frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

modules: Port bitcoin-core/secp256k1#1579 to zkp-specific code

Browse Source
This commit is contained in:
DarkWindman
2026-02-18 16:26:07 +02:00
parent 913be29ea2
commit e3bddfa750
13 changed files with 34 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/modules/bppp/bppp_transcript_impl.h
View File

@@ -34,6 +34,7 @@ static void secp256k1_bppp_challenge_scalar(secp256k1_scalar* ch, const secp256k
secp256k1_bppp_le64(buf, idx);
secp256k1_sha256_write(&sha, buf, 8);
secp256k1_sha256_finalize(&sha, buf);
secp256k1_sha256_clear(&sha);
secp256k1_scalar_set_b32(ch, buf, NULL);
}

2
src/modules/ecdsa_adaptor/dleq_impl.h
View File

@@ -46,6 +46,7 @@ static int secp256k1_dleq_nonce(secp256k1_scalar *k, const unsigned char *sk32,
secp256k1_sha256_write(&sha, p1_33, size);
secp256k1_sha256_write(&sha, p2_33, size);
secp256k1_sha256_finalize(&sha, buf);
secp256k1_sha256_clear(&sha);
if (!noncefp(nonce, buf, sk32, gen2_33, dleq_algo, sizeof(dleq_algo), ndata)) {
return 0;
@@ -71,6 +72,7 @@ static void secp256k1_dleq_challenge(secp256k1_scalar *e, secp256k1_ge *gen2, se
secp256k1_dleq_hash_point(&sha, r1);
secp256k1_dleq_hash_point(&sha, r2);
secp256k1_sha256_finalize(&sha, buf);
secp256k1_sha256_clear(&sha);
secp256k1_scalar_set_b32(e, buf, NULL);
}

2
src/modules/ecdsa_adaptor/main_impl.h
View File

@@ -114,6 +114,7 @@ static int nonce_function_ecdsa_adaptor(unsigned char *nonce32, const unsigned c
secp256k1_nonce_function_ecdsa_adaptor_sha256_tagged_aux(&sha);
secp256k1_sha256_write(&sha, data, 32);
secp256k1_sha256_finalize(&sha, masked_key);
secp256k1_sha256_clear(&sha);
for (i = 0; i < 32; i++) {
masked_key[i] ^= key32[i];
}
@@ -141,6 +142,7 @@ static int nonce_function_ecdsa_adaptor(unsigned char *nonce32, const unsigned c
secp256k1_sha256_write(&sha, pk33, 33);
secp256k1_sha256_write(&sha, msg32, 32);
secp256k1_sha256_finalize(&sha, nonce32);
secp256k1_sha256_clear(&sha);
return 1;
}

4
src/modules/ecdsa_s2c/main_impl.h
View File

@@ -86,6 +86,7 @@ int secp256k1_ecdsa_s2c_sign(const secp256k1_context* ctx, secp256k1_ecdsa_signa
secp256k1_s2c_ecdsa_data_sha256_tagged(&s2c_sha);
secp256k1_sha256_write(&s2c_sha, s2c_data32, 32);
secp256k1_sha256_finalize(&s2c_sha, ndata);
secp256k1_sha256_clear(&s2c_sha);
secp256k1_s2c_ecdsa_point_sha256_tagged(&s2c_sha);
ret = secp256k1_ecdsa_sign_inner(ctx, &r, &s, NULL, &s2c_sha, s2c_opening, s2c_data32, msg32, seckey, NULL, ndata);
@@ -147,6 +148,7 @@ int secp256k1_ecdsa_anti_exfil_host_commit(const secp256k1_context* ctx, unsigne
secp256k1_s2c_ecdsa_data_sha256_tagged(&sha);
secp256k1_sha256_write(&sha, rand32, 32);
secp256k1_sha256_finalize(&sha, rand_commitment32);
secp256k1_sha256_clear(&sha);
return 1;
}
@@ -180,7 +182,7 @@ int secp256k1_ecdsa_anti_exfil_signer_commit(const secp256k1_context* ctx, secp2
secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &k);
secp256k1_ge_set_gej(&r, &rj);
secp256k1_ecdsa_s2c_opening_save(opening, &r);
memset(nonce32, 0, 32);
secp256k1_memclear(nonce32, 32);
secp256k1_scalar_clear(&k);
return 1;
}

2
src/modules/generator/main_impl.h
View File

@@ -222,6 +222,7 @@ static int secp256k1_generator_generate_internal(const secp256k1_context* ctx, s
secp256k1_sha256_write(&sha256, prefix1, 16);
secp256k1_sha256_write(&sha256, key32, 32);
secp256k1_sha256_finalize(&sha256, b32);
secp256k1_sha256_clear(&sha256);
ret &= secp256k1_fe_set_b32_limit(&t, b32);
shallue_van_de_woestijne(&add, &t);
if (blind32) {
@@ -234,6 +235,7 @@ static int secp256k1_generator_generate_internal(const secp256k1_context* ctx, s
secp256k1_sha256_write(&sha256, prefix2, 16);
secp256k1_sha256_write(&sha256, key32, 32);
secp256k1_sha256_finalize(&sha256, b32);
secp256k1_sha256_clear(&sha256);
ret &= secp256k1_fe_set_b32_limit(&t, b32);
shallue_van_de_woestijne(&add, &t);
secp256k1_gej_add_ge(&accum, &accum, &add);

2
src/modules/generator/pedersen_impl.h
View File

@@ -28,7 +28,7 @@ static void secp256k1_pedersen_scalar_set_u64(secp256k1_scalar *sec, uint64_t va
value <<= 8;
}
secp256k1_scalar_set_b32(sec, data, NULL);
memset(data, 0, 32);
secp256k1_memclear(data, 32);
}
static void secp256k1_pedersen_ecmult_small(secp256k1_gej *r, uint64_t gn, const secp256k1_ge* genp) {

5
src/modules/rangeproof/borromean_impl.h
View File

@@ -33,6 +33,7 @@ SECP256K1_INLINE static void secp256k1_borromean_hash(unsigned char *hash, const
secp256k1_sha256_write(&sha256_en, ring, 4);
secp256k1_sha256_write(&sha256_en, epos, 4);
secp256k1_sha256_finalize(&sha256_en, hash);
secp256k1_sha256_clear(&sha256_en);
}
/** "Borromean" ring signature.
@@ -99,6 +100,7 @@ int secp256k1_borromean_verify(secp256k1_scalar *evalues, const unsigned char *e
}
secp256k1_sha256_write(&sha256_e0, m, mlen);
secp256k1_sha256_finalize(&sha256_e0, tmp);
secp256k1_sha256_clear(&sha256_e0);
return secp256k1_memcmp_var(e0, tmp, 32) == 0;
}
@@ -157,6 +159,7 @@ int secp256k1_borromean_sign(const secp256k1_ecmult_gen_context *ecmult_gen_ctx,
}
secp256k1_sha256_write(&sha256_e0, m, mlen);
secp256k1_sha256_finalize(&sha256_e0, e0);
secp256k1_sha256_clear(&sha256_e0);
count = 0;
for (i = 0; i < nrings; i++) {
VERIFY_CHECK(INT_MAX - count > rsizes[i]);
@@ -189,7 +192,7 @@ int secp256k1_borromean_sign(const secp256k1_ecmult_gen_context *ecmult_gen_ctx,
secp256k1_scalar_clear(&ens);
secp256k1_ge_clear(&rge);
secp256k1_gej_clear(&rgej);
memset(tmp, 0, 33);
secp256k1_memclear(tmp, 33);
return 1;
}

13
src/modules/rangeproof/rangeproof_impl.h
View File

@@ -76,7 +76,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_genrand(secp256k1_scalar *sec,
secp256k1_rangeproof_serialize_point(rngseed + 32 + 33, genp);
memcpy(rngseed + 33 + 33 + 32, proof, len);
secp256k1_rfc6979_hmac_sha256_initialize(&rng, rngseed, 32 + 33 + 33 + len);
secp256k1_scalar_clear(&acc);
secp256k1_scalar_set_int(&acc, 0);
npub = 0;
ret = 1;
for (i = 0; i < rings; i++) {
@@ -105,8 +105,9 @@ SECP256K1_INLINE static int secp256k1_rangeproof_genrand(secp256k1_scalar *sec,
}
}
secp256k1_rfc6979_hmac_sha256_finalize(&rng);
secp256k1_rfc6979_hmac_sha256_clear(&rng);
secp256k1_scalar_clear(&acc);
memset(tmp, 0, 32);
secp256k1_memclear(tmp, 32);
return ret;
}
@@ -269,7 +270,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_sign_impl(const secp256k1_ecmul
if (!secp256k1_rangeproof_genrand(sec, s, prep, rsizes, rings, nonce, commit, proof, len, genp)) {
return 0;
}
memset(prep, 0, 4096);
secp256k1_memclear(prep, 4096);
for (i = 0; i < rings; i++) {
/* Sign will overwrite the non-forged signature, move that random value into the nonce. */
k[i] = s[i * 4 + secidx[i]];
@@ -320,6 +321,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_sign_impl(const secp256k1_ecmul
secp256k1_sha256_write(&sha256_m, extra_commit, extra_commit_len);
}
secp256k1_sha256_finalize(&sha256_m, tmp);
secp256k1_sha256_clear(&sha256_m);
if (!secp256k1_borromean_sign(ecmult_gen_ctx, &proof[len], s, pubs, k, sec, rsizes, secidx, rings, tmp, 32)) {
return 0;
}
@@ -330,7 +332,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_sign_impl(const secp256k1_ecmul
}
VERIFY_CHECK(len <= *plen);
*plen = len;
memset(prep, 0, 4096);
secp256k1_memclear(prep, 4096);
return 1;
}
@@ -471,7 +473,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_rewind_inner(secp256k1_scalar *
}
}
*mlen = offset;
memset(prep, 0, 4096);
secp256k1_memclear(prep, 4096);
for (i = 0; i < 128; i++) {
secp256k1_scalar_clear(&s_orig[i]);
}
@@ -646,6 +648,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_verify_impl(const secp256k1_ecm
secp256k1_sha256_write(&sha256_m, extra_commit, extra_commit_len);
}
secp256k1_sha256_finalize(&sha256_m, m);
secp256k1_sha256_clear(&sha256_m);
ret = secp256k1_borromean_verify(nonce ? evalues : NULL, e0, s, pubs, rsizes, rings, m, 32);
if (ret && nonce) {
/* Given the nonce, try rewinding the witness to recover its initial state. */

2
src/modules/schnorrsig_halfagg/main_impl.h
View File

@@ -85,6 +85,7 @@ int secp256k1_schnorrsig_inc_aggregate(const secp256k1_context *ctx, unsigned ch
hashcopy = hash;
/* 1.c) Finalize the copy to get zi*/
secp256k1_sha256_finalize(&hashcopy, hashoutput);
secp256k1_sha256_clear(&hashcopy);
/* Note: No need to check overflow, comes from hash */
secp256k1_scalar_set_b32(&zi, hashoutput, NULL);
@@ -162,6 +163,7 @@ int secp256k1_schnorrsig_aggverify(const secp256k1_context *ctx, const secp256k1
hashcopy = hash;
/* 1.c) Finalize the copy to get zi*/
secp256k1_sha256_finalize(&hashcopy, hashoutput);
secp256k1_sha256_clear(&hashcopy);
secp256k1_scalar_set_b32(&zi, hashoutput, NULL);
/* Step 2: T_i = R_i+e_i*P_i */

1
src/modules/surjection/main_impl.h
View File

@@ -153,6 +153,7 @@ static size_t secp256k1_surjectionproof_csprng_next(secp256k1_surjectionproof_cs
secp256k1_sha256_initialize(&sha);
secp256k1_sha256_write(&sha, csprng->state, 32);
secp256k1_sha256_finalize(&sha, csprng->state);
secp256k1_sha256_clear(&sha);
csprng->state_i = 0;
}
val = csprng->state[csprng->state_i];

6
src/modules/surjection/surjection_impl.h
View File

@@ -32,6 +32,7 @@ SECP256K1_INLINE static void secp256k1_surjection_genmessage(unsigned char *msg3
memcpy(&pk_ser[1], &ephemeral_output_tag->data[0], 32);
secp256k1_sha256_write(&sha256_en, pk_ser, pk_len);
secp256k1_sha256_finalize(&sha256_en, msg32);
secp256k1_sha256_clear(&sha256_en);
}
SECP256K1_INLINE static int secp256k1_surjection_genrand(secp256k1_scalar *s, size_t ns, const secp256k1_scalar *blinding_key) {
@@ -51,13 +52,14 @@ SECP256K1_INLINE static int secp256k1_surjection_genrand(secp256k1_scalar *s, si
secp256k1_sha256_initialize(&sha256_en);
secp256k1_sha256_write(&sha256_en, sec_input, 36);
secp256k1_sha256_finalize(&sha256_en, sec_input);
secp256k1_sha256_clear(&sha256_en);
secp256k1_scalar_set_b32(&s[i], sec_input, &overflow);
if (overflow == 1) {
memset(sec_input, 0, 32);
secp256k1_memclear(sec_input, 32);
return 0;
}
}
memset(sec_input, 0, 32);
secp256k1_memclear(sec_input, 32);
return 1;
}

4
src/modules/whitelist/main_impl.h
View File

@@ -54,7 +54,7 @@ int secp256k1_whitelist_sign(const secp256k1_context* ctx, secp256k1_whitelist_s
break;
}
secp256k1_scalar_set_b32(&non, nonce32, &overflow);
memset(nonce32, 0, 32);
secp256k1_memclear(nonce32, 32);
if (overflow || secp256k1_scalar_is_zero(&non)) {
count++;
continue;
@@ -80,7 +80,7 @@ int secp256k1_whitelist_sign(const secp256k1_context* ctx, secp256k1_whitelist_s
break;
}
}
memset(seckey32, 0, 32);
secp256k1_memclear(seckey32, 32);
}
/* Actually sign */
if (ret) {

2
src/modules/whitelist/whitelist_impl.h
View File

@@ -23,6 +23,7 @@ static int secp256k1_whitelist_hash_pubkey(secp256k1_scalar* output, secp256k1_g
}
secp256k1_sha256_write(&sha, c, size);
secp256k1_sha256_finalize(&sha, h);
secp256k1_sha256_clear(&sha);
secp256k1_scalar_set_b32(output, h, &overflow);
if (overflow || secp256k1_scalar_is_zero(output)) {
@@ -122,6 +123,7 @@ static int secp256k1_whitelist_compute_keys_and_message(const secp256k1_context*
secp256k1_gej_add_ge_var(&keys[i], &tweaked_gej, &online_ge, NULL);
}
secp256k1_sha256_finalize(&sha, msg32);
secp256k1_sha256_clear(&sha);
return 1;
}