Better-performing “25519” elliptic-curve cryptography 2 years ago
The next paragraph makes a slightly stronger statement about its constant-time'ness:
Our implementations of x/Ed25519 are designed with constant time in mind. They perform exactly the same sequence of basic CPU instructions regardless of the input values, and they avoid any CPU instructions that might have data-dependent timing.