* Vendor import unsafe_target_features as curve25519-dalek-derive
Co-authored-by: Jan Bujak <jan@parity.io>
* Remove feature gates from avx2/ifma
* Add buildtime compile diagnostics about backend selection
* Add build script tests
* Documentation changes
* Disable simd related features unless simd was determined via build
* Add note and test about the override warning when unsuccesful
* Reduce complexity in build gating via compile_error
---------
Co-authored-by: Jan Bujak <jan@parity.io>
Co-authored-by: Michael Rosenberg <michael@mrosenberg.pub>
When using Scalar::from_bits to manually create unreduced Scalars (e.g.,
X/Ed25519 keys with specified bit patterns), it's possible to construct Scalar
values that range up to 2^255-1. These shouldn't ever end up in a vartime
multiscalar mul call anyways, because it doesn't handle secret data, but it is
technically allowed by the type system and should be handled. When w=8, these
can generate terminal carries that can't be folded into the last digit, but
this can be handled by folding them into an extra digit instead.
This fixes a bug in the Pippenger implementation reported by Fernando Krell and
diagnosed by Oleg Andreev. The problem is that at the largest problem sizes
(using w=8), the signed digits fill the value range of an i8, and so doing
computation on them to calculate the bucket index can hit an overflow.
This was not caught in CI because the test suite didn't check all problem
sizes; tests for these sizes which expose this bug were added in the previous
commit.
