CVE-2023-26557: IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic

The vulnerability stems from using Go's non-constant time big.Int operations in cryptographic primitives. The paillier.go file is explicitly called out as containing an example leak. The Paillier cryptosystem implementation relies heavily on modular exponentiation and inverse operations for encryption/decryption, which when implemented with variable-time arithmetic (big.Int.Exp, big.Int.ModInverse) would leak timing information about the private lambda parameter. Key generation involving prime comparisons (Cmp) and lambda calculation would similarly leak timing information. The high confidence comes from the vulnerability description explicitly linking these operations to the side-channel leak.