Constant-time impl for part (but not all) of PosInt::invert_vartime

[brian-pane]

No description provided.

[codspeed-hq]

Merging this PR will not alter performance

✅ 155 untouched benchmarks

---

_{Comparing brian-pane:vartime (f4eff21) with main (410dd9e)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.76%. Comparing base (410dd9e) to head (f4eff21).
⚠️ Report is 20 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #153   +/-   ##
=======================================
  Coverage   99.76%   99.76%           
=======================================
  Files         184      184           
  Lines       50802    50813   +11     
=======================================
+ Hits        50684    50695   +11     
  Misses        118      118           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[brian-pane]

The performance regression reported by CodSpeed seems to be unrelated. It happens only in the libcrux ML-KEM test, and based on my reading of the code and CodSpeed's flamegraphs, that test doesn't appear to have any dependency on PosInt::invert_vartime.

[brian-pane]

The performance regression reported by CodSpeed seems to be unrelated. It happens only in the libcrux ML-KEM test, and based on my reading of the code and CodSpeed's flamegraphs, that test doesn't appear to have any dependency on PosInt::invert_vartime.

I just rebased, and the CodSpeed test is passing now.

[brian-pane]

On x86_64, rustc+llvm generates a cmov operation for the saturating_sub.
On Aarch64, it generates a csel operation. (Compiler Explorer)

As far as I can tell, both those instructions should run in constant time, independent of their inputs. But if there's a better idiom for "sign-extend this bit to fill 64 bits," I'm happy to switch to that.

[brian-pane]

Now that I have a ctgrind working in my test environment, I'll iterate some more on this to see if I can remove the remaining variable-time operations.

[brian-pane]

Now that I have a ctgrind working in my test environment, I'll iterate some more on this to see if I can remove the remaining variable-time operations.

I found that it will be complicated to remove the remaining variable-time operations, because they're mostly in the s2n-bignum code. Notably, bignum_digitsize loops through the bignum's words and does a conditional branch on each one.

So for now, this PR is as close to constant-time as I can make invert_vartime.