Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks
Is there a "sane" implementation of the algorithms used by bitcoin? e.g. are there high-quality implementations available that incorporate defenses against side channel attacks?


libsecp256k1


  Does OpenSSL already protects against side-channel attacks? 


haha*


  How can I train myself to evaluate whether an existing implementation is vulnerable to certain types of attacks? 



Review the claims.  If it doesn't even claim side channel resistance, worry.
Review the track record.  If it's been subjected to side channel attacks repeatedly and it doesn't claim to have taken a serious comprehensive approach to fixing them, worry.
Identify the physical observables of interest.  If you're talking over the internet, you probably don't need to worry about power analysis.  But if you're making a smart card that a hapless luser will put into a malicious ATM, you may need to worry about it.
For timing side channels:


Identify a set of primitive computations that you take as constant-time.  Typical set: copying data, $w$-bit addition and subtraction, bitwise operations, constant shifts and rotates.  Multiplication can be questionable.
Follow the data flow of secrets.  If you can find any primitive computations that depend on the values of secrets, like the conditions of branches or the addresses of memory references, *bzzzzzrt*.  If you can prove they flow only into the safe operations, you might be OK.

Try not to handle individual bits at a time, and keep up with the state of the art because technology moves fast.
Pay attention to tools like gfverif.



  Are there good resources that explain how to implement those algorithms myself? I do not intend to use my own implementation for the app, but I am interested in understanding how the stuff works I'm using. Entry-bar seems quite high. Can the "Guide to Elliptic Curve Cryptography" book be recommended?


Our friendly neighborhood bear has some good references.  Reading existing implementations is indispensible, and the abysmal code quality of a lot of otherwise good cryptographers can provide good motivation to get into implementation yourself.  For references on elliptic curve cryptography, we have lots on this site!



* In fairness to the modern OpenSSL team, they inherited a gigantic legacy code base and they are doing their best to clean it up and plug side channels without severely damaging performance.  Unfortunately, these goals—maintain legacy code base, preserve performance of bad cryptosystems—often come into conflict with side channel security.