secp256k1: Add fixed-precision group order type.

[davecgh]

This requires #2059.

This introduces a specialized type for handling arithmetic modulo the group order which is significantly faster than using big integers from the standard library

The implementation is also constant time, whereas big integers from the standard library are not, which helps protect against side channel attacks in certain scenarios.

Comprehensive tests with 100% coverage and a full suite of benchmarks are included.

Due to the fact the code relies on a lot of low-level bit manipulations to achieve the speed and constant time characteristics, it is not the easiest code to review for correctness, so significant effort has been put into attempting to clearly explain the details via comments to help with review.

For now, this merely introduces the type without modifying any of the code to make use of it, and it also does not yet include the ability to perform inversions which will be required in order to switch over to it. That capability will be added in a future commit.

The following benchmarks show a comparison between the new specialized type and generic big ints for various operations:

benchmark                  old ns/op   new ns/op     delta
------------------------------------------------------------
BenchmarkModN              267         18.9          -92.92%
BenchmarkZero              7.28        0.64          -91.25%
BenchmarkIsZero            0.32        0.32          +0.00%
BenchmarkEquals            9.14        5.58          -38.95%
BenchmarkAddModN           305         23.8          -92.20%
BenchmarkMulModN           457         237           -48.14%
BenchmarkSquareModN        459         238           -48.15%
BenchmarkNegateModN        295         9.82          -96.67%
BenchmarkIsOverHalfOrder   9.25        8.55          -7.57%

benchmark                  old allocs   new allocs   delta
------------------------------------------------------------
BenchmarkModN              2            0            -100.00%
BenchmarkZero              0            0            +0.00%
BenchmarkIsZero            0            0            +0.00%
BenchmarkEquals            0            0            +0.00%
BenchmarkAddModN           2            0            -100.00%
BenchmarkMulModN           2            0            -100.00%
BenchmarkSquareModN        2            0            -100.00%
BenchmarkNegateModN        2            0            -100.00%
BenchmarkIsOverHalfOrder   0            0            +0.00%

[davecgh]

Test coverage:

$ go test -coverprofile=cov.out && go tool cover -func=cov.out | grep modnscalar | sed -e "s#github.com/decred/dcrd/dcrec/secp256k1/v3/##"
modnscalar.go:142:              String                  100.0%
modnscalar.go:152:              Set                     100.0%
modnscalar.go:160:              Zero                    100.0%
modnscalar.go:172:              IsZero                  100.0%
modnscalar.go:184:              SetInt                  100.0%
modnscalar.go:191:              constantTimeEq          100.0%
modnscalar.go:196:              constantTimeNotEq       100.0%
modnscalar.go:201:              constantTimeLess        100.0%
modnscalar.go:206:              constantTimeLessOrEq    100.0%
modnscalar.go:211:              constantTimeGreater     100.0%
modnscalar.go:216:              constantTimeGreaterOrEq 100.0%
modnscalar.go:221:              constantTimeMin         100.0%
modnscalar.go:227:              overflows               100.0%
modnscalar.go:258:              reduce256               100.0%
modnscalar.go:297:              SetBytes                100.0%
modnscalar.go:328:              SetByteSlice            100.0%
modnscalar.go:340:              PutBytes                100.0%
modnscalar.go:382:              Bytes                   100.0%
modnscalar.go:389:              IsOdd                   100.0%
modnscalar.go:395:              Equals                  100.0%
modnscalar.go:410:              Add2                    100.0%
modnscalar.go:439:              Add                     100.0%
modnscalar.go:450:              Add                     100.0%
modnscalar.go:460:              Rsh32                   100.0%
modnscalar.go:468:              reduce385               100.0%
modnscalar.go:597:              reduce512               100.0%
modnscalar.go:761:              Mul2                    100.0%
modnscalar.go:922:              Mul                     100.0%
modnscalar.go:931:              SquareVal               100.0%
modnscalar.go:948:              Square                  100.0%
modnscalar.go:957:              NegateVal               100.0%
modnscalar.go:997:              Negate                  100.0%
modnscalar.go:1075:             IsOverHalfOrder         100.0%

[matheusd]

This was a doozy to review indeed :P

Only two small nits.

[matheusd]

Woot! 🎉

[dnldd]

Wheew, looks good.