Fix isZeroMask in SignedSecretWord

constantine/math/arithmetic/limbs_exgcd.nim

@@ -626,7 +626,7 @@ func legendreImpl[N, E](
 
   accL = (accL + accL.isOdd()) and SignedSecretWord(3)
   accL = SignedSecretWord(1)-accL
-  accL.csetZero(f.isZeroMask())
+  accL.csetZero(not f.isZeroMask())
   return SecretWord(accL)
 
 func legendre*(a, M: Limbs, bits: static int): SecretWord =

constantine/math/arithmetic/limbs_unsaturated.nim

@@ -280,9 +280,10 @@ func isOdd*(a: SignedSecretWord): SignedSecretWord {.inline.} =
   a and SignedSecretWord(1)
 
 func isZeroMask*(a: SignedSecretWord): SignedSecretWord {.inline.} =
-  ## Produce the -1 mask if a is negative
+  ## Produce the -1 mask if a is 0
   ## and 0 otherwise
-  not SignedSecretWord(a.SecretWord().isZero())
+  # In x86 assembly, we can use "neg" + "sbb"
+  -SignedSecretWord(a.SecretWord().isZero())
 
 func isNegMask*(a: SignedSecretWord): SignedSecretWord {.inline.} =
   ## Produce the -1 mask if a is negative

constantine/platforms/constant_time/ct_routines.nim

@@ -215,6 +215,7 @@ template isNonZero*[T: Ct](x: T): CTBool[T] =
   isMsbSet(x_NZ or -x_NZ)
 
 template isZero*[T: Ct](x: T): CTBool[T] =
+  # In x86 assembly, we can use "neg" + "adc"
   not isNonZero(x)
 
 # ############################################################