From baac08d207003151d095423487d3954503a52aeb Mon Sep 17 00:00:00 2001
From: DarkWindman <mazylia6@gmail.com>
Date: Thu, 2 Apr 2026 18:03:37 +0300
Subject: [PATCH] modules, tests: Port bitcoin-core/secp256k1#1777 and
 bitcoin-core/secp256k1#1824 to zkp-specific code

---
 src/bench_whitelist.c                       |  6 ++-
 src/eccommit.h                              |  2 +-
 src/eccommit_impl.h                         | 20 ++++----
 src/modules/bppp/bppp_norm_product_impl.h   | 10 ++--
 src/modules/bppp/bppp_transcript_impl.h     |  6 +--
 src/modules/bppp/main_impl.h                |  5 +-
 src/modules/bppp/tests_impl.h               | 34 +++++++-------
 src/modules/ecdsa_adaptor/dleq_impl.h       | 35 +++++++-------
 src/modules/ecdsa_adaptor/main_impl.h       | 33 +++++++++----
 src/modules/ecdsa_adaptor/tests_impl.h      | 29 ++++++------
 src/modules/ecdsa_s2c/main_impl.h           | 13 ++++--
 src/modules/ecdsa_s2c/tests_impl.h          | 17 +++----
 src/modules/generator/main_impl.h           | 13 +++---
 src/modules/musig/session_impl.h            | 12 -----
 src/modules/rangeproof/borromean.h          |  4 +-
 src/modules/rangeproof/borromean_impl.h     | 38 +++++++--------
 src/modules/rangeproof/main_impl.h          |  9 ++--
 src/modules/rangeproof/rangeproof_impl.h    | 52 ++++++++++-----------
 src/modules/rangeproof/tests_impl.h         |  9 ++--
 src/modules/schnorrsig_halfagg/main_impl.h  | 26 ++++++-----
 src/modules/schnorrsig_halfagg/tests_impl.h |  3 +-
 src/modules/surjection/main_impl.h          | 21 +++++----
 src/modules/surjection/surjection_impl.h    | 14 +++---
 src/modules/surjection/tests_impl.h         | 13 +++---
 src/modules/whitelist/main_impl.h           |  6 ++-
 src/modules/whitelist/whitelist_impl.h      | 24 +++++-----
 src/secp256k1.c                             |  7 +--
 src/tests.c                                 | 22 +++++----
 28 files changed, 259 insertions(+), 224 deletions(-)

diff --git a/src/bench_whitelist.c b/src/bench_whitelist.c
index 46de7d5a..ecaa77b3 100644
--- a/src/bench_whitelist.c
+++ b/src/bench_whitelist.c
@@ -51,15 +51,17 @@ static void run_test(bench_data* data, int iters) {
 
 static void generate_scalar(secp256k1_scalar *scalar, unsigned char *seckey, uint32_t num) {
     secp256k1_sha256 sha256;
+    secp256k1_hash_ctx hash_ctx;
     unsigned char c[13] = {'w','h','i','t','e','l','i','s','t', 0, 0, 0, 0};
     int is_valid;
+    secp256k1_hash_ctx_init(&hash_ctx);
     c[9] = num;
     c[10] = num >> 8;
     c[11] = num >> 16;
     c[12] = num >> 24;
     secp256k1_sha256_initialize(&sha256);
-    secp256k1_sha256_write(&sha256, c, sizeof(c));
-    secp256k1_sha256_finalize(&sha256, seckey);
+    secp256k1_sha256_write(&hash_ctx, &sha256, c, sizeof(c));
+    secp256k1_sha256_finalize(&hash_ctx, &sha256, seckey);
     is_valid = secp256k1_scalar_set_b32_seckey(scalar, seckey);
     CHECK(is_valid);
 }
diff --git a/src/eccommit.h b/src/eccommit.h
index 6bb11039..4932ad1c 100644
--- a/src/eccommit.h
+++ b/src/eccommit.h
@@ -17,7 +17,7 @@ static int secp256k1_ec_pubkey_tweak_add_helper(const secp256k1_ecmult_context*
  *  pubp->infinity before calling this function. */
 static int secp256k1_ec_commit_pubkey_serialize_const(secp256k1_ge *pubp, unsigned char *buf33);
 /** Compute an ec commitment tweak as hash(pubkey, data). */
-static int secp256k1_ec_commit_tweak(unsigned char *tweak32, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size);
+static int secp256k1_ec_commit_tweak(const secp256k1_hash_ctx *hash_ctx, unsigned char *tweak32, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size);
 /** Compute an ec commitment as pubkey + hash(pubkey, data)*G. */
 static int secp256k1_ec_commit(const secp256k1_ecmult_context* ecmult_ctx, secp256k1_ge* commitp, const secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size);
 /** Compute a secret key commitment as seckey + hash(pubkey, data). */
diff --git a/src/eccommit_impl.h b/src/eccommit_impl.h
index 2dc24257..8f273bc5 100644
--- a/src/eccommit_impl.h
+++ b/src/eccommit_impl.h
@@ -25,42 +25,42 @@ static int secp256k1_ec_commit_pubkey_serialize_const(secp256k1_ge *pubp, unsign
 }
 
 /* Compute an ec commitment tweak as hash(pubp, data). */
-static int secp256k1_ec_commit_tweak(unsigned char *tweak32, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size)
+static int secp256k1_ec_commit_tweak(const secp256k1_hash_ctx *hash_ctx, unsigned char *tweak32, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size)
 {
     unsigned char rbuf[33];
 
     if (!secp256k1_ec_commit_pubkey_serialize_const(pubp, rbuf)) {
         return 0;
     }
-    secp256k1_sha256_write(sha, rbuf, sizeof(rbuf));
-    secp256k1_sha256_write(sha, data, data_size);
-    secp256k1_sha256_finalize(sha, tweak32);
+    secp256k1_sha256_write(hash_ctx, sha, rbuf, sizeof(rbuf));
+    secp256k1_sha256_write(hash_ctx, sha, data, data_size);
+    secp256k1_sha256_finalize(hash_ctx, sha, tweak32);
     return 1;
 }
 
 /* Compute an ec commitment as pubp + hash(pubp, data)*G. */
-static int secp256k1_ec_commit(secp256k1_ge* commitp, const secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size) {
+static int secp256k1_ec_commit(const secp256k1_hash_ctx *hash_ctx, secp256k1_ge* commitp, const secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size) {
     unsigned char tweak[32];
 
     *commitp = *pubp;
-    return secp256k1_ec_commit_tweak(tweak, commitp, sha, data, data_size)
+    return secp256k1_ec_commit_tweak(hash_ctx, tweak, commitp, sha, data, data_size)
            && secp256k1_ec_pubkey_tweak_add_helper(commitp, tweak);
 }
 
 /* Compute the seckey of an ec commitment from the original secret key of the pubkey as seckey +
  * hash(pubp, data). */
-static int secp256k1_ec_commit_seckey(secp256k1_scalar* seckey, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size) {
+static int secp256k1_ec_commit_seckey(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar* seckey, secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size) {
     unsigned char tweak[32];
-    return secp256k1_ec_commit_tweak(tweak, pubp, sha, data, data_size)
+    return secp256k1_ec_commit_tweak(hash_ctx, tweak, pubp, sha, data, data_size)
            && secp256k1_ec_seckey_tweak_add_helper(seckey, tweak);
 }
 
 /* Verify an ec commitment as pubp + hash(pubp, data)*G ?= commitment. */
-static int secp256k1_ec_commit_verify(const secp256k1_ge* commitp, const secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size) {
+static int secp256k1_ec_commit_verify(const secp256k1_hash_ctx *hash_ctx, const secp256k1_ge* commitp, const secp256k1_ge* pubp, secp256k1_sha256* sha, const unsigned char *data, size_t data_size) {
     secp256k1_gej pj;
     secp256k1_ge p;
 
-    if (!secp256k1_ec_commit(&p, pubp, sha, data, data_size)) {
+    if (!secp256k1_ec_commit(hash_ctx, &p, pubp, sha, data, data_size)) {
         return 0;
     }
 
diff --git a/src/modules/bppp/bppp_norm_product_impl.h b/src/modules/bppp/bppp_norm_product_impl.h
index daf7b0da..0abd3cd4 100644
--- a/src/modules/bppp/bppp_norm_product_impl.h
+++ b/src/modules/bppp/bppp_norm_product_impl.h
@@ -236,6 +236,7 @@ static int secp256k1_bppp_rangeproof_norm_product_prove(
     secp256k1_scalar* c_vec,
     size_t c_vec_len
 ) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_scalar mu_f, rho_f = *rho;
     size_t proof_idx = 0;
     ecmult_x_cb_data x_cb_data;
@@ -316,8 +317,8 @@ static int secp256k1_bppp_rangeproof_norm_product_prove(
         proof_idx += 65;
 
         /* Obtain challenge gamma for the the next round */
-        secp256k1_sha256_write(transcript, &proof[proof_idx - 65], 65);
-        secp256k1_bppp_challenge_scalar(&gamma, transcript, 0);
+        secp256k1_sha256_write(hash_ctx, transcript, &proof[proof_idx - 65], 65);
+        secp256k1_bppp_challenge_scalar(hash_ctx, &gamma, transcript, 0);
 
         if (g_len > 1) {
             for (i = 0; i < g_len; i = i + 2) {
@@ -434,6 +435,7 @@ static int secp256k1_bppp_rangeproof_norm_product_verify(
     size_t c_vec_len,
     const secp256k1_ge* commit
 ) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_scalar rho_f, mu_f, v, n, l, rho_inv, h_c;
     secp256k1_scalar *gammas, *s_g, *s_h, *rho_inv_pows;
     secp256k1_gej res1, res2;
@@ -487,8 +489,8 @@ static int secp256k1_bppp_rangeproof_norm_product_verify(
 
     for (i = 0; i < n_rounds; i++) {
         secp256k1_scalar gamma;
-        secp256k1_sha256_write(transcript, &proof[i * 65], 65);
-        secp256k1_bppp_challenge_scalar(&gamma, transcript, 0);
+        secp256k1_sha256_write(hash_ctx, transcript, &proof[i * 65], 65);
+        secp256k1_bppp_challenge_scalar(hash_ctx, &gamma, transcript, 0);
         gammas[i] = gamma;
     }
     /* s_g[0] = n * \prod_{j=0}^{log_g_len - 1} rho^(2^j)
diff --git a/src/modules/bppp/bppp_transcript_impl.h b/src/modules/bppp/bppp_transcript_impl.h
index 5e212231..53b86c5d 100644
--- a/src/modules/bppp/bppp_transcript_impl.h
+++ b/src/modules/bppp/bppp_transcript_impl.h
@@ -22,12 +22,12 @@ static void secp256k1_bppp_sha256_tagged_commitment_init(secp256k1_sha256 *sha)
 }
 
 /* Obtain a challenge scalar from the current transcript.*/
-static void secp256k1_bppp_challenge_scalar(secp256k1_scalar* ch, const secp256k1_sha256 *transcript, uint64_t idx) {
+static void secp256k1_bppp_challenge_scalar(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar* ch, const secp256k1_sha256 *transcript, uint64_t idx) {
     unsigned char buf[32];
     secp256k1_sha256 sha = *transcript;
     secp256k1_bppp_le64(buf, idx);
-    secp256k1_sha256_write(&sha, buf, 8);
-    secp256k1_sha256_finalize(&sha, buf);
+    secp256k1_sha256_write(hash_ctx, &sha, buf, 8);
+    secp256k1_sha256_finalize(hash_ctx, &sha, buf);
     secp256k1_sha256_clear(&sha);
     secp256k1_scalar_set_b32(ch, buf, NULL);
 }
diff --git a/src/modules/bppp/main_impl.h b/src/modules/bppp/main_impl.h
index e8e9e30a..8c4d1eab 100644
--- a/src/modules/bppp/main_impl.h
+++ b/src/modules/bppp/main_impl.h
@@ -18,6 +18,7 @@
 secp256k1_bppp_generators *secp256k1_bppp_generators_create(const secp256k1_context *ctx, size_t n) {
     secp256k1_bppp_generators *ret;
     secp256k1_rfc6979_hmac_sha256 rng;
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     unsigned char seed[64];
     size_t i;
 
@@ -37,11 +38,11 @@ secp256k1_bppp_generators *secp256k1_bppp_generators_create(const secp256k1_cont
     secp256k1_fe_get_b32(&seed[0], &secp256k1_ge_const_g.x);
     secp256k1_fe_get_b32(&seed[32], &secp256k1_ge_const_g.y);
 
-    secp256k1_rfc6979_hmac_sha256_initialize(&rng, seed, 64);
+    secp256k1_rfc6979_hmac_sha256_initialize(hash_ctx, &rng, seed, 64);
     for (i = 0; i < n; i++) {
         secp256k1_generator gen;
         unsigned char tmp[32] = { 0 };
-        secp256k1_rfc6979_hmac_sha256_generate(&rng, tmp, 32);
+        secp256k1_rfc6979_hmac_sha256_generate(hash_ctx, &rng, tmp, 32);
         CHECK(secp256k1_generator_generate(ctx, &gen, tmp));
         secp256k1_generator_load(&ret->gens[i], &gen);
     }
diff --git a/src/modules/bppp/tests_impl.h b/src/modules/bppp/tests_impl.h
index dda9a8c0..47a00c6d 100644
--- a/src/modules/bppp/tests_impl.h
+++ b/src/modules/bppp/tests_impl.h
@@ -104,6 +104,7 @@ static void test_bppp_generators_fixed(void) {
 }
 
 static void test_bppp_tagged_hash(void) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     unsigned char tag_data[] = {'B', 'u', 'l', 'l', 'e', 't', 'p', 'r', 'o', 'o', 'f', 's', '_', 'p', 'p', '/', 'v', '0', '/', 'c', 'o', 'm', 'm', 'i', 't', 'm', 'e', 'n', 't'};
     secp256k1_sha256 sha;
     secp256k1_sha256 sha_cached;
@@ -111,10 +112,10 @@ static void test_bppp_tagged_hash(void) {
     unsigned char output_cached[32];
     secp256k1_scalar s;
 
-    secp256k1_sha256_initialize_tagged(&sha, tag_data, sizeof(tag_data));
+    secp256k1_sha256_initialize_tagged(hash_ctx, &sha, tag_data, sizeof(tag_data));
     secp256k1_bppp_sha256_tagged_commitment_init(&sha_cached);
-    secp256k1_sha256_finalize(&sha, output);
-    secp256k1_sha256_finalize(&sha_cached, output_cached);
+    secp256k1_sha256_finalize(hash_ctx, &sha, output);
+    secp256k1_sha256_finalize(hash_ctx, &sha_cached, output_cached);
     CHECK(secp256k1_memcmp_var(output, output_cached, 32) == 0);
 
     {
@@ -123,7 +124,7 @@ static void test_bppp_tagged_hash(void) {
                                        0x8A, 0x41, 0xC6, 0x85, 0x1A, 0x79, 0x14, 0xFC,
                                        0x48, 0x15, 0xC7, 0x2D, 0xF8, 0x63, 0x8F, 0x1B };
         secp256k1_bppp_sha256_tagged_commitment_init(&sha);
-        secp256k1_bppp_challenge_scalar(&s, &sha, 0);
+        secp256k1_bppp_challenge_scalar(hash_ctx, &s, &sha, 0);
         secp256k1_scalar_get_b32(output, &s);
         CHECK(secp256k1_memcmp_var(output, expected, sizeof(output)) == 0);
     }
@@ -134,8 +135,8 @@ static void test_bppp_tagged_hash(void) {
                                        0x72, 0x7E, 0x3E, 0xB7, 0x10, 0x03, 0xF0, 0xE9,
                                        0x69, 0x4D, 0xAA, 0x96, 0xCE, 0x98, 0xBB, 0x39,
                                        0x1C, 0x2F, 0x7C, 0x2E, 0x1C, 0x17, 0x78, 0x6D };
-        secp256k1_sha256_write(&sha, tmp, sizeof(tmp));
-        secp256k1_bppp_challenge_scalar(&s, &sha, 0);
+        secp256k1_sha256_write(hash_ctx, &sha, tmp, sizeof(tmp));
+        secp256k1_bppp_challenge_scalar(hash_ctx, &s, &sha, 0);
         secp256k1_scalar_get_b32(output, &s);
         CHECK(secp256k1_memcmp_var(output, expected, sizeof(output)) == 0);
     }
@@ -279,6 +280,7 @@ static void secp256k1_norm_arg_commit_initial_data(
     const secp256k1_ge* commit
 ) {
     /* Commit to the initial public values */
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     unsigned char ser_commit[33], ser_scalar[32], ser_le64[8];
     size_t i;
     secp256k1_ge comm = *commit;
@@ -287,24 +289,24 @@ static void secp256k1_norm_arg_commit_initial_data(
     secp256k1_fe_normalize(&comm.y);
     CHECK(secp256k1_ge_is_infinity(&comm) == 0);
     CHECK(secp256k1_bppp_serialize_pt(&ser_commit[0], &comm));
-    secp256k1_sha256_write(transcript, ser_commit, 33);
+    secp256k1_sha256_write(hash_ctx, transcript, ser_commit, 33);
     secp256k1_scalar_get_b32(ser_scalar, rho);
-    secp256k1_sha256_write(transcript, ser_scalar, 32);
+    secp256k1_sha256_write(hash_ctx, transcript, ser_scalar, 32);
     secp256k1_bppp_le64(ser_le64, g_len);
-    secp256k1_sha256_write(transcript, ser_le64, 8);
+    secp256k1_sha256_write(hash_ctx, transcript, ser_le64, 8);
     secp256k1_bppp_le64(ser_le64, gens_vec->n);
-    secp256k1_sha256_write(transcript, ser_le64, 8);
+    secp256k1_sha256_write(hash_ctx, transcript, ser_le64, 8);
     for (i = 0; i < gens_vec->n; i++) {
         secp256k1_fe_normalize(&gens_vec->gens[i].x);
         secp256k1_fe_normalize(&gens_vec->gens[i].y);
         CHECK(secp256k1_bppp_serialize_pt(&ser_commit[0], &gens_vec->gens[i]));
-        secp256k1_sha256_write(transcript, ser_commit, 33);
+        secp256k1_sha256_write(hash_ctx, transcript, ser_commit, 33);
     }
     secp256k1_bppp_le64(ser_le64, c_vec_len);
-    secp256k1_sha256_write(transcript, ser_le64, 8);
+    secp256k1_sha256_write(hash_ctx, transcript, ser_le64, 8);
     for (i = 0; i < c_vec_len; i++) {
         secp256k1_scalar_get_b32(ser_scalar, &c_vec[i]);
-        secp256k1_sha256_write(transcript, ser_scalar, 32);
+        secp256k1_sha256_write(hash_ctx, transcript, ser_scalar, 32);
     }
 }
 
@@ -561,7 +563,7 @@ int norm_arg_verify_vectors_helper(secp256k1_scratch *scratch, const unsigned ch
     return ret;
 }
 
-#define IDX_TO_TEST(i) (norm_arg_verify_vectors_helper(scratch, verify_vector_gens, verify_vector_##i##_proof, sizeof(verify_vector_##i##_proof), verify_vector_##i##_r32, verify_vector_##i##_n_vec_len, verify_vector_##i##_c_vec32, verify_vector_##i##_c_vec, sizeof(verify_vector_##i##_c_vec)/sizeof(secp256k1_scalar), verify_vector_##i##_commit33) == verify_vector_##i##_result)
+#define IDX_TO_TEST(i) (norm_arg_verify_vectors_helper(scratch, verify_vector_gens, verify_vector_##i##_proof, sizeof(verify_vector_##i##_proof), verify_vector_##i##_r32, verify_vector_##i##_n_vec_len, verify_vector_##i##_c_vec32, verify_vector_##i##_c_vec, ARRAY_SIZE(verify_vector_##i##_c_vec), verify_vector_##i##_commit33) == verify_vector_##i##_result)
 
 static void norm_arg_verify_vectors(void) {
     secp256k1_scratch *scratch = secp256k1_scratch_space_create(CTX, 1000*1000); /* shouldn't need much */
@@ -629,9 +631,9 @@ static void norm_arg_prove_vectors_helper(secp256k1_scratch *scratch, const unsi
 
 
 #define IDX_TO_TEST(i) (norm_arg_prove_vectors_helper(scratch, prove_vector_gens, prove_vector_##i##_proof, sizeof(prove_vector_##i##_proof), prove_vector_##i##_r32,\
-    prove_vector_##i##_n_vec32, prove_vector_##i##_n_vec, sizeof(prove_vector_##i##_n_vec)/sizeof(secp256k1_scalar),\
+    prove_vector_##i##_n_vec32, prove_vector_##i##_n_vec, ARRAY_SIZE(prove_vector_##i##_n_vec),\
     prove_vector_##i##_l_vec32, prove_vector_##i##_l_vec,\
-    prove_vector_##i##_c_vec32, prove_vector_##i##_c_vec, sizeof(prove_vector_##i##_c_vec)/sizeof(secp256k1_scalar), \
+    prove_vector_##i##_c_vec32, prove_vector_##i##_c_vec, ARRAY_SIZE(prove_vector_##i##_c_vec), \
     prove_vector_##i##_result))
 
 static void norm_arg_prove_vectors(void) {
diff --git a/src/modules/ecdsa_adaptor/dleq_impl.h b/src/modules/ecdsa_adaptor/dleq_impl.h
index a117d69d..b05c0b18 100644
--- a/src/modules/ecdsa_adaptor/dleq_impl.h
+++ b/src/modules/ecdsa_adaptor/dleq_impl.h
@@ -24,14 +24,14 @@ static void secp256k1_nonce_function_dleq_sha256_tagged(secp256k1_sha256 *sha) {
 /* algo argument for nonce_function_ecdsa_adaptor to derive the nonce using a tagged hash function. */
 static const unsigned char dleq_algo[] = {'D','L','E','Q'};
 
-static void secp256k1_dleq_hash_point(secp256k1_sha256 *sha, secp256k1_ge *p) {
+static void secp256k1_dleq_hash_point(const secp256k1_hash_ctx *hash_ctx, secp256k1_sha256 *sha, secp256k1_ge *p) {
     unsigned char buf[33];
 
     secp256k1_eckey_pubkey_serialize33(p, buf);
-    secp256k1_sha256_write(sha, buf, 33);
+    secp256k1_sha256_write(hash_ctx, sha, buf, 33);
 }
 
-static int secp256k1_dleq_nonce(secp256k1_scalar *k, const unsigned char *sk32, const unsigned char *gen2_33, const unsigned char *p1_33, const unsigned char *p2_33, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) {
+static int secp256k1_dleq_nonce(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar *k, const unsigned char *sk32, const unsigned char *gen2_33, const unsigned char *p1_33, const unsigned char *p2_33, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) {
     secp256k1_sha256 sha;
     unsigned char buf[32];
     unsigned char nonce[32];
@@ -41,9 +41,9 @@ static int secp256k1_dleq_nonce(secp256k1_scalar *k, const unsigned char *sk32,
     }
 
     secp256k1_sha256_initialize(&sha);
-    secp256k1_sha256_write(&sha, p1_33, 33);
-    secp256k1_sha256_write(&sha, p2_33, 33);
-    secp256k1_sha256_finalize(&sha, buf);
+    secp256k1_sha256_write(hash_ctx, &sha, p1_33, 33);
+    secp256k1_sha256_write(hash_ctx, &sha, p2_33, 33);
+    secp256k1_sha256_finalize(hash_ctx, &sha, buf);
     secp256k1_sha256_clear(&sha);
 
     if (!noncefp(nonce, buf, sk32, gen2_33, dleq_algo, sizeof(dleq_algo), ndata)) {
@@ -59,17 +59,17 @@ static int secp256k1_dleq_nonce(secp256k1_scalar *k, const unsigned char *sk32,
 
 /* Generates a challenge as defined in the DLC Specification at
  * https://github.com/discreetlogcontracts/dlcspecs */
-static void secp256k1_dleq_challenge(secp256k1_scalar *e, secp256k1_ge *gen2, secp256k1_ge *r1, secp256k1_ge *r2, secp256k1_ge *p1, secp256k1_ge *p2) {
+static void secp256k1_dleq_challenge(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar *e, secp256k1_ge *gen2, secp256k1_ge *r1, secp256k1_ge *r2, secp256k1_ge *p1, secp256k1_ge *p2) {
     unsigned char buf[32];
     secp256k1_sha256 sha;
 
     secp256k1_nonce_function_dleq_sha256_tagged(&sha);
-    secp256k1_dleq_hash_point(&sha, p1);
-    secp256k1_dleq_hash_point(&sha, gen2);
-    secp256k1_dleq_hash_point(&sha, p2);
-    secp256k1_dleq_hash_point(&sha, r1);
-    secp256k1_dleq_hash_point(&sha, r2);
-    secp256k1_sha256_finalize(&sha, buf);
+    secp256k1_dleq_hash_point(hash_ctx, &sha, p1);
+    secp256k1_dleq_hash_point(hash_ctx, &sha, gen2);
+    secp256k1_dleq_hash_point(hash_ctx, &sha, p2);
+    secp256k1_dleq_hash_point(hash_ctx, &sha, r1);
+    secp256k1_dleq_hash_point(hash_ctx, &sha, r2);
+    secp256k1_sha256_finalize(hash_ctx, &sha, buf);
     secp256k1_sha256_clear(&sha);
 
     secp256k1_scalar_set_b32(e, buf, NULL);
@@ -89,6 +89,7 @@ static void secp256k1_dleq_pair(const secp256k1_ecmult_gen_context *ecmult_gen_c
 static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *s, secp256k1_scalar *e, const secp256k1_scalar *sk, secp256k1_ge *p1, secp256k1_ge *gen2, secp256k1_ge *p2, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) {
     /* Note: r[2] and k are local to the DLEQ proof, and they differ from the
      * values with the same identifiers in main_impl.h. */
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_ge r[2];
     secp256k1_scalar k = { 0 };
     unsigned char sk32[32];
@@ -103,7 +104,7 @@ static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *
 
     secp256k1_scalar_get_b32(sk32, sk);
 
-    ret = secp256k1_dleq_nonce(&k, sk32, gen2_33, p1_33, p2_33, noncefp, ndata);
+    ret = secp256k1_dleq_nonce(hash_ctx, &k, sk32, gen2_33, p1_33, p2_33, noncefp, ndata);
     secp256k1_declassify(ctx, &ret, sizeof(ret));
     if (!ret) {
         secp256k1_memclear_explicit(sk32, sizeof(sk32));
@@ -118,7 +119,7 @@ static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *
 
     /* e = tagged hash(p1, gen2, p2, r[0], r[1]) */
     /* s = k + e * sk */
-    secp256k1_dleq_challenge(e, gen2, &r[0], &r[1], p1, p2);
+    secp256k1_dleq_challenge(hash_ctx, e, gen2, &r[0], &r[1], p1, p2);
     secp256k1_scalar_mul(s, e, sk);
     secp256k1_scalar_add(s, s, &k);
 
@@ -127,7 +128,7 @@ static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *
     return 1;
 }
 
-static int secp256k1_dleq_verify(const secp256k1_scalar *s, const secp256k1_scalar *e, secp256k1_ge *p1, secp256k1_ge *gen2, secp256k1_ge *p2) {
+static int secp256k1_dleq_verify(const secp256k1_hash_ctx *hash_ctx, const secp256k1_scalar *s, const secp256k1_scalar *e, secp256k1_ge *p1, secp256k1_ge *gen2, secp256k1_ge *p2) {
     secp256k1_scalar e_neg;
     secp256k1_scalar e_expected;
     secp256k1_gej gen2j;
@@ -154,7 +155,7 @@ static int secp256k1_dleq_verify(const secp256k1_scalar *s, const secp256k1_scal
 
     secp256k1_ge_set_all_gej_var(r, rj, 2);
 
-    secp256k1_dleq_challenge(&e_expected, gen2, &r[0], &r[1], p1, p2);
+    secp256k1_dleq_challenge(hash_ctx, &e_expected, gen2, &r[0], &r[1], p1, p2);
 
     secp256k1_scalar_add(&e_expected, &e_expected, &e_neg);
     return secp256k1_scalar_is_zero(&e_expected);
diff --git a/src/modules/ecdsa_adaptor/main_impl.h b/src/modules/ecdsa_adaptor/main_impl.h
index 0d590907..19fe1b09 100644
--- a/src/modules/ecdsa_adaptor/main_impl.h
+++ b/src/modules/ecdsa_adaptor/main_impl.h
@@ -90,7 +90,7 @@ static void secp256k1_nonce_function_ecdsa_adaptor_sha256_tagged_aux(secp256k1_s
 static const unsigned char ecdsa_adaptor_algo[] = {'E', 'C', 'D', 'S', 'A', 'a', 'd', 'a', 'p', 't', 'o', 'r', '/', 'n', 'o', 'n'};
 
 /* Modified BIP-340 nonce function */
-static int nonce_function_ecdsa_adaptor(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *pk33, const unsigned char *algo, size_t algolen, void *data) {
+static int nonce_function_ecdsa_adaptor_impl(const secp256k1_hash_ctx *hash_ctx, unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *pk33, const unsigned char *algo, size_t algolen, void *data) {
     secp256k1_sha256 sha;
     unsigned char masked_key[32];
     int i;
@@ -101,8 +101,8 @@ static int nonce_function_ecdsa_adaptor(unsigned char *nonce32, const unsigned c
 
     if (data != NULL) {
         secp256k1_nonce_function_ecdsa_adaptor_sha256_tagged_aux(&sha);
-        secp256k1_sha256_write(&sha, data, 32);
-        secp256k1_sha256_finalize(&sha, masked_key);
+        secp256k1_sha256_write(hash_ctx, &sha, data, 32);
+        secp256k1_sha256_finalize(hash_ctx, &sha, masked_key);
         secp256k1_sha256_clear(&sha);
         for (i = 0; i < 32; i++) {
             masked_key[i] ^= key32[i];
@@ -119,22 +119,34 @@ static int nonce_function_ecdsa_adaptor(unsigned char *nonce32, const unsigned c
             && secp256k1_memcmp_var(algo, dleq_algo, algolen) == 0) {
         secp256k1_nonce_function_dleq_sha256_tagged(&sha);
     } else {
-        secp256k1_sha256_initialize_tagged(&sha, algo, algolen);
+        secp256k1_sha256_initialize_tagged(hash_ctx, &sha, algo, algolen);
     }
 
     /* Hash (masked-)key||pk||msg using the tagged hash as per BIP-340 */
     if (data != NULL) {
-        secp256k1_sha256_write(&sha, masked_key, 32);
+        secp256k1_sha256_write(hash_ctx, &sha, masked_key, 32);
     } else {
-        secp256k1_sha256_write(&sha, key32, 32);
+        secp256k1_sha256_write(hash_ctx, &sha, key32, 32);
     }
-    secp256k1_sha256_write(&sha, pk33, 33);
-    secp256k1_sha256_write(&sha, msg32, 32);
-    secp256k1_sha256_finalize(&sha, nonce32);
+    secp256k1_sha256_write(hash_ctx, &sha, pk33, 33);
+    secp256k1_sha256_write(hash_ctx, &sha, msg32, 32);
+    secp256k1_sha256_finalize(hash_ctx, &sha, nonce32);
     secp256k1_sha256_clear(&sha);
     return 1;
 }
 
+static int nonce_function_ecdsa_adaptor(
+    unsigned char *nonce32,
+    const unsigned char *msg32,
+    const unsigned char *key32,
+    const unsigned char *pk33,
+    const unsigned char *algo,
+    size_t algolen,
+    void *data)
+{
+    return nonce_function_ecdsa_adaptor_impl(secp256k1_get_hash_context(secp256k1_context_static),nonce32, msg32, key32, pk33, algo, algolen, data);
+}
+
 const secp256k1_nonce_function_hardened_ecdsa_adaptor secp256k1_nonce_function_ecdsa_adaptor = nonce_function_ecdsa_adaptor;
 
 int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char *adaptor_sig162, unsigned char *seckey32, const secp256k1_pubkey *enckey, const unsigned char *msg32, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) {
@@ -232,6 +244,7 @@ int secp256k1_ecdsa_adaptor_verify(const secp256k1_context* ctx, const unsigned
     secp256k1_gej derived_rp;
     secp256k1_scalar sn, u1, u2;
     secp256k1_gej pubkeyj;
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(adaptor_sig162 != NULL);
@@ -246,7 +259,7 @@ int secp256k1_ecdsa_adaptor_verify(const secp256k1_context* ctx, const unsigned
         return 0;
     }
     /* DLEQ_verify((R', Y, R), dleq_proof) */
-    if(!secp256k1_dleq_verify(&dleq_proof_s, &dleq_proof_e, &rp, &enckey_ge, &r)) {
+    if(!secp256k1_dleq_verify(hash_ctx, &dleq_proof_s, &dleq_proof_e, &rp, &enckey_ge, &r)) {
         return 0;
     }
     secp256k1_scalar_set_b32(&msg, msg32, NULL);
diff --git a/src/modules/ecdsa_adaptor/tests_impl.h b/src/modules/ecdsa_adaptor/tests_impl.h
index 09058997..693cc7dd 100644
--- a/src/modules/ecdsa_adaptor/tests_impl.h
+++ b/src/modules/ecdsa_adaptor/tests_impl.h
@@ -20,15 +20,17 @@ static void rand_point(secp256k1_ge *point) {
 }
 
 static void dleq_nonce_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     secp256k1_scalar k1, k2;
 
-    CHECK(secp256k1_dleq_nonce(&k1, args[0], args[1], args[2], args[3], NULL, args[4]) == 1);
+    CHECK(secp256k1_dleq_nonce(hash_ctx, &k1, args[0], args[1], args[2], args[3], NULL, args[4]) == 1);
     testrand_flip(args[n_flip], n_bytes);
-    CHECK(secp256k1_dleq_nonce(&k2, args[0], args[1], args[2], args[3], NULL, args[4]) == 1);
+    CHECK(secp256k1_dleq_nonce(hash_ctx, &k2, args[0], args[1], args[2], args[3], NULL, args[4]) == 1);
     CHECK(secp256k1_scalar_eq(&k1, &k2) == 0);
 }
 
 static void dleq_tests_internal(void) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     secp256k1_scalar s, e, sk, k;
     secp256k1_ge gen2, p1, p2;
     secp256k1_ge p[2];
@@ -46,20 +48,20 @@ static void dleq_tests_internal(void) {
     p1 = p[0];
     p2 = p[1];
     CHECK(secp256k1_dleq_prove(CTX, &s, &e, &sk, &p1, &gen2, &p2, NULL, NULL) == 1);
-    CHECK(secp256k1_dleq_verify(&s, &e, &p1, &gen2, &p2) == 1);
+    CHECK(secp256k1_dleq_verify(hash_ctx, &s, &e, &p1, &gen2, &p2) == 1);
 
     {
         secp256k1_scalar tmp;
         secp256k1_scalar_set_int(&tmp, 1);
-        CHECK(secp256k1_dleq_verify(&tmp, &e, &p1, &gen2, &p2) == 0);
-        CHECK(secp256k1_dleq_verify(&s, &tmp, &p1, &gen2, &p2) == 0);
+        CHECK(secp256k1_dleq_verify(hash_ctx, &tmp, &e, &p1, &gen2, &p2) == 0);
+        CHECK(secp256k1_dleq_verify(hash_ctx, &s, &tmp, &p1, &gen2, &p2) == 0);
     }
     {
         secp256k1_ge p_tmp;
         rand_point(&p_tmp);
-        CHECK(secp256k1_dleq_verify(&s, &e, &p_tmp, &gen2, &p2) == 0);
-        CHECK(secp256k1_dleq_verify(&s, &e, &p1, &p_tmp, &p2) == 0);
-        CHECK(secp256k1_dleq_verify(&s, &e, &p1, &gen2, &p_tmp) == 0);
+        CHECK(secp256k1_dleq_verify(hash_ctx, &s, &e, &p_tmp, &gen2, &p2) == 0);
+        CHECK(secp256k1_dleq_verify(hash_ctx, &s, &e, &p1, &p_tmp, &p2) == 0);
+        CHECK(secp256k1_dleq_verify(hash_ctx, &s, &e, &p1, &gen2, &p_tmp) == 0);
     }
 
     /* Nonce tests */
@@ -67,7 +69,7 @@ static void dleq_tests_internal(void) {
     secp256k1_eckey_pubkey_serialize33(&gen2, gen2_33);
     secp256k1_eckey_pubkey_serialize33(&p1, p1_33);
     secp256k1_eckey_pubkey_serialize33(&p2, p2_33);
-    CHECK(secp256k1_dleq_nonce(&k, sk32, gen2_33, p1_33, p2_33, NULL, NULL) == 1);
+    CHECK(secp256k1_dleq_nonce(hash_ctx, &k, sk32, gen2_33, p1_33, p2_33, NULL, NULL) == 1);
 
     testrand_bytes_test(sk32, sizeof(sk32));
     testrand_bytes_test(gen2_33, sizeof(gen2_33));
@@ -93,7 +95,7 @@ static void dleq_tests_internal(void) {
     }
 
     /* NULL aux_rand argument is allowed. */
-    CHECK(secp256k1_dleq_nonce(&k, sk32, gen2_33, p1_33, p2_33, NULL, NULL) == 1);
+    CHECK(secp256k1_dleq_nonce(hash_ctx, &k, sk32, gen2_33, p1_33, p2_33, NULL, NULL) == 1);
 }
 
 static void rand_flip_bit(unsigned char *array, size_t n) {
@@ -715,6 +717,7 @@ static void nonce_function_ecdsa_adaptor_bitflip(unsigned char **args, size_t n_
 }
 
 static void run_nonce_function_ecdsa_adaptor_tests(void) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     static const unsigned char tag[] = {'E', 'C', 'D', 'S', 'A', 'a', 'd', 'a', 'p', 't', 'o', 'r', '/', 'n', 'o', 'n'};
     static const unsigned char aux_tag[] = {'E', 'C', 'D', 'S', 'A', 'a', 'd', 'a', 'p', 't', 'o', 'r', '/', 'a', 'u', 'x'};
     unsigned char algo[] = {'E', 'C', 'D', 'S', 'A', 'a', 'd', 'a', 'p', 't', 'o', 'r', '/', 'n', 'o', 'n'};
@@ -733,19 +736,19 @@ static void run_nonce_function_ecdsa_adaptor_tests(void) {
      * secp256k1_nonce_function_ecdsa_adaptor_sha256_tagged has the expected
      * state. */
     secp256k1_nonce_function_ecdsa_adaptor_sha256_tagged(&sha_optimized);
-    test_sha256_tag_midstate(&sha_optimized, tag, sizeof(tag));
+    test_sha256_tag_midstate(hash_ctx, &sha_optimized, tag, sizeof(tag));
 
    /* Check that hash initialized by
     * secp256k1_nonce_function_ecdsa_adaptor_sha256_tagged_aux has the expected
     * state. */
     secp256k1_nonce_function_ecdsa_adaptor_sha256_tagged_aux(&sha_optimized);
-    test_sha256_tag_midstate(&sha_optimized, aux_tag, sizeof(aux_tag));
+    test_sha256_tag_midstate(hash_ctx, &sha_optimized, aux_tag, sizeof(aux_tag));
 
    /* Check that hash initialized by
     * secp256k1_nonce_function_dleq_sha256_tagged_aux has the expected
     * state. */
     secp256k1_nonce_function_dleq_sha256_tagged(&sha_optimized);
-    test_sha256_tag_midstate(&sha_optimized, dleq_tag, sizeof(dleq_tag));
+    test_sha256_tag_midstate(hash_ctx, &sha_optimized, dleq_tag, sizeof(dleq_tag));
 
     testrand_bytes_test(msg, sizeof(msg));
     testrand_bytes_test(key, sizeof(key));
diff --git a/src/modules/ecdsa_s2c/main_impl.h b/src/modules/ecdsa_s2c/main_impl.h
index cdc54737..d8d85384 100644
--- a/src/modules/ecdsa_s2c/main_impl.h
+++ b/src/modules/ecdsa_s2c/main_impl.h
@@ -55,6 +55,7 @@ static void secp256k1_s2c_ecdsa_data_sha256_tagged(secp256k1_sha256 *sha) {
 
 int secp256k1_ecdsa_s2c_sign(const secp256k1_context* ctx, secp256k1_ecdsa_signature* signature, secp256k1_ecdsa_s2c_opening* s2c_opening, const unsigned char
  *msg32, const unsigned char *seckey, const unsigned char* s2c_data32) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_scalar r, s;
     int ret;
     unsigned char ndata[32];
@@ -72,8 +73,8 @@ int secp256k1_ecdsa_s2c_sign(const secp256k1_context* ctx, secp256k1_ecdsa_signa
      * to derive nonces even if only a SHA256 commitment to the data is
      * known.  This is important in the ECDSA anti-exfil protocol. */
     secp256k1_s2c_ecdsa_data_sha256_tagged(&s2c_sha);
-    secp256k1_sha256_write(&s2c_sha, s2c_data32, 32);
-    secp256k1_sha256_finalize(&s2c_sha, ndata);
+    secp256k1_sha256_write(hash_ctx, &s2c_sha, s2c_data32, 32);
+    secp256k1_sha256_finalize(hash_ctx, &s2c_sha, ndata);
     secp256k1_sha256_clear(&s2c_sha);
 
     secp256k1_s2c_ecdsa_point_sha256_tagged(&s2c_sha);
@@ -85,6 +86,7 @@ int secp256k1_ecdsa_s2c_sign(const secp256k1_context* ctx, secp256k1_ecdsa_signa
 }
 
 int secp256k1_ecdsa_s2c_verify_commit(const secp256k1_context* ctx, const secp256k1_ecdsa_signature* sig, const unsigned char* data32, const secp256k1_ecdsa_s2c_opening* opening) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_ge commitment_ge;
     secp256k1_ge original_pubnonce_ge;
     unsigned char x_bytes[32];
@@ -100,7 +102,7 @@ int secp256k1_ecdsa_s2c_verify_commit(const secp256k1_context* ctx, const secp25
         return 0;
     }
     secp256k1_s2c_ecdsa_point_sha256_tagged(&s2c_sha);
-    if (!secp256k1_ec_commit(&commitment_ge, &original_pubnonce_ge, &s2c_sha, data32, 32)) {
+    if (!secp256k1_ec_commit(hash_ctx, &commitment_ge, &original_pubnonce_ge, &s2c_sha, data32, 32)) {
         return 0;
     }
 
@@ -128,14 +130,15 @@ int secp256k1_ecdsa_s2c_verify_commit(const secp256k1_context* ctx, const secp25
 /*** anti-exfil ***/
 int secp256k1_ecdsa_anti_exfil_host_commit(const secp256k1_context* ctx, unsigned char* rand_commitment32, const unsigned char* rand32) {
     secp256k1_sha256 sha;
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(rand_commitment32 != NULL);
     ARG_CHECK(rand32 != NULL);
 
     secp256k1_s2c_ecdsa_data_sha256_tagged(&sha);
-    secp256k1_sha256_write(&sha, rand32, 32);
-    secp256k1_sha256_finalize(&sha, rand_commitment32);
+    secp256k1_sha256_write(hash_ctx, &sha, rand32, 32);
+    secp256k1_sha256_finalize(hash_ctx, &sha, rand_commitment32);
     secp256k1_sha256_clear(&sha);
     return 1;
 }
diff --git a/src/modules/ecdsa_s2c/tests_impl.h b/src/modules/ecdsa_s2c/tests_impl.h
index d13e5164..ba4f158c 100644
--- a/src/modules/ecdsa_s2c/tests_impl.h
+++ b/src/modules/ecdsa_s2c/tests_impl.h
@@ -11,6 +11,7 @@
 #include "../../unit_test.h"
 
 static void test_ecdsa_s2c_tagged_hash(void) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     unsigned char tag_data[] = {'s', '2', 'c', '/', 'e', 'c', 'd', 's', 'a', '/', 'd', 'a', 't', 'a'};
     unsigned char tag_point[] = {'s', '2', 'c', '/', 'e', 'c', 'd', 's', 'a', '/', 'p', 'o', 'i', 'n', 't'};
     secp256k1_sha256 sha;
@@ -18,16 +19,16 @@ static void test_ecdsa_s2c_tagged_hash(void) {
     unsigned char output[32];
     unsigned char output_optimized[32];
 
-    secp256k1_sha256_initialize_tagged(&sha, tag_data, sizeof(tag_data));
+    secp256k1_sha256_initialize_tagged(hash_ctx, &sha, tag_data, sizeof(tag_data));
     secp256k1_s2c_ecdsa_data_sha256_tagged(&sha_optimized);
-    secp256k1_sha256_finalize(&sha, output);
-    secp256k1_sha256_finalize(&sha_optimized, output_optimized);
+    secp256k1_sha256_finalize(hash_ctx, &sha, output);
+    secp256k1_sha256_finalize(hash_ctx, &sha_optimized, output_optimized);
     CHECK(secp256k1_memcmp_var(output, output_optimized, 32) == 0);
 
-    secp256k1_sha256_initialize_tagged(&sha, tag_point, sizeof(tag_point));
+    secp256k1_sha256_initialize_tagged(hash_ctx, &sha, tag_point, sizeof(tag_point));
     secp256k1_s2c_ecdsa_point_sha256_tagged(&sha_optimized);
-    secp256k1_sha256_finalize(&sha, output);
-    secp256k1_sha256_finalize(&sha_optimized, output_optimized);
+    secp256k1_sha256_finalize(hash_ctx, &sha, output);
+    secp256k1_sha256_finalize(hash_ctx, &sha_optimized, output_optimized);
     CHECK(secp256k1_memcmp_var(output, output_optimized, 32) == 0);
 }
 
@@ -171,7 +172,7 @@ static void test_ecdsa_s2c_fixed_vectors(void) {
     };
     size_t i;
 
-    for (i = 0; i < sizeof(ecdsa_s2c_tests) / sizeof(ecdsa_s2c_tests[0]); i++) {
+    for (i = 0; i < ARRAY_SIZE(ecdsa_s2c_tests); i++) {
         secp256k1_ecdsa_s2c_opening s2c_opening;
         unsigned char opening_ser[33];
         const ecdsa_s2c_test *test = &ecdsa_s2c_tests[i];
@@ -248,7 +249,7 @@ static void test_ecdsa_anti_exfil_signer_commit(void) {
         0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88,
     };
     /* Check that original pubnonce is derived from s2c_data */
-    for (i = 0; i < sizeof(ecdsa_s2c_tests) / sizeof(ecdsa_s2c_tests[0]); i++) {
+    for (i = 0; i < ARRAY_SIZE(ecdsa_s2c_tests); i++) {
         secp256k1_ecdsa_s2c_opening s2c_opening;
         unsigned char buf[33];
         const ecdsa_s2c_test *test = &ecdsa_s2c_tests[i];
diff --git a/src/modules/generator/main_impl.h b/src/modules/generator/main_impl.h
index c58d66fe..c2a1adff 100644
--- a/src/modules/generator/main_impl.h
+++ b/src/modules/generator/main_impl.h
@@ -211,6 +211,7 @@ static int secp256k1_generator_generate_internal(const secp256k1_context* ctx, s
     secp256k1_sha256 sha256;
     unsigned char b32[32];
     int ret = 1;
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
 
     if (blind32) {
         secp256k1_scalar blind;
@@ -220,9 +221,9 @@ static int secp256k1_generator_generate_internal(const secp256k1_context* ctx, s
     }
 
     secp256k1_sha256_initialize(&sha256);
-    secp256k1_sha256_write(&sha256, prefix1, 16);
-    secp256k1_sha256_write(&sha256, key32, 32);
-    secp256k1_sha256_finalize(&sha256, b32);
+    secp256k1_sha256_write(hash_ctx, &sha256, prefix1, 16);
+    secp256k1_sha256_write(hash_ctx, &sha256, key32, 32);
+    secp256k1_sha256_finalize(hash_ctx, &sha256, b32);
     secp256k1_sha256_clear(&sha256);
     ret &= secp256k1_fe_set_b32_limit(&t, b32);
     shallue_van_de_woestijne(&add, &t);
@@ -233,9 +234,9 @@ static int secp256k1_generator_generate_internal(const secp256k1_context* ctx, s
     }
 
     secp256k1_sha256_initialize(&sha256);
-    secp256k1_sha256_write(&sha256, prefix2, 16);
-    secp256k1_sha256_write(&sha256, key32, 32);
-    secp256k1_sha256_finalize(&sha256, b32);
+    secp256k1_sha256_write(hash_ctx, &sha256, prefix2, 16);
+    secp256k1_sha256_write(hash_ctx, &sha256, key32, 32);
+    secp256k1_sha256_finalize(hash_ctx, &sha256, b32);
     secp256k1_sha256_clear(&sha256);
     ret &= secp256k1_fe_set_b32_limit(&t, b32);
     shallue_van_de_woestijne(&add, &t);
diff --git a/src/modules/musig/session_impl.h b/src/modules/musig/session_impl.h
index 2c89ba20..7920fbfd 100644
--- a/src/modules/musig/session_impl.h
+++ b/src/modules/musig/session_impl.h
@@ -619,18 +619,6 @@ int secp256k1_musig_nonce_process(const secp256k1_context* ctx, secp256k1_musig_
         secp256k1_ge_set_gej(&aggnonce_pts[0], &tmp);
     }
 
-    /* Add public adaptor to nonce */
-    if (adaptor != NULL) {
-        secp256k1_ge adaptorp;
-        secp256k1_gej tmp;
-        if (!secp256k1_pubkey_load(ctx, &adaptorp, adaptor)) {
-            return 0;
-        }
-        secp256k1_gej_set_ge(&tmp, &aggnonce_pts[0]);
-        secp256k1_gej_add_ge_var(&tmp, &tmp, &adaptorp, NULL);
-        secp256k1_ge_set_gej(&aggnonce_pts[0], &tmp);
-    }
-
     secp256k1_musig_nonce_process_internal(ctx, &session_i.fin_nonce_parity, fin_nonce, &session_i.noncecoef, aggnonce_pts, agg_pk32, msg32);
     secp256k1_schnorrsig_challenge(secp256k1_get_hash_context(ctx), &session_i.challenge, fin_nonce, msg32, 32, agg_pk32);
 
diff --git a/src/modules/rangeproof/borromean.h b/src/modules/rangeproof/borromean.h
index 5620deac..b4d58d31 100644
--- a/src/modules/rangeproof/borromean.h
+++ b/src/modules/rangeproof/borromean.h
@@ -14,10 +14,10 @@
 #include "../../ecmult.h"
 #include "../../ecmult_gen.h"
 
-static int secp256k1_borromean_verify(secp256k1_scalar *evalues, const unsigned char *e0, const secp256k1_scalar *s,
+static int secp256k1_borromean_verify(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar *evalues, const unsigned char *e0, const secp256k1_scalar *s,
  const secp256k1_gej *pubs, const size_t *rsizes, size_t nrings, const unsigned char *m, size_t mlen);
 
-static int secp256k1_borromean_sign(const secp256k1_ecmult_gen_context *ecmult_gen_ctx,
+static int secp256k1_borromean_sign(const secp256k1_hash_ctx *hash_ctx, const secp256k1_ecmult_gen_context *ecmult_gen_ctx,
  unsigned char *e0, secp256k1_scalar *s, const secp256k1_gej *pubs, const secp256k1_scalar *k, const secp256k1_scalar *sec,
  const size_t *rsizes, const size_t *secidx, size_t nrings, const unsigned char *m, size_t mlen);
 
diff --git a/src/modules/rangeproof/borromean_impl.h b/src/modules/rangeproof/borromean_impl.h
index 2fff3c28..cd62abaa 100644
--- a/src/modules/rangeproof/borromean_impl.h
+++ b/src/modules/rangeproof/borromean_impl.h
@@ -20,7 +20,7 @@
 #include <limits.h>
 #include <string.h>
 
-SECP256K1_INLINE static void secp256k1_borromean_hash(unsigned char *hash, const unsigned char *m, size_t mlen, const unsigned char *e, size_t elen,
+SECP256K1_INLINE static void secp256k1_borromean_hash(const secp256k1_hash_ctx *hash_ctx, unsigned char *hash, const unsigned char *m, size_t mlen, const unsigned char *e, size_t elen,
  size_t ridx, size_t eidx) {
     unsigned char ring[4];
     unsigned char epos[4];
@@ -28,11 +28,11 @@ SECP256K1_INLINE static void secp256k1_borromean_hash(unsigned char *hash, const
     secp256k1_sha256_initialize(&sha256_en);
     secp256k1_write_be32(ring, (uint32_t)ridx);
     secp256k1_write_be32(epos, (uint32_t)eidx);
-    secp256k1_sha256_write(&sha256_en, e, elen);
-    secp256k1_sha256_write(&sha256_en, m, mlen);
-    secp256k1_sha256_write(&sha256_en, ring, 4);
-    secp256k1_sha256_write(&sha256_en, epos, 4);
-    secp256k1_sha256_finalize(&sha256_en, hash);
+    secp256k1_sha256_write(hash_ctx, &sha256_en, e, elen);
+    secp256k1_sha256_write(hash_ctx, &sha256_en, m, mlen);
+    secp256k1_sha256_write(hash_ctx, &sha256_en, ring, 4);
+    secp256k1_sha256_write(hash_ctx, &sha256_en, epos, 4);
+    secp256k1_sha256_finalize(hash_ctx, &sha256_en, hash);
     secp256k1_sha256_clear(&sha256_en);
 }
 
@@ -50,7 +50,7 @@ SECP256K1_INLINE static void secp256k1_borromean_hash(unsigned char *hash, const
  *   | | r_i = r
  *   | return e_0 ==== H(r_{0..i}||m)
  */
-int secp256k1_borromean_verify(secp256k1_scalar *evalues, const unsigned char *e0,
+int secp256k1_borromean_verify(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar *evalues, const unsigned char *e0,
  const secp256k1_scalar *s, const secp256k1_gej *pubs, const size_t *rsizes, size_t nrings, const unsigned char *m, size_t mlen) {
     secp256k1_gej rgej;
     secp256k1_ge rge;
@@ -71,7 +71,7 @@ int secp256k1_borromean_verify(secp256k1_scalar *evalues, const unsigned char *e
     secp256k1_sha256_initialize(&sha256_e0);
     for (i = 0; i < nrings; i++) {
         VERIFY_CHECK(INT_MAX - count > rsizes[i]);
-        secp256k1_borromean_hash(tmp, m, mlen, e0, 32, i, 0);
+        secp256k1_borromean_hash(hash_ctx, tmp, m, mlen, e0, 32, i, 0);
         secp256k1_scalar_set_b32(&ens, tmp, &overflow);
         for (j = 0; j < rsizes[i]; j++) {
             if (overflow || secp256k1_scalar_is_zero(&s[count]) || secp256k1_scalar_is_zero(&ens) || secp256k1_gej_is_infinity(&pubs[count])) {
@@ -89,21 +89,21 @@ int secp256k1_borromean_verify(secp256k1_scalar *evalues, const unsigned char *e
             secp256k1_ge_set_gej_var(&rge, &rgej);
             secp256k1_eckey_pubkey_serialize33(&rge, tmp);
             if (j != rsizes[i] - 1) {
-                secp256k1_borromean_hash(tmp, m, mlen, tmp, 33, i, j + 1);
+                secp256k1_borromean_hash(hash_ctx, tmp, m, mlen, tmp, 33, i, j + 1);
                 secp256k1_scalar_set_b32(&ens, tmp, &overflow);
             } else {
-                secp256k1_sha256_write(&sha256_e0, tmp, 33);
+                secp256k1_sha256_write(hash_ctx, &sha256_e0, tmp, 33);
             }
             count++;
         }
     }
-    secp256k1_sha256_write(&sha256_e0, m, mlen);
-    secp256k1_sha256_finalize(&sha256_e0, tmp);
+    secp256k1_sha256_write(hash_ctx, &sha256_e0, m, mlen);
+    secp256k1_sha256_finalize(hash_ctx, &sha256_e0, tmp);
     secp256k1_sha256_clear(&sha256_e0);
     return secp256k1_memcmp_var(e0, tmp, 32) == 0;
 }
 
-int secp256k1_borromean_sign(const secp256k1_ecmult_gen_context *ecmult_gen_ctx,
+int secp256k1_borromean_sign(const secp256k1_hash_ctx *hash_ctx, const secp256k1_ecmult_gen_context *ecmult_gen_ctx,
  unsigned char *e0, secp256k1_scalar *s, const secp256k1_gej *pubs, const secp256k1_scalar *k, const secp256k1_scalar *sec,
  const size_t *rsizes, const size_t *secidx, size_t nrings, const unsigned char *m, size_t mlen) {
     secp256k1_gej rgej;
@@ -136,7 +136,7 @@ int secp256k1_borromean_sign(const secp256k1_ecmult_gen_context *ecmult_gen_ctx,
         }
         secp256k1_eckey_pubkey_serialize33(&rge, tmp);
         for (j = secidx[i] + 1; j < rsizes[i]; j++) {
-            secp256k1_borromean_hash(tmp, m, mlen, tmp, 33, i, j);
+            secp256k1_borromean_hash(hash_ctx, tmp, m, mlen, tmp, 33, i, j);
             secp256k1_scalar_set_b32(&ens, tmp, &overflow);
             if (overflow || secp256k1_scalar_is_zero(&ens)) {
                 return 0;
@@ -152,16 +152,16 @@ int secp256k1_borromean_sign(const secp256k1_ecmult_gen_context *ecmult_gen_ctx,
             secp256k1_ge_set_gej_var(&rge, &rgej);
             secp256k1_eckey_pubkey_serialize33(&rge, tmp);
         }
-        secp256k1_sha256_write(&sha256_e0, tmp, 33);
+        secp256k1_sha256_write(hash_ctx, &sha256_e0, tmp, 33);
         count += rsizes[i];
     }
-    secp256k1_sha256_write(&sha256_e0, m, mlen);
-    secp256k1_sha256_finalize(&sha256_e0, e0);
+    secp256k1_sha256_write(hash_ctx, &sha256_e0, m, mlen);
+    secp256k1_sha256_finalize(hash_ctx, &sha256_e0, e0);
     secp256k1_sha256_clear(&sha256_e0);
     count = 0;
     for (i = 0; i < nrings; i++) {
         VERIFY_CHECK(INT_MAX - count > rsizes[i]);
-        secp256k1_borromean_hash(tmp, m, mlen, e0, 32, i, 0);
+        secp256k1_borromean_hash(hash_ctx, tmp, m, mlen, e0, 32, i, 0);
         secp256k1_scalar_set_b32(&ens, tmp, &overflow);
         if (overflow || secp256k1_scalar_is_zero(&ens)) {
             return 0;
@@ -173,7 +173,7 @@ int secp256k1_borromean_sign(const secp256k1_ecmult_gen_context *ecmult_gen_ctx,
             }
             secp256k1_ge_set_gej_var(&rge, &rgej);
             secp256k1_eckey_pubkey_serialize33(&rge, tmp);
-            secp256k1_borromean_hash(tmp, m, mlen, tmp, 33, i, j + 1);
+            secp256k1_borromean_hash(hash_ctx, tmp, m, mlen, tmp, 33, i, j + 1);
             secp256k1_scalar_set_b32(&ens, tmp, &overflow);
             if (overflow || secp256k1_scalar_is_zero(&ens)) {
                 return 0;
diff --git a/src/modules/rangeproof/main_impl.h b/src/modules/rangeproof/main_impl.h
index 32614caa..420338dd 100644
--- a/src/modules/rangeproof/main_impl.h
+++ b/src/modules/rangeproof/main_impl.h
@@ -32,6 +32,7 @@ int secp256k1_rangeproof_rewind(const secp256k1_context* ctx,
  unsigned char *blind_out, uint64_t *value_out, unsigned char *message_out, size_t *outlen, const unsigned char *nonce,
  uint64_t *min_value, uint64_t *max_value,
  const secp256k1_pedersen_commitment *commit, const unsigned char *proof, size_t plen, const unsigned char *extra_commit, size_t extra_commit_len, const secp256k1_generator* gen) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_ge commitp;
     secp256k1_ge genp;
     VERIFY_CHECK(ctx != NULL);
@@ -46,12 +47,13 @@ int secp256k1_rangeproof_rewind(const secp256k1_context* ctx,
     ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
     secp256k1_pedersen_commitment_load(&commitp, commit);
     secp256k1_generator_load(&genp, gen);
-    return secp256k1_rangeproof_verify_impl(&ctx->ecmult_gen_ctx,
+    return secp256k1_rangeproof_verify_impl(hash_ctx, &ctx->ecmult_gen_ctx,
      blind_out, value_out, message_out, outlen, nonce, min_value, max_value, &commitp, proof, plen, extra_commit, extra_commit_len, &genp);
 }
 
 int secp256k1_rangeproof_verify(const secp256k1_context* ctx, uint64_t *min_value, uint64_t *max_value,
  const secp256k1_pedersen_commitment *commit, const unsigned char *proof, size_t plen, const unsigned char *extra_commit, size_t extra_commit_len, const secp256k1_generator* gen) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_ge commitp;
     secp256k1_ge genp;
     VERIFY_CHECK(ctx != NULL);
@@ -63,13 +65,14 @@ int secp256k1_rangeproof_verify(const secp256k1_context* ctx, uint64_t *min_valu
     ARG_CHECK(gen != NULL);
     secp256k1_pedersen_commitment_load(&commitp, commit);
     secp256k1_generator_load(&genp, gen);
-    return secp256k1_rangeproof_verify_impl(NULL,
+    return secp256k1_rangeproof_verify_impl(hash_ctx, NULL,
      NULL, NULL, NULL, NULL, NULL, min_value, max_value, &commitp, proof, plen, extra_commit, extra_commit_len, &genp);
 }
 
 int secp256k1_rangeproof_sign(const secp256k1_context* ctx, unsigned char *proof, size_t *plen, uint64_t min_value,
  const secp256k1_pedersen_commitment *commit, const unsigned char *blind, const unsigned char *nonce, int exp, int min_bits, uint64_t value,
  const unsigned char *message, size_t msg_len, const unsigned char *extra_commit, size_t extra_commit_len, const secp256k1_generator* gen){
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_ge commitp;
     secp256k1_ge genp;
     VERIFY_CHECK(ctx != NULL);
@@ -84,7 +87,7 @@ int secp256k1_rangeproof_sign(const secp256k1_context* ctx, unsigned char *proof
     ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
     secp256k1_pedersen_commitment_load(&commitp, commit);
     secp256k1_generator_load(&genp, gen);
-    return secp256k1_rangeproof_sign_impl(&ctx->ecmult_gen_ctx,
+    return secp256k1_rangeproof_sign_impl(hash_ctx, &ctx->ecmult_gen_ctx,
      proof, plen, min_value, &commitp, blind, nonce, exp, min_bits, value, message, msg_len, extra_commit, extra_commit_len, &genp);
 }
 
diff --git a/src/modules/rangeproof/rangeproof_impl.h b/src/modules/rangeproof/rangeproof_impl.h
index 476da5eb..50211b07 100644
--- a/src/modules/rangeproof/rangeproof_impl.h
+++ b/src/modules/rangeproof/rangeproof_impl.h
@@ -58,7 +58,7 @@ SECP256K1_INLINE static void secp256k1_rangeproof_serialize_point(unsigned char*
     secp256k1_fe_get_b32(data + 1, &pointx);
 }
 
-SECP256K1_INLINE static int secp256k1_rangeproof_genrand(secp256k1_scalar *sec, secp256k1_scalar *s, unsigned char *message,
+SECP256K1_INLINE static int secp256k1_rangeproof_genrand(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar *sec, secp256k1_scalar *s, unsigned char *message,
  size_t *rsizes, size_t rings, const unsigned char *nonce, const secp256k1_ge *commit, const unsigned char *proof, size_t len, const secp256k1_ge* genp) {
     unsigned char tmp[32];
     unsigned char rngseed[32 + 33 + 33 + 10];
@@ -75,15 +75,15 @@ SECP256K1_INLINE static int secp256k1_rangeproof_genrand(secp256k1_scalar *sec,
     secp256k1_rangeproof_serialize_point(rngseed + 32, commit);
     secp256k1_rangeproof_serialize_point(rngseed + 32 + 33, genp);
     memcpy(rngseed + 33 + 33 + 32, proof, len);
-    secp256k1_rfc6979_hmac_sha256_initialize(&rng, rngseed, 32 + 33 + 33 + len);
+    secp256k1_rfc6979_hmac_sha256_initialize(hash_ctx, &rng, rngseed, 32 + 33 + 33 + len);
     secp256k1_scalar_set_int(&acc, 0);
     npub = 0;
     ret = 1;
     for (i = 0; i < rings; i++) {
         if (i < rings - 1) {
-            secp256k1_rfc6979_hmac_sha256_generate(&rng, tmp, 32);
+            secp256k1_rfc6979_hmac_sha256_generate(hash_ctx, &rng, tmp, 32);
             do {
-                secp256k1_rfc6979_hmac_sha256_generate(&rng, tmp, 32);
+                secp256k1_rfc6979_hmac_sha256_generate(hash_ctx, &rng, tmp, 32);
                 secp256k1_scalar_set_b32(&sec[i], tmp, &overflow);
             } while (overflow || secp256k1_scalar_is_zero(&sec[i]));
             secp256k1_scalar_add(&acc, &acc, &sec[i]);
@@ -92,7 +92,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_genrand(secp256k1_scalar *sec,
             sec[i] = acc;
         }
         for (j = 0; j < rsizes[i]; j++) {
-            secp256k1_rfc6979_hmac_sha256_generate(&rng, tmp, 32);
+            secp256k1_rfc6979_hmac_sha256_generate(hash_ctx, &rng, tmp, 32);
             if (message) {
                 for (b = 0; b < 32; b++) {
                     tmp[b] ^= message[(i * 4 + j) * 32 + b];
@@ -189,7 +189,7 @@ SECP256K1_INLINE static int secp256k1_range_proveparams(uint64_t *v, size_t *rin
 }
 
 /* strawman interface, writes proof in proof, a buffer of plen, proves with respect to min_value the range for commit which has the provided blinding factor and value. */
-SECP256K1_INLINE static int secp256k1_rangeproof_sign_impl(const secp256k1_ecmult_gen_context* ecmult_gen_ctx,
+SECP256K1_INLINE static int secp256k1_rangeproof_sign_impl(const secp256k1_hash_ctx *hash_ctx, const secp256k1_ecmult_gen_context* ecmult_gen_ctx,
  unsigned char *proof, size_t *plen, uint64_t min_value,
  const secp256k1_ge *commit, const unsigned char *blind, const unsigned char *nonce, int exp, int min_bits, uint64_t value,
  const unsigned char *message, size_t msg_len, const unsigned char *extra_commit, size_t extra_commit_len, const secp256k1_ge* genp){
@@ -245,10 +245,10 @@ SECP256K1_INLINE static int secp256k1_rangeproof_sign_impl(const secp256k1_ecmul
     }
     secp256k1_sha256_initialize(&sha256_m);
     secp256k1_rangeproof_serialize_point(tmp, commit);
-    secp256k1_sha256_write(&sha256_m, tmp, 33);
+    secp256k1_sha256_write(hash_ctx, &sha256_m, tmp, 33);
     secp256k1_rangeproof_serialize_point(tmp, genp);
-    secp256k1_sha256_write(&sha256_m, tmp, 33);
-    secp256k1_sha256_write(&sha256_m, proof, len);
+    secp256k1_sha256_write(hash_ctx, &sha256_m, tmp, 33);
+    secp256k1_sha256_write(hash_ctx, &sha256_m, proof, len);
 
     memset(prep, 0, 4096);
     if (message != NULL) {
@@ -267,7 +267,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_sign_impl(const secp256k1_ecmul
         }
         prep[idx] = 128;
     }
-    if (!secp256k1_rangeproof_genrand(sec, s, prep, rsizes, rings, nonce, commit, proof, len, genp)) {
+    if (!secp256k1_rangeproof_genrand(hash_ctx, sec, s, prep, rsizes, rings, nonce, commit, proof, len, genp)) {
         return 0;
     }
     secp256k1_memclear_explicit(prep, 4096);
@@ -309,7 +309,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_sign_impl(const secp256k1_ecmul
             secp256k1_ge_set_gej_var(&c, &pubs[npub]);
             secp256k1_rangeproof_serialize_point(tmpc, &c);
             quadness = tmpc[0];
-            secp256k1_sha256_write(&sha256_m, tmpc, 33);
+            secp256k1_sha256_write(hash_ctx, &sha256_m, tmpc, 33);
             signs[i>>3] |= quadness << (i&7);
             memcpy(&proof[len], tmpc + 1, 32);
             len += 32;
@@ -318,11 +318,11 @@ SECP256K1_INLINE static int secp256k1_rangeproof_sign_impl(const secp256k1_ecmul
     }
     secp256k1_rangeproof_pub_expand(pubs, exp, rsizes, rings, genp);
     if (extra_commit != NULL) {
-        secp256k1_sha256_write(&sha256_m, extra_commit, extra_commit_len);
+        secp256k1_sha256_write(hash_ctx, &sha256_m, extra_commit, extra_commit_len);
     }
-    secp256k1_sha256_finalize(&sha256_m, tmp);
+    secp256k1_sha256_finalize(hash_ctx, &sha256_m, tmp);
     secp256k1_sha256_clear(&sha256_m);
-    if (!secp256k1_borromean_sign(ecmult_gen_ctx, &proof[len], s, pubs, k, sec, rsizes, secidx, rings, tmp, 32)) {
+    if (!secp256k1_borromean_sign(hash_ctx, ecmult_gen_ctx, &proof[len], s, pubs, k, sec, rsizes, secidx, rings, tmp, 32)) {
         return 0;
     }
     len += 32;
@@ -361,7 +361,7 @@ SECP256K1_INLINE static void secp256k1_rangeproof_ch32xor(unsigned char *x, cons
     }
 }
 
-SECP256K1_INLINE static int secp256k1_rangeproof_rewind_inner(secp256k1_scalar *blind, uint64_t *v,
+SECP256K1_INLINE static int secp256k1_rangeproof_rewind_inner(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar *blind, uint64_t *v,
  unsigned char *m, size_t *mlen, secp256k1_scalar *ev, secp256k1_scalar *s,
  size_t *rsizes, size_t rings, const unsigned char *nonce, const secp256k1_ge *commit, const unsigned char *proof, size_t len, const secp256k1_ge *genp) {
     secp256k1_scalar s_orig[128];
@@ -382,7 +382,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_rewind_inner(secp256k1_scalar *
     VERIFY_CHECK(npub >= 1);
     memset(prep, 0, 4096);
     /* Reconstruct the provers random values. */
-    secp256k1_rangeproof_genrand(sec, s_orig, prep, rsizes, rings, nonce, commit, proof, len, genp);
+    secp256k1_rangeproof_genrand(hash_ctx, sec, s_orig, prep, rsizes, rings, nonce, commit, proof, len, genp);
     *v = UINT64_MAX;
     secp256k1_scalar_clear(blind);
     if (rings == 1 && rsizes[0] == 1) {
@@ -538,7 +538,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_getheader_impl(size_t *offset,
 }
 
 /* Verifies range proof (len plen) for commit, the min/max values proven are put in the min/max arguments; returns 0 on failure 1 on success.*/
-SECP256K1_INLINE static int secp256k1_rangeproof_verify_impl(const secp256k1_ecmult_gen_context* ecmult_gen_ctx,
+SECP256K1_INLINE static int secp256k1_rangeproof_verify_impl(const secp256k1_hash_ctx *hash_ctx, const secp256k1_ecmult_gen_context* ecmult_gen_ctx,
  unsigned char *blindout, uint64_t *value_out, unsigned char *message_out, size_t *outlen, const unsigned char *nonce,
  uint64_t *min_value, uint64_t *max_value, const secp256k1_ge *commit, const unsigned char *proof, size_t plen, const unsigned char *extra_commit, size_t extra_commit_len, const secp256k1_ge* genp) {
     secp256k1_gej accj;
@@ -587,10 +587,10 @@ SECP256K1_INLINE static int secp256k1_rangeproof_verify_impl(const secp256k1_ecm
     }
     secp256k1_sha256_initialize(&sha256_m);
     secp256k1_rangeproof_serialize_point(m, commit);
-    secp256k1_sha256_write(&sha256_m, m, 33);
+    secp256k1_sha256_write(hash_ctx, &sha256_m, m, 33);
     secp256k1_rangeproof_serialize_point(m, genp);
-    secp256k1_sha256_write(&sha256_m, m, 33);
-    secp256k1_sha256_write(&sha256_m, proof, offset);
+    secp256k1_sha256_write(hash_ctx, &sha256_m, m, 33);
+    secp256k1_sha256_write(hash_ctx, &sha256_m, proof, offset);
     for(i = 0; i < rings - 1; i++) {
         signs[i] = (proof[offset + ( i>> 3)] & (1 << (i & 7))) != 0;
     }
@@ -617,8 +617,8 @@ SECP256K1_INLINE static int secp256k1_rangeproof_verify_impl(const secp256k1_ecm
         }
         /* Not using secp256k1_rangeproof_serialize_point as we almost have it
          * serialized form already. */
-        secp256k1_sha256_write(&sha256_m, &signs[i], 1);
-        secp256k1_sha256_write(&sha256_m, &proof[offset], 32);
+        secp256k1_sha256_write(hash_ctx, &sha256_m, &signs[i], 1);
+        secp256k1_sha256_write(hash_ctx, &sha256_m, &proof[offset], 32);
         secp256k1_gej_set_ge(&pubs[npub], &c);
         secp256k1_gej_add_ge_var(&accj, &accj, &c, NULL);
         offset += 32;
@@ -645,11 +645,11 @@ SECP256K1_INLINE static int secp256k1_rangeproof_verify_impl(const secp256k1_ecm
         return 0;
     }
     if (extra_commit != NULL) {
-        secp256k1_sha256_write(&sha256_m, extra_commit, extra_commit_len);
+        secp256k1_sha256_write(hash_ctx, &sha256_m, extra_commit, extra_commit_len);
     }
-    secp256k1_sha256_finalize(&sha256_m, m);
+    secp256k1_sha256_finalize(hash_ctx, &sha256_m, m);
     secp256k1_sha256_clear(&sha256_m);
-    ret = secp256k1_borromean_verify(nonce ? evalues : NULL, e0, s, pubs, rsizes, rings, m, 32);
+    ret = secp256k1_borromean_verify(hash_ctx, nonce ? evalues : NULL, e0, s, pubs, rsizes, rings, m, 32);
     if (ret && nonce) {
         /* Given the nonce, try rewinding the witness to recover its initial state. */
         secp256k1_scalar blind;
@@ -657,7 +657,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_verify_impl(const secp256k1_ecm
         if (!ecmult_gen_ctx) {
             return 0;
         }
-        if (!secp256k1_rangeproof_rewind_inner(&blind, &vv, message_out, outlen, evalues, s, rsizes, rings, nonce, commit, proof, offset_post_header, genp)) {
+        if (!secp256k1_rangeproof_rewind_inner(hash_ctx, &blind, &vv, message_out, outlen, evalues, s, rsizes, rings, nonce, commit, proof, offset_post_header, genp)) {
             return 0;
         }
         /* Unwind apparently successful, see if the commitment can be reconstructed. */
diff --git a/src/modules/rangeproof/tests_impl.h b/src/modules/rangeproof/tests_impl.h
index 7538558e..002c3707 100644
--- a/src/modules/rangeproof/tests_impl.h
+++ b/src/modules/rangeproof/tests_impl.h
@@ -123,6 +123,7 @@ static void test_rangeproof_api_internal(void) {
 }
 
 static void test_borromean_internal(void) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     unsigned char e0[32];
     secp256k1_scalar s[64];
     secp256k1_gej pubs[64];
@@ -169,11 +170,11 @@ static void test_borromean_internal(void) {
         }
         c += rsizes[i];
     }
-    CHECK(secp256k1_borromean_sign(&CTX->ecmult_gen_ctx, e0, s, pubs, k, sec, rsizes, secidx, nrings, m, 32));
-    CHECK(secp256k1_borromean_verify(NULL, e0, s, pubs, rsizes, nrings, m, 32));
+    CHECK(secp256k1_borromean_sign(hash_ctx, &CTX->ecmult_gen_ctx, e0, s, pubs, k, sec, rsizes, secidx, nrings, m, 32));
+    CHECK(secp256k1_borromean_verify(hash_ctx, NULL, e0, s, pubs, rsizes, nrings, m, 32));
     i = testrand32() % c;
     secp256k1_scalar_negate(&s[i],&s[i]);
-    CHECK(!secp256k1_borromean_verify(NULL, e0, s, pubs, rsizes, nrings, m, 32));
+    CHECK(!secp256k1_borromean_verify(hash_ctx, NULL, e0, s, pubs, rsizes, nrings, m, 32));
     secp256k1_scalar_negate(&s[i],&s[i]);
     secp256k1_scalar_set_int(&one, 1);
     for(j = 0; j < 4; j++) {
@@ -183,7 +184,7 @@ static void test_borromean_internal(void) {
         } else {
             secp256k1_scalar_add(&s[i],&s[i],&one);
         }
-        CHECK(!secp256k1_borromean_verify(NULL, e0, s, pubs, rsizes, nrings, m, 32));
+        CHECK(!secp256k1_borromean_verify(hash_ctx, NULL, e0, s, pubs, rsizes, nrings, m, 32));
     }
 }
 
diff --git a/src/modules/schnorrsig_halfagg/main_impl.h b/src/modules/schnorrsig_halfagg/main_impl.h
index 5d424a38..466c819b 100644
--- a/src/modules/schnorrsig_halfagg/main_impl.h
+++ b/src/modules/schnorrsig_halfagg/main_impl.h
@@ -21,6 +21,7 @@ int secp256k1_schnorrsig_inc_aggregate(const secp256k1_context *ctx, unsigned ch
     size_t n;
     secp256k1_sha256 hash;
     secp256k1_scalar s;
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(aggsig != NULL);
@@ -47,11 +48,11 @@ int secp256k1_schnorrsig_inc_aggregate(const secp256k1_context *ctx, unsigned ch
             return 0;
         }
         /* write r_i */
-        secp256k1_sha256_write(&hash, &aggsig[i*32], 32);
+        secp256k1_sha256_write(hash_ctx, &hash, &aggsig[i*32], 32);
         /* write pk_i */
-        secp256k1_sha256_write(&hash, pk_ser, 32);
+        secp256k1_sha256_write(hash_ctx, &hash, pk_ser, 32);
         /* write m_i*/
-        secp256k1_sha256_write(&hash, &all_msgs32[i*32], 32);
+        secp256k1_sha256_write(hash_ctx, &hash, &all_msgs32[i*32], 32);
     }
 
     /* Compute s = s_old + sum_{i = n_before}^{n} z_i*s_i */
@@ -72,13 +73,13 @@ int secp256k1_schnorrsig_inc_aggregate(const secp256k1_context *ctx, unsigned ch
 
         /* Step 1: z_i = TaggedHash(...) */
         /* 1.a) Write into hash r_i, pk_i, m_i, r_i */
-        secp256k1_sha256_write(&hash, &new_sigs64[(i-n_before)*64], 32);
-        secp256k1_sha256_write(&hash, pk_ser, 32);
-        secp256k1_sha256_write(&hash, &all_msgs32[i*32], 32);
+        secp256k1_sha256_write(hash_ctx, &hash, &new_sigs64[(i-n_before)*64], 32);
+        secp256k1_sha256_write(hash_ctx, &hash, pk_ser, 32);
+        secp256k1_sha256_write(hash_ctx, &hash, &all_msgs32[i*32], 32);
         /* 1.b) Copy the hash */
         hashcopy = hash;
         /* 1.c) Finalize the copy to get zi*/
-        secp256k1_sha256_finalize(&hashcopy, hashoutput);
+        secp256k1_sha256_finalize(hash_ctx, &hashcopy, hashoutput);
         secp256k1_sha256_clear(&hashcopy);
         /* Note: No need to check overflow, comes from hash */
         secp256k1_scalar_set_b32(&zi, hashoutput, NULL);
@@ -105,6 +106,7 @@ int secp256k1_schnorrsig_aggregate(const secp256k1_context *ctx, unsigned char *
 }
 
 int secp256k1_schnorrsig_aggverify(const secp256k1_context *ctx, const secp256k1_xonly_pubkey *pubkeys, const unsigned char *msgs32, size_t n, const unsigned char *aggsig, size_t aggsig_len) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     size_t i;
     secp256k1_gej lhs, rhs;
     secp256k1_scalar s;
@@ -150,13 +152,13 @@ int secp256k1_schnorrsig_aggverify(const secp256k1_context *ctx, const secp256k1
 
         /* Step 1: z_i = TaggedHash(...) */
         /* 1.a) Write into hash r_i, pk_i, m_i, r_i */
-        secp256k1_sha256_write(&hash, &aggsig[i*32], 32);
-        secp256k1_sha256_write(&hash, pk_ser, 32);
-        secp256k1_sha256_write(&hash, &msgs32[i*32], 32);
+        secp256k1_sha256_write(hash_ctx, &hash, &aggsig[i*32], 32);
+        secp256k1_sha256_write(hash_ctx, &hash, pk_ser, 32);
+        secp256k1_sha256_write(hash_ctx, &hash, &msgs32[i*32], 32);
         /* 1.b) Copy the hash */
         hashcopy = hash;
         /* 1.c) Finalize the copy to get zi*/
-        secp256k1_sha256_finalize(&hashcopy, hashoutput);
+        secp256k1_sha256_finalize(hash_ctx, &hashcopy, hashoutput);
         secp256k1_sha256_clear(&hashcopy);
         secp256k1_scalar_set_b32(&zi, hashoutput, NULL);
 
@@ -170,7 +172,7 @@ int secp256k1_schnorrsig_aggverify(const secp256k1_context *ctx, const secp256k1
         }
 
         /* 2.b) e_i = int(hash_{BIP0340/challenge}(bytes(r_i) || pk_i || m_i)) mod n */
-        secp256k1_schnorrsig_challenge(&ei, &aggsig[i*32], &msgs32[i*32], 32, pk_ser);
+        secp256k1_schnorrsig_challenge(hash_ctx, &ei, &aggsig[i*32], &msgs32[i*32], 32, pk_ser);
         secp256k1_gej_set_ge(&ppj, &pp);
         /* 2.c) T_i = R_i + e_i*P_i */
         secp256k1_ecmult(&ti, &ppj, &ei, NULL);
diff --git a/src/modules/schnorrsig_halfagg/tests_impl.h b/src/modules/schnorrsig_halfagg/tests_impl.h
index 29d39b2c..f4092842 100644
--- a/src/modules/schnorrsig_halfagg/tests_impl.h
+++ b/src/modules/schnorrsig_halfagg/tests_impl.h
@@ -11,9 +11,10 @@
 void test_schnorrsig_sha256_tagged_aggregate(void) {
     static const unsigned char tag[] = {'H', 'a', 'l', 'f', 'A', 'g', 'g', '/', 'r', 'a', 'n', 'd', 'o', 'm', 'i', 'z', 'e', 'r'};
     secp256k1_sha256 sha_optimized;
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
 
     secp256k1_schnorrsig_sha256_tagged_aggregation(&sha_optimized);
-    test_sha256_tag_midstate(&sha_optimized, tag, sizeof(tag));
+    test_sha256_tag_midstate(hash_ctx, &sha_optimized, tag, sizeof(tag));
 }
 
 /* Create n many x-only pubkeys and sigs for random messages */
diff --git a/src/modules/surjection/main_impl.h b/src/modules/surjection/main_impl.h
index 248efe14..968cc477 100644
--- a/src/modules/surjection/main_impl.h
+++ b/src/modules/surjection/main_impl.h
@@ -138,7 +138,7 @@ static void secp256k1_surjectionproof_csprng_init(secp256k1_surjectionproof_cspr
     csprng->state_i = 0;
 }
 
-static size_t secp256k1_surjectionproof_csprng_next(secp256k1_surjectionproof_csprng *csprng, size_t rand_max) {
+static size_t secp256k1_surjectionproof_csprng_next(const secp256k1_hash_ctx *hash_ctx, secp256k1_surjectionproof_csprng *csprng, size_t rand_max) {
     /* The number of random bytes to read for each random sample */
     const size_t increment = rand_max > 256 ? 2 : 1;
     /* The maximum value expressable by the number of random bytes we read */
@@ -151,8 +151,8 @@ static size_t secp256k1_surjectionproof_csprng_next(secp256k1_surjectionproof_cs
         if (csprng->state_i + increment >= 32) {
             secp256k1_sha256 sha;
             secp256k1_sha256_initialize(&sha);
-            secp256k1_sha256_write(&sha, csprng->state, 32);
-            secp256k1_sha256_finalize(&sha, csprng->state);
+            secp256k1_sha256_write(hash_ctx, &sha, csprng->state, 32);
+            secp256k1_sha256_finalize(hash_ctx, &sha, csprng->state);
             secp256k1_sha256_clear(&sha);
             csprng->state_i = 0;
         }
@@ -212,6 +212,7 @@ void secp256k1_surjectionproof_destroy(secp256k1_surjectionproof* proof) {
 }
 
 int secp256k1_surjectionproof_initialize(const secp256k1_context* ctx, secp256k1_surjectionproof* proof, size_t *input_index, const secp256k1_fixed_asset_tag* fixed_input_tags, const size_t n_input_tags, const size_t n_input_tags_to_use, const secp256k1_fixed_asset_tag* fixed_output_tag, const size_t n_max_iterations, const unsigned char *random_seed32) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_surjectionproof_csprng csprng;
     size_t n_iterations = 0;
 
@@ -239,7 +240,7 @@ int secp256k1_surjectionproof_initialize(const secp256k1_context* ctx, secp256k1
         for (i = 0; i < n_input_tags_to_use; i++) {
             while (1) {
                 size_t next_input_index;
-                next_input_index = secp256k1_surjectionproof_csprng_next(&csprng, n_input_tags);
+                next_input_index = secp256k1_surjectionproof_csprng_next(hash_ctx, &csprng, n_input_tags);
                 if (secp256k1_memcmp_var(&fixed_input_tags[next_input_index], fixed_output_tag, sizeof(*fixed_output_tag)) == 0) {
                     *input_index = next_input_index;
                     has_output_tag = 1;
@@ -270,6 +271,7 @@ int secp256k1_surjectionproof_initialize(const secp256k1_context* ctx, secp256k1
 }
 
 int secp256k1_surjectionproof_generate(const secp256k1_context* ctx, secp256k1_surjectionproof* proof, const secp256k1_generator* ephemeral_input_tags, size_t n_ephemeral_input_tags, const secp256k1_generator* ephemeral_output_tag, size_t input_index, const unsigned char *input_blinding_key, const unsigned char *output_blinding_key) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_scalar blinding_key;
     secp256k1_scalar tmps;
     secp256k1_scalar nonce;
@@ -334,8 +336,8 @@ int secp256k1_surjectionproof_generate(const secp256k1_context* ctx, secp256k1_s
     /* Produce signature */
     rsizes[0] = (int) n_used_pubkeys;
     indices[0] = (int) ring_input_index;
-    secp256k1_surjection_genmessage(msg32, ephemeral_input_tags, n_total_pubkeys, ephemeral_output_tag);
-    if (secp256k1_surjection_genrand(borromean_s, n_used_pubkeys, &blinding_key) == 0) {
+    secp256k1_surjection_genmessage(hash_ctx, msg32, ephemeral_input_tags, n_total_pubkeys, ephemeral_output_tag);
+    if (secp256k1_surjection_genrand(hash_ctx, borromean_s, n_used_pubkeys, &blinding_key) == 0) {
         return 0;
     }
     /* Borromean sign will overwrite one of the s values we just generated, so use
@@ -343,7 +345,7 @@ int secp256k1_surjectionproof_generate(const secp256k1_context* ctx, secp256k1_s
      * homage to the rangeproof code which does this very cleverly to encode messages. */
     nonce = borromean_s[ring_input_index];
     secp256k1_scalar_clear(&borromean_s[ring_input_index]);
-    if (secp256k1_borromean_sign(&ctx->ecmult_gen_ctx, &proof->data[0], borromean_s, ring_pubkeys, &nonce, &blinding_key, rsizes, indices, 1, msg32, 32) == 0) {
+    if (secp256k1_borromean_sign(hash_ctx, &ctx->ecmult_gen_ctx, &proof->data[0], borromean_s, ring_pubkeys, &nonce, &blinding_key, rsizes, indices, 1, msg32, 32) == 0) {
         return 0;
     }
     for (i = 0; i < n_used_pubkeys; i++) {
@@ -356,6 +358,7 @@ int secp256k1_surjectionproof_generate(const secp256k1_context* ctx, secp256k1_s
 static
 #endif
 int secp256k1_surjectionproof_verify(const secp256k1_context* ctx, const secp256k1_surjectionproof* proof, const secp256k1_generator* ephemeral_input_tags, size_t n_ephemeral_input_tags, const secp256k1_generator* ephemeral_output_tag) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     size_t rsizes[1];    /* array needed for borromean sig API */
     size_t i;
     size_t n_total_pubkeys;
@@ -394,8 +397,8 @@ int secp256k1_surjectionproof_verify(const secp256k1_context* ctx, const secp256
             return 0;
         }
     }
-    secp256k1_surjection_genmessage(msg32, ephemeral_input_tags, n_total_pubkeys, ephemeral_output_tag);
-    return secp256k1_borromean_verify(NULL, &proof->data[0], borromean_s, ring_pubkeys, rsizes, 1, msg32, 32);
+    secp256k1_surjection_genmessage(hash_ctx, msg32, ephemeral_input_tags, n_total_pubkeys, ephemeral_output_tag);
+    return secp256k1_borromean_verify(hash_ctx, NULL, &proof->data[0], borromean_s, ring_pubkeys, rsizes, 1, msg32, 32);
 }
 
 #endif
diff --git a/src/modules/surjection/surjection_impl.h b/src/modules/surjection/surjection_impl.h
index 0776e4c8..bccced52 100644
--- a/src/modules/surjection/surjection_impl.h
+++ b/src/modules/surjection/surjection_impl.h
@@ -15,7 +15,7 @@
 #include "../../scalar.h"
 #include "../../hash.h"
 
-SECP256K1_INLINE static void secp256k1_surjection_genmessage(unsigned char *msg32, const secp256k1_generator *ephemeral_input_tags, size_t n_input_tags, const secp256k1_generator *ephemeral_output_tag) {
+SECP256K1_INLINE static void secp256k1_surjection_genmessage(const secp256k1_hash_ctx *hash_ctx, unsigned char *msg32, const secp256k1_generator *ephemeral_input_tags, size_t n_input_tags, const secp256k1_generator *ephemeral_output_tag) {
     /* compute message */
     size_t i;
     unsigned char pk_ser[33];
@@ -26,16 +26,16 @@ SECP256K1_INLINE static void secp256k1_surjection_genmessage(unsigned char *msg3
     for (i = 0; i < n_input_tags; i++) {
         pk_ser[0] = 2 + (ephemeral_input_tags[i].data[63] & 1);
         memcpy(&pk_ser[1], &ephemeral_input_tags[i].data[0], 32);
-        secp256k1_sha256_write(&sha256_en, pk_ser, pk_len);
+        secp256k1_sha256_write(hash_ctx, &sha256_en, pk_ser, pk_len);
     }
     pk_ser[0] = 2 + (ephemeral_output_tag->data[63] & 1);
     memcpy(&pk_ser[1], &ephemeral_output_tag->data[0], 32);
-    secp256k1_sha256_write(&sha256_en, pk_ser, pk_len);
-    secp256k1_sha256_finalize(&sha256_en, msg32);
+    secp256k1_sha256_write(hash_ctx, &sha256_en, pk_ser, pk_len);
+    secp256k1_sha256_finalize(hash_ctx, &sha256_en, msg32);
     secp256k1_sha256_clear(&sha256_en);
 }
 
-SECP256K1_INLINE static int secp256k1_surjection_genrand(secp256k1_scalar *s, size_t ns, const secp256k1_scalar *blinding_key) {
+SECP256K1_INLINE static int secp256k1_surjection_genrand(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar *s, size_t ns, const secp256k1_scalar *blinding_key) {
     size_t i;
     unsigned char sec_input[36];
     secp256k1_sha256 sha256_en;
@@ -50,8 +50,8 @@ SECP256K1_INLINE static int secp256k1_surjection_genrand(secp256k1_scalar *s, si
         sec_input[3] = i >> 24;
 
         secp256k1_sha256_initialize(&sha256_en);
-        secp256k1_sha256_write(&sha256_en, sec_input, 36);
-        secp256k1_sha256_finalize(&sha256_en, sec_input);
+        secp256k1_sha256_write(hash_ctx, &sha256_en, sec_input, 36);
+        secp256k1_sha256_finalize(hash_ctx, &sha256_en, sec_input);
         secp256k1_sha256_clear(&sha256_en);
         secp256k1_scalar_set_b32(&s[i], sec_input, &overflow);
         if (overflow == 1) {
diff --git a/src/modules/surjection/tests_impl.h b/src/modules/surjection/tests_impl.h
index d81ac624..7ba328c3 100644
--- a/src/modules/surjection/tests_impl.h
+++ b/src/modules/surjection/tests_impl.h
@@ -26,7 +26,7 @@ static void test_surjectionproof_api(void) {
     size_t  serialized_len;
     secp256k1_surjectionproof proof;
     secp256k1_surjectionproof* proof_on_heap;
-    size_t n_inputs = sizeof(fixed_input_tags) / sizeof(fixed_input_tags[0]);
+    size_t n_inputs = ARRAY_SIZE(fixed_input_tags);
     size_t input_index;
     size_t i;
 
@@ -146,7 +146,7 @@ static void test_input_selection(size_t n_inputs) {
     size_t try_count = n_inputs * 100;
     secp256k1_surjectionproof proof;
     secp256k1_fixed_asset_tag fixed_input_tags[1000];
-    const size_t max_n_inputs = sizeof(fixed_input_tags) / sizeof(fixed_input_tags[0]) - 1;
+    const size_t max_n_inputs = ARRAY_SIZE(fixed_input_tags) - 1;
 
     CHECK(n_inputs < max_n_inputs);
     testrand256(seed);
@@ -313,7 +313,7 @@ static void test_gen_verify(size_t n_inputs, size_t n_used) {
     secp256k1_fixed_asset_tag fixed_input_tags[1000];
     secp256k1_generator ephemeral_input_tags[1000];
     unsigned char *input_blinding_key[1000];
-    const size_t max_n_inputs = sizeof(fixed_input_tags) / sizeof(fixed_input_tags[0]) - 1;
+    const size_t max_n_inputs = ARRAY_SIZE(fixed_input_tags) - 1;
     size_t try_count = n_inputs * 100;
     size_t key_index;
     size_t input_index;
@@ -395,6 +395,7 @@ static void test_gen_verify(size_t n_inputs, size_t n_used) {
 
 /* check that a proof with empty n_used_inputs is invalid */
 static void test_no_used_inputs_verify(void) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     secp256k1_surjectionproof proof;
     secp256k1_fixed_asset_tag fixed_input_tag;
     secp256k1_fixed_asset_tag fixed_output_tag;
@@ -422,10 +423,10 @@ static void test_no_used_inputs_verify(void) {
 
     /* create "borromean signature" which is just a hash of metadata (pubkeys, etc) in this case */
     secp256k1_generator_load(&output, &ephemeral_output_tag);
-    secp256k1_surjection_genmessage(proof.data, ephemeral_input_tags, 1, &ephemeral_output_tag);
+    secp256k1_surjection_genmessage(hash_ctx, proof.data, ephemeral_input_tags, 1, &ephemeral_output_tag);
     secp256k1_sha256_initialize(&sha256_e0);
-    secp256k1_sha256_write(&sha256_e0, proof.data, 32);
-    secp256k1_sha256_finalize(&sha256_e0, proof.data);
+    secp256k1_sha256_write(hash_ctx, &sha256_e0, proof.data, 32);
+    secp256k1_sha256_finalize(hash_ctx, &sha256_e0, proof.data);
 
     result = secp256k1_surjectionproof_verify(CTX, &proof, ephemeral_input_tags, n_ephemeral_input_tags, &ephemeral_output_tag);
     CHECK(result == 0);
diff --git a/src/modules/whitelist/main_impl.h b/src/modules/whitelist/main_impl.h
index 301d2476..28c563b2 100644
--- a/src/modules/whitelist/main_impl.h
+++ b/src/modules/whitelist/main_impl.h
@@ -13,6 +13,7 @@
 #define MAX_KEYS SECP256K1_WHITELIST_MAX_N_KEYS  /* shorter alias */
 
 int secp256k1_whitelist_sign(const secp256k1_context* ctx, secp256k1_whitelist_signature *sig, const secp256k1_pubkey *online_pubkeys, const secp256k1_pubkey *offline_pubkeys, const size_t n_keys, const secp256k1_pubkey *sub_pubkey, const unsigned char *online_seckey, const unsigned char *summed_seckey, const size_t index) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_gej pubs[MAX_KEYS];
     secp256k1_scalar s[MAX_KEYS];
     secp256k1_scalar sec, non;
@@ -85,7 +86,7 @@ int secp256k1_whitelist_sign(const secp256k1_context* ctx, secp256k1_whitelist_s
     /* Actually sign */
     if (ret) {
         sig->n_keys = n_keys;
-        ret = secp256k1_borromean_sign(&ctx->ecmult_gen_ctx, &sig->data[0], s, pubs, &non, &sec, &n_keys, &index, 1, msg32, 32);
+        ret = secp256k1_borromean_sign(hash_ctx, &ctx->ecmult_gen_ctx, &sig->data[0], s, pubs, &non, &sec, &n_keys, &index, 1, msg32, 32);
         /* Signing will change s[index], so update in the sig structure */
         secp256k1_scalar_get_b32(&sig->data[32 * (index + 1)], &s[index]);
     }
@@ -96,6 +97,7 @@ int secp256k1_whitelist_sign(const secp256k1_context* ctx, secp256k1_whitelist_s
 }
 
 int secp256k1_whitelist_verify(const secp256k1_context* ctx, const secp256k1_whitelist_signature *sig, const secp256k1_pubkey *online_pubkeys, const secp256k1_pubkey *offline_pubkeys, const size_t n_keys, const secp256k1_pubkey *sub_pubkey) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     secp256k1_scalar s[MAX_KEYS];
     secp256k1_gej pubs[MAX_KEYS];
     unsigned char msg32[32];
@@ -123,7 +125,7 @@ int secp256k1_whitelist_verify(const secp256k1_context* ctx, const secp256k1_whi
         return 0;
     }
     /* Do verification */
-    return secp256k1_borromean_verify(NULL, &sig->data[0], s, pubs, &sig->n_keys, 1, msg32, 32);
+    return secp256k1_borromean_verify(hash_ctx, NULL, &sig->data[0], s, pubs, &sig->n_keys, 1, msg32, 32);
 }
 
 size_t secp256k1_whitelist_signature_n_keys(const secp256k1_whitelist_signature *sig) {
diff --git a/src/modules/whitelist/whitelist_impl.h b/src/modules/whitelist/whitelist_impl.h
index edb90b4f..9a9023fb 100644
--- a/src/modules/whitelist/whitelist_impl.h
+++ b/src/modules/whitelist/whitelist_impl.h
@@ -7,7 +7,7 @@
 #ifndef SECP256K1_WHITELIST_IMPL_H
 #define SECP256K1_WHITELIST_IMPL_H
 
-static int secp256k1_whitelist_hash_pubkey(secp256k1_scalar* output, secp256k1_gej* pubkey) {
+static int secp256k1_whitelist_hash_pubkey(const secp256k1_hash_ctx *hash_ctx, secp256k1_scalar* output, secp256k1_gej* pubkey) {
     unsigned char h[32];
     unsigned char c[33];
     secp256k1_sha256 sha;
@@ -22,8 +22,8 @@ static int secp256k1_whitelist_hash_pubkey(secp256k1_scalar* output, secp256k1_g
         return 0;
     }
     secp256k1_eckey_pubkey_serialize33(&ge, c);
-    secp256k1_sha256_write(&sha, c, size);
-    secp256k1_sha256_finalize(&sha, h);
+    secp256k1_sha256_write(hash_ctx, &sha, c, size);
+    secp256k1_sha256_finalize(hash_ctx, &sha, h);
     secp256k1_sha256_clear(&sha);
 
     secp256k1_scalar_set_b32(output, h, &overflow);
@@ -35,14 +35,14 @@ static int secp256k1_whitelist_hash_pubkey(secp256k1_scalar* output, secp256k1_g
     return 1;
 }
 
-static int secp256k1_whitelist_tweak_pubkey(secp256k1_gej* pub_tweaked) {
+static int secp256k1_whitelist_tweak_pubkey(const secp256k1_hash_ctx *hash_ctx, secp256k1_gej* pub_tweaked) {
     secp256k1_scalar tweak;
     secp256k1_scalar zero;
     int ret;
 
     secp256k1_scalar_set_int(&zero, 0);
 
-    ret = secp256k1_whitelist_hash_pubkey(&tweak, pub_tweaked);
+    ret = secp256k1_whitelist_hash_pubkey(hash_ctx, &tweak, pub_tweaked);
     if (ret) {
         secp256k1_ecmult(pub_tweaked, pub_tweaked, &tweak, &zero);
     }
@@ -51,6 +51,7 @@ static int secp256k1_whitelist_tweak_pubkey(secp256k1_gej* pub_tweaked) {
 
 static int secp256k1_whitelist_compute_tweaked_privkey(const secp256k1_context* ctx, secp256k1_scalar* skey, const unsigned char *online_key, const unsigned char *summed_key) {
     secp256k1_scalar tweak;
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     int ret = 1;
     int overflow = 0;
 
@@ -61,7 +62,7 @@ static int secp256k1_whitelist_compute_tweaked_privkey(const secp256k1_context*
     if (ret) {
         secp256k1_gej pkeyj;
         secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pkeyj, skey);
-        ret = secp256k1_whitelist_hash_pubkey(&tweak, &pkeyj);
+        ret = secp256k1_whitelist_hash_pubkey(hash_ctx, &tweak, &pkeyj);
     }
     if (ret) {
         secp256k1_scalar sonline;
@@ -86,6 +87,7 @@ static int secp256k1_whitelist_compute_tweaked_privkey(const secp256k1_context*
  * for the ring signature; also produce a commitment to every one that will
  * be our "message". */
 static int secp256k1_whitelist_compute_keys_and_message(const secp256k1_context* ctx, unsigned char *msg32, secp256k1_gej *keys, const secp256k1_pubkey *online_pubkeys, const secp256k1_pubkey *offline_pubkeys, const int n_keys, const secp256k1_pubkey *sub_pubkey) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     unsigned char c[33];
     size_t size = 33;
     secp256k1_sha256 sha;
@@ -97,7 +99,7 @@ static int secp256k1_whitelist_compute_keys_and_message(const secp256k1_context*
 
     /* commit to sub-key */
     secp256k1_eckey_pubkey_serialize33(&subkey_ge, c);
-    secp256k1_sha256_write(&sha, c, size);
+    secp256k1_sha256_write(hash_ctx, &sha, c, size);
     for (i = 0; i < n_keys; i++) {
         secp256k1_ge offline_ge;
         secp256k1_ge online_ge;
@@ -106,18 +108,18 @@ static int secp256k1_whitelist_compute_keys_and_message(const secp256k1_context*
         /* commit to fixed keys */
         secp256k1_pubkey_load(ctx, &offline_ge, &offline_pubkeys[i]);
         secp256k1_eckey_pubkey_serialize33(&offline_ge, c);
-        secp256k1_sha256_write(&sha, c, size);
+        secp256k1_sha256_write(hash_ctx, &sha, c, size);
         secp256k1_pubkey_load(ctx, &online_ge, &online_pubkeys[i]);
         secp256k1_eckey_pubkey_serialize33(&online_ge, c);
-        secp256k1_sha256_write(&sha, c, size);
+        secp256k1_sha256_write(hash_ctx, &sha, c, size);
 
         /* compute tweaked keys */
         secp256k1_gej_set_ge(&tweaked_gej, &offline_ge);
         secp256k1_gej_add_ge_var(&tweaked_gej, &tweaked_gej, &subkey_ge, NULL);
-        secp256k1_whitelist_tweak_pubkey(&tweaked_gej);
+        secp256k1_whitelist_tweak_pubkey(hash_ctx, &tweaked_gej);
         secp256k1_gej_add_ge_var(&keys[i], &tweaked_gej, &online_ge, NULL);
     }
-    secp256k1_sha256_finalize(&sha, msg32);
+    secp256k1_sha256_finalize(hash_ctx, &sha, msg32);
     secp256k1_sha256_clear(&sha);
     return 1;
 }
diff --git a/src/secp256k1.c b/src/secp256k1.c
index 532c9fdf..a3d37bd2 100644
--- a/src/secp256k1.c
+++ b/src/secp256k1.c
@@ -561,6 +561,7 @@ const secp256k1_nonce_function secp256k1_nonce_function_default = nonce_function
 
 static int secp256k1_ecdsa_sign_inner(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, int* recid, secp256k1_sha256* s2c_sha, secp256k1_ecdsa_s2c_opening *s2c_opening, const unsigned char* s2c_data32, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
     secp256k1_scalar sec, non, msg;
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(ctx);
     int ret = 0;
     int is_sec_valid;
     unsigned char nonce32[32];
@@ -575,8 +576,8 @@ static int secp256k1_ecdsa_sign_inner(const secp256k1_context* ctx, secp256k1_sc
      * because we need to ensure that s2c_data is actually hashed into the nonce and
      * not just ignored. Otherwise an attacker can exfiltrate the secret key by
      * signing the same message thrice with different commitments. */
-    VERIFY_CHECK(s2c_data32 == NULL || noncefp == secp256k1_nonce_function_default);
-    
+    VERIFY_CHECK(s2c_data32 == NULL || noncefp == NULL || noncefp == secp256k1_nonce_function_default);
+
     /* Fail if the secret key is invalid. */
     is_sec_valid = secp256k1_scalar_set_b32_seckey(&sec, seckey);
     secp256k1_scalar_cmov(&sec, &secp256k1_scalar_one, !is_sec_valid);
@@ -615,7 +616,7 @@ static int secp256k1_ecdsa_sign_inner(const secp256k1_context* ctx, secp256k1_sc
                 secp256k1_declassify(ctx, &nonce_p.infinity, sizeof(nonce_p.infinity));
 
                 /* Tweak nonce with s2c commitment. */
-                ret = secp256k1_ec_commit_seckey(&non, &nonce_p, s2c_sha, s2c_data32, 32);
+                ret = secp256k1_ec_commit_seckey(hash_ctx, &non, &nonce_p, s2c_sha, s2c_data32, 32);
                 secp256k1_declassify(ctx, &ret, sizeof(ret)); /* may be secret that the tweak falied, but happens with negligible probability */
                 if (!ret) {
                     break;
diff --git a/src/tests.c b/src/tests.c
index bb0bb190..5d5e833d 100644
--- a/src/tests.c
+++ b/src/tests.c
@@ -4387,6 +4387,7 @@ static void run_ec_combine(void) {
 }
 
 static void test_ec_commit(void) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     secp256k1_scalar seckey_s;
     secp256k1_ge pubkey;
     secp256k1_gej pubkeyj;
@@ -4402,29 +4403,30 @@ static void test_ec_commit(void) {
 
     /* Commit to data and verify */
     secp256k1_sha256_initialize(&sha);
-    CHECK(secp256k1_ec_commit(&commitment, &pubkey, &sha, data, 32) == 1);
+    CHECK(secp256k1_ec_commit(hash_ctx, &commitment, &pubkey, &sha, data, 32) == 1);
     secp256k1_sha256_initialize(&sha);
-    CHECK(secp256k1_ec_commit_verify(&commitment, &pubkey, &sha, data, 32) == 1);
+    CHECK(secp256k1_ec_commit_verify(hash_ctx, &commitment, &pubkey, &sha, data, 32) == 1);
     secp256k1_sha256_initialize(&sha);
-    CHECK(secp256k1_ec_commit_seckey(&seckey_s, &pubkey, &sha, data, 32) == 1);
+    CHECK(secp256k1_ec_commit_seckey(hash_ctx, &seckey_s, &pubkey, &sha, data, 32) == 1);
     secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &pubkeyj, &seckey_s);
     secp256k1_gej_eq_ge_var(&pubkeyj, &commitment);
 
     /* Check that verification fails with different data */
     secp256k1_sha256_initialize(&sha);
-    CHECK(secp256k1_ec_commit_verify(&commitment, &pubkey, &sha, data, 31) == 0);
+    CHECK(secp256k1_ec_commit_verify(hash_ctx, &commitment, &pubkey, &sha, data, 31) == 0);
 
     /* Check that commmitting fails when the inner pubkey is the point at
      * infinity */
     secp256k1_sha256_initialize(&sha);
     secp256k1_ge_set_infinity(&pubkey);
-    CHECK(secp256k1_ec_commit(&commitment, &pubkey, &sha, data, 32) == 0);
+    CHECK(secp256k1_ec_commit(hash_ctx, &commitment, &pubkey, &sha, data, 32) == 0);
     secp256k1_scalar_set_int(&seckey_s, 0);
-    CHECK(secp256k1_ec_commit_seckey(&seckey_s, &pubkey, &sha, data, 32) == 0);
-    CHECK(secp256k1_ec_commit_verify(&commitment, &pubkey, &sha, data, 32) == 0);
+    CHECK(secp256k1_ec_commit_seckey(hash_ctx, &seckey_s, &pubkey, &sha, data, 32) == 0);
+    CHECK(secp256k1_ec_commit_verify(hash_ctx, &commitment, &pubkey, &sha, data, 32) == 0);
 }
 
 static void test_ec_commit_api(void) {
+    const secp256k1_hash_ctx *hash_ctx = secp256k1_get_hash_context(CTX);
     unsigned char seckey[32];
     secp256k1_scalar seckey_s;
     secp256k1_ge pubkey;
@@ -4442,17 +4444,17 @@ static void test_ec_commit_api(void) {
     secp256k1_ge_set_gej(&pubkey, &pubkeyj);
 
     secp256k1_sha256_initialize(&sha);
-    CHECK(secp256k1_ec_commit(&commitment, &pubkey, &sha, data, 1) == 1);
+    CHECK(secp256k1_ec_commit(hash_ctx, &commitment, &pubkey, &sha, data, 1) == 1);
     /* The same pubkey can be both input and output of the function */
     {
         secp256k1_ge pubkey_tmp = pubkey;
         secp256k1_sha256_initialize(&sha);
-        CHECK(secp256k1_ec_commit(&pubkey_tmp, &pubkey_tmp, &sha, data, 1) == 1);
+        CHECK(secp256k1_ec_commit(hash_ctx, &pubkey_tmp, &pubkey_tmp, &sha, data, 1) == 1);
         secp256k1_ge_eq_var(&commitment, &pubkey_tmp);
     }
 
     secp256k1_sha256_initialize(&sha);
-    CHECK(secp256k1_ec_commit_verify(&commitment, &pubkey, &sha, data, 1) == 1);
+    CHECK(secp256k1_ec_commit_verify(hash_ctx, &commitment, &pubkey, &sha, data, 1) == 1);
 }
 
 static void run_ec_commit(void) {