* SECURITY UPDATE: Bleichenbacher-type side-channel in RSA decryption - debian/patches/CVE-2018-16869-1.patch: add side-channel silent memeql_sec and cnd_memcpy in memeql-sec.c, cnd-memcpy.c, memops.h, ccm.c, examples/rsa-decrypt.c, Makefile.in, testsuite. - debian/patches/CVE-2018-16869-2.patch: add side-channel silent RSA root function _rsa_sec_compute_root and mpn_get_base256 in rsa-sec-compute-root.c, rsa-internal.h, gmp-glue.c, gmp-glue.h, Makefile.in. - debian/patches/CVE-2018-16869-3.patch: add side-channel silent PKCS#1 decoding _pkcs1_sec_decrypt in pkcs1-sec-decrypt.c, rsa-internal.h, Makefile.in, testsuite. - debian/patches/CVE-2018-16869-4.patch: add rsa_sec_decrypt and use the side-channel silent root in rsa_compute_root_tr and rsa_compute_root, and reject bad private keys early, in rsa-sec-decrypt.c, rsa-sign-tr.c, rsa-sign.c, rsa-sec-compute-root.c, rsa.h, Makefile.in, testsuite. - debian/patches/CVE-2018-16869-5.patch: require input in range and of fixed size in rsa_sec_decrypt, rsa_decrypt_tr, rsa_decrypt and rsa_sec_compute_root_tr, and check the message length in _pkcs1_sec_decrypt, in pkcs1-sec-decrypt.c, rsa-decrypt-tr.c, rsa-decrypt.c, rsa-sec-decrypt.c, rsa-sign-tr.c, rsa.h, testsuite. - debian/patches/CVE-2018-16869-6.patch: strip the PKCS#1 padding in rsa_decrypt and rsa_decrypt_tr with the side-channel silent _pkcs1_sec_decrypt_variable, in pkcs1-sec-decrypt.c, pkcs1-decrypt.c, rsa-decrypt-tr.c, rsa-internal.h, testsuite. - debian/libhogweed4.symbols, debian/libnettle6.symbols: added new symbols. - CVE-2018-16869 - CVE-2021-3580 (the input range checks in CVE-2018-16869-5.patch)