In order to compile and run the tests you need cmake.
Valgrind is also used, if found, to check that the code handling secrets runs in constant time (see below).
Some tests are generated by Python scripts, run with the interpreter in the
environment variable PYTHON (by default, ``python``).

In Linux, do::

	cmake -B build -DSSE=1
	make -C build -j 8 all test

In Windows, do::

	cmake -B build -G "NMake Makefiles"
	cd build
	nmake all test

Constant-time checks with Valgrind
----------------------------------

The tests whose name ends in ``_ct`` (``test_nat_ct``, ``test_ec_nat_ct``,
``test_ed25519_ct``, ``test_curve25519_ct``, and their 32-bit and BMI2/ADX
variants) check that no branch and no memory access depends on secret data,
as such dependencies can leak the secret through timing or cache side
channels. They are built and run only if both ``valgrind`` and the header
``valgrind/memcheck.h`` are found (for instance, the ``valgrind`` package
on Debian and Fedora).

How it works (the "ctgrind" technique):

* The secret inputs (private numbers, scalars, random seeds for the
  blinding, and some points) are marked as *undefined* memory with
  ``VALGRIND_MAKE_MEM_UNDEFINED``.
* Valgrind memcheck tracks how undefined values propagate through the
  computation, and reports an error for every conditional jump, and for
  every memory access whose address, that depends on them.
* The values that may be public on purpose (for instance, whether a point
  is valid, or the final result) are marked as *defined* again, in the C
  code with ``ct_declassify()`` (active only when ``NAT_CTGRIND`` is defined).

The check is on the compiled binary, so it also catches branches that the
compiler introduces on its own. That depends on the compiler, its version
and the optimization level: it is worth running the checks with other
settings too, for instance::

	cmake -B build-clang -DCMAKE_C_COMPILER=clang -DSSE=1
	make -C build-clang -j 8 all test

What it does not detect: instructions whose duration depends on their
operands (such as divisions on many CPUs, or multiplications on a few),
and leaks in code that the tests do not run.

To run one check by hand::

	valgrind --error-exitcode=1 build/test_ed25519_ct

The sanitizers (ASan, UBSan) are disabled for these tests, as they cannot
run under Valgrind.
