2025-11-20 12:40:50 +00:00
|
|
|
ACLOCAL_AMFLAGS = -I autotools-aux/m4
|
2014-11-06 22:35:41 +13:00
|
|
|
|
2021-05-13 17:06:16 +02:00
|
|
|
# AM_CFLAGS will be automatically prepended to CFLAGS by Automake when compiling some foo
|
|
|
|
|
# which does not have an explicit foo_CFLAGS variable set.
|
|
|
|
|
AM_CFLAGS = $(SECP_CFLAGS)
|
|
|
|
|
|
2014-01-17 22:52:33 -05:00
|
|
|
lib_LTLIBRARIES = libsecp256k1.la
|
|
|
|
|
include_HEADERS = include/secp256k1.h
|
2018-11-27 16:48:57 +01:00
|
|
|
include_HEADERS += include/secp256k1_preallocated.h
|
2014-01-17 22:52:33 -05:00
|
|
|
noinst_HEADERS =
|
2014-10-28 04:08:15 -07:00
|
|
|
noinst_HEADERS += src/scalar.h
|
2014-10-29 00:35:49 -07:00
|
|
|
noinst_HEADERS += src/scalar_4x64.h
|
|
|
|
|
noinst_HEADERS += src/scalar_8x32.h
|
2016-07-07 10:11:30 +00:00
|
|
|
noinst_HEADERS += src/scalar_low.h
|
2014-10-28 04:08:15 -07:00
|
|
|
noinst_HEADERS += src/scalar_impl.h
|
2014-10-29 00:35:49 -07:00
|
|
|
noinst_HEADERS += src/scalar_4x64_impl.h
|
|
|
|
|
noinst_HEADERS += src/scalar_8x32_impl.h
|
2016-07-07 10:11:30 +00:00
|
|
|
noinst_HEADERS += src/scalar_low_impl.h
|
2014-01-17 22:52:33 -05:00
|
|
|
noinst_HEADERS += src/group.h
|
2014-03-07 01:11:01 +01:00
|
|
|
noinst_HEADERS += src/group_impl.h
|
2020-12-05 22:40:54 +00:00
|
|
|
noinst_HEADERS += src/eccommit.h
|
|
|
|
|
noinst_HEADERS += src/eccommit_impl.h
|
2014-01-17 22:52:33 -05:00
|
|
|
noinst_HEADERS += src/ecdsa.h
|
2014-03-07 01:11:01 +01:00
|
|
|
noinst_HEADERS += src/ecdsa_impl.h
|
2014-10-27 02:57:27 -07:00
|
|
|
noinst_HEADERS += src/eckey.h
|
|
|
|
|
noinst_HEADERS += src/eckey_impl.h
|
2014-01-17 22:52:33 -05:00
|
|
|
noinst_HEADERS += src/ecmult.h
|
2014-03-07 01:11:01 +01:00
|
|
|
noinst_HEADERS += src/ecmult_impl.h
|
2021-12-17 12:02:40 -05:00
|
|
|
noinst_HEADERS += src/ecmult_compute_table.h
|
|
|
|
|
noinst_HEADERS += src/ecmult_compute_table_impl.h
|
2015-05-13 17:31:47 -05:00
|
|
|
noinst_HEADERS += src/ecmult_const.h
|
|
|
|
|
noinst_HEADERS += src/ecmult_const_impl.h
|
2014-10-26 03:42:24 -07:00
|
|
|
noinst_HEADERS += src/ecmult_gen.h
|
|
|
|
|
noinst_HEADERS += src/ecmult_gen_impl.h
|
2021-12-17 11:33:38 -05:00
|
|
|
noinst_HEADERS += src/ecmult_gen_compute_table.h
|
|
|
|
|
noinst_HEADERS += src/ecmult_gen_compute_table_impl.h
|
2014-01-17 22:52:33 -05:00
|
|
|
noinst_HEADERS += src/field_10x26.h
|
2014-03-07 01:11:01 +01:00
|
|
|
noinst_HEADERS += src/field_10x26_impl.h
|
2014-01-17 22:52:33 -05:00
|
|
|
noinst_HEADERS += src/field_5x52.h
|
2014-03-07 01:11:01 +01:00
|
|
|
noinst_HEADERS += src/field_5x52_impl.h
|
|
|
|
|
noinst_HEADERS += src/field_5x52_int128_impl.h
|
2020-11-29 14:01:03 -08:00
|
|
|
noinst_HEADERS += src/modinv32.h
|
|
|
|
|
noinst_HEADERS += src/modinv32_impl.h
|
|
|
|
|
noinst_HEADERS += src/modinv64.h
|
|
|
|
|
noinst_HEADERS += src/modinv64_impl.h
|
2021-12-17 14:21:38 -05:00
|
|
|
noinst_HEADERS += src/precomputed_ecmult.h
|
2021-12-17 13:50:39 -05:00
|
|
|
noinst_HEADERS += src/precomputed_ecmult_gen.h
|
2020-08-12 15:52:20 -07:00
|
|
|
noinst_HEADERS += src/assumptions.h
|
2022-12-06 16:35:35 -05:00
|
|
|
noinst_HEADERS += src/checkmem.h
|
2025-09-09 15:35:47 -04:00
|
|
|
noinst_HEADERS += src/tests_common.h
|
2023-08-17 19:25:56 +02:00
|
|
|
noinst_HEADERS += src/testutil.h
|
2025-09-03 10:59:37 -04:00
|
|
|
noinst_HEADERS += src/unit_test.h
|
|
|
|
|
noinst_HEADERS += src/unit_test.c
|
2014-01-17 22:52:33 -05:00
|
|
|
noinst_HEADERS += src/util.h
|
2025-03-10 11:22:13 +00:00
|
|
|
noinst_HEADERS += src/util_local_visibility.h
|
2022-07-27 11:09:51 -04:00
|
|
|
noinst_HEADERS += src/int128.h
|
|
|
|
|
noinst_HEADERS += src/int128_impl.h
|
|
|
|
|
noinst_HEADERS += src/int128_native.h
|
|
|
|
|
noinst_HEADERS += src/int128_native_impl.h
|
|
|
|
|
noinst_HEADERS += src/int128_struct.h
|
|
|
|
|
noinst_HEADERS += src/int128_struct_impl.h
|
2017-07-22 18:03:17 +00:00
|
|
|
noinst_HEADERS += src/scratch.h
|
|
|
|
|
noinst_HEADERS += src/scratch_impl.h
|
2020-08-17 13:48:22 -07:00
|
|
|
noinst_HEADERS += src/selftest.h
|
2014-11-12 15:59:26 -08:00
|
|
|
noinst_HEADERS += src/testrand.h
|
|
|
|
|
noinst_HEADERS += src/testrand_impl.h
|
2014-12-13 18:06:33 +01:00
|
|
|
noinst_HEADERS += src/hash.h
|
|
|
|
|
noinst_HEADERS += src/hash_impl.h
|
2014-01-17 22:52:33 -05:00
|
|
|
noinst_HEADERS += src/field.h
|
2014-03-07 01:11:01 +01:00
|
|
|
noinst_HEADERS += src/field_impl.h
|
2014-12-04 20:26:54 +01:00
|
|
|
noinst_HEADERS += src/bench.h
|
2023-04-14 07:11:46 +02:00
|
|
|
noinst_HEADERS += src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.h
|
2024-04-17 17:33:51 +00:00
|
|
|
noinst_HEADERS += src/hsort.h
|
|
|
|
|
noinst_HEADERS += src/hsort_impl.h
|
2015-10-14 17:43:20 +02:00
|
|
|
noinst_HEADERS += contrib/lax_der_parsing.h
|
2015-10-26 15:21:53 -05:00
|
|
|
noinst_HEADERS += contrib/lax_der_parsing.c
|
2015-10-21 04:02:30 +00:00
|
|
|
noinst_HEADERS += contrib/lax_der_privatekey_parsing.h
|
2015-10-26 15:21:53 -05:00
|
|
|
noinst_HEADERS += contrib/lax_der_privatekey_parsing.c
|
2023-02-17 14:08:06 +05:30
|
|
|
noinst_HEADERS += examples/examples_util.h
|
2014-01-17 22:52:33 -05:00
|
|
|
|
2021-12-17 13:50:39 -05:00
|
|
|
PRECOMPUTED_LIB = libsecp256k1_precomputed.la
|
|
|
|
|
noinst_LTLIBRARIES = $(PRECOMPUTED_LIB)
|
2021-12-17 14:21:38 -05:00
|
|
|
libsecp256k1_precomputed_la_SOURCES = src/precomputed_ecmult.c src/precomputed_ecmult_gen.c
|
2022-11-21 22:13:04 -05:00
|
|
|
# We need `-I$(top_srcdir)/src` in VPATH builds if libsecp256k1_precomputed_la_SOURCES have been recreated in the build tree.
|
|
|
|
|
# This helps users and packagers who insist on recreating the precomputed files (e.g., Gentoo).
|
2023-01-19 09:43:28 +00:00
|
|
|
libsecp256k1_precomputed_la_CPPFLAGS = -I$(top_srcdir)/src $(SECP_CONFIG_DEFINES)
|
2021-12-17 13:50:39 -05:00
|
|
|
|
2014-12-24 12:12:37 +01:00
|
|
|
if USE_EXTERNAL_ASM
|
|
|
|
|
COMMON_LIB = libsecp256k1_common.la
|
|
|
|
|
else
|
|
|
|
|
COMMON_LIB =
|
|
|
|
|
endif
|
2021-12-17 13:50:39 -05:00
|
|
|
noinst_LTLIBRARIES += $(COMMON_LIB)
|
2014-12-24 12:12:37 +01:00
|
|
|
|
2014-05-20 20:59:11 -04:00
|
|
|
pkgconfigdir = $(libdir)/pkgconfig
|
2014-05-07 06:10:08 +00:00
|
|
|
pkgconfig_DATA = libsecp256k1.pc
|
|
|
|
|
|
2014-12-24 12:12:37 +01:00
|
|
|
if USE_EXTERNAL_ASM
|
|
|
|
|
if USE_ASM_ARM
|
|
|
|
|
libsecp256k1_common_la_SOURCES = src/asm/field_10x26_arm.s
|
|
|
|
|
endif
|
|
|
|
|
endif
|
|
|
|
|
|
2014-08-19 13:39:58 +02:00
|
|
|
libsecp256k1_la_SOURCES = src/secp256k1.c
|
2023-01-19 09:43:28 +00:00
|
|
|
libsecp256k1_la_CPPFLAGS = $(SECP_CONFIG_DEFINES)
|
|
|
|
|
libsecp256k1_la_LIBADD = $(COMMON_LIB) $(PRECOMPUTED_LIB)
|
2021-07-06 21:06:46 +00:00
|
|
|
libsecp256k1_la_LDFLAGS = -no-undefined -version-info $(LIB_VERSION_CURRENT):$(LIB_VERSION_REVISION):$(LIB_VERSION_AGE)
|
2014-08-19 13:39:58 +02:00
|
|
|
|
2014-01-17 22:52:33 -05:00
|
|
|
noinst_PROGRAMS =
|
|
|
|
|
if USE_BENCHMARK
|
2021-10-17 12:08:06 -04:00
|
|
|
noinst_PROGRAMS += bench bench_internal bench_ecmult
|
|
|
|
|
bench_SOURCES = src/bench.c
|
2023-01-30 22:42:39 +00:00
|
|
|
bench_LDADD = libsecp256k1.la
|
2022-12-29 14:52:14 -05:00
|
|
|
bench_CPPFLAGS = $(SECP_CONFIG_DEFINES)
|
2015-01-31 16:12:10 -04:00
|
|
|
bench_internal_SOURCES = src/bench_internal.c
|
2023-01-19 09:43:28 +00:00
|
|
|
bench_internal_LDADD = $(COMMON_LIB) $(PRECOMPUTED_LIB)
|
|
|
|
|
bench_internal_CPPFLAGS = $(SECP_CONFIG_DEFINES)
|
2017-09-12 20:05:39 -07:00
|
|
|
bench_ecmult_SOURCES = src/bench_ecmult.c
|
2023-01-19 09:43:28 +00:00
|
|
|
bench_ecmult_LDADD = $(COMMON_LIB) $(PRECOMPUTED_LIB)
|
|
|
|
|
bench_ecmult_CPPFLAGS = $(SECP_CONFIG_DEFINES)
|
2026-08-31 12:25:09 +02:00
|
|
|
if ENABLE_MODULE_ICEBERG
|
|
|
|
|
noinst_PROGRAMS += bench_iceberg
|
|
|
|
|
bench_iceberg_SOURCES = src/bench_iceberg.c
|
|
|
|
|
bench_iceberg_LDADD = $(COMMON_LIB) $(PRECOMPUTED_LIB)
|
|
|
|
|
bench_iceberg_CPPFLAGS = $(SECP_CONFIG_DEFINES)
|
|
|
|
|
endif
|
2014-01-17 22:52:33 -05:00
|
|
|
endif
|
|
|
|
|
|
2015-09-17 18:54:52 -05:00
|
|
|
TESTS =
|
2014-01-17 22:52:33 -05:00
|
|
|
if USE_TESTS
|
2023-01-05 11:37:40 +01:00
|
|
|
TESTS += noverify_tests
|
|
|
|
|
noinst_PROGRAMS += noverify_tests
|
|
|
|
|
noverify_tests_SOURCES = src/tests.c
|
2025-09-03 10:59:37 -04:00
|
|
|
noverify_tests_CPPFLAGS = $(SECP_CONFIG_DEFINES) $(TEST_DEFINES)
|
2023-01-19 09:43:28 +00:00
|
|
|
noverify_tests_LDADD = $(COMMON_LIB) $(PRECOMPUTED_LIB)
|
2023-01-05 11:37:40 +01:00
|
|
|
noverify_tests_LDFLAGS = -static
|
2016-11-26 20:34:15 +00:00
|
|
|
if !ENABLE_COVERAGE
|
2015-09-17 18:54:52 -05:00
|
|
|
TESTS += tests
|
2023-01-05 11:37:40 +01:00
|
|
|
noinst_PROGRAMS += tests
|
|
|
|
|
tests_SOURCES = $(noverify_tests_SOURCES)
|
|
|
|
|
tests_CPPFLAGS = $(noverify_tests_CPPFLAGS) -DVERIFY
|
|
|
|
|
tests_LDADD = $(noverify_tests_LDADD)
|
|
|
|
|
tests_LDFLAGS = $(noverify_tests_LDFLAGS)
|
|
|
|
|
endif
|
2015-09-17 18:54:52 -05:00
|
|
|
endif
|
|
|
|
|
|
2022-12-06 23:12:15 -05:00
|
|
|
if USE_CTIME_TESTS
|
|
|
|
|
noinst_PROGRAMS += ctime_tests
|
|
|
|
|
ctime_tests_SOURCES = src/ctime_tests.c
|
2023-01-30 22:42:39 +00:00
|
|
|
ctime_tests_LDADD = libsecp256k1.la
|
2022-12-06 23:12:15 -05:00
|
|
|
ctime_tests_CPPFLAGS = $(SECP_CONFIG_DEFINES)
|
|
|
|
|
endif
|
|
|
|
|
|
2015-09-17 18:54:52 -05:00
|
|
|
if USE_EXHAUSTIVE_TESTS
|
|
|
|
|
noinst_PROGRAMS += exhaustive_tests
|
|
|
|
|
exhaustive_tests_SOURCES = src/tests_exhaustive.c
|
2023-01-19 09:43:28 +00:00
|
|
|
exhaustive_tests_CPPFLAGS = $(SECP_CONFIG_DEFINES)
|
2016-11-26 20:34:15 +00:00
|
|
|
if !ENABLE_COVERAGE
|
|
|
|
|
exhaustive_tests_CPPFLAGS += -DVERIFY
|
|
|
|
|
endif
|
2021-12-17 13:50:39 -05:00
|
|
|
# Note: do not include $(PRECOMPUTED_LIB) in exhaustive_tests (it uses runtime-generated tables).
|
2023-01-19 09:43:28 +00:00
|
|
|
exhaustive_tests_LDADD = $(COMMON_LIB)
|
2015-09-17 18:54:52 -05:00
|
|
|
exhaustive_tests_LDFLAGS = -static
|
|
|
|
|
TESTS += exhaustive_tests
|
2014-01-17 22:52:33 -05:00
|
|
|
endif
|
|
|
|
|
|
2020-04-30 14:34:24 +03:00
|
|
|
if USE_EXAMPLES
|
|
|
|
|
noinst_PROGRAMS += ecdsa_example
|
|
|
|
|
ecdsa_example_SOURCES = examples/ecdsa.c
|
2023-06-30 09:26:48 +01:00
|
|
|
ecdsa_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
|
2020-04-30 14:34:24 +03:00
|
|
|
ecdsa_example_LDADD = libsecp256k1.la
|
|
|
|
|
ecdsa_example_LDFLAGS = -static
|
|
|
|
|
if BUILD_WINDOWS
|
|
|
|
|
ecdsa_example_LDFLAGS += -lbcrypt
|
|
|
|
|
endif
|
|
|
|
|
TESTS += ecdsa_example
|
|
|
|
|
if ENABLE_MODULE_ECDH
|
|
|
|
|
noinst_PROGRAMS += ecdh_example
|
|
|
|
|
ecdh_example_SOURCES = examples/ecdh.c
|
2023-06-30 09:26:48 +01:00
|
|
|
ecdh_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
|
2020-04-30 14:34:24 +03:00
|
|
|
ecdh_example_LDADD = libsecp256k1.la
|
|
|
|
|
ecdh_example_LDFLAGS = -static
|
|
|
|
|
if BUILD_WINDOWS
|
|
|
|
|
ecdh_example_LDFLAGS += -lbcrypt
|
|
|
|
|
endif
|
|
|
|
|
TESTS += ecdh_example
|
|
|
|
|
endif
|
|
|
|
|
if ENABLE_MODULE_SCHNORRSIG
|
|
|
|
|
noinst_PROGRAMS += schnorr_example
|
|
|
|
|
schnorr_example_SOURCES = examples/schnorr.c
|
2023-06-30 09:26:48 +01:00
|
|
|
schnorr_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
|
2020-04-30 14:34:24 +03:00
|
|
|
schnorr_example_LDADD = libsecp256k1.la
|
|
|
|
|
schnorr_example_LDFLAGS = -static
|
|
|
|
|
if BUILD_WINDOWS
|
|
|
|
|
schnorr_example_LDFLAGS += -lbcrypt
|
|
|
|
|
endif
|
|
|
|
|
TESTS += schnorr_example
|
|
|
|
|
endif
|
2024-06-25 03:11:21 +02:00
|
|
|
if ENABLE_MODULE_ELLSWIFT
|
|
|
|
|
noinst_PROGRAMS += ellswift_example
|
|
|
|
|
ellswift_example_SOURCES = examples/ellswift.c
|
|
|
|
|
ellswift_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
|
|
|
|
|
ellswift_example_LDADD = libsecp256k1.la
|
|
|
|
|
ellswift_example_LDFLAGS = -static
|
|
|
|
|
if BUILD_WINDOWS
|
|
|
|
|
ellswift_example_LDFLAGS += -lbcrypt
|
|
|
|
|
endif
|
|
|
|
|
TESTS += ellswift_example
|
|
|
|
|
endif
|
2024-01-06 19:31:18 +00:00
|
|
|
if ENABLE_MODULE_MUSIG
|
|
|
|
|
noinst_PROGRAMS += musig_example
|
|
|
|
|
musig_example_SOURCES = examples/musig.c
|
|
|
|
|
musig_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
|
|
|
|
|
musig_example_LDADD = libsecp256k1.la
|
|
|
|
|
musig_example_LDFLAGS = -static
|
|
|
|
|
if BUILD_WINDOWS
|
|
|
|
|
musig_example_LDFLAGS += -lbcrypt
|
|
|
|
|
endif
|
|
|
|
|
TESTS += musig_example
|
|
|
|
|
endif
|
2026-08-31 00:05:16 +02:00
|
|
|
if ENABLE_MODULE_FROST
|
|
|
|
|
noinst_PROGRAMS += frost_example
|
|
|
|
|
frost_example_SOURCES = examples/frost.c
|
|
|
|
|
frost_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
|
|
|
|
|
frost_example_LDADD = libsecp256k1.la
|
|
|
|
|
frost_example_LDFLAGS = -static
|
|
|
|
|
if BUILD_WINDOWS
|
|
|
|
|
frost_example_LDFLAGS += -lbcrypt
|
|
|
|
|
endif
|
|
|
|
|
TESTS += frost_example
|
|
|
|
|
endif
|
frost_enrollment: fix the example's stale n and failure-path hygiene
The last of the review findings, plus the comment and structure fixes it
listed.
The example's repair run used the pre-enrollment participant count.
Two blocks earlier the example teaches that every participant must
update its record of n from 3 to 4 after an enrollment, and the
signing session duly uses N_PARTICIPANTS_AFTER. Then enroll() -- which
hard-coded N_PARTICIPANTS -- ran the repair at n = 3. It worked only
because the Lagrange math never involves n and every party in this
single-process demo passed the same stale value.
In a real post-enrollment repair it would not. n is bound into the
parameters hash, so helpers feeding their updated n = 4 into
shares_gen while the requester feeds n = 3 abort round 1.2 with no
visible cause. enroll() now takes n_participants as a parameter, the
repair passes N_PARTICIPANTS_AFTER, and both the function's contract
comment and the repair call site say why. The repaired share is still
byte-identical to the original, which is the point: n changes the
hash, not the arithmetic.
The example leaked secrets on its failure paths.
enroll() erased the delta and sigma buffers only on success; four
early returns left them live. sign_and_verify() returned from three
places without erasing already-generated secnonces. Both now route
every exit through a cleanup block. This example is otherwise more
careful about erasure than its siblings, so the asymmetry was exactly
what a reader copying it would carry into production -- on the fault
paths where hygiene matters most.
The double-wipe of session_secrand is gone with it: shares_gen and
nonce_gen both wipe the seed on every path, and doing it again read
as uncertainty about the contract. The comment now states the
contract instead. The fill_random failure path does erase, since
nothing else has touched the buffer there.
The example's mismatch message asserted a cause it cannot know.
It printed "Helper %u disagrees about the enrollment parameters" for
what may equally be a corrupted share, per the previous commit's
finding. It now says the helper "contributed a share this helper
cannot use", with a comment noting that share_agg does not
distinguish the two causes so neither can the message.
Comment and structure fixes, all noted in the review:
- The vector generator claimed case 4 was "the only case whose DERIVED
public share has odd Y". It is not -- cases 1, 2 and 4 are odd and
case 3 is even. The comment existed to justify a coverage choice and
misinformed; both parity comments now describe the set accurately and
say they document it rather than constrain it. Regenerating vectors.h
still reproduces it byte for byte.
- The secp256k1_frost_sort_ids declaration in frost/session.h no longer
duplicates the definition's doc comment, which was two copies to keep
in sync. It says what the function is for and points at the
definition for the contract.
- The t >= 2 rationale was stated in full in three places. The impl now
states the conclusion and names frost_enrollment.md as the single
place to edit if the policy moves.
- The ctime_tests comments read ambiguously ("the parameters hash is
public, the delta values are not" against a header calling deltas
secret), and computing direct_hash without asserting anything invited
a "forgotten assertion" reading. Both are now explicit.
- The example moves next to frost_example in Makefile.am rather than
after iceberg, matching the FROST-stack grouping used in
configure.ac, ci.sh, ci.yml and README.
- frost_enrollment.md now distinguishes what is unstable (the C API)
from what is frozen (the wire-visible encodings), which the two
statements together previously left easy to conflate.
Not fixed, deliberately, and now recorded where the tree can see it: the
plan called for a CHANGELOG.md entry. That file states in its first two
lines that it is upstream libsecp256k1's changelog and not this fork's,
and none of frost, chilldkg, iceberg or prefractal has an entry. Adding
the first one is a decision about all five modules, not this one. The
README link is the fork's actual convention for announcing a module and
is in place.
Verification: autotools builds warning-free and `make check` is 12/12
including the example; ctime_tests is clean under valgrind; `make dist`
carries all nine frost_enrollment files; CMake with examples builds
warning-free and ctest is 542/542; the example source is clean under
gcc -std=c89 -pedantic -Wall -Wextra; regenerating vectors.h reproduces
it byte for byte.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-04 10:27:17 +02:00
|
|
|
if ENABLE_MODULE_FROST_ENROLLMENT
|
|
|
|
|
noinst_PROGRAMS += frost_enrollment_example
|
|
|
|
|
frost_enrollment_example_SOURCES = examples/frost_enrollment.c
|
|
|
|
|
frost_enrollment_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
|
|
|
|
|
frost_enrollment_example_LDADD = libsecp256k1.la
|
|
|
|
|
frost_enrollment_example_LDFLAGS = -static
|
|
|
|
|
if BUILD_WINDOWS
|
|
|
|
|
frost_enrollment_example_LDFLAGS += -lbcrypt
|
|
|
|
|
endif
|
|
|
|
|
TESTS += frost_enrollment_example
|
|
|
|
|
endif
|
chilldkg: Phase 6 - test vectors, FROST integration, docs, example
Final phase of the ChillDKG module: upstream test vectors, a
DKG->FROST integration test, boundary tests, full module
documentation and a runnable example.
Test vectors:
- tools/test_vectors_chilldkg_generate.py converts all 10 upstream
bip-frost-dkg JSON vector files into src/modules/chilldkg/vectors.h
(modeled on tools/test_vectors_frost_generate.py; takes the vectors
directory as an argument; upstream pinned to commit
a91896883f85b159415ecf298d5e844879af112d, recorded in the generated
header with the exact regeneration invocation; regeneration is
reproducible byte-for-byte).
- tests_impl.h vector runners execute 191 of 241 upstream cases
through the public API: hostpubkey_gen, params_hash,
participant_step1/step2/finalize/investigate,
coordinator_step1/finalize/investigate, recover. Happy paths are
byte-exact (pmsg1/cmsg1/pmsg2/cmsg2/dkg_output/recovery/cinv);
error cases assert both the fault enum and fault_index against
expectedError.participantId. The 50 skipped cases are
wrong-length/wrong-count inputs not expressible with the
fixed-size C API; each skip is documented in vectors.h.
Boundary/robustness tests: t=1, t=n, n=2, a full n=128/t=2 session
end-to-end with per-participant secshare*G == pubshare checks and a
recovery roundtrip, and a state1 memcpy roundtrip (step2 from a copied
state object).
DKG->FROST integration test (guarded by ENABLE_MODULE_FROST): a full
ChillDKG session (n=3, t=2) feeds (secshare, thresh_pk, pubshares)
directly into the frost module. ChillDKG's thresh_pk is already
TapTweak'ed, so frost_tweak_cache_init is called with no further
tweaks (frost's tweaked x-only key asserted equal to the x-only part
of the ChillDKG thresh_pk); signers 0 and 2 run nonce_gen, nonce_agg,
session_init with the shared x = id+1 convention, frost_sign,
partial_sig_verify and partial_sig_agg; the aggregate signature
verifies as a plain BIP-340 signature against the threshold key.
Example: examples/chilldkg.c runs a full 2-of-3 DKG session (host key
generation, params hash, participant/coordinator steps, finalize, and
a recovery roundtrip via participant_recover) with fixed-size buffers
and secret erasure. Wired into Makefile.am and
examples/CMakeLists.txt exactly like frost_example (runs as a TEST);
chilldkg_example binary added to .gitignore.
Docs: src/modules/chilldkg/chilldkg.md now documents the protocol
summary, message-flow table with exact byte sizes, blame taxonomy,
recovery workflow, security notes (host key reuse/retention, fresh
randomness per session, state secrecy, recovery-data sensitivity) and
the pinned reference commit; src/modules/frost/frost.md points at the
new module as the intended DKG.
Bug fix found by the vector runner (recover tcId 9): the internal
recover() passed a possibly-NULL fault_index from coordinator_recover
to certeq_verify, which dereferences it on failure; now uses a local.
Verified: make check 10/10 (3 test suites + 7 examples incl.
chilldkg_example, exit 0 when run); CMake ctest 428/428 with chilldkg
+ frost, and a no-frost build confirms the ENABLE_MODULE_FROST guard;
make distdir includes vectors.h, the example and the generator.
The module is feature-complete against bip-frost-dkg v0.3.0-dev at
a91896883f85b159415ecf298d5e844879af112d. The BIP is still a draft;
tagged hashes and wire formats may change upstream.
2026-08-31 06:52:58 +02:00
|
|
|
if ENABLE_MODULE_CHILLDKG
|
|
|
|
|
noinst_PROGRAMS += chilldkg_example
|
|
|
|
|
chilldkg_example_SOURCES = examples/chilldkg.c
|
|
|
|
|
chilldkg_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
|
|
|
|
|
chilldkg_example_LDADD = libsecp256k1.la
|
|
|
|
|
chilldkg_example_LDFLAGS = -static
|
|
|
|
|
if BUILD_WINDOWS
|
|
|
|
|
chilldkg_example_LDFLAGS += -lbcrypt
|
|
|
|
|
endif
|
|
|
|
|
TESTS += chilldkg_example
|
|
|
|
|
endif
|
2026-08-31 12:25:09 +02:00
|
|
|
if ENABLE_MODULE_ICEBERG
|
|
|
|
|
noinst_PROGRAMS += iceberg_example
|
|
|
|
|
iceberg_example_SOURCES = examples/iceberg.c
|
|
|
|
|
iceberg_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
|
|
|
|
|
iceberg_example_LDADD = libsecp256k1.la
|
|
|
|
|
iceberg_example_LDFLAGS = -static
|
|
|
|
|
if BUILD_WINDOWS
|
|
|
|
|
iceberg_example_LDFLAGS += -lbcrypt
|
|
|
|
|
endif
|
|
|
|
|
TESTS += iceberg_example
|
|
|
|
|
endif
|
2020-04-30 14:34:24 +03:00
|
|
|
endif
|
2021-05-05 15:45:31 +00:00
|
|
|
|
2021-08-27 17:53:44 +02:00
|
|
|
### Precomputed tables
|
2021-12-17 11:19:45 -05:00
|
|
|
EXTRA_PROGRAMS = precompute_ecmult precompute_ecmult_gen
|
2021-08-27 17:53:44 +02:00
|
|
|
CLEANFILES = $(EXTRA_PROGRAMS)
|
2021-06-28 16:33:03 -04:00
|
|
|
|
2021-12-17 11:19:45 -05:00
|
|
|
precompute_ecmult_SOURCES = src/precompute_ecmult.c
|
2023-05-17 23:28:36 +02:00
|
|
|
precompute_ecmult_CPPFLAGS = $(SECP_CONFIG_DEFINES) -DVERIFY
|
2023-01-19 09:43:28 +00:00
|
|
|
precompute_ecmult_LDADD = $(COMMON_LIB)
|
2015-05-19 17:32:35 -07:00
|
|
|
|
2021-12-17 11:15:37 -05:00
|
|
|
precompute_ecmult_gen_SOURCES = src/precompute_ecmult_gen.c
|
2023-05-17 23:28:36 +02:00
|
|
|
precompute_ecmult_gen_CPPFLAGS = $(SECP_CONFIG_DEFINES) -DVERIFY
|
2023-01-19 09:43:28 +00:00
|
|
|
precompute_ecmult_gen_LDADD = $(COMMON_LIB)
|
2015-05-19 17:32:35 -07:00
|
|
|
|
2021-08-27 17:53:44 +02:00
|
|
|
# See Automake manual, Section "Errors with distclean".
|
|
|
|
|
# We don't list any dependencies for the prebuilt files here because
|
|
|
|
|
# otherwise make's decision whether to rebuild them (even in the first
|
|
|
|
|
# build by a normal user) depends on mtimes, and thus is very fragile.
|
|
|
|
|
# This means that rebuilds of the prebuilt files always need to be
|
2023-04-14 07:37:10 +02:00
|
|
|
# forced by deleting them.
|
2021-12-17 14:21:38 -05:00
|
|
|
src/precomputed_ecmult.c:
|
2021-12-17 11:19:45 -05:00
|
|
|
$(MAKE) $(AM_MAKEFLAGS) precompute_ecmult$(EXEEXT)
|
|
|
|
|
./precompute_ecmult$(EXEEXT)
|
2021-12-17 13:50:39 -05:00
|
|
|
src/precomputed_ecmult_gen.c:
|
2021-12-17 11:15:37 -05:00
|
|
|
$(MAKE) $(AM_MAKEFLAGS) precompute_ecmult_gen$(EXEEXT)
|
|
|
|
|
./precompute_ecmult_gen$(EXEEXT)
|
2015-05-19 17:32:35 -07:00
|
|
|
|
2021-12-17 14:21:38 -05:00
|
|
|
PRECOMP = src/precomputed_ecmult_gen.c src/precomputed_ecmult.c
|
2021-08-27 17:53:44 +02:00
|
|
|
precomp: $(PRECOMP)
|
2015-05-19 17:32:35 -07:00
|
|
|
|
2021-08-27 17:53:44 +02:00
|
|
|
# Ensure the prebuilt files will be build first (only if they don't exist,
|
|
|
|
|
# e.g., after `make maintainer-clean`).
|
|
|
|
|
BUILT_SOURCES = $(PRECOMP)
|
2015-07-16 00:05:32 +00:00
|
|
|
|
2023-04-14 07:45:49 +02:00
|
|
|
.PHONY: clean-precomp
|
2021-08-27 17:53:44 +02:00
|
|
|
clean-precomp:
|
|
|
|
|
rm -f $(PRECOMP)
|
2023-04-14 07:45:49 +02:00
|
|
|
maintainer-clean-local: clean-precomp
|
2015-05-19 17:32:35 -07:00
|
|
|
|
2023-04-14 07:22:01 +02:00
|
|
|
### Pregenerated test vectors
|
2023-04-14 07:37:10 +02:00
|
|
|
### (see the comments in the previous section for detailed rationale)
|
2023-04-14 07:22:01 +02:00
|
|
|
TESTVECTORS = src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.h
|
|
|
|
|
|
2024-02-03 18:52:22 -05:00
|
|
|
if ENABLE_MODULE_ECDH
|
|
|
|
|
TESTVECTORS += src/wycheproof/ecdh_secp256k1_test.h
|
|
|
|
|
endif
|
|
|
|
|
|
2023-04-14 07:22:01 +02:00
|
|
|
src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.h:
|
2023-04-14 07:54:24 +02:00
|
|
|
mkdir -p $(@D)
|
2024-02-03 18:52:22 -05:00
|
|
|
python3 $(top_srcdir)/tools/tests_wycheproof_generate_ecdsa.py $(top_srcdir)/src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.json > $@
|
|
|
|
|
|
|
|
|
|
src/wycheproof/ecdh_secp256k1_test.h:
|
|
|
|
|
mkdir -p $(@D)
|
|
|
|
|
python3 $(top_srcdir)/tools/tests_wycheproof_generate_ecdh.py $(top_srcdir)/src/wycheproof/ecdh_secp256k1_test.json > $@
|
2023-04-14 07:22:01 +02:00
|
|
|
|
|
|
|
|
testvectors: $(TESTVECTORS)
|
|
|
|
|
|
2023-04-14 07:37:10 +02:00
|
|
|
BUILT_SOURCES += $(TESTVECTORS)
|
|
|
|
|
|
2023-04-14 07:45:49 +02:00
|
|
|
.PHONY: clean-testvectors
|
2023-04-14 07:22:01 +02:00
|
|
|
clean-testvectors:
|
|
|
|
|
rm -f $(TESTVECTORS)
|
2023-04-14 07:45:49 +02:00
|
|
|
maintainer-clean-local: clean-testvectors
|
2023-04-14 07:22:01 +02:00
|
|
|
|
|
|
|
|
### Additional files to distribute
|
2022-12-12 21:20:52 +00:00
|
|
|
EXTRA_DIST = autogen.sh CHANGELOG.md SECURITY.md
|
|
|
|
|
EXTRA_DIST += doc/release-process.md doc/safegcd_implementation.md
|
2026-09-04 02:59:16 +02:00
|
|
|
EXTRA_DIST += doc/ellswift.md doc/musig.md doc/iceberg.md doc/prefractal.md
|
2026-09-01 23:38:15 +02:00
|
|
|
EXTRA_DIST += src/modules/frost/frost.md src/modules/chilldkg/chilldkg.md
|
build: wire the frost_enrollment module into both build systems
Second of six commits adding the frost_enrollment module. This one is
scaffolding only: the five entry points are stubs that validate their
pointer arguments, zero their outputs and return 0. What is being
verified here is that the module configures, compiles, links, exports
its symbols and registers its test module in both build systems -- so
that the next commit changes nothing but arithmetic.
Ordering is the one thing in this commit that can go silently wrong, and
it goes wrong in opposite directions in the two build systems:
- configure.ac executes its `if` blocks in file order, and
enable_module_frost defaults to no (configure.ac:243). A block placed
after the frost block at :601 that sets enable_module_frost=yes flips
the variable too late: AM_CONDITIONAL goes true, so the header is
installed and the Makefile fragment is pulled in, but
-DENABLE_MODULE_FROST=1 is never appended, so src/secp256k1.c never
includes frost's implementation and every secp256k1_frost_* symbol
fails to link. The new block therefore goes ahead of both the frost
block and prefractal's, which documents the same trap.
- src/CMakeLists.txt processes dependents FIRST, so the same block goes
above the FROST block there, beside prefractal's.
Verified rather than assumed: configuring with ONLY
--enable-module-frost-enrollment emits -DENABLE_MODULE_FROST=1
alongside -DENABLE_MODULE_FROST_ENROLLMENT=1, and the CMake summary
prints "frost ON" for the same configuration -- the latter is what the
PARENT_SCOPE lift buys, since the summary runs after
add_subdirectory(src) and would otherwise report a module it is
compiling in as OFF.
The dependency guard is prefractal's implies-frost idiom, copied
verbatim along with its reasoning. frost is default-OFF, so the
`test x"$enable_module_frost" = x"no"` / `DEFINED X AND NOT X` guard
every other module uses -- which reads as "the user disabled it
explicitly" for a default-ON dependency -- is true by default here and
cannot tell an explicit --disable-module-frost from the default once
both are in the cache. Enabling frost-enrollment simply implies frost,
with no error.
The one frost-module change in the whole series is in this commit:
src/modules/frost/session.h gains a declaration for
secp256k1_frost_sort_ids, which is defined at session_impl.h:517 and
declared nowhere. The params hash needs it to canonicalize identifier
order. Prefractal reaches frost's statics through translation-unit
ordering alone; rather than inherit reuse-by-link-order, this declares
the function where keygen.h:48 already declares derive_pubshare_at, so
the reuse goes through an interface. No behavior change: it is a
declaration for an existing static definition in the same TU.
CI wiring is two files, and skipping either half fails quietly:
- ci/ci.sh gets FROST_ENROLLMENT in the reproduction header's variable
list and --enable-module-frost-enrollment="$FROST_ENROLLMENT" after
the prefractal line.
- .github/workflows/ci.yml gets FROST_ENROLLMENT at every PREFRACTAL
site: the global default, 11 inline matrix entries and 10 job-level
env blocks. Without the default, ci.sh runs under set -eux with an
empty $FROST_ENROLLMENT, passes --enable-module-frost-enrollment="",
`test x"" = x"yes"` is false, and the module is off in all of CI while
ci.sh visibly has the plumbing.
Verified programmatically over the parsed workflow: across the 106
effective job contexts, PREFRACTAL and FROST_ENROLLMENT now agree in
every single one (45 set to yes, no mismatches), no context sets
FROST_ENROLLMENT without FROST or without EXPERIMENTAL, and no context
leaves it undefined. ci.sh passes sh -n.
The stub test is not a placeholder that has to be deleted later: every
entry point must reject an empty helper set and leave its output zeroed,
which is true of the stubs and stays true of the finished
implementation, so it doubles as the check that all five symbols are
reachable from the test binary.
Verification. Autotools: ./autogen.sh, then a frost-enrollment-only
configure and a full configure with frost, chilldkg, iceberg, prefractal
and frost-enrollment all on -- both build with zero warnings under the
project's -Werror-grade flag set, ./tests and ./exhaustive_tests exit 0,
and `./tests -l` lists the frost_enrollment module. CMake: configure with
-DSECP256K1_EXPERIMENTAL=ON -DSECP256K1_ENABLE_MODULE_FROST_ENROLLMENT=ON
builds clean and ctest passes 391 tests. nm shows the five new symbols
exported from libsecp256k1.so; tools/symbol-check.py could not be run
here because python3-lief is not installed in this environment, but all
five carry the required secp256k1_ prefix. make dist succeeds and the
tarball carries src/modules/frost_enrollment/frost_enrollment.md
alongside the other module documents.
One unrelated observation from this build: a stale
src/ctime_tests-ctime_tests.o left over from an earlier configure with a
different module set will fail to link, because automake does not track
CPPFLAGS changes across reconfigures. make clean between configurations
with different module sets, not a fault in this change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-04 03:53:03 +02:00
|
|
|
EXTRA_DIST += src/modules/frost_enrollment/frost_enrollment.md
|
2022-12-12 21:20:52 +00:00
|
|
|
EXTRA_DIST += examples/EXAMPLES_COPYING
|
|
|
|
|
EXTRA_DIST += sage/gen_exhaustive_groups.sage
|
|
|
|
|
EXTRA_DIST += sage/gen_split_lambda_constants.sage
|
|
|
|
|
EXTRA_DIST += sage/group_prover.sage
|
|
|
|
|
EXTRA_DIST += sage/prove_group_implementations.sage
|
|
|
|
|
EXTRA_DIST += sage/secp256k1_params.sage
|
|
|
|
|
EXTRA_DIST += sage/weierstrass_prover.sage
|
2023-04-14 07:22:01 +02:00
|
|
|
EXTRA_DIST += src/wycheproof/WYCHEPROOF_COPYING
|
|
|
|
|
EXTRA_DIST += src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.json
|
2024-02-03 18:52:22 -05:00
|
|
|
EXTRA_DIST += src/wycheproof/ecdh_secp256k1_test.json
|
|
|
|
|
EXTRA_DIST += tools/tests_wycheproof_generate_ecdsa.py
|
|
|
|
|
EXTRA_DIST += tools/tests_wycheproof_generate_ecdh.py
|
2015-06-29 15:06:28 -05:00
|
|
|
|
2023-11-26 16:44:23 +01:00
|
|
|
if ENABLE_MODULE_SCHNORRSIG_HALFAGG
|
|
|
|
|
include src/modules/schnorrsig_halfagg/Makefile.am.include
|
|
|
|
|
endif
|
|
|
|
|
|
2023-02-06 13:53:02 -08:00
|
|
|
if ENABLE_MODULE_BPPP
|
|
|
|
|
include src/modules/bppp/Makefile.am.include
|
2022-08-27 15:02:44 +00:00
|
|
|
endif
|
|
|
|
|
|
2015-06-29 15:06:28 -05:00
|
|
|
if ENABLE_MODULE_ECDH
|
|
|
|
|
include src/modules/ecdh/Makefile.am.include
|
|
|
|
|
endif
|
2015-07-24 15:44:49 +02:00
|
|
|
|
2015-08-27 03:42:57 +02:00
|
|
|
if ENABLE_MODULE_RECOVERY
|
|
|
|
|
include src/modules/recovery/Makefile.am.include
|
|
|
|
|
endif
|
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
|
|
|
|
2016-07-07 00:47:41 +02:00
|
|
|
if ENABLE_MODULE_GENERATOR
|
|
|
|
|
include src/modules/generator/Makefile.am.include
|
|
|
|
|
endif
|
|
|
|
|
|
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
|
|
|
if ENABLE_MODULE_RANGEPROOF
|
|
|
|
|
include src/modules/rangeproof/Makefile.am.include
|
|
|
|
|
endif
|
2016-04-21 22:22:39 +00:00
|
|
|
|
|
|
|
|
if ENABLE_MODULE_WHITELIST
|
|
|
|
|
include src/modules/whitelist/Makefile.am.include
|
|
|
|
|
endif
|
2016-07-01 15:51:07 +00:00
|
|
|
|
|
|
|
|
if ENABLE_MODULE_SURJECTIONPROOF
|
|
|
|
|
include src/modules/surjection/Makefile.am.include
|
|
|
|
|
endif
|
2020-11-04 21:46:54 +00:00
|
|
|
|
2020-05-12 13:58:47 +00:00
|
|
|
if ENABLE_MODULE_EXTRAKEYS
|
|
|
|
|
include src/modules/extrakeys/Makefile.am.include
|
|
|
|
|
endif
|
2020-05-12 21:19:03 +00:00
|
|
|
|
|
|
|
|
if ENABLE_MODULE_SCHNORRSIG
|
|
|
|
|
include src/modules/schnorrsig/Makefile.am.include
|
|
|
|
|
endif
|
2020-12-05 23:18:54 +00:00
|
|
|
|
2024-01-06 19:31:18 +00:00
|
|
|
if ENABLE_MODULE_MUSIG
|
|
|
|
|
include src/modules/musig/Makefile.am.include
|
|
|
|
|
endif
|
|
|
|
|
|
2022-11-04 16:18:40 -04:00
|
|
|
if ENABLE_MODULE_ELLSWIFT
|
|
|
|
|
include src/modules/ellswift/Makefile.am.include
|
|
|
|
|
endif
|
2023-07-26 15:19:08 +00:00
|
|
|
|
2020-12-05 23:18:54 +00:00
|
|
|
if ENABLE_MODULE_ECDSA_S2C
|
|
|
|
|
include src/modules/ecdsa_s2c/Makefile.am.include
|
|
|
|
|
endif
|
|
|
|
|
|
2021-03-04 23:38:48 -08:00
|
|
|
if ENABLE_MODULE_ECDSA_ADAPTOR
|
|
|
|
|
include src/modules/ecdsa_adaptor/Makefile.am.include
|
|
|
|
|
endif
|
2026-08-31 00:05:16 +02:00
|
|
|
|
|
|
|
|
if ENABLE_MODULE_FROST
|
|
|
|
|
include src/modules/frost/Makefile.am.include
|
|
|
|
|
endif
|
chilldkg: Phase 0 - module scaffolding and build wiring
Add an empty, experimental `chilldkg` module as the foundation for a
ChillDKG implementation (distributed key generation for FROST) per the
bip-frost-dkg BIP draft (v0.3.0-dev):
https://github.com/BlockstreamResearch/bip-frost-dkg
The module lives in src/modules/chilldkg/ (separate from the frost
module, per the implementation plan in .idea/docs/
chilldkg-implementation-plan.md: FROST signing (BIP 445) and ChillDKG
are separate BIPs with separate reference repos, test vectors and
review cycles; the dependency between them is one-way bytes).
New files:
- include/secp256k1_chilldkg.h: public header skeleton with the same
"EXTREMELY DANGEROUS / work in progress" warning style as
secp256k1_frost.h, plus a note that the BIP is a draft and tagged
hashes/wire formats may change. No API yet (Phase 3+).
- src/modules/chilldkg/main_impl.h: implementation skeleton including
the public header.
- src/modules/chilldkg/tests_impl.h: trivial scaffolding unit test
(chilldkg_scaffolding_test) registered via the tests_chilldkg[]
CASE1 array used by this repo's unit-test framework.
- src/modules/chilldkg/Makefile.am.include: autotools file list,
mirroring the frost module's.
- src/modules/chilldkg/chilldkg.md: module doc stub (purpose, draft
status, dependency on the schnorrsig and ecdh modules).
Build wiring (mirrors the frost module exactly):
- configure.ac: --enable-module-chilldkg (default no, experimental
gate), dependency errors when schnorrsig or ecdh are explicitly
disabled, AM_CONDITIONAL(ENABLE_MODULE_CHILLDKG), summary line.
- Makefile.am: include src/modules/chilldkg/Makefile.am.include under
ENABLE_MODULE_CHILLDKG.
- src/secp256k1.c: guarded include of modules/chilldkg/main_impl.h
after the frost module.
- src/tests.c: guarded include of tests_impl.h and
MAKE_TEST_MODULE(chilldkg) registration.
- CMakeLists.txt: SECP256K1_ENABLE_MODULE_CHILLDKG option (OFF) +
summary line.
- src/CMakeLists.txt: dependency checks on
SECP256K1_ENABLE_MODULE_SCHNORRSIG and SECP256K1_ENABLE_MODULE_ECDH,
ENABLE_MODULE_CHILLDKG=1 compile definition, public header export.
Verified:
- ./autogen.sh && ./configure --enable-experimental
--enable-module-chilldkg --enable-module-schnorrsig
--enable-module-ecdh && make check: PASS 3/3 (tests, noverify_tests,
exhaustive_tests).
- configure fails with a clear error when schnorrsig or ecdh are
disabled, or when experimental is not enabled.
- CMake build with SECP256K1_ENABLE_MODULE_CHILLDKG=ON: ctest 345/345
passed; dependency errors fire correctly when schnorrsig/ecdh OFF.
2026-08-31 01:37:22 +02:00
|
|
|
|
|
|
|
|
if ENABLE_MODULE_CHILLDKG
|
|
|
|
|
include src/modules/chilldkg/Makefile.am.include
|
|
|
|
|
endif
|
iceberg: add the Iceberg threshold-MuSig module
Port the experimental Iceberg module from the benchmark-iceberg tree
(github.com/furszy/benchmark-iceberg, sources/secp256k1-kmp/native/
secp256k1) into this repo.
Iceberg is a threshold scheme that lets a group of parties stand in
for a single MuSig2 (BIP 327) participant: the group produces one
ordinary MuSig2 public nonce and one ordinary MuSig2 partial
signature, so cosigners cannot tell a group is involved and need no
changes. Nonces are derived from a caller-chosen per-session label
(sid32) rather than stored, so no signer holds a secret nonce between
rounds; labels are public but must never be reused. A quorum of 2t-1
members (of whom up to t-1 may be corrupt) is needed in each round,
so the threshold is at most half the group rounded up; combined with
the scheme's other constraints the smallest usable group is 2-of-4.
See doc/iceberg.md and the module header for the full usage notes.
Module layout (src/modules/iceberg/, layered bottom-up, each layer
may only use the ones above it -- that ordering is also the
constant-time story):
- scalar_poly.{h,_impl.h}: secret-carrying polynomial arithmetic,
keeping secrets away from inversions (documented in the header).
- rss.{h,_impl.h}: replicated secret sharing evaluation.
- vpss.{h,_impl.h}: verifiable public shares; variable-time by
design, sees only participant indices and published points.
- keygen_impl.h: distributed key generation producing one share per
member.
- session_impl.h: nonce_gen/nonce_agg and partial_sign/
partial_sig_agg producing plain MuSig2 objects.
- tests_impl.h: 28 tests including the shipped vectors.h vector
suite and dealer known-answer tests.
- bench_impl.h: benchmark definitions (wired in a follow-up commit).
Public headers: include/secp256k1_iceberg.h (installed) and
include/secp256k1_iceberg_dealer.h (in-tree only: a trusted dealer is
not part of the shipped API, but tests, benchmarks and the example
need to deal shares).
Content adaptations relative to the source tree (the only changes to
the ported code): three secp256k1_musig_nonce_process call sites in
tests_impl.h gained a NULL adaptor argument, because this repo's
musig is the zkp variant whose public nonce_process takes an optional
adaptor point. All musig internals the module uses (ge_parse_ext,
ge_serialize_ext, keyaggcoef, aggnonce_load, pubnonce_save,
partial_sig_save, nonce_process_internal) are identical in both
trees, as are all core headers the module touches; nothing else
needed adaptation.
Build wiring mirrors the chilldkg module:
- configure.ac: --enable-module-iceberg (default no, experimental
gate), hard dependency on the musig module with a configure error
if musig is explicitly disabled (musig itself pulls in schnorrsig),
AM_CONDITIONAL(ENABLE_MODULE_ICEBERG), summary line.
- Makefile.am: include src/modules/iceberg/Makefile.am.include under
the conditional.
- src/secp256k1.c: guarded include of modules/iceberg/main_impl.h
after the chilldkg block (musig is included earlier, so its
internals are in scope).
- src/tests.c: module test registration via MAKE_TEST_MODULE(iceberg).
- CMakeLists.txt / src/CMakeLists.txt: SECP256K1_ENABLE_MODULE_ICEBERG
option (OFF) with a dependency check on SECP256K1_ENABLE_MODULE_MUSIG
(placed before the musig block so the force-enable takes effect),
ENABLE_MODULE_ICEBERG=1 compile definition, public header export,
summary line.
Verified: ./configure --enable-experimental --enable-module-iceberg
&& make check passes; ./tests --target=iceberg runs the full module
suite (28/28); CMake build + ctest pass; the musig dependency error
fires correctly in both build systems.
2026-08-31 12:24:48 +02:00
|
|
|
|
prefractal: add the nested FROST+MuSig2 module (API, implementation, wiring)
Adds `prefractal`, an experimental module that lets a FROST t-of-n group
occupy ONE participant slot of an ordinary MuSig2 (BIP 327) session. Each
member computes
s_i = k1_i + b_frost*b_musig*k2_i + e*a*lambda_i*g*gacc*d_i
and the group publishes one ordinary MuSig2 public nonce and one ordinary
MuSig2 partial signature, so cosigners need no support for it and cannot tell
a group is involved.
Four public functions, all sessionless (every call takes its session
parameters explicitly, so there are no new opaque types, magics or *_SIZE
constants to keep synchronised):
secp256k1_prefractal_nonce_agg group wire nonce + unscaled aggnonce
secp256k1_prefractal_sign one member's partial signature
secp256k1_prefractal_partial_sig_verify identifiable abort
secp256k1_prefractal_partial_sig_agg sum -> musig partial signature
Three deliberate deviations from BIP 445, all documented in the public header:
1. b_frost does not commit to the message. The target protocols publish the
group's wire nonce before the message exists, so a message-committing
coefficient could not be computed in round one and rebuilt later. The outer
b_musig does commit to the message and multiplies this one, so the product
still binds it. Same trade the iceberg module makes, for the same reason.
The preimage is BIP 445's with the message dropped and the group key
carried in full rather than x-only, since it is used as a full point
downstream.
2. There is NO g_frost factor. Stock FROST normalises its threshold key to
even Y (g_times_gacc_parity = gacc_parity ^ pk_odd, frost/session_impl.h
:664) because it produces a BIP 340 x-only signature. Here the threshold
key is an inner participant of the outer key aggregation and is used as a
full point, so all key-side parity normalisation happens once, at the
aggregate level, off the OUTER keyagg cache. Note this is NOT implied by
the tweak cache being the identity: with an identity cache g_frost is still
-1 for every odd-Y group key, i.e. about half of them. Importing frost's
key-side parity here would yield a signer that works for even-Y groups and
fails for odd-Y ones.
3. The FROST tweak cache must be the identity (tacc == 0, gacc_parity == 0).
Checked in sign and partial_sig_verify, not only in partial_sig_agg, so the
key a member signs under is tied to the cache that was validated; sign and
verify additionally require thresh_pk to equal the cache's own key so the
two arguments cannot disagree.
The verification equation lives in one helper used both by sign's BIP 445
self-check and by partial_sig_verify, so the two cannot drift apart.
Build wiring. Three files order their module blocks differently and the
constraints point in opposite directions:
- src/secp256k1.c: the include goes AFTER frost and musig, because the
module calls their static internals.
- src/CMakeLists.txt: the block goes BEFORE both, because its set() calls
are only observed by blocks that run later.
- configure.ac: the block likewise goes before the musig block, NOT at
iceberg's position further down. configure.ac orders musig and frost ahead
of iceberg, and iceberg's late enable_module_musig=yes is harmless only
because musig defaults to yes. frost defaults to no, so a late
force-enable would leave -DENABLE_MODULE_FROST=1 unemitted while
AM_CONDITIONAL still observed the mutation - a library whose secp256k1.c
never included frost, built alongside frost's own sources.
frost is also the first default-OFF module anything depends on, which breaks
the dependency-guard idiom used everywhere else in both build systems: the
existing "DEFINED X AND NOT X" (CMake) and "x$X = xno" (autotools) tests read
as "the user disabled it explicitly" only for default-ON modules, and are true
by default for a default-OFF one. Since neither build system can distinguish
an explicit disable from the default once both are in the cache, enabling
prefractal simply implies frost; the guard is kept for musig, where it still
means what it says. The CMake block additionally lifts both dependencies into
the parent scope so the top-level configuration summary reports what was
actually built rather than printing "frost OFF" while compiling frost in.
Verified on both build systems:
cmake -B build -DSECP256K1_ENABLE_MODULE_PREFRACTAL=ON -DSECP256K1_BUILD_TESTS=ON
-> musig/frost/prefractal all ON, tests pass, 4 prefractal symbols exported
cmake -B build -DSECP256K1_BUILD_TESTS=ON
-> prefractal OFF, default build unchanged, tests pass
./configure --enable-experimental --enable-module-prefractal && make && make check
-> frost=yes forced on, -DENABLE_MODULE_FROST=1 emitted, 3/3 pass
./configure --enable-module-prefractal
-> correctly refused: "Prefractal module is experimental"
tests_impl.h is a placeholder here so the module links; the real suite lands
next.
2026-09-04 00:44:43 +02:00
|
|
|
if ENABLE_MODULE_PREFRACTAL
|
|
|
|
|
include src/modules/prefractal/Makefile.am.include
|
|
|
|
|
endif
|
|
|
|
|
|
build: wire the frost_enrollment module into both build systems
Second of six commits adding the frost_enrollment module. This one is
scaffolding only: the five entry points are stubs that validate their
pointer arguments, zero their outputs and return 0. What is being
verified here is that the module configures, compiles, links, exports
its symbols and registers its test module in both build systems -- so
that the next commit changes nothing but arithmetic.
Ordering is the one thing in this commit that can go silently wrong, and
it goes wrong in opposite directions in the two build systems:
- configure.ac executes its `if` blocks in file order, and
enable_module_frost defaults to no (configure.ac:243). A block placed
after the frost block at :601 that sets enable_module_frost=yes flips
the variable too late: AM_CONDITIONAL goes true, so the header is
installed and the Makefile fragment is pulled in, but
-DENABLE_MODULE_FROST=1 is never appended, so src/secp256k1.c never
includes frost's implementation and every secp256k1_frost_* symbol
fails to link. The new block therefore goes ahead of both the frost
block and prefractal's, which documents the same trap.
- src/CMakeLists.txt processes dependents FIRST, so the same block goes
above the FROST block there, beside prefractal's.
Verified rather than assumed: configuring with ONLY
--enable-module-frost-enrollment emits -DENABLE_MODULE_FROST=1
alongside -DENABLE_MODULE_FROST_ENROLLMENT=1, and the CMake summary
prints "frost ON" for the same configuration -- the latter is what the
PARENT_SCOPE lift buys, since the summary runs after
add_subdirectory(src) and would otherwise report a module it is
compiling in as OFF.
The dependency guard is prefractal's implies-frost idiom, copied
verbatim along with its reasoning. frost is default-OFF, so the
`test x"$enable_module_frost" = x"no"` / `DEFINED X AND NOT X` guard
every other module uses -- which reads as "the user disabled it
explicitly" for a default-ON dependency -- is true by default here and
cannot tell an explicit --disable-module-frost from the default once
both are in the cache. Enabling frost-enrollment simply implies frost,
with no error.
The one frost-module change in the whole series is in this commit:
src/modules/frost/session.h gains a declaration for
secp256k1_frost_sort_ids, which is defined at session_impl.h:517 and
declared nowhere. The params hash needs it to canonicalize identifier
order. Prefractal reaches frost's statics through translation-unit
ordering alone; rather than inherit reuse-by-link-order, this declares
the function where keygen.h:48 already declares derive_pubshare_at, so
the reuse goes through an interface. No behavior change: it is a
declaration for an existing static definition in the same TU.
CI wiring is two files, and skipping either half fails quietly:
- ci/ci.sh gets FROST_ENROLLMENT in the reproduction header's variable
list and --enable-module-frost-enrollment="$FROST_ENROLLMENT" after
the prefractal line.
- .github/workflows/ci.yml gets FROST_ENROLLMENT at every PREFRACTAL
site: the global default, 11 inline matrix entries and 10 job-level
env blocks. Without the default, ci.sh runs under set -eux with an
empty $FROST_ENROLLMENT, passes --enable-module-frost-enrollment="",
`test x"" = x"yes"` is false, and the module is off in all of CI while
ci.sh visibly has the plumbing.
Verified programmatically over the parsed workflow: across the 106
effective job contexts, PREFRACTAL and FROST_ENROLLMENT now agree in
every single one (45 set to yes, no mismatches), no context sets
FROST_ENROLLMENT without FROST or without EXPERIMENTAL, and no context
leaves it undefined. ci.sh passes sh -n.
The stub test is not a placeholder that has to be deleted later: every
entry point must reject an empty helper set and leave its output zeroed,
which is true of the stubs and stays true of the finished
implementation, so it doubles as the check that all five symbols are
reachable from the test binary.
Verification. Autotools: ./autogen.sh, then a frost-enrollment-only
configure and a full configure with frost, chilldkg, iceberg, prefractal
and frost-enrollment all on -- both build with zero warnings under the
project's -Werror-grade flag set, ./tests and ./exhaustive_tests exit 0,
and `./tests -l` lists the frost_enrollment module. CMake: configure with
-DSECP256K1_EXPERIMENTAL=ON -DSECP256K1_ENABLE_MODULE_FROST_ENROLLMENT=ON
builds clean and ctest passes 391 tests. nm shows the five new symbols
exported from libsecp256k1.so; tools/symbol-check.py could not be run
here because python3-lief is not installed in this environment, but all
five carry the required secp256k1_ prefix. make dist succeeds and the
tarball carries src/modules/frost_enrollment/frost_enrollment.md
alongside the other module documents.
One unrelated observation from this build: a stale
src/ctime_tests-ctime_tests.o left over from an earlier configure with a
different module set will fail to link, because automake does not track
CPPFLAGS changes across reconfigures. make clean between configurations
with different module sets, not a fault in this change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-04 03:53:03 +02:00
|
|
|
if ENABLE_MODULE_FROST_ENROLLMENT
|
|
|
|
|
include src/modules/frost_enrollment/Makefile.am.include
|
|
|
|
|
endif
|
|
|
|
|
|
iceberg: add the Iceberg threshold-MuSig module
Port the experimental Iceberg module from the benchmark-iceberg tree
(github.com/furszy/benchmark-iceberg, sources/secp256k1-kmp/native/
secp256k1) into this repo.
Iceberg is a threshold scheme that lets a group of parties stand in
for a single MuSig2 (BIP 327) participant: the group produces one
ordinary MuSig2 public nonce and one ordinary MuSig2 partial
signature, so cosigners cannot tell a group is involved and need no
changes. Nonces are derived from a caller-chosen per-session label
(sid32) rather than stored, so no signer holds a secret nonce between
rounds; labels are public but must never be reused. A quorum of 2t-1
members (of whom up to t-1 may be corrupt) is needed in each round,
so the threshold is at most half the group rounded up; combined with
the scheme's other constraints the smallest usable group is 2-of-4.
See doc/iceberg.md and the module header for the full usage notes.
Module layout (src/modules/iceberg/, layered bottom-up, each layer
may only use the ones above it -- that ordering is also the
constant-time story):
- scalar_poly.{h,_impl.h}: secret-carrying polynomial arithmetic,
keeping secrets away from inversions (documented in the header).
- rss.{h,_impl.h}: replicated secret sharing evaluation.
- vpss.{h,_impl.h}: verifiable public shares; variable-time by
design, sees only participant indices and published points.
- keygen_impl.h: distributed key generation producing one share per
member.
- session_impl.h: nonce_gen/nonce_agg and partial_sign/
partial_sig_agg producing plain MuSig2 objects.
- tests_impl.h: 28 tests including the shipped vectors.h vector
suite and dealer known-answer tests.
- bench_impl.h: benchmark definitions (wired in a follow-up commit).
Public headers: include/secp256k1_iceberg.h (installed) and
include/secp256k1_iceberg_dealer.h (in-tree only: a trusted dealer is
not part of the shipped API, but tests, benchmarks and the example
need to deal shares).
Content adaptations relative to the source tree (the only changes to
the ported code): three secp256k1_musig_nonce_process call sites in
tests_impl.h gained a NULL adaptor argument, because this repo's
musig is the zkp variant whose public nonce_process takes an optional
adaptor point. All musig internals the module uses (ge_parse_ext,
ge_serialize_ext, keyaggcoef, aggnonce_load, pubnonce_save,
partial_sig_save, nonce_process_internal) are identical in both
trees, as are all core headers the module touches; nothing else
needed adaptation.
Build wiring mirrors the chilldkg module:
- configure.ac: --enable-module-iceberg (default no, experimental
gate), hard dependency on the musig module with a configure error
if musig is explicitly disabled (musig itself pulls in schnorrsig),
AM_CONDITIONAL(ENABLE_MODULE_ICEBERG), summary line.
- Makefile.am: include src/modules/iceberg/Makefile.am.include under
the conditional.
- src/secp256k1.c: guarded include of modules/iceberg/main_impl.h
after the chilldkg block (musig is included earlier, so its
internals are in scope).
- src/tests.c: module test registration via MAKE_TEST_MODULE(iceberg).
- CMakeLists.txt / src/CMakeLists.txt: SECP256K1_ENABLE_MODULE_ICEBERG
option (OFF) with a dependency check on SECP256K1_ENABLE_MODULE_MUSIG
(placed before the musig block so the force-enable takes effect),
ENABLE_MODULE_ICEBERG=1 compile definition, public header export,
summary line.
Verified: ./configure --enable-experimental --enable-module-iceberg
&& make check passes; ./tests --target=iceberg runs the full module
suite (28/28); CMake build + ctest pass; the musig dependency error
fires correctly in both build systems.
2026-08-31 12:24:48 +02:00
|
|
|
if ENABLE_MODULE_ICEBERG
|
|
|
|
|
include src/modules/iceberg/Makefile.am.include
|
|
|
|
|
endif
|
