Make libjade use DOIT instructions on secrets

[J08nY]

This ties in to the effort in jasmin-lang/jasmin#736.

• crypto_hash
  • Removed BSWAP from SHA2. Replaced with direct byte moves as it only occured when loading and storing the inputs/results.
  • Replaced ROLs in Keccak with an implementation that uses two shifts and an OR.
• crypto_xof
  • Replaced VMOVLPD/VMOVHPD with ordinary 64bit moves and a shift in shake128/256 AVX2 4x version used.
• crypto_stream
  • Replaced ROLs in ChaCha and Salsa20 with an implementation that uses two shifts and an OR. This required an auxilliary register that was not available, as the Chacha/Salsa20 states fully saturate the registers in the implementation. Spilling of two additional registers was necessary for ChaCha and Salsa20.
  • Also, the change above had the side effect that the AVX(2) versions of XSalsa20 require compilation with -lazy-regalloc.
• crypto_kem
  • Added declassifications for publicseed, necessary to make the CT checker pass even without DOIT.
  • No other changes necessary, but implemented a DOIT POPCNT32 and POPCNT64.
• crypto_onetimeauth
  • Replaced SHRD in avx/avx2 implementations of Poly1305 with two shifts and an OR.
• crypto_scalarmult
  • Replaced SHLD and SHRD with two shifts and an OR.
• crypto_secretbox
  • Added declassifications for the tag verification result, necessary to make the CT checker pass even without DOIT.
  • Made the same fixes to the included xsalsa20 implementations as to the ones in crypto_stream.
• crypto_sign
  • Replaced ROLs in Keccak. Otherwise unchanged and does not verify with CT checker (even in current state).

[J08nY]

Good points, thanks. Though this is only a draft, worth looking at after some more work.

[J08nY]

Alright, this is ready for some review now.

I used something like:

env JASMIN="jasminc -checkCT -checkCTafter=propagate -doit -infer -nowarning" make 2>&1 | grep -E "(Entering|line |constant)"

to check that all implementations pass the CT checker as expected.