secp256k1: Direct byte clears.

[davecgh]

The current implementation either clears fixed-size buffers by copying a zeroed array over them, looping over each entry and setting it zero, or manually setting each entry to 0. All of these approaches work as intended, but a cleaner and more efficent approach is to simply set it equal to the zero value of an array of the appropriate size.

This package requires a minimum of Go 1.17 and so all supported versions of the Go compiler recognize this pattern and compile it to efficient memory-clearing instructions.

While Go does not guarantee constant time operations, inspection of the generated code for supported architectures shows this produces a fixed sequence of stores as desired.

Moreover, this approach avoids relying on runtime.memmove, which makes the generated code simpler and easier to reason about with respect to timing behavior.

[jholdstock]

Did you deliberately leave ModNScalar.Zero() as it was?

[davecgh]

Did you deliberately leave ModNScalar.Zero() as it was?

Well, I actually missed that because I did the work already on top of #3731 and then ended up rebasing it for easier review, but I guess that's also why it doesn't really matter. It's entirely replaced by the 4x64 implementation there which uses the same technique.

Nevertheless, that's a good catch and I went ahead and updated it though for completeness in the mean time.