Enable bounded bigmod operations by default

[mswilkison]

Depends on #11 and is stacked on constant-time-hardening-backport. This carries the public corrections from #10 onto the current backport and enables the covered bigmod operations by default, following upstream's public default-on change.

Selectively adapts public commits 3169e56d59bf022817dad838ca81e62b02dd08e9 and cf15377f96bf8f3d522c6de7a626f4a13e6e3649, and upstream 44a95b248096396b4ef8a611bed789948be46267.

Encode exponents at a fixed public width, including zero, reject overflow instead of silently widening the operation, and use explicit public bounds where proof exponents exceed the arithmetic modulus width. Snapshot the mode across multi-step operations. Decryption uses its existing Carmichael exponent for inversion, preserving support for keys without the optional PhiN field.

Coverage remains limited to the documented exponentiation paths: surrounding conversions, reductions, and other math/big operations remain variable-time. The explicit opt-out API remains available. Kept as a draft for application performance and rollout review.

Validation: focused default-mode, zero, width, inverse, mode-toggle, unequal-modulus, and nil-PhiN compatibility tests passed in common, crypto/paillier, and crypto/mta. Repository-wide go vet, formatting, diff checks, independent patch review, and correction verification passed. The repository-wide test run is in progress. Existing 2048-bit exponentiation benchmarks ran successfully; these are primitive measurements on one machine and do not establish application throughput or side-channel resistance.

Full test CI and formatting CI were dispatched for this branch because the automatic PR trigger only covers master.

[piotr-roslaniec]

Heads up — a separate review pass turned up one more CT gap that none of #8 / #10 / #11 / this PR cover: upstream bnb-chain/tss-lib's 3709c25 also hardens crypto/schnorr/schnorr_proof.go (witness multiplications in NewZKProofWithSession / NewZKVProofWithSession) and ecdsa/signing/round_3.go / round_4.go / round_5.go (k·γ, k·w, θ⁻¹, m·k, rx·σ). I cherry-picked the port onto a new stacked draft — #23 (ct-hardening-schnorr-signing-coverage, base codex/ct-defaults-and-bounds) — using the exact same IsConstantTimeEnabled() / NewCTModInt(...).MulCT / .ModInverseCT pattern. gofmt -l ., go build ./..., go vet ./..., and go test ./... all clean there; new Schnorr equivalence test (crypto/schnorr/constant_time_equiv_test.go) passes.

Separately, the same upstream commit also touches crypto/mta/share_protocol.go's AliceEnd / AliceEndWC — but via a different mechanism (sleep-based NewTimingProtection, ~200 ms + jitter) that doesn't exist in this fork and isn't a mechanical extension of the bigmod CT pattern. I deliberately did not port that, but I did add a COVERAGE comment in common/constant_time.go recording it as a known, intentionally-deferred gap so it doesn't get lost — see #23 for that doc update.

[piotr-roslaniec]

Merged into dev after merging the current dev head into this branch (b1400ad). Dependency/toolchain choices from #20/#21 were retained.

Verification on the integrated head:

• CI: Test and Go fmt green.
• Local: go mod tidy/go mod verify, build, vet, format, and full go test ./... green (496 s).
• Independent CT equivalence: >150 assertions, 0 failures; 11-party default-on signing succeeds; concurrent toggle test is race-clean.
• Timing controls detected the expected math/big leak (Exp median delta 633.6%, Decrypt 968.9%); CT paths were flat in the same harness (0.03% and 0.09%).
• Benchmark impact: Exp2048 -16.96%, DLN proof -11.21%, but Paillier Decrypt +447.97% (about 5.5x) due to constant-time inversion. This is a consumer-visible cost keep-core must budget for before its tss-lib bump.
• Overflow panics are not peer-reachable in shipped protocol paths; every in-tree caller supplies a sufficient public bound.

#23 is the required stacked follow-up for Schnorr and signing-round coverage. One missing #10 regression (TestShareProtocolUnequalWidthsCTEquivalence) will land in the CT test-only follow-up PR.

Full report: agent-docs/pr-integration/17.md (local).