From cde28971a2274beeeb2e9df27342d956b5664d44 Mon Sep 17 00:00:00 2001 From: mllwchrry Date: Mon, 10 Aug 2026 11:50:56 +0300 Subject: [PATCH] rangeproof: warn that nonce must not be reused across differing arguments --- include/secp256k1_rangeproof.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/include/secp256k1_rangeproof.h b/include/secp256k1_rangeproof.h index 0224972f..338c7243 100644 --- a/include/secp256k1_rangeproof.h +++ b/include/secp256k1_rangeproof.h @@ -125,7 +125,14 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_rangeproof_rewind( * commit: the commitment being proved. * blind: 32-byte blinding factor used by commit. The blinding factor may be all-zeros as long as min_bits is set to 3 or greater. * This is a side-effect of the underlying crypto, not a deliberate API choice, but it may be useful when balancing CT transactions. - * nonce: 32-byte secret nonce used to initialize the proof (value can be reverse-engineered out of the proof if this secret is known.) + * nonce: 32-byte secret nonce used to initialize the proof. + * + * Each call to this function must have a UNIQUE nonce that + * MUST NOT BE REUSED in subsequent calls. The nonce must be + * KEPT SECRET except from parties authorized to rewind the + * proof. Anyone who knows the nonce can recover `value` and + * `blind` from the proof. Reusing the nonce may expose `blind` + * even to parties that do not know the nonce. * exp: Base-10 exponent. Digits below above will be made public, but the proof will be made smaller. Allowed range is -1 to 18. * (-1 is a special case that makes the value public. 0 is the most private.) * min_bits: Number of bits of the value to keep private. (0 = auto/minimal, - 64).