Compute pubkey only on demand.

[jhoenicke]

I'm not completely happy with this pull request, but I opened it to be able to discuss this.
This pull request changes the API and needs more changes to trezor-mcu to work, see the corresponding pull request trezor/trezor-mcu#97.

The goal of this pull request is to reduce the number of times we compute the public key. This is both for performance reasons and to reduce the side-channel risk. I'm confident that the current implementation is side-channel resistant but if we can avoid computing a public key, we should avoid it. For example for u2f we currently compute 10 public keys, including the master public key for the nist256p hierarchy. With this patch u2f only computes the R value of the signature from the private nonce.

Things I'm not happy with:

• Most functions on hdnode are no longer const, since they may write the public key to the hdnode.
• The previous point is especially true for ed25519 sign, which needs the public key.
• The hdnode becomes stateful. If we compute a hdnode, then use a function that needs the public key and then access the public key, it works. If we later remove the function, the public key would be zero, which is a hard to find bug.
• The unit tests don't test the statefulness of hdnode.
• We now set the first byte of the 33 byte ed25519 public key to 1, to mark the presence of the public key. Currently the Trezor API sets it to 0. (Officially, an ed25519 public key is 32 byte).

The public key is always 33 byte. NIST and SECP public keys use the usual 02/03 prefix byte to mark even/odd compressed public key. ed25519 instead uses a 01 prefix, just to distinguish unset public key.

[jhoenicke]

The check that failed is a timeout in test_codepoints. Is there an easy way to increase the timeout limit for one test?

[prusnak]

http://check.sourceforge.net/doc/check_html/check_4.html#Test-Timeouts says:

The timeout for a specific test case, which may contain multiple unit tests, can be changed with the tcase_set_timeout() function.

[prusnak]

I like the change because of the performance upgrade. (I was thinking about this in the past, but did not want to break things). Let's get this in.

[prusnak]

test_codepoints timeout increased in dc16759

[prusnak]

I also reintroduced uint32_t field to HDNode structure in 9a8df5a where fingerprint used to be, so we won't break binary compatibility of people using the struct directly (we do this in storage for example).

[jhoenicke]

I was under the impression that this isn't a problem, since the storage node stores a HDNodeType (protobuf structure).

[prusnak]

Ah, yeah. I got that mixed up. Sorry. Reverted.