Optimize size of ed25519

[onvej-sl]

This is a continuation of #4107.

[onvej-sl]

Saved space 24.5 KB.

	Before	After
publickey	4.1 ms	11 ms
sign	8.3 ms	23 ms
verify	11 ms	11 ms

[onvej-sl]

The test CK_TIMEOUT_MULTIPLIER=20 valgrind -q --error-exitcode=1 ./crypto/tests/test_check_noasan is failing. It returns a lot of errors that look like this:

==27372== Use of uninitialised value of size 8
==27372==    at 0x472C01: curve25519_mul (curve25519-donna-32bit.c:167)
==27372==    by 0x477193: ge25519_pnielsadd_p1p1 (ed25519-donna-impl-base.c:112)
==27372==    by 0x478FDA: ge25519_scalarmult (ed25519-donna-impl-base.c:480)
==27372==    by 0x47A098: ed25519_publickey_ext (ed25519.c:216)
==27372==    by 0x47A098: ed25519_publickey (ed25519.c:49)
==27372==    by 0x415C76: test_ed25519_fn (test_check.c:7817)
==27372==    by 0x485A27A: srunner_run_tagged (in /nix/store/hag8z773k2l4l42kdbbqmhp1qb4pfk8h-check-0.15.2/lib/libcheck.so.0.0.0)
==27372==    by 0x40121B: main (test_check.c:11828)

I experimentally found out that these errors disappear if I remove the following lines:

• trezor-firmware/crypto/tests/test_check.c

  Line 7815 in b534a72

  MARK_SECRET_DATA(sk, sizeof(sk));

• trezor-firmware/crypto/tests/test_check.c

  Line 8032 in b534a72

  MARK_SECRET_DATA(private_key, sizeof(private_key));

• trezor-firmware/crypto/tests/test_check.c

  Line 8087 in b534a72

  MARK_SECRET_DATA(keys, sizeof(keys));

• trezor-firmware/crypto/tests/test_check_cardano.h

  Line 87 in b534a72

  MARK_SECRET_DATA(secret_key, sizeof(secret_key));

• trezor-firmware/crypto/tests/test_check_cardano.h

  Line 90 in b534a72

  MARK_SECRET_DATA(secret_key_extension, sizeof(secret_key_extension));

The macro MARK_SECRET_DATA(addr, len) is defined as VALGRIND_MAKE_MEM_UNDEFINED(addr, len). This should be a trick how to make valgrind test that the code is constant time (see this blogpost). I don't quiet understand how it works.

It seems to me that this is a false positive.

[onvej-sl]

Together with Andrew we discovered this is caused by memory access dependent on secret key:

• trezor-firmware/crypto/ed25519-donna/ed25519-donna-impl-base.c

  Line 112 in b534a72

  curve25519_mul(a, a, qb[signbit]); /* ysubx for +, xaddy for - */

• trezor-firmware/crypto/ed25519-donna/ed25519-donna-impl-base.c

  Line 113 in b534a72

  curve25519_mul(r->x, b, qb[signbit^1]); /* xaddy for +, ysubx for - */

• trezor-firmware/crypto/ed25519-donna/ed25519-donna-impl-base.c

  Line 120 in b534a72

  curve25519_add(rb[2+signbit], rb[2+signbit], c); /* z for +, t for - */

• trezor-firmware/crypto/ed25519-donna/ed25519-donna-impl-base.c

  Line 121 in b534a72

  curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c); /* t for +, z for - */

[github-actions]

core UI changes	device test	click test	persistence test
T2T1 Model T	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
T3B1 Safe 3	test(screens) main(screens)	test(screens) main(screens)	2724
T3T1	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
All	main(screens)

[matejcik]

gotta say, pretty cool that we have setup which caught this