Use pwd_seed to determine y parity for sae hunt-and-peck.

This should use pwd_seed rather than pwd_value for y-bit, but the
test vector in 802.11 happens to still pass. The generated test
case is updated as well.

Change-Id: I551d5ada29ba132b8d62a9258b493d828b607757
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102647
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>

crypto/ec/hash_to_curve.cc

diff --git a/crypto/ec/hash_to_curve.cc b/crypto/ec/hash_to_curve.cc
index dd715ee..39abbe2 100644
--- a/crypto/ec/hash_to_curve.cc
+++ b/crypto/ec/hash_to_curve.cc
@@ -692,9 +692,9 @@
       return 0;
     }
 
-    // Try to import `pwd_value` as a compressed point. `y_bit` reuses one of
-    // the bits of the x-coordinate.
-    uint8_t y_bit = pwd_value[kFieldBytes - 1] & 1;
+    // Try to import `pwd_value` as a compressed point.
+    // The parity of y is determined by the least significant bit of `pwd_seed`.
+    uint8_t y_bit = pwd_seed[pwd_seed_len - 1] & 1;
     EC_FELEM x, y2, y;
     crypto_word_t iter_ok =
         ec_felem_from_bytes_or_placeholder(group, &x, pwd_value, kFieldBytes);

crypto/fipsmodule/ec/ec_test.cc

diff --git a/crypto/fipsmodule/ec/ec_test.cc b/crypto/fipsmodule/ec/ec_test.cc
index 4d6409f..d066cdf 100644
--- a/crypto/fipsmodule/ec/ec_test.cc
+++ b/crypto/fipsmodule/ec/ec_test.cc
@@ -1608,9 +1608,9 @@
       0x04, 0x80, 0x22, 0x98, 0x77, 0x74, 0x4b, 0x3c, 0x85, 0xd4, 0x0c,
       0xef, 0x54, 0x10, 0x8c, 0xfd, 0xb9, 0x45, 0x8c, 0xe8, 0x8f, 0x47,
       0xb6, 0x93, 0xf4, 0x30, 0x19, 0x43, 0xe1, 0x6f, 0x12, 0xd0, 0x6d,
-      0x83, 0x87, 0x58, 0xc0, 0x79, 0x2c, 0x58, 0x57, 0x0b, 0x62, 0x8e,
-      0x6c, 0xb7, 0x35, 0xe6, 0x45, 0xda, 0xb3, 0x80, 0xad, 0xdb, 0xaf,
-      0xda, 0x7a, 0x1c, 0x60, 0x7c, 0xd3, 0xa7, 0xa1, 0x68, 0x3d};
+      0x7c, 0x78, 0xa7, 0x3e, 0x86, 0xd3, 0xa7, 0xa9, 0xf4, 0x9d, 0x71,
+      0x93, 0x48, 0xca, 0x19, 0xba, 0x25, 0x4c, 0x7f, 0x53, 0x24, 0x50,
+      0x25, 0x85, 0xe3, 0x9f, 0x83, 0x2c, 0x58, 0x5e, 0x97, 0xc2};
   for (uint8_t min_iterations = 0; min_iterations < 32; min_iterations++) {
     SCOPED_TRACE(int{min_iterations});
     point.reset(EC_POINT_new(group));