Fix constant-time behaviour for ct_reduce/ct_div_rem

[andrewwhitehead]

Fixes #116

[andrewwhitehead]

I believe this is sufficient since there are no constant-time guarantees around rhs.

[tarcieri]

Might be good to leave a comment to that effect

[andrewwhitehead]

I threw in a ct_select since it doesn't make a significant difference to the runtime.

[mikelodder7]

Can you add your test case that triggered this PR?

[mikelodder7]

Want to make sure it’s actually fixed

[tarcieri]

Just saw this comment.

Perhaps it would make sense to use something like sidefuzz to test constant-time behavior?

[andrewwhitehead]

My test was a criterion benchmark, I suspected it from reading the code.

#[macro_use]
extern crate criterion;
use criterion::{black_box, Criterion};
fn criterion_benchmark(c: &mut Criterion) {
    use crypto_bigint::U256;
    let u1 = U256::from_be_hex("0123456780123456780123456780123456780123456780123456780123456780");
    let u2 = U256::from_be_hex("0000000000000000000000000000000000000000000000000000000000000012");
    let md = U256::from_be_hex("0000000000000000000000000000000000000000000000000000000012345678");
    c.bench_function("reduce large", move |b| {
        b.iter(|| black_box(u1).reduce(&md))
    });
    c.bench_function("reduce small", move |b| {
        b.iter(|| black_box(u2).reduce(&md))
    });
}
criterion_group!(benches, criterion_benchmark);
criterion_main!(benches);

Old timing:

reduce large            time:   [948.59 ns 949.00 ns 949.46 ns]                           
Found 8 outliers among 100 measurements (8.00%)
  6 (6.00%) high mild
  2 (2.00%) high severe

reduce small            time:   [15.520 ns 15.535 ns 15.549 ns]                           
Found 3 outliers among 100 measurements (3.00%)
  1 (1.00%) low mild
  2 (2.00%) high severe

And patched:

reduce large            time:   [955.12 ns 955.84 ns 956.81 ns]                          
Found 10 outliers among 100 measurements (10.00%)
  3 (3.00%) high mild
  7 (7.00%) high severe

reduce small            time:   [955.58 ns 956.55 ns 957.99 ns]                          
Found 11 outliers among 100 measurements (11.00%)
  4 (4.00%) high mild
  7 (7.00%) high severe

[andrewwhitehead]

Also if somebody feels like implementing a limb-based method this looks interesting: https://www.bearssl.org/bigint.html#modred