Remove _constant_time suffixes.

It is confusing to have a convention where explicitly-OK-to-be-
variable-time functions have a suffix to that affect, and a very small
number of functions have suffixes to the other effect, but most
functions aspire to be constant time but have neither suffix.

src/arithmetic/bigint.rs

@@ -101,7 +101,7 @@ impl<M, E> Elem<M, E> {
 impl<M, E> Elem<M, E> {
     #[inline]
     pub fn is_zero(&self) -> bool {
-        limb::limbs_are_zero_constant_time(&self.limbs).leak()
+        limb::limbs_are_zero(&self.limbs).leak()
     }
 }
 
@@ -214,7 +214,7 @@ pub fn elem_reduced_once<A, M>(
 ) -> Elem<M, Unencoded> {
     assert_eq!(m.len_bits(), other_modulus_len_bits);
     r.limbs.copy_from_slice(&a.limbs);
-    limb::limbs_reduce_once_constant_time(&mut r.limbs, m.limbs())
+    limb::limbs_reduce_once(&mut r.limbs, m.limbs())
         .unwrap_or_else(unwrap_impossible_len_mismatch_error);
     Elem {
         limbs: r.limbs,

src/ec/curve25519/ed25519/signing.rs

@@ -177,7 +177,7 @@ impl Ed25519KeyPair {
         let private_scalar =
             MaskedScalar::from_bytes_masked(private_scalar.try_into().unwrap()).into();
 
-        let a = ExtPoint::from_scalarmult_base_consttime(&private_scalar, cpu_features);
+        let a = ExtPoint::from_scalarmult_base(&private_scalar, cpu_features);
 
         Self {
             private_scalar,
@@ -209,7 +209,7 @@ impl Ed25519KeyPair {
             };
             let nonce = Scalar::from_sha512_digest_reduced(nonce);
 
-            let r = ExtPoint::from_scalarmult_base_consttime(&nonce, cpu_features);
+            let r = ExtPoint::from_scalarmult_base(&nonce, cpu_features);
             signature_r.copy_from_slice(&r.into_encoded_point(cpu_features));
             let hram_digest = eddsa_digest(signature_r, self.public_key.as_ref(), msg);
             let hram = Scalar::from_sha512_digest_reduced(hram_digest);

src/ec/curve25519/ops.rs

@@ -74,7 +74,7 @@ pub struct ExtPoint {
 
 impl ExtPoint {
     // Returns the result of multiplying the base point by the scalar in constant time.
-    pub(super) fn from_scalarmult_base_consttime(scalar: &Scalar, cpu: cpu::Features) -> Self {
+    pub(super) fn from_scalarmult_base(scalar: &Scalar, cpu: cpu::Features) -> Self {
         let mut r = Self {
             x: Elem::zero(),
             y: Elem::zero(),

src/ec/suite_b/ops.rs

@@ -160,7 +160,7 @@ impl CommonOps {
     #[inline]
     fn is_zero<M, E: Encoding>(&self, a: &elem::Elem<M, E>) -> bool {
         let num_limbs = self.num_limbs.into();
-        limbs_are_zero_constant_time(&a.limbs[..num_limbs]).leak()
+        limbs_are_zero(&a.limbs[..num_limbs]).leak()
     }
 
     #[inline]
@@ -494,7 +494,7 @@ impl Modulus<N> {
     pub fn elem_reduced_to_scalar(&self, elem: &Elem<Unencoded>) -> Scalar<Unencoded> {
         let num_limbs = self.num_limbs.into();
         let mut r_limbs = elem.limbs;
-        limbs_reduce_once_constant_time(&mut r_limbs[..num_limbs], &self.limbs[..num_limbs])
+        limbs_reduce_once(&mut r_limbs[..num_limbs], &self.limbs[..num_limbs])
             .unwrap_or_else(unwrap_impossible_len_mismatch_error);
         Scalar {
             limbs: r_limbs,
@@ -577,7 +577,7 @@ pub(super) fn scalar_parse_big_endian_partially_reduced_variable_consttime(
     {
         let r = &mut r.limbs[..num_limbs];
         parse_big_endian_and_pad_consttime(bytes, r)?;
-        limbs_reduce_once_constant_time(r, &n.limbs[..num_limbs])
+        limbs_reduce_once(r, &n.limbs[..num_limbs])
             .unwrap_or_else(unwrap_impossible_len_mismatch_error);
     }
 

src/limb.rs

@@ -46,14 +46,11 @@ pub fn limbs_equal_limbs_consttime(a: &[Limb], b: &[Limb]) -> Result<LimbMask, L
         return Err(LenMismatchError::new(a.len()));
     }
     let all = a.iter().zip(b).fold(0, |running, (a, b)| running | (a ^ b));
-    Ok(limb_is_zero_constant_time(all))
+    Ok(limb_is_zero(all))
 }
 
 #[inline]
-fn limbs_less_than_limbs_constant_time(
-    a: &[Limb],
-    b: &[Limb],
-) -> Result<LimbMask, LenMismatchError> {
+fn limbs_less_than_limbs(a: &[Limb], b: &[Limb]) -> Result<LimbMask, LenMismatchError> {
     prefixed_extern! {
         fn LIMBS_less_than(a: *const Limb, b: *const Limb, num_limbs: c::NonZero_size_t)
             -> LimbMask;
@@ -74,7 +71,7 @@ pub(crate) fn verify_limbs_less_than_limbs_leak_bit(
     a: &[Limb],
     b: &[Limb],
 ) -> Result<(), error::Unspecified> {
-    let r = limbs_less_than_limbs_constant_time(a, b).map_err(error::erase::<LenMismatchError>)?;
+    let r = limbs_less_than_limbs(a, b).map_err(error::erase::<LenMismatchError>)?;
     if r.leak() {
         Ok(())
     } else {
@@ -84,21 +81,21 @@ pub(crate) fn verify_limbs_less_than_limbs_leak_bit(
 
 #[inline]
 pub fn limbs_less_than_limbs_vartime(a: &[Limb], b: &[Limb]) -> Result<bool, LenMismatchError> {
-    let r = limbs_less_than_limbs_constant_time(a, b)?;
+    let r = limbs_less_than_limbs(a, b)?;
     Ok(r.leak())
 }
 
 #[inline]
-fn limb_is_zero_constant_time(limb: Limb) -> LimbMask {
+fn limb_is_zero(limb: Limb) -> LimbMask {
     prefixed_extern! {
         fn LIMB_is_zero(limb: Limb) -> LimbMask;
     }
     unsafe { LIMB_is_zero(limb) }
 }
 
 #[inline]
-pub fn limbs_are_zero_constant_time(limbs: &[Limb]) -> LimbMask {
-    limb_is_zero_constant_time(limbs.iter().fold(0, |a, b| a | b))
+pub fn limbs_are_zero(limbs: &[Limb]) -> LimbMask {
+    limb_is_zero(limbs.iter().fold(0, |a, b| a | b))
 }
 
 /// Leaks one bit of information (other than the lengths of the inputs):
@@ -107,7 +104,7 @@ pub fn limbs_are_zero_constant_time(limbs: &[Limb]) -> LimbMask {
 #[inline]
 pub fn limbs_reject_even_leak_bit(limbs: &[Limb]) -> Result<(), error::Unspecified> {
     let bottom = *limbs.first().ok_or(error::Unspecified)?;
-    if limb_is_zero_constant_time(bottom & 1).leak() {
+    if limb_is_zero(bottom & 1).leak() {
         return Err(error::Unspecified);
     }
     Ok(())
@@ -117,7 +114,7 @@ pub fn limbs_reject_even_leak_bit(limbs: &[Limb]) -> Result<(), error::Unspecifi
 #[inline]
 pub fn verify_limbs_equal_1_leak_bit(a: &[Limb]) -> Result<(), error::Unspecified> {
     if let [bottom, ref rest @ ..] = *a {
-        let equal = limb_is_zero_constant_time(bottom ^ 1) & limbs_are_zero_constant_time(rest);
+        let equal = limb_is_zero(bottom ^ 1) & limbs_are_zero(rest);
         if equal.leak() {
             return Ok(());
         }
@@ -157,7 +154,7 @@ pub fn limbs_minimal_bits(a: &[Limb]) -> bits::BitLength {
 
 /// Equivalent to `if (r >= m) { r -= m; }`
 #[inline]
-pub fn limbs_reduce_once_constant_time(r: &mut [Limb], m: &[Limb]) -> Result<(), LenMismatchError> {
+pub fn limbs_reduce_once(r: &mut [Limb], m: &[Limb]) -> Result<(), LenMismatchError> {
     prefixed_extern! {
         fn LIMBS_reduce_once(r: *mut Limb, m: *const Limb, num_limbs: c::NonZero_size_t);
     }
@@ -191,7 +188,7 @@ pub fn parse_big_endian_in_range_and_pad_consttime(
     parse_big_endian_and_pad_consttime(input, result)?;
     verify_limbs_less_than_limbs_leak_bit(result, max_exclusive)?;
     if allow_zero != AllowZero::Yes {
-        if limbs_are_zero_constant_time(result).leak() {
+        if limbs_are_zero(result).leak() {
             return Err(error::Unspecified);
         }
     }
@@ -457,11 +454,11 @@ mod tests {
     fn test_limbs_are_zero() {
         for zero in ZEROES {
             let zero = &Vec::from_iter(zero.iter().copied().map(Limb::from));
-            assert!(leak_in_test(limbs_are_zero_constant_time(zero)));
+            assert!(leak_in_test(limbs_are_zero(zero)));
         }
         for nonzero in NONZEROES {
             let nonzero = &Vec::from_iter(nonzero.iter().copied().map(Limb::from));
-            assert!(!leak_in_test(limbs_are_zero_constant_time(nonzero)));
+            assert!(!leak_in_test(limbs_are_zero(nonzero)));
         }
     }