chilldkg: CI wiring, ctime_tests coverage, declassify fixes

CI:
- ci/ci.sh: new CHILLDKG environment variable, passed to configure as
  --enable-module-chilldkg (mirroring FROST).
- .github/workflows/ci.yml: default CHILLDKG: 'no' and CHILLDKG: 'yes'
  in every job that enables FROST, except the x86_64 matrix entry that
  deliberately builds without the ecdh module (chilldkg requires
  schnorrsig + ecdh; the configure-time dependency error would fire
  there). YAML validity and per-job dependency presence checked
  programmatically.

ctime_tests:
- src/ctime_tests.c: run a full ChillDKG session (n = 2, t = 2) through
  the public API under the memory checker: hostpubkey_gen, params_hash,
  participant_step1, coordinator_step1, participant_step2,
  coordinator_finalize, participant_finalize, participant_recover and
  recovery_ack_sign. Host secret keys, session randomness, aux
  randomness and the resulting secret shares are undefined (secret);
  all protocol messages, the certificate, threshold public key, public
  shares, recovery data, ack signature and the secret-free state1
  objects are defined (public). state2 stays secret (contains the
  secret share).

Constant-time fixes found by running the new block under
MemorySanitizer (valgrind unavailable locally; MSan build via clang +
CMake). All are missing declassifications of secret-derived but public
(or public-outcome) values, following the frost module's
secp256k1_declassify pattern with justification comments; no real
constant-time bugs were found:
- hostpubkey_gen: declassify the computed host public key before
  serialization (public output).
- participant_step1: declassify the zero-randomness check result (only
  reveals "the RNG returned 32 zero bytes", which aborts the session).
- encpedpop participant_step1: declassify the pubnonce point before
  serialization (public, part of pmsg1).
- chilldkg_schnorrsig_sign: declassify the signer public key before
  normalization/parity branch, and declassify the return value (a
  failure only reveals a zero derived nonce, negligible probability).
- vss_commit: declassify the VSS commitments before serialization
  (public, part of pmsg1).
- vss_verify_secshare: declassify secshare*G before the infinity/eq
  checks (equals the public pubshare in honest runs; the discrete log
  is not revealed).
- simplpedpop_participant_investigate (proactive audit; not reached by
  ctime_tests): declassify the secshare-sum comparison result (the
  public fault code reveals it anyway).

Verified: MSan ctime_tests exits 0; autotools make check 10/10 (the
local tree is configured without --enable-ctime-tests because neither
valgrind nor an MSan-instrumented gcc build is available; CI runs
ctime_tests under valgrind as before); CMake ctest 428/428;
./tests --target=chilldkg and ./chilldkg_example pass.

src/modules/chilldkg/encpedpop_impl.h

@@ -212,6 +212,10 @@ static int secp256k1_chilldkg_encpedpop_participant_step1(const secp256k1_contex
         secp256k1_ge pubnonce_ge;
         secp256k1_ecmult_gen_gej(&ctx->ecmult_gen_ctx, &pubnoncej, &secnonce);
         secp256k1_ge_set_gej(&pubnonce_ge, &pubnoncej);
+        /* The pubnonce is public (it is part of the participant message);
+         * declassify it so that the variable-time serialization is allowed
+         * to branch on it. */
+        secp256k1_declassify(ctx, &pubnonce_ge, sizeof(pubnonce_ge));
         secp256k1_chilldkg_point_save(pubnonce33, &pubnonce_ge);
         secp256k1_gej_clear(&pubnoncej);
 

src/modules/chilldkg/main_impl.h

@@ -262,6 +262,9 @@ int secp256k1_chilldkg_hostpubkey_gen(const secp256k1_context *ctx, unsigned cha
         /* pubkey_gen_plain in the reference (IndividualPubkey of BIP 327). */
         secp256k1_ecmult_gen_gej(&ctx->ecmult_gen_ctx, &pubkeyj, &seckey);
         secp256k1_ge_set_gej(&pubkey, &pubkeyj);
+        /* The host public key is not secret; declassify it so that the
+         * variable-time serialization is allowed to branch on it. */
+        secp256k1_declassify(ctx, &pubkey, sizeof(pubkey));
         secp256k1_chilldkg_point_save(hostpubkey33, &pubkey);
         secp256k1_gej_clear(&pubkeyj);
     }
@@ -348,12 +351,18 @@ int secp256k1_chilldkg_participant_step1(const secp256k1_context *ctx, secp256k1
         }
         /* HostSeckeyError if there is no match; RandomnessError if the
          * randomness is all zeroes (guards against a malfunctioning random
-         * number generator). */
-        if (found && !secp256k1_is_zero_array(random32, 32)) {
-            /* In EncPedPop, both the seed and the deckey are the host secret
-             * key, and the enckeys are the host public keys (see
-             * chilldkg_ref/chilldkg.py participant_step1). */
-            ret = secp256k1_chilldkg_encpedpop_participant_step1(ctx, &enc_state, pmsg1, hostseckey32, hostseckey32, hostpubkeys33, threshold, participant_id, random32, n_participants);
+         * number generator). Whether the randomness is all zeroes does not
+         * leak anything about its value otherwise (if it is, the session
+         * fails), so the check can be declassified. */
+        {
+            int random_is_zero = secp256k1_is_zero_array(random32, 32);
+            secp256k1_declassify(ctx, &random_is_zero, sizeof(random_is_zero));
+            if (found && !random_is_zero) {
+                /* In EncPedPop, both the seed and the deckey are the host
+                 * secret key, and the enckeys are the host public keys (see
+                 * chilldkg_ref/chilldkg.py participant_step1). */
+                ret = secp256k1_chilldkg_encpedpop_participant_step1(ctx, &enc_state, pmsg1, hostseckey32, hostseckey32, hostpubkeys33, threshold, participant_id, random32, n_participants);
+            }
         }
     }
 

src/modules/chilldkg/simplpedpop_impl.h

@@ -411,9 +411,17 @@ static secp256k1_chilldkg_fault secp256k1_chilldkg_simplpedpop_participant_inves
     for (i = 0; i < n; i++) {
         secp256k1_scalar_add(&secshare_sum, &secshare_sum, &partial_secshares[i]);
     }
-    if (!secp256k1_scalar_eq(&secshare_sum, &inv_data->secshare)) {
-        secp256k1_scalar_clear(&secshare_sum);
-        return SECP256K1_CHILLDKG_FAULTY_COORDINATOR;
+    /* We can declassify the result of the comparison because branching on it
+     * only leaks whether the sum of the partial secshares equals the
+     * secshare, which is exactly what the resulting public fault code
+     * reveals. */
+    {
+        int sums_match = secp256k1_scalar_eq(&secshare_sum, &inv_data->secshare);
+        secp256k1_declassify(ctx, &sums_match, sizeof(sums_match));
+        if (!sums_match) {
+            secp256k1_scalar_clear(&secshare_sum);
+            return SECP256K1_CHILLDKG_FAULTY_COORDINATOR;
+        }
     }
     secp256k1_scalar_clear(&secshare_sum);
 

src/modules/chilldkg/util_impl.h

@@ -203,6 +203,7 @@ static int secp256k1_chilldkg_schnorrsig_sign(const secp256k1_context *ctx, unsi
     secp256k1_ecmult_gen_ge(&ctx->ecmult_gen_ctx, &pk, &sk);
     /* The public key is not secret, so variable-time normalization and
      * branching on its y parity are fine. */
+    secp256k1_declassify(ctx, &pk, sizeof(pk));
     secp256k1_fe_normalize_var(&pk.x);
     secp256k1_fe_normalize_var(&pk.y);
     if (secp256k1_fe_is_odd(&pk.y)) {
@@ -242,6 +243,10 @@ static int secp256k1_chilldkg_schnorrsig_sign(const secp256k1_context *ctx, unsi
     secp256k1_memclear_explicit(seckey, sizeof(seckey));
     secp256k1_memclear_explicit(nonce32, sizeof(nonce32));
 
+    /* Branching on the return value only leaks whether the derived nonce is
+     * zero, which happens with negligible probability (the case of an invalid
+     * secret key is declassified above). */
+    secp256k1_declassify(ctx, &ret, sizeof(ret));
     return ret;
 }
 

src/modules/chilldkg/vss_impl.h

@@ -75,6 +75,10 @@ static void secp256k1_chilldkg_vss_commit(const secp256k1_context *ctx, secp256k
          * in the point at infinity, matching the reference. */
         secp256k1_ecmult_gen_gej(&ctx->ecmult_gen_ctx, &comj, &coeffs[j]);
         secp256k1_ge_set_gej(&coms[j], &comj);
+        /* The commitment is public (it is part of the participant message);
+         * declassify it so that the variable-time serialization is allowed
+         * to branch on it. */
+        secp256k1_declassify(ctx, &coms[j], sizeof(coms[j]));
         secp256k1_gej_clear(&comj);
     }
 }
@@ -121,6 +125,11 @@ static int secp256k1_chilldkg_vss_verify_secshare(const secp256k1_context *ctx,
 
     VERIFY_CHECK(ctx != NULL);
     secp256k1_ecmult_gen_ge(&ctx->ecmult_gen_ctx, &actual, secshare);
+    /* We can declassify because in honest runs actual = secshare*G is the
+     * (public) pubshare itself, and because the verification result is always
+     * public: it determines a public fault code. The discrete log of actual
+     * (the secret share) is not revealed. */
+    secp256k1_declassify(ctx, &actual, sizeof(actual));
     if (secp256k1_ge_is_infinity(&actual) || secp256k1_ge_is_infinity(pubshare)) {
         return secp256k1_ge_is_infinity(&actual) && secp256k1_ge_is_infinity(pubshare);
     }