Store blinding factor + its inverse, so that they can be reused & updated
on every blinding operation. This avoids expensive computations.

The reuse of the previous blinding factor is done via squaring (mod n), as
per section 9 of 'A Timing Attack against RSA with the Chinese Remainder
Theorem' by Werner Schindler, https://tls.mbed.org/public/WSchindler-RSA_Timing_Attack.pdf

According to PKCS#1 v1.5, the padding should be at least 8 bytes long.
See https://tools.ietf.org/html/rfc8017#section-7.2.2 step 3 for more info.

The third-party library that adds support for this to Python 3.5 is a
binary package, and thus breaks the pure-Python nature of Python-RSA.

This should fix [#147](https://github.com/sybrenstuvel/python-rsa/issues/147).

The newer versions always have a message, even on success.

Reject cyphertexts that have been modified by prepending zero bytes, by
checking the cyphertext length against the expected size (given the
decryption key). This resolves CVE-2020-13757.

The same approach is used when verifying a signature.

Thanks Carnil for pointing this out on https://github.com/sybrenstuvel/python-rsa/issues/146

This is based on https://github.com/sybrenstuvel/python-rsa/pull/96, with
a few improvements:
  - The minimum of one use of SHA3 in a unit test, to at least touch it at
    some point.
  - Documented the support of SHA3.
  - Only install the third-party library required by Python 3.5 when we're
    running on Python 3.5. Newer Python versions support SHA3 natively.

Shouldn't try to coerce bytes to a string. Instead, print the repr
value (e.g. b'mybytestring').

When running tests with the Python `-b` option, fixes warnings of the
form:

.../python-rsa/tests/test_strings.py:34: BytesWarning: str() on a bytes instance
  print("\tMessage:   %s" % message)
.../python-rsa/tests/test_strings.py:37: BytesWarning: str() on a bytes instance
  print("\tEncrypted: %s" % encrypted)
.../python-rsa/tests/test_strings.py:40: BytesWarning: str() on a bytes instance
  print("\tDecrypted: %s" % decrypted)