dsa: migrate to crypto-bigint

[aumetra]

This is a draft. The code is incredibly ugly.
Will clean it up as soon as I got all of the tests to pass.

[tarcieri]

See also #779 #782

[aumetra]

Small question @tarcieri

let params = BoxedMontyParams::new_vartime(Odd::new((**components.p()).clone()).unwrap());
let form = BoxedMontyForm::new((*y).clone(), params);

if *y < two() || form.pow(components.q()).to_montgomery() != BoxedUint::one() {
    return Err(signature::Error::new());
}

should be equivalent to the following code

if y < two() || y.modpow(components.q(), components.p()) != BigUint::one() {
    return Err(signature::Error::new());
}

Right? Or did I make a mistake with the MontyParams and MontyForms API?

[tarcieri]

@aumetra I think you may have run into a confusing API we should really fix.

Instead of to_montgomery() you probably want retrieve() or from_montgomery()

(Personally I would've named everything from_canonical and to_canonical)

[aumetra]

Ah. Yeah, that was it. I guess when I wrote the code at an airport I overlooked that in the docs

[tarcieri]

needs an MSRV bump to 1.73 in .github/workflows/dsa.yml

[baloo]

If you have any spare time, I think we could use this rewrite very soon as it should ease up the transition to rand_core 0.9 a lot.

[tarcieri]

Closing in favor of #906