This code is extracted from crypto/rsa with
a few variables renamed and a comment fixed.

R=agl, rsc, agl
CC=golang-dev
https://golang.org/cl/4446068