Make ge25519_cmove_stride4b constant time

[onvej-sl]

This pull request builds on top of #4374, it fixes #4393. I don't know if we want to update the version of gcc once the issue is fixed, so I kept it the same as the version of gcc-arm-embedded. Which means you need to update gcc to version 14 to verify if this pull request indeed resolves the issue.

[github-actions]

core UI changes	device test	click test	persistence test
T2T1 Model T	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
T3B1 Safe 3	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
T3T1 Safe 5	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
All	main(screens)

[onvej-sl]

I also checked the binary of the core firmware (make build_firmware). If I read it correctly, the function ge25519_cmove_stride4 is inlined in ge25519_move_conditional_pniels_array and this pull request removes conditional branching from the part of the function that appears to corresponds to ge25519_cmove_stride4. See this.

[andrewkozlik]

Looking at this I feel a little uneasy about the bitwise operations on signed integers, but it's probably correct.

[onvej-sl]

That's a good point. I think we can use unsigned long instead of long.

[onvej-sl]

Done in 7f359b1.

[mmilata]

Thanks for looking into this!

removes conditional branching from the part of the function [...] See this.

Doesn't it slow ed25519 signing/verification though? The "old" assembly listing had movne instructions which if I understand correctly are not really branching and should be OK wrt constant time? The "new" assembly is OK too.

If the bitwise version is slower we can only use it for x86_64 and keep the old one for firmware.

[onvej-sl]

Doesn't it slow ed25519 signing/verification though?

I did a benchmark on trezor T and the times seem to be the same before and after this pull request:

function	time
publickey	11.8 ms
sign	23.8 ms
verify	10.9 ms

The "old" assembly listing had movne instructions which if I understand correctly are not really branching and should be OK wrt constant time?

I am not sure how the movne instruction is interpreted internally, but I would guess that if the condition is not met, skipping the instruction takes less time compared to executing it.

[mmilata]

Feel free to rebase on main and merge, or I can do it once #4374 is merged.

But please fix style first:

crypto/ed25519-donna/ed25519-donna-impl-base.c:
	400: Trailing whitespace
	403: Trailing whitespace
	425: Trailing whitespace
	428: Trailing whitespace