs.

[briansmith]

Status update:

• digest -> scalar conversion (shared with P-256)
• close-to-constant-time multiplication and squaring (mod n).
• constant-time inversion mod n (to the extent multiplication and squaring are constant-time).
• constant-time Jacobian -> affine conversion (including constant-time inversion mod q) and serialization of public keys (shared with P-256)
• constant-time point doubling and point addition*
• constant-time base point multiplication
• The actual ECDSA signing function, serialization of signatures, key generation, serialization of private keys, deserialization of private keys (all shared with P-256).
• Tests
• Benchmarks in crypto-bench
• Audit and document side channel resistance, including base assumptions
• Nonce reuse prevention hardening

Everything checked off above is in master. Note that the point addition should be constant time on the assumption that the exceptional cases are never hit during ECDH and ECDSA signing, which is the same assumption that OpenSSL has. It would be worthwhile to write up a proof that that is the case.

[briansmith]

I've added the initial implementation of P-384 ECDSA signing in e5a4fe9 and I updated the checklist above to indicate what work is needed to call this "complete." The nonce reuse hardening will be added soon.

[briansmith]

I'm calling this done.