3415 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Kgothatso Ngako	03db82815f	Merge branch 'iceberg'	2026-09-01 00:31:57 +02:00
Kgothatso Ngako	ff9c49cb7b	chilldkg: add regression tests for the recovery/state bounds fixes ... Add chilldkg_input_bounds_test covering the two review findings that the vector suite cannot catch (the memory-safe Python reference never exercises fixed-size-array overflows, so no upstream vector encodes them): - Recovery data with t = 129 (one past MAX_PARTICIPANTS) and t = 30000, both with n = 0: previously a stack buffer overflow in deserialize_recovery_data (ASan-confirmed: this test reports a stack-buffer-overflow on sum_coms against the unfixed code); now both participant_recover and coordinator_recover return INVALID_INPUT with outputs zeroed. Plus a t = 0 case. - Tampered persisted state objects (valid magic, n = 100000) for all four state types: participant_step2, participant_finalize, coordinator_finalize and participant_investigate fire the illegal-argument callback and return INVALID_INPUT instead of indexing out of bounds, in both verify and noverify builds. Verified: the test fails (ASan stack-buffer-overflow) against the pre-fix parser and passes against the fixed code, in the default, noverify and ASan builds.	2026-08-31 13:25:41 +02:00
Kgothatso Ngako	ceccb50a5a	chilldkg: harden persisted-state bounds checks for noverify builds ... The four opaque-state loaders (participant state1, state2, coordinator state, inv_data) guarded the t/n/participant_id fields read from the serialized object with VERIFY_CHECK, which is compiled out in noverify (release) builds. chilldkg.md explicitly recommends persisting state1 and the coordinator state between rounds, which turns the persisted file into an attack surface: a state1 with n altered to 100000 and the magic bytes left intact crashed participant_step2 with out-of-bounds array indexing in a noverify build. Promote all four guards to ARG_CHECK, consistent with the magic-byte check right above them: the illegal-argument callback fires, the load returns 0, and the public entry points (participant_step2, participant_finalize, coordinator_finalize, participant_investigate) return SECP256K1_CHILLDKG_INVALID_INPUT before any state-derived size is used -- verified in both verify and noverify builds.	2026-08-31 13:25:26 +02:00
Kgothatso Ngako	c43f645f15	chilldkg: fix out-of-bounds write in recovery data parsing ... secp256k1_chilldkg_deserialize_recovery_data read the threshold t from the first four bytes of the recovery blob and used it directly as the loop bound writing into the fixed-size sum_coms[SECP256K1_CHILLDKG_MAX_PARTICIPANTS] array. params_validate would reject an out-of-range t, but it only runs after the parse -- the overflow happens first. The reference implementation is safe only because Python lists grow dynamically; the C port lost that implicit bound. Reachable with attacker-supplied input from both public entry points, secp256k1_chilldkg_participant_recover and secp256k1_chilldkg_coordinator_recover (recovery data is untrusted by design: participants who never received cmsg2 are expected to accept recovery data from third parties). Confirmed with AddressSanitizer: t = 129 with a 4261-byte blob writes one group element past the array; t = 30000 with a ~1 MB blob writes ~1.2 MB of attacker- controlled group elements past it. The spec's own "invalid threshold" recovery vector cannot catch this because the memory-safe reference never exercises a t large enough to overflow a fixed C array. Fix: reject t < 1 and t > SECP256K1_CHILLDKG_MAX_PARTICIPANTS right after reading t, before any use as a loop bound, and reject recovery_len > SECP256K1_CHILLDKG_MAX_RECOVERY_LEN up front for consistency with the recovery-ack paths (the macro moves next to the parser; with t and n bounded the length cap is redundant, but it documents and enforces the invariant at the single choke point). Invalid recovery data is a plain input error (RecoveryDataError in the reference), so this maps to SECP256K1_CHILLDKG_INVALID_INPUT with outputs zeroed, like any other malformed blob.	2026-08-31 13:25:26 +02:00
Kgothatso Ngako	d9549a6c5a	tests: raise MAX_ARGS from 200 to 400 ... With the chilldkg (and iceberg) modules enabled, the unit test binary registers more than 200 tests (213 with all modules on), tripping the "Number of tests exceeds MAX_ARGS" internal error in unit_test.c and bailing before running anything -- both tests and noverify_tests were unrunnable in the all-modules CI rows. MAX_ARGS must be at least the total number of registered tests; 400 leaves headroom for future modules and vector-suite growth.	2026-08-31 13:25:26 +02:00
Kgothatso Ngako	a68cae31ca	iceberg: list the module in the README feature list ... Add the Iceberg module to the "Added features" section, after the ChillDKG entry, linking doc/iceberg.md.	2026-08-31 12:25:55 +02:00
Kgothatso Ngako	2473c76871	iceberg: wire the module into CI ... - ci/ci.sh: new ICEBERG environment variable, printed in the reproduction header and passed to configure as --enable-module-iceberg (mirroring CHILLDKG); bench_iceberg runs in the bench step when the module is enabled, as in the source tree's CI. - .github/workflows/ci.yml: ICEBERG: 'no' default; ICEBERG: 'yes' in the 20 jobs that enable musig + schnorrsig + experimental (the same jobs that build chilldkg). Jobs that deliberately build without musig or its dependencies are left at 'no'. Verified programmatically: the YAML parses and every ICEBERG: 'yes' context also has MUSIG, SCHNORRSIG and EXPERIMENTAL set to 'yes'.	2026-08-31 12:25:55 +02:00
Kgothatso Ngako	8c4bf548ed	iceberg: cover the module in ctime_tests ... Port the source tree's own iceberg ctime_tests block (guarded by ENABLE_MODULE_ICEBERG, after the chilldkg block): a 3-of-5 group run through shares_gen, a share serialize/parse roundtrip, share_cache_create (with a CHECKMEM_CHECK proving the cache holds no secrets), pubshare_gen, pubkey_agg, nonce_gen, nonce_agg and partial_sign, with share secrets undefined and all protocol outputs defined, following the frost/chilldkg annotation style. Both memory checkers pass with zero new declassifies needed -- the module's constant-time layering (vpss variable-time but secret-free, scalar_poly keeping secrets away from inversions) was already in place. Verified: valgrind ./ctime_tests exits 0, and the clang MemorySanitizer build exits 0 (with the chilldkg block unaffected).	2026-08-31 12:25:55 +02:00
Kgothatso Ngako	da13028c0d	iceberg: add the bench_iceberg benchmark binary ... Port src/bench_iceberg.c, the standalone benchmark binary the module's bench_impl.h is written for (this repo's bench harness has no per-module include pattern for it, so the source tree's own wiring is mirrored instead): noinst_PROGRAMS under USE_BENCHMARK + ENABLE_MODULE_ICEBERG in Makefile.am, a bench_iceberg target in src/CMakeLists.txt, and a .gitignore entry. The benchmark covers the group configurations 2-of-3, 3-of-5, 4-of-7, 5-of-9 and 5-of-10. Verified: ./bench_iceberg builds and runs under both build systems.	2026-08-31 12:25:33 +02:00
Kgothatso Ngako	072f6631f3	iceberg: add the example program ... Port examples/iceberg.c from the source tree: a full Iceberg session demonstrating the call order from the module docs -- distributed key generation, pubshare_gen/pubkey_agg to obtain the group public key, nonce_gen/nonce_agg into an ordinary MuSig2 public nonce, and partial_sign/partial_sig_agg into an ordinary MuSig2 partial signature. One content adaptation: the secp256k1_musig_nonce_process call gains a NULL adaptor argument, matching this repo's zkp musig variant. Wired like the chilldkg example: autotools noinst_PROGRAMS + TESTS entry under ENABLE_MODULE_ICEBERG (the example runs as part of make check), CMake example target in examples/CMakeLists.txt, and iceberg_example added to .gitignore. Verified: ./iceberg_example runs to completion (exit 0) under both build systems.	2026-08-31 12:25:09 +02:00
Kgothatso Ngako	e581abad00	iceberg: add the Iceberg threshold-MuSig module ... Port the experimental Iceberg module from the benchmark-iceberg tree (github.com/furszy/benchmark-iceberg, sources/secp256k1-kmp/native/ secp256k1) into this repo. Iceberg is a threshold scheme that lets a group of parties stand in for a single MuSig2 (BIP 327) participant: the group produces one ordinary MuSig2 public nonce and one ordinary MuSig2 partial signature, so cosigners cannot tell a group is involved and need no changes. Nonces are derived from a caller-chosen per-session label (sid32) rather than stored, so no signer holds a secret nonce between rounds; labels are public but must never be reused. A quorum of 2t-1 members (of whom up to t-1 may be corrupt) is needed in each round, so the threshold is at most half the group rounded up; combined with the scheme's other constraints the smallest usable group is 2-of-4. See doc/iceberg.md and the module header for the full usage notes. Module layout (src/modules/iceberg/, layered bottom-up, each layer may only use the ones above it -- that ordering is also the constant-time story): - scalar_poly.{h,_impl.h}: secret-carrying polynomial arithmetic, keeping secrets away from inversions (documented in the header). - rss.{h,_impl.h}: replicated secret sharing evaluation. - vpss.{h,_impl.h}: verifiable public shares; variable-time by design, sees only participant indices and published points. - keygen_impl.h: distributed key generation producing one share per member. - session_impl.h: nonce_gen/nonce_agg and partial_sign/ partial_sig_agg producing plain MuSig2 objects. - tests_impl.h: 28 tests including the shipped vectors.h vector suite and dealer known-answer tests. - bench_impl.h: benchmark definitions (wired in a follow-up commit). Public headers: include/secp256k1_iceberg.h (installed) and include/secp256k1_iceberg_dealer.h (in-tree only: a trusted dealer is not part of the shipped API, but tests, benchmarks and the example need to deal shares). Content adaptations relative to the source tree (the only changes to the ported code): three secp256k1_musig_nonce_process call sites in tests_impl.h gained a NULL adaptor argument, because this repo's musig is the zkp variant whose public nonce_process takes an optional adaptor point. All musig internals the module uses (ge_parse_ext, ge_serialize_ext, keyaggcoef, aggnonce_load, pubnonce_save, partial_sig_save, nonce_process_internal) are identical in both trees, as are all core headers the module touches; nothing else needed adaptation. Build wiring mirrors the chilldkg module: - configure.ac: --enable-module-iceberg (default no, experimental gate), hard dependency on the musig module with a configure error if musig is explicitly disabled (musig itself pulls in schnorrsig), AM_CONDITIONAL(ENABLE_MODULE_ICEBERG), summary line. - Makefile.am: include src/modules/iceberg/Makefile.am.include under the conditional. - src/secp256k1.c: guarded include of modules/iceberg/main_impl.h after the chilldkg block (musig is included earlier, so its internals are in scope). - src/tests.c: module test registration via MAKE_TEST_MODULE(iceberg). - CMakeLists.txt / src/CMakeLists.txt: SECP256K1_ENABLE_MODULE_ICEBERG option (OFF) with a dependency check on SECP256K1_ENABLE_MODULE_MUSIG (placed before the musig block so the force-enable takes effect), ENABLE_MODULE_ICEBERG=1 compile definition, public header export, summary line. Verified: ./configure --enable-experimental --enable-module-iceberg && make check passes; ./tests --target=iceberg runs the full module suite (28/28); CMake build + ctest pass; the musig dependency error fires correctly in both build systems.	2026-08-31 12:24:48 +02:00
Kgothatso Ngako	e9f171f197	chilldkg: list the module in the README feature list ... Add the ChillDKG module to the "Added features" section of the README, next to the FROST entry, linking to the module documentation.	2026-08-31 10:58:24 +02:00
Kgothatso Ngako	3b68633f59	chilldkg: CI wiring, ctime_tests coverage, declassify fixes ... CI: - ci/ci.sh: new CHILLDKG environment variable, passed to configure as --enable-module-chilldkg (mirroring FROST). - .github/workflows/ci.yml: default CHILLDKG: 'no' and CHILLDKG: 'yes' in every job that enables FROST, except the x86_64 matrix entry that deliberately builds without the ecdh module (chilldkg requires schnorrsig + ecdh; the configure-time dependency error would fire there). YAML validity and per-job dependency presence checked programmatically. ctime_tests: - src/ctime_tests.c: run a full ChillDKG session (n = 2, t = 2) through the public API under the memory checker: hostpubkey_gen, params_hash, participant_step1, coordinator_step1, participant_step2, coordinator_finalize, participant_finalize, participant_recover and recovery_ack_sign. Host secret keys, session randomness, aux randomness and the resulting secret shares are undefined (secret); all protocol messages, the certificate, threshold public key, public shares, recovery data, ack signature and the secret-free state1 objects are defined (public). state2 stays secret (contains the secret share). Constant-time fixes found by running the new block under MemorySanitizer (valgrind unavailable locally; MSan build via clang + CMake). All are missing declassifications of secret-derived but public (or public-outcome) values, following the frost module's secp256k1_declassify pattern with justification comments; no real constant-time bugs were found: - hostpubkey_gen: declassify the computed host public key before serialization (public output). - participant_step1: declassify the zero-randomness check result (only reveals "the RNG returned 32 zero bytes", which aborts the session). - encpedpop participant_step1: declassify the pubnonce point before serialization (public, part of pmsg1). - chilldkg_schnorrsig_sign: declassify the signer public key before normalization/parity branch, and declassify the return value (a failure only reveals a zero derived nonce, negligible probability). - vss_commit: declassify the VSS commitments before serialization (public, part of pmsg1). - vss_verify_secshare: declassify secshare*G before the infinity/eq checks (equals the public pubshare in honest runs; the discrete log is not revealed). - simplpedpop_participant_investigate (proactive audit; not reached by ctime_tests): declassify the secshare-sum comparison result (the public fault code reveals it anyway). Verified: MSan ctime_tests exits 0; autotools make check 10/10 (the local tree is configured without --enable-ctime-tests because neither valgrind nor an MSan-instrumented gcc build is available; CI runs ctime_tests under valgrind as before); CMake ctest 428/428; ./tests --target=chilldkg and ./chilldkg_example pass.	2026-08-31 10:25:14 +02:00
Kgothatso Ngako	d1c817b528	chilldkg: Phase 6 - test vectors, FROST integration, docs, example ... Final phase of the ChillDKG module: upstream test vectors, a DKG->FROST integration test, boundary tests, full module documentation and a runnable example. Test vectors: - tools/test_vectors_chilldkg_generate.py converts all 10 upstream bip-frost-dkg JSON vector files into src/modules/chilldkg/vectors.h (modeled on tools/test_vectors_frost_generate.py; takes the vectors directory as an argument; upstream pinned to commit a91896883f85b159415ecf298d5e844879af112d, recorded in the generated header with the exact regeneration invocation; regeneration is reproducible byte-for-byte). - tests_impl.h vector runners execute 191 of 241 upstream cases through the public API: hostpubkey_gen, params_hash, participant_step1/step2/finalize/investigate, coordinator_step1/finalize/investigate, recover. Happy paths are byte-exact (pmsg1/cmsg1/pmsg2/cmsg2/dkg_output/recovery/cinv); error cases assert both the fault enum and fault_index against expectedError.participantId. The 50 skipped cases are wrong-length/wrong-count inputs not expressible with the fixed-size C API; each skip is documented in vectors.h. Boundary/robustness tests: t=1, t=n, n=2, a full n=128/t=2 session end-to-end with per-participant secshare*G == pubshare checks and a recovery roundtrip, and a state1 memcpy roundtrip (step2 from a copied state object). DKG->FROST integration test (guarded by ENABLE_MODULE_FROST): a full ChillDKG session (n=3, t=2) feeds (secshare, thresh_pk, pubshares) directly into the frost module. ChillDKG's thresh_pk is already TapTweak'ed, so frost_tweak_cache_init is called with no further tweaks (frost's tweaked x-only key asserted equal to the x-only part of the ChillDKG thresh_pk); signers 0 and 2 run nonce_gen, nonce_agg, session_init with the shared x = id+1 convention, frost_sign, partial_sig_verify and partial_sig_agg; the aggregate signature verifies as a plain BIP-340 signature against the threshold key. Example: examples/chilldkg.c runs a full 2-of-3 DKG session (host key generation, params hash, participant/coordinator steps, finalize, and a recovery roundtrip via participant_recover) with fixed-size buffers and secret erasure. Wired into Makefile.am and examples/CMakeLists.txt exactly like frost_example (runs as a TEST); chilldkg_example binary added to .gitignore. Docs: src/modules/chilldkg/chilldkg.md now documents the protocol summary, message-flow table with exact byte sizes, blame taxonomy, recovery workflow, security notes (host key reuse/retention, fresh randomness per session, state secrecy, recovery-data sensitivity) and the pinned reference commit; src/modules/frost/frost.md points at the new module as the intended DKG. Bug fix found by the vector runner (recover tcId 9): the internal recover() passed a possibly-NULL fault_index from coordinator_recover to certeq_verify, which dereferences it on failure; now uses a local. Verified: make check 10/10 (3 test suites + 7 examples incl. chilldkg_example, exit 0 when run); CMake ctest 428/428 with chilldkg + frost, and a no-frost build confirms the ENABLE_MODULE_FROST guard; make distdir includes vectors.h, the example and the generator. The module is feature-complete against bip-frost-dkg v0.3.0-dev at a91896883f85b159415ecf298d5e844879af112d. The BIP is still a draft; tagged hashes and wire formats may change upstream.	2026-08-31 06:52:58 +02:00
Kgothatso Ngako	d48a1579cf	chilldkg: Phase 5 - recovery, recovery acks, investigation ... Complete the ChillDKG protocol surface with the recovery and blame- attribution procedures (bip-frost-dkg v0.3.0-dev, reference commit a91896883f85b159415ecf298d5e844879af112d). Recovery: - secp256k1_chilldkg_participant_recover / _coordinator_recover: parse the self-delimiting recovery layout u32be(t) || sum_coms(33t) || hostpubkeys(33n) || pubnonces(33n) || enc_secshares(32n, checked) || cert(64n), deriving n = (len-4-33t)/162 exactly as the reference's deserialize_recovery_data; re-verify the certificate, recompute the TapTweak and the receiver's ECDH/self pads from (hostseckey, pubnonces, enc_context), recompute the tweaked secshare, and sanity-check secshare*G == pubshares[own]. Also return hostpubkeys, n and t so callers can re-derive session params. RecoveryDataError / HostSeckeyError / params failures map to INVALID_INPUT (no index, as in the reference); an invalid pubnonce during decrypt passes through as FAULTY_PARTICIPANT_OR_COORDINATOR(i), matching the reference leaking that exception from recover(). Recovery acks: - secp256k1_chilldkg_recovery_ack_sign / _acks_verify: BIP-340 (standard BIP0340 tags) over pad33("BIP DKG/recovery acknowledgment") || u32be(i) || recovery_data. Verification failure maps to FAULTY_PARTICIPANT(i) (InvalidRecoveryAckError subclasses FaultyParticipantError in the reference). Investigation: - secp256k1_chilldkg_coordinator_investigate: builds one 65n-byte per-participant message (per-dealer encrypted partial secshares (32n) + partial pubshares (33n)) per call; the reference returns all n at once -- equivalent, the caller iterates. - secp256k1_chilldkg_participant_investigate: the reference's three-step blame attribution -- sum-of-pubshares check -> FAULTY_COORDINATOR; sum-of-secshares check -> FAULTY_COORDINATOR (covers the reference's SecshareSumError translation); per-dealer decrypted share vs commitment -> FAULTY_PARTICIPANT_OR_COORDINATOR(i) (or FAULTY_COORDINATOR for the own index); all-consistent -> INVALID_INPUT (the reference's uncaught RuntimeError). - Investigation data is transported via a new opaque, secret-bearing secp256k1_chilldkg_participant_inv_data object (4205 bytes, magic-validated save/load, secret-cleared) filled by participant_step2 on the UNKNOWN_FAULT paths. This amends the Phase 3 participant_step2 signature with a nullable inv_data out-param -- required because recomputing inside participant_investigate would duplicate step2's decrypt/verify logic. - New length helper secp256k1_chilldkg_investigation_msg_len (65n). tests_impl.h: chilldkg_recovery_test (recover roundtrips byte-exact vs the session outputs and reference vectors, tampered/truncated/ over-long recovery data, unknown/invalid hostseckey, ack sign byte-exact + verify with wrong-index and tampered-ack blame, params/recovery mismatch rejects, misuse) and chilldkg_investigate_test (two end-to-end public-API scenarios generated from the reference: dealer corrupting a participant's encrypted share, and coordinator tampering with an enc_secshare; cmsg1/cinv/inv_data byte-exact, blame codes and indices matching the reference's exception type and index; malformed cinv -> FAULTY_COORDINATOR; malformed pmsg1 -> FAULTY_PARTICIPANT(j); misuse). The all-consistent investigate path is not constructible without discrete logs and matches the reference's unreachable RuntimeError. Verified: make check 3/3 (incl. noverify); CMake ctest 369/369; make distdir clean.	2026-08-31 06:09:03 +02:00
Kgothatso Ngako	5409aae813	chilldkg: Phase 4 - public coordinator API ... Add the coordinator side of the ChillDKG protocol (bip-frost-dkg v0.3.0-dev, reference commit a91896883f85b159415ecf298d5e844879af112d), as thin wrappers over the Phase 2 encpedpop coordinator internals (whose cmsg1 output was already verified byte-identical to the reference coordinator_step1). Public API: - secp256k1_chilldkg_coordinator_step1: takes an array of pointers to the n participant pmsg1 messages (musig/frost-style convention), parses each with checked scalar parse, aggregates SimplPedPop and EncPedPop, builds eq_input (including the enc_secshares suffix, mirroring the reference) and emits cmsg1 (162n + 33(t-1) bytes). PoPs are not verified coordinator-side, exactly as the reference. - secp256k1_chilldkg_coordinator_finalize: concatenates the n CertEq pmsg2 signatures into the 64n-byte certificate, verifies all of them via certeq_verify (hostpubkeys recovered from eq_input at offset 4+33t), and outputs the coordinator-side DKG result: threshold pubkey, pubshares and recovery data -- no secshare. - secp256k1_chilldkg_coordinator_state: opaque, 21041 bytes, magic-validated, holds only t, n, eq_input, thresh_pk and pubshares -- no secret material, documented as freely copyable/persistable so a stateless coordinator is possible. Blame mapping (verified against chilldkg.py): - malformed pmsg1 (bad commitment encoding, overflowing encrypted share) -> FAULTY_PARTICIPANT(sender index), - invalid CertEq signature -> FAULTY_PARTICIPANT(failing index) (deliberately different from participant_finalize, which maps the same failure to FAULTY_COORDINATOR -- matching the reference), - invalid session params -> INVALID_INPUT; all outputs zeroed on failure. tests_impl.h: chilldkg_coordinator_api_test runs a full n=3,t=2 session through only the public APIs on both sides, byte-exact against the Python reference vectors and cross-checked against every participant's finalize outputs; blame cases (malformed pmsg1 and overflowing share -> FAULTY_PARTICIPANT with the right index, bad CertEq sig -> FAULTY_PARTICIPANT(2), zeroed outputs); misuse coverage (NULL args, corrupted state magic). Verified: make check 3/3 (incl. noverify); CMake ctest 365/365; ./tests --target=chilldkg green.	2026-08-31 05:33:42 +02:00
Kgothatso Ngako	2a0e14d076	chilldkg: Phase 3 - public participant API and CertEq ... Add the public participant-facing ChillDKG API to include/secp256k1_chilldkg.h and the CertEq sub-protocol, completing the participant side of the protocol (bip-frost-dkg v0.3.0-dev, reference pinned at a91896883f85b159415ecf298d5e844879af112d). New module files: - certeq.h / certeq_impl.h: CertEq sub-protocol. Participants sign pad33("BIP DKG/certeq message") || u32be(i) || eq_input with plain BIP0340-tagged Schnorr signatures under their host key (certeq_participant_step); verification is per-index against the x-only hostpubkeys[i][1:33] exactly as the reference (certeq_verify). The coordinator side reuses certeq_verify in Phase 4. Public API (all no-malloc, caller-allocated buffers, outputs zeroed on failure, secret paths cleared): - secp256k1_chilldkg_hostpubkey_gen: plain compressed host pubkey generation; rejects zero / >= group order seckeys. - secp256k1_chilldkg_params_hash: validates session params (participant and threshold ranges, strictly compressed non-infinity pubkeys, no duplicates) and computes TH("BIP DKG/params_hash", u32be(t) || hostpubkeys). - Message-length helpers so callers can size buffers: participant_msg1_len (33t+32n+97), coordinator_msg1_len (162n+33(t-1)), participant_msg2_len (64), coordinator_msg2_len (64n), recovery_data_len (4+33t+162n). - secp256k1_chilldkg_participant_step1: full EncPedPop step1 with seed=deckey=hostseckey; rejects zero randomness and hostseckeys not matching the claimed hostpubkey (input errors, not protocol faults). - secp256k1_chilldkg_participant_step2: parses and verifies cmsg1 via the Phase 2 encpedpop/simplpedpop participant path, computes the tweaked secshare/pubshares/threshold pubkey, appends enc_secshares to eq_input (matching the reference for recovery consistency), and emits the 64-byte CertEq signature. - secp256k1_chilldkg_participant_finalize: re-verifies all n CertEq signatures in the certificate, then outputs the 32-byte secshare, 33-byte threshold pubkey, n pubshares and the self-delimiting recovery data (eq_input || cert). Blame reporting without exceptions: public enum secp256k1_chilldkg_fault (OK / FAULTY_COORDINATOR / FAULTY_PARTICIPANT / FAULTY_PARTICIPANT_OR_COORDINATOR / UNKNOWN_FAULTY_PARTICIPANT_OR_COORDINATOR / INVALID_INPUT) plus an out fault_index, mapping the reference's exception taxonomy: - hostseckey invalid/mismatch -> INVALID_INPUT (HostSeckeyError), - cmsg1 scalar overflow/parse -> FAULTY_COORDINATOR (MsgParseError), - pubnonce/commitment/PoP faults -> FAULTY_PARTICIPANT_OR_COORDINATOR(i), - share-vs-pubshare mismatch -> UNKNOWN with fault_index = UINT32_MAX, - certificate signature failure -> FAULTY_COORDINATOR (documented deviation: fault_index carries the failing signature index as diagnostic info; the reference discards it). Enum-returning functions use a local CHILLDKG_ARG_CHECK that fires the illegal-argument callback and returns INVALID_INPUT (ARG_CHECK would return 0 = OK). Opaque state objects with magic-validated save/load (frost idiom): participant_state1 (4306 bytes, no secrets) and participant_state2 (21073 bytes, contains the secshare; documented keep-secret/no-copy). Fixed-size at SECP256K1_CHILLDKG_MAX_PARTICIPANTS = 128. Also fixes a noverify-build bug: state1_load ran point_load inside VERIFY_CHECK, which compiles out in noverify builds and left the commitment uninitialized; now called unconditionally. tests_impl.h: participant_api_test with full-session reference vectors (n=3, t=2; coordinator aggregation simulated through the internal Phase 2 coordinator step and verified byte-identical to the reference's coordinator_step1): msglen helpers, hostpubkey_gen and params_hash vectors incl. duplicate/invalid/infinity rejection, byte-exact pmsg1/cmsg1/CertEq sigs/secshare/thresh_pk/pubshares/ recovery, blame cases (tampered enc_secshare -> UNKNOWN, invalid pubnonce -> FAULTY_PARTICIPANT_OR_COORDINATOR(1), overflowing enc_secshare -> FAULTY_COORDINATOR, corrupted cert sig -> FAULTY_COORDINATOR with fault_index and zeroed outputs), NULL-arg misuse and bad-magic state rejection. Verified: make check 3/3 (incl. noverify); CMake ctest 363/363; make distdir includes all new files.	2026-08-31 05:22:53 +02:00
Kgothatso Ngako	580e4f6502	chilldkg: Phase 2 - SimplPedPop and EncPedPop layers ... Port the two sub-protocol layers of the ChillDKG reference implementation (bip-frost-dkg v0.3.0-dev, upstream commit a91896883f85b159415ecf298d5e844879af112d) to C, keeping the same function decomposition as simplpedpop.py / encpedpop.py so the code stays diffable against the reference. simplpedpop.h / simplpedpop_impl.h (mirrors simplpedpop.py): - simplpedpop_participant_step1: VSS coefficient generation and commitment, per-participant shares, proof of possession. The PoP is a BIP-340 signature with custom tag prefix "BIP DKG/pop message" over u32be(participant_id), signed with the constant coefficient f(0), using TH("BIP DKG/simplpedpop aux", simpl_seed) as aux_rand. - simplpedpop_coordinator_step / assemble_sum_coms: echo per-dealer constant-term commitments, sum non-constant-term commitments, collect PoPs (not verified by the coordinator, as in the reference). - simplpedpop_participant_step2: own-commitment echo check, per-dealer infinity rejection and PoP verification against the x-only coms_to_secrets[i], TapTweak applied before share verification (secshare vs pubshare check on tweaked values), eq_input = u32be(t) || sum_coms committing to the UNTWEAKED summed commitment. encpedpop.h / encpedpop_impl.h (mirrors encpedpop.py): - simpl_seed / aux / secnonce derivations from (hostseckey, random, enc_context) via "BIP DKG/encpedpop seed", "BIP DKG/simplpedpop aux" and "BIP DKG/encpedpop secnonce"; pubnonce = pubkey_gen_plain(secnonce). - encaps_multi / encrypt_multi: per-recipient pad context u32be(i) || enc_context, self-pad at the own index (no ECDH), libsecp256k1-style ECDH pad otherwise with sender-first ordering; encryption is additive mod n so the coordinator can sum encrypted shares per recipient. - decaps_multi / decrypt_sum: receiver-side pads, invalid or infinity pubnonce maps to FAULTY_PARTICIPANT_OR_COORDINATOR(sender). - coordinator_step: checked scalar parse of encrypted shares (overflow blames the sender), per-recipient summation. - participant_step2: pubnonce echo check (mismatch -> FAULTY_COORDINATOR), decrypt, delegate to simplpedpop step2, eq_input extended with enckeys || pubnonces. util.h: add SECP256K1_CHILLDKG_MAX_PARTICIPANTS (128, matching frost) and the internal fault enum mirroring the reference's exception taxonomy (FAULTY_COORDINATOR, FAULTY_PARTICIPANT, FAULTY_PARTICIPANT_OR_COORDINATOR, UNKNOWN_FAULTY_PARTICIPANT_OR_COORDINATOR, INVALID_INPUT). The public blame-reporting enum arrives with the Phase 3 API. State structs are fixed-size (no malloc, cap 128 participants). All secret temporaries are cleared; negligible-probability secret- dependent failures are declassified before branching. Documented deviations where the reference crashes with non-protocol errors: infinity sum_coms[0] in invalid_taproot_commit (unreachable after PoP verification) and tweak-hash overflow (negligible) return UNKNOWN_FAULTY_PARTICIPANT_OR_COORDINATOR; a wrong cmsg length maps to FAULTY_COORDINATOR. Investigation procedures are deferred to Phase 5 per the plan. tests_impl.h: byte-exact n=3/t=2 happy-path vectors for both layers generated from the Python reference (pmsg/cmsg/eq_input/enc_secshares and all DKG outputs), plus PoP reject cases (tampered, wrong index, infinity commitment, wrong echo, tampered non-constant-term sum), coordinator blame (bad commitment, overflowing encrypted share), encaps/decaps pad symmetry for all sender/receiver pairs including self-pad, encrypt->sum->decrypt_sum roundtrip, tampered encrypted share, invalid pubnonce blame, and input-validation rejects. Verified: make check 3/3 suites pass (incl. noverify_tests running the module); CMake ctest 361/361; ./tests --target=chilldkg runs all 9 module tests green.	2026-08-31 04:47:38 +02:00
Kgothatso Ngako	e462f7c1ac	chilldkg: Phase 1 - internal primitives (util, vss) ... Add the byte-exact internal primitives for the ChillDKG module, mirroring the Python reference implementation of the bip-frost-dkg draft (v0.3.0-dev), pinned to upstream commit a91896883f85b159415ecf298d5e844879af112d. util.h / util_impl.h (mirrors chilldkg_ref/util.py): - Point (de)serialization with explicit point-at-infinity support: 33 zero bytes <-> infinity, otherwise SEC compressed. Checked parse rejects invalid encodings and out-of-range x coordinates (point_save/point_load, xonly_save/xonly_load). - Internal parameterized-tag BIP-340 Schnorr sign/verify (chilldkg_schnorrsig_sign/_verify): tag prefix selects the <prefix>/aux, /nonce, /challenge subtags ("BIP DKG/pop message" for proofs of possession, "BIP0340" for CertEq signatures and recovery acks), arbitrary-length messages, pad33 zero-padding helper. The public schnorrsig API hardcodes BIP0340/32-byte messages, so the algorithm is replicated from secp256k1_schnorrsig_sign_internal with a custom tag; cross-checked against secp256k1_schnorrsig_sign32. - Tagged hashes via secp256k1_sha256_initialize_tagged: "BIP DKG/params_hash", "BIP DKG/encpedpop seed", "BIP DKG/simplpedpop aux", "BIP DKG/encpedpop secnonce", "BIP DKG/encpedpop ecdh", "BIP DKG/encaps_multi self_pad", "BIP DKG/vss coeffs", and BIP-341 "TapTweak" (32-byte x-only input). - params_hash = TH("BIP DKG/params_hash", u32be(t) || hostpubkeys) (note: plan had the operand order reversed; the reference hashes t first). - ECDH pads: reuses the ecdh module's SHA256-of-compressed-shared- point hash, then TH("BIP DKG/encpedpop ecdh", ecdh || sender_pubnonce || receiver_hostpubkey || context) with a sending flag fixing the sender|receiver order; self_pad for the own index. Pads are parsed wrapping (mod-n reduction); wire scalars, VSS coefficients and the TapTweak are parsed checked. vss.h / vss_impl.h (mirrors chilldkg_ref/vss.py): - vss_gen_coeffs: per-coefficient TH("BIP DKG/vss coeffs", seed || u32be(j)), checked parse with bitwise error accumulation. - vss_poly_eval (Horner) and vss_secshare_for with the x = id+1 convention (safe at UINT32_MAX). - vss_commit (constant-time ecmult_gen, zero coefficient -> infinity), vss_pubshare (powers-of-x over commitments, skips infinity), vss_commitment_add, vss_verify_secshare. - vss_invalid_taproot_commit: TapTweak applied to the x-only constant term so the Taproot script path is unspendable; returns tweak and pubtweak. tests_impl.h: 7 vector tests (tagged hashes, params_hash, point serialization incl. infinity roundtrip and parity prefixes, checked vs wrapping scalar parse at the group order boundary, custom-tag schnorrsig incl. wrong-tag/key/msg rejection, ECDH pad sender/receiver symmetry, VSS coeff derivation/Horner/commitment/pubshare/tweak) with expected values generated once from the Python reference (committed into the test file, reference commit recorded). Verified: make check 3/3 suites pass; CMake ctest all pass; ./tests --target=chilldkg runs all 7 new tests green in both verify and noverify builds.	2026-08-31 04:05:15 +02:00
Kgothatso Ngako	49f3eba8f5	chilldkg: Phase 0 - module scaffolding and build wiring ... Add an empty, experimental `chilldkg` module as the foundation for a ChillDKG implementation (distributed key generation for FROST) per the bip-frost-dkg BIP draft (v0.3.0-dev): https://github.com/BlockstreamResearch/bip-frost-dkg The module lives in src/modules/chilldkg/ (separate from the frost module, per the implementation plan in .idea/docs/ chilldkg-implementation-plan.md: FROST signing (BIP 445) and ChillDKG are separate BIPs with separate reference repos, test vectors and review cycles; the dependency between them is one-way bytes). New files: - include/secp256k1_chilldkg.h: public header skeleton with the same "EXTREMELY DANGEROUS / work in progress" warning style as secp256k1_frost.h, plus a note that the BIP is a draft and tagged hashes/wire formats may change. No API yet (Phase 3+). - src/modules/chilldkg/main_impl.h: implementation skeleton including the public header. - src/modules/chilldkg/tests_impl.h: trivial scaffolding unit test (chilldkg_scaffolding_test) registered via the tests_chilldkg[] CASE1 array used by this repo's unit-test framework. - src/modules/chilldkg/Makefile.am.include: autotools file list, mirroring the frost module's. - src/modules/chilldkg/chilldkg.md: module doc stub (purpose, draft status, dependency on the schnorrsig and ecdh modules). Build wiring (mirrors the frost module exactly): - configure.ac: --enable-module-chilldkg (default no, experimental gate), dependency errors when schnorrsig or ecdh are explicitly disabled, AM_CONDITIONAL(ENABLE_MODULE_CHILLDKG), summary line. - Makefile.am: include src/modules/chilldkg/Makefile.am.include under ENABLE_MODULE_CHILLDKG. - src/secp256k1.c: guarded include of modules/chilldkg/main_impl.h after the frost module. - src/tests.c: guarded include of tests_impl.h and MAKE_TEST_MODULE(chilldkg) registration. - CMakeLists.txt: SECP256K1_ENABLE_MODULE_CHILLDKG option (OFF) + summary line. - src/CMakeLists.txt: dependency checks on SECP256K1_ENABLE_MODULE_SCHNORRSIG and SECP256K1_ENABLE_MODULE_ECDH, ENABLE_MODULE_CHILLDKG=1 compile definition, public header export. Verified: - ./autogen.sh && ./configure --enable-experimental --enable-module-chilldkg --enable-module-schnorrsig --enable-module-ecdh && make check: PASS 3/3 (tests, noverify_tests, exhaustive_tests). - configure fails with a clear error when schnorrsig or ecdh are disabled, or when experimental is not enabled. - CMake build with SECP256K1_ENABLE_MODULE_CHILLDKG=ON: ctest 345/345 passed; dependency errors fire correctly when schnorrsig/ecdh OFF.	2026-08-31 01:37:22 +02:00
Kgothatso Ngako	7afaab53dc	frost: close remaining gaps against the BIP 445 reference ... Four small divergences from the reference implementation and its API contract, none of which changes any signature: the differential harness (240 signing + 120 deterministic-signing cases against the Python reference) produces byte-identical output before and after. Length prefixes that do not fit ------------------------------- secp256k1_frost_sha256_write_prefixed asserted, via VERIFY_CHECK, that the length fits into its prefix. VERIFY_CHECK compiles away in release builds, so a length that does not fit was silently truncated modulo 2^(8*prefix_size) instead of being rejected, yielding a nonce that does not follow the spec. The reference raises OverflowError instead. Only the 4-byte extra_in prefix of nonce_hash is affected, and only where size_t is wider than 32 bits, so this needs an extra_in of 4 GiB to trigger. It is nevertheless a silent deviation, so write_prefixed now returns 0 without writing anything, and the failure is propagated: secp256k1_frost_nonce_function and secp256k1_frost_det_nonce_function return 0, and secp256k1_frost_nonce_gen returns 0 after wiping session_secrand32 and the nonces. Checking the shifted-out bits (which the loop already computes) rather than comparing extra_in_len against a 32-bit bound avoids a comparison that is always true on 32-bit platforms. The bound is now documented on the extra_in_len parameter. Identifiers equal to UINT32_MAX ------------------------------- BIP 445 derive_interpolating_value accepts every identifier in 0 <= id < 2^32, but secp256k1_frost_ids_are_valid rejected UINT32_MAX because the mapping to the polynomial x-coordinate, id + 1, overflows in uint32_t arithmetic. The +1 is now added in scalar arithmetic, where it cannot overflow, and the identifier restriction is gone. The denominator never needed the +1 at all, since x_j - x_i = (id_j + 1) - (my_id + 1) = id_j - my_id so it is computed directly from the identifiers. This was unreachable through the public API -- validate_session_params already bounds identifiers by n_participants, which is at most SECP256K1_FROST_MAX_PARTICIPANTS = 128 -- but it made an internal helper diverge from the algorithm it implements. frost_large_id_test covers it by reconstructing the constant term of a random degree-2 polynomial from shares held by identifiers 0, UINT32_MAX - 1 and UINT32_MAX. Zero-length messages -------------------- secp256k1_frost_session_init and secp256k1_frost_deterministic_sign required a non-NULL msg, so an empty message -- which the reference represents as the byte string b"" -- could only be passed as a pointer that is never dereferenced. Both now accept NULL when msglen is 0, matching secp256k1_schnorrsig_sign_custom and the msg parameter of secp256k1_frost_nonce_gen. secp256k1_sha256_write guards both of its memcpy calls on a non-zero length, so it is never reached with a NULL pointer. NonceGen keeps its distinction between a NULL msg and a zero-length msg: there the BIP really does distinguish msg = None (hashed as the single byte 0x00) from msg = b"" (hashed as 0x01 followed by an eight-byte zero length), and the API expresses that as NULL versus non-NULL. frost_empty_msg_test runs a signing round over a zero-length message passed both ways and checks that the two session objects are identical. The two API tests that relied on a NULL msg always being rejected now pass an explicit non-zero msglen; previously they passed a random msglen that could be 0. Header documentation -------------------- The parameter tables of eleven doc comments had names that did not line up with their block's continuation column. All parameter tables are now aligned consistently, with wrapped text two columns past the colon. Verification ------------ - gcc and clang, -std=c89 -pedantic-errors -Werror, with and without -DVERIFY: clean - tests (multiple seeds), noverify_tests and frost_example: pass - ctime_tests under MemorySanitizer: exits 0 with halt_on_error=1 - vectors.h still reproduces exactly from the spec's JSON vectors - 240 signing + 120 deterministic-signing differential cases against the BIP 445 Python reference: byte-identical to the previous commit Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-31 01:19:28 +02:00
Kgothatso Ngako	7e73badcbd	frost: fix constant-time violations and C90 conformance ... The module's BIP 445 logic itself is unchanged and was independently validated against the pinned spec commit bb5396f (BIP v0.10.0), both via the checked-in test vectors and via differential testing against the Python reference over 360 randomised configurations (n up to 128, shuffled non-contiguous signer ids, mixed xonly/plain tweak chains, variable-length messages, pubshares present and absent). Every change below is structural: the differential harness produces byte-identical pubnonces, aggnonces, partial signatures and final signatures before and after. Two classes of problem prevented the module from passing CI. 1. Constant-time violations (ctime_tests) ----------------------------------------- The CI matrix enables FROST in rows that also run "valgrind --error-exitcode=42 ./ctime_tests" -- WITH_VALGRIND and CTIMETESTS both default to 'yes'. With the module enabled that job reported 639 "conditional jump depends on uninitialised value" errors, all originating from two sites: - secp256k1_frost_derive_coefficient returned !overflow && !secp256k1_scalar_is_zero(out) where the short-circuiting && branches on `overflow`, which is derived from the threshold secret key. The caller declassifies the return value, but the branch has already happened inside the callee. Replaced with a bitwise &, matching the existing idiom in secp256k1_scalar_set_b32_seckey (src/scalar_impl.h). - secp256k1_frost_sign_internal performs the self-verification recommended by BIP 445, which runs the *variable-time* secp256k1_ecmult over the partial signature s. nonce_pts and pk were already declassified ahead of that call; s was not. Since s is the public output of the function, declassifying it before the self-verification is both correct and sufficient. secp256k1_frost_deterministic_sign carried three more instances of the same class, invisible until now because ctime_tests did not exercise that path at all: - the `if (!valid)` check on secp256k1_scalar_set_b32_seckey lacked the declassify that the identical checks in secp256k1_frost_nonce_gen and secp256k1_frost_sign_internal already have; - secp256k1_frost_det_nonce_function used the same short-circuiting &&, here over the secret nonces; - the branch on that function's result was not declassified. The && in det_nonce_function is rewritten via two int locals rather than a bare bitwise &: clang's -Wbitwise-instead-of-logical fires when both operands are `!f(...)` expressions, which would break the -Werror clang builds. ctime_tests now also covers secp256k1_frost_deterministic_sign, so that path stays checked from here on. None of these leak anything of value in practice -- they reveal only negligible-probability events (a hash overflowing the curve order, a zero nonce) or whether a secret share is a valid secret key -- but they violate the project's declassification discipline and fail the ctime test. 2. C90 conformance (-Werror -pedantic-errors) --------------------------------------------- The project targets C90 (CMAKE_C_STANDARD 90, -std=c89 -pedantic) and CI passes WERROR_CFLAGS='-Werror -pedantic-errors'. Compiling src/tests.c with those flags produced 62 errors in three groups: - 40x "ISO C forbids empty initializer braces before C2X" in the generated vectors.h; empty {} initializers are C23-only. Fixed in tools/test_vectors_frost_generate.py so it survives regeneration: hexstr_to_intarray now emits "0" for an empty byte string (all six of its call sites wrap the result in braces), and init_group's `counted` helper emits "{ 0 }" for an empty group. In every affected slot the paired count/length field is 0, so the padding element is never read. - 1x "comma at end of enumerator list" (C99+), also in the generator. - 21x "initializer element is not computable at load time" across 11 lines of tests_impl.h. C90 requires constant expressions in initializers for automatic aggregates, so const secp256k1_frost_pubnonce *ptrs[2] = { &a, &b }; is invalid. Rewritten as a declaration plus assignments, the style the musig tests already use, which is why the pre-existing tree was green. vectors.h is regenerated from the spec's JSON vectors. Its hex payload is byte-identical (verified by hashing every 0xNN token) and the file still reproduces exactly from tools/test_vectors_frost_generate.py. Verification ------------ - gcc and clang, -std=c89 -pedantic-errors -Werror, with and without -DVERIFY: clean (was 62 errors) - ctime_tests under MemorySanitizer: 0 reports (was 639); exits 0 with halt_on_error=1 - tests, noverify_tests and frost_example: pass - vectors.h regenerates identically from the pinned spec vectors - 240 signing + 120 deterministic-signing differential cases against the BIP 445 Python reference: byte-identical to the pre-fix build Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-31 00:57:43 +02:00
Kgothatso Ngako	2d97cc2242	Frost Module logic.	2026-08-31 00:05:16 +02:00
Andrew Poelstra	10366dbbbf	Merge BlockstreamResearch/secp256k1-zkp#365: tests: Port hash context tests to zkp modules ... 72867fd682 tests: Port hash context tests to zkp modules (mllwchrry) Pull request description: Ports the hash context tests from bitcoin-core/secp256k1#1777 to the zkp-specific modules. ACKs for top commit: apoelstra: ACK 72867fd682279ff2c79cf13f4f8d8484048d2527; successfully ran local tests Tree-SHA512: 1714a4c5fd793b32a0f00a92670a48709e4d01917bb81739428601c6e88e89f871cdc1294024e6df7272d6c16e681309d9b3448adcd07ce37bfa2be2dc3f4172	2026-08-19 14:32:07 +00:00
Andrew Poelstra	e166e4024f	Merge BlockstreamResearch/secp256k1-zkp#371: whitelist, bppp: defensive hardening and documentation ... 598e22dcde whitelist: document the degenerate W = -P_i destination (DarkWindman) 7ea12c2dca whitelist: document that the parsed key count is untrusted (DarkWindman) e8c3396597 whitelist: honour the documented parse initialization guarantee (DarkWindman) 1de3864ff9 bppp: check for overflow in generator allocation (DarkWindman) Pull request description: Small defensive fixes + docs for whitelist/bppp: - bppp: overflow check in `generators_create` allocation. - whitelist: signature_parse always leaves `sig` in a valid-or-canonically-invalid state; guard serialize against untrusted `n_keys`. - whitelist: document that `n_keys` is attacker-controlled and must not be used to size the arrays passed to `_verify`. - whitelist: document the accepted degenerate `W = -P_i` destination. No API/format changes. New tests cover theallocation overflow and the parse-failure guarantee. ACKs for top commit: apoelstra: ACK 598e22dcde2152003c6a60f04196cc5fe2e2a090; successfully ran local tests mllwchrry: ACK 598e22d. Tree-SHA512: 4c218775a4c2e53091f3ac11e5d93caf17083216afa167fb5c1a1cc38c0a7a2cb1e0564cf9e63c5391d72aba9fc42d90a64b9a5f288ae763f0bf9b4b20f3b2e1	2026-08-19 14:31:55 +00:00
Andrew Poelstra	a8b5410e73	Merge BlockstreamResearch/secp256k1-zkp#367: Fix missing clears on secret values ... a69a662d05 Fix missing clears on secret values (mllwchrry) Pull request description: Several zkp module functions leave secret scalars and buffers live on the stack after use. Adds the missing clears. Also removes a redundant `prep` clear in `secp256k1_rangeproof_sign_impl` that was already cleared earlier on the same path. ACKs for top commit: apoelstra: ACK a69a662d052f2a3839798fdb7d98864d26ccf2cb; successfully ran local tests Tree-SHA512: b11acfaad3bbc26b7597918afdb90aaa563eb2974bc2522626f70457fa354bad349bc698b72371de9df9004bc1e16fee3afb437135cafb1e0c85dcc2535e2987	2026-08-19 14:31:39 +00:00
mllwchrry	72867fd682	tests: Port hash context tests to zkp modules	2026-08-17 16:39:17 +03:00
mllwchrry	a69a662d05	Fix missing clears on secret values	2026-08-17 16:17:43 +03:00
DarkWindman	598e22dcde	whitelist: document the degenerate W = -P_i destination	2026-08-17 13:43:52 +03:00
DarkWindman	7ea12c2dca	whitelist: document that the parsed key count is untrusted	2026-08-17 13:40:33 +03:00
DarkWindman	e8c3396597	whitelist: honour the documented parse initialization guarantee	2026-08-14 12:01:58 +03:00
DarkWindman	1de3864ff9	bppp: check for overflow in generator allocation	2026-08-14 12:01:43 +03:00
Jonas Nick	a2b001cc20	Merge elementsproject/secp256k1-zkp#369: surjection: bind genrand nonce to the full statement ... 65093e1444 surjection: prevent s-value reuse for different proof inputs (mllwchrry) Pull request description: ACKs for top commit: jonasnick: ACK 65093e1444 Tree-SHA512: 563c91fc40d962064efed2fcfc70bbf6f25fc9be049feff95f88cbf62141056cfbe16ae000e828cdbde023aa271436910ed8f4930e244221fc49fb9e838fe2bd	2026-08-14 07:31:46 +00:00
Jonas Nick	f8841c14d5	Merge elementsproject/secp256k1-zkp#370: rangeproof: warn that nonce must not be reused across differing arguments ... cde28971a2 rangeproof: warn that nonce must not be reused across differing arguments (mllwchrry) Pull request description: ACKs for top commit: apoelstra: ACK cde28971a2274beeeb2e9df27342d956b5664d44; successfully ran local tests jonasnick: ACK cde28971a2 Tree-SHA512: 890100ed778e06d1e4ed6fed03080a74676ff804c5f6844e3d2530b7f26a4ec715b8c1f81e3d1fdbbd25c28f50d966802115e493993bfc64ba336296593e7a71	2026-08-14 06:49:59 +00:00
mllwchrry	cde28971a2	rangeproof: warn that nonce must not be reused across differing arguments	2026-08-13 17:52:40 +03:00
mllwchrry	65093e1444	surjection: prevent s-value reuse for different proof inputs ... The s-values produced by secp256k1_surjection_genrand previously depended only on their indices and the difference between input_blinding_key and output_blinding_key. Calls with the same difference therefore reused s-values even when their proof inputs differed. For proofs with the same used-input selection and honest input index, the same generated s-value was used as the signing nonce. Reusing this nonce across different proof messages allowed recovery of the blinding-key difference. The remaining repeated s-values also revealed the honest input index. This commit affects proof generation only; verification is unchanged.	2026-08-13 17:35:31 +03:00
merge-script	2af926dc30	Merge BlockstreamResearch/secp256k1-zkp#366: Upstream PRs 1851, 1852, 1861, 1855, 1864, 1867, 1860, 1865, 1859, 1879, 1881, 1845, 1877, 1882, 1884 ... 217fe59bbf tests: register run_util_tests and run_ec_commit, remove dead print_vector (mllwchrry) 21645c03a2 SECURITY.md: remove Jonas Nick from trusted keys (Jonas Nick) 6a599a4428 scalar: correct `_scalar_get_bits_{limb32,var}` input condition docs (Sebastian Falbesoner) 994b35010d field: correct fe_equal's b magnitude bound (Lőrinc) 0cad3df503 Improve checks for scalar _get_bits methods (Peter.Dettman) 9d75769dec tests: Fix GCC 17 snapshot warning (Tim Ruffing) 66260b78a2 ci: add 'brew trust' invocation to macOS CI (fanquake) 71fcd8410e field: force-inline 5x52 mul and sqr (Lőrinc) a77dacad9a test: enable -Wunused-function in test suite (Fix #1831) (kallal79) 1eab757207 cmake: Fix shared library versioning on OpenBSD (Hennadii Stepanov) a401c5145a cmake: Fix shared library versioning on NetBSD (Hennadii Stepanov) 8a0f4002c7 cmake, refactor: Improve documenting in `SetLibtoolAbiVersion` module (Hennadii Stepanov) acf2084aa7 cmake, refactor: Introduce `SetLibtoolAbiVersion` module (Hennadii Stepanov) d7125e517d test: musig: fix dead "aggnonce encodes two points at infinity" check (Sebastian Falbesoner) 2ee79e77e6 test: add unit test for `_ecmult_gen_ge` (Sebastian Falbesoner) ca68daf8e1 test: refactor: simplify tests by using `_ecmult_gen_ge` helper (Sebastian Falbesoner) 240578eef5 bench: add internal benchmark for `secp256k1_fe_normalize_var` (Sebastian Falbesoner) 9e017e5062 refactor: rename `_ecmult_gen` -> `_ecmult_gen_gej` for consistency (Sebastian Falbesoner) a3296d5e23 refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks) (Sebastian Falbesoner) 5698e66c64 Add exhaustive test for ECDH module (Sebastian Falbesoner) 40a0d874a6 doc: correct API docs for ECDSA signing out-params (s/array/signature object/) (Sebastian Falbesoner) Pull request description: *Note: This PR has been created by a GitHub Actions workflow without human involvement.* This PR syncs the following upstream PRs: * bitcoin-core/secp256k1#1851: doc: correct API docs for ECDSA signing out-params (s/array/signature object/) * bitcoin-core/secp256k1#1852: Add exhaustive test for ECDH module * bitcoin-core/secp256k1#1861: refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks) * bitcoin-core/secp256k1#1855: bench: add internal benchmark for `secp256k1_fe_normalize_var` * bitcoin-core/secp256k1#1864: test: refactor: simplify tests by using `_ecmult_gen_ge` helper, add test * bitcoin-core/secp256k1#1867: test: musig: fix dead "aggnonce encodes two points at infinity" check * bitcoin-core/secp256k1#1860: cmake: Emulate Libtool's behavior on NetBSD and OpenBSD * bitcoin-core/secp256k1#1865: test: enable -Wunused-function in test suite (Fix #1831) * bitcoin-core/secp256k1#1859: field: force-inline 5x52 mul and sqr * bitcoin-core/secp256k1#1879: ci: add 'brew trust' invocation to macOS CI * bitcoin-core/secp256k1#1881: tests: Fix GCC 17 snapshot warning * bitcoin-core/secp256k1#1845: Improve checks for scalar _get_bits methods * bitcoin-core/secp256k1#1877: field: correct `fe_equal` magnitude bound for `b` * bitcoin-core/secp256k1#1882: scalar: correct `_scalar_get_bits_{limb32,var}` input condition docs * bitcoin-core/secp256k1#1884: SECURITY.md: remove Jonas Nick from trusted keys Usage hints: * If this PR has merge conflicts, resolve these by switching to the PR branch and merging the base branch into it using `git merge <base-branch>`. * To show the conflict resolution diff from an existing merge commit, use `git show --remerge-diff <merge-commit>`. * In case you are recreating the PR branch locally, you can (during the conflict resolution state) replay this conflict resolution diff using `git read-tree --reset -u <merge-commit>`. Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree. ACKs for top commit: DarkWindman: ACK 217fe59bbf real-or-random: ACK 217fe59bbf Tree-SHA512: 761fb08be08afcbaa3a43f7432c92a5e65113545a2a25131baf3385d7e354d2a913856f667c8478729877a074d98c0e58fc0c92b17b70a583cbd96d1f478d7f2	2026-07-09 11:31:18 +02:00
mllwchrry	217fe59bbf	tests: register run_util_tests and run_ec_commit, remove dead print_vector	2026-07-03 15:17:36 +03:00
mllwchrry	b1f9e6e360	Merge branch 'master' into sync-ebf59432	2026-07-02 18:43:56 +03:00
merge-script	ebf594320d	Merge bitcoin-core/secp256k1#1884: SECURITY.md: remove Jonas Nick from trusted keys ... 21645c03a2 SECURITY.md: remove Jonas Nick from trusted keys (Jonas Nick) Pull request description: As announced in `#bitcoin-core-dev` IRC, I’m stepping down as a libsecp256k1 maintainer because I’m no longer able to dedicate the time and attention that the project deserves. This PR removes me from the contact list in `SECURITY.md`. ACKs for top commit: real-or-random: ACK 21645c03a2 🫡 theStack: ACK 21645c03a2 🫡 furszy: ACK 21645c03a2 🫡 Tree-SHA512: c7d5fc32476e377766e9f4c07f78a4d8389b213f319070810456879996c6b3ac25949ae65a500f79b9108c3fb52b53a735842b438438349a3f5e2d3df1ba0e1e	2026-06-30 08:35:53 +02:00
Jonas Nick	21645c03a2	SECURITY.md: remove Jonas Nick from trusted keys	2026-06-29 07:06:10 +00:00
merge-script	b90075a074	Merge bitcoin-core/secp256k1#1882: scalar: correct _scalar_get_bits_{limb32,var} input condition docs ... 6a599a4428 scalar: correct `_scalar_get_bits_{limb32,var}` input condition docs (Sebastian Falbesoner) Pull request description: This PR is a small correction of documented (off-by-one) input conditions for the `scalar_get_bits_{limb32,var}`, that came up during reviewing #1845. ACKs for top commit: real-or-random: ACK 6a599a4428 Tree-SHA512: 2f0982b6d69d2abeebe0c9d82161e85feaae317d1e3ac2f415338044c8725a0442e14d998053e62f1b5f59f785a31796b5b3c4b36d9eb516ff53e9bb11429e78	2026-06-26 08:40:47 +02:00
merge-script	5a8a411425	Merge bitcoin-core/secp256k1#1877: field: correct fe_equal magnitude bound for b ... 994b35010d field: correct fe_equal's b magnitude bound (Lőrinc) Pull request description: **Problem:** While reviewing this area with Fable, I noticed that `secp256k1_fe_equal(a, b)` documented `b` up to magnitude 31. Review pointed out that the implementation negates `a` before adding `b`, so the actual internal bound is 30. **Fix:** Lower the documented and checked bound to 30. This keeps `fe_equal` unchanged at runtime and matches current callers, which use much smaller magnitudes. **Test:** Add a focused test with random field elements whose magnitudes are randomized within the accepted `a <= 1` and `b <= 30` bounds. ACKs for top commit: theStack: ACK 994b35010d real-or-random: utACK 994b35010d Tree-SHA512: 034b90b4020c65fcb335ab361341424e08355f64deefaf153d94b05304e68760c9f771e4bc3e0fd664aee164d7e9f5f533d001f21207ef968c52f67d2c23a74a	2026-06-26 08:38:37 +02:00
Sebastian Falbesoner	6a599a4428	scalar: correct _scalar_get_bits_{limb32,var} input condition docs	2026-06-26 03:04:13 +02:00
Lőrinc	994b35010d	field: correct fe_equal's b magnitude bound ... `secp256k1_fe_equal` negates `a` before adding `b`. That gives the temporary value magnitude 2, and the following field addition requires the input magnitudes to sum to at most 32. So the largest `b` magnitude the implementation can accept is 30, not 31. Lower the documented and checked bound for `b` to 30. Adjust the focused test to use random field elements with randomized magnitudes within the accepted `a <= 1` and `b <= 30` bounds. Co-authored-by: Sebastian Falbesoner <sebastian.falbesoner@gmail.com> Co-authored-by: Tim Ruffing <me@real-or-random.org>	2026-06-25 09:23:38 -07:00
merge-script	2ce4f71dc5	Merge bitcoin-core/secp256k1#1845: Improve checks for scalar _get_bits methods ... 0cad3df503 Improve checks for scalar _get_bits methods (Peter.Dettman) Pull request description: Improves the `VERIFY_CHECK`s in all `_scalar_get_bits_limb32` and `_scalar_get_bits_var` methods. The initial prompt was noticing that scalar_4x64_impl/`secp256k1_scalar_get_bits_limb32` was not restricting to 32-bit limbs correctly. Then missing range checks for `offset` were added and all such checks rewritten to avoid overflow. With these changes, the _low and _4x64 impls of `_get_bits_var` can no longer forward to `_get_bits_limb32`, so those calls were inlined instead. ACKs for top commit: sipa: ACK 0cad3df503 theStack: ACK 0cad3df503 real-or-random: utACK 0cad3df503 Tree-SHA512: 753991d586fe5695dd33af6c261c5458ab659be94204626166503af7d403748abb76d791846857a16383cbd38a1f84af9fde74b4327d68d706f88b6531ee7546	2026-06-25 17:02:04 +02:00
merge-script	68b45fd4e2	Merge bitcoin-core/secp256k1#1881: tests: Fix GCC 17 snapshot warning ... 9d75769dec tests: Fix GCC 17 snapshot warning (Tim Ruffing) Pull request description: Passing a non-malloc pointer to free() would be UB. In this case, the free() line is never actually reached (and GCC 17 fails to prove this) in a correct implementation of secp256k1_scratch_space_destroy(), but the test shouldn't rely on the correctness of the tested function. Alternative to #1880. I think this is cleaner - it doesn't recreate the scratch space in the middle of some other tests - it has an obvious matching (malloc, free) pair - it additionally checks that only `magic` is accessed ACKs for top commit: hebasto: ACK 9d75769dec, I have reviewed the code and it looks OK. theStack: re-ACK 9d75769dec Tree-SHA512: eb1a73c04e1996aeecabaa804e6a4fb1f5e6dfba4b9a775b6dd33d147be17185115a5aa9b7d9bf50260c20849e159d1b57f9ee41901d3d691dec25f2643b7cd2	2026-06-25 16:44:49 +02:00
Tim Ruffing	9d75769dec	tests: Fix GCC 17 snapshot warning ... Passing a non-malloc pointer to free() would be UB. In this case, the free() line is never actually reached (and GCC 17 fails to prove this) in a correct implementation of secp256k1_scratch_space_destroy(), but the test shouldn't rely on the correctness of the tested function.	2026-06-25 14:57:56 +02:00
merge-script	9e3a165ad0	Merge bitcoin-core/secp256k1#1879: ci: add 'brew trust' invocation to macOS CI ... 66260b78a2 ci: add 'brew trust' invocation to macOS CI (fanquake) Pull request description: This is probably needed to fix the issues in the macOS Valgrind jobs. i.e in #1877: https://github.com/bitcoin-core/secp256k1/actions/runs/28111568199/job/83240127830?pr=1877#step:4:199 ```bash Cache restored from key: x86_64-macos-native-valgrind-6ebc928a1e40da9db2f283a1c4ac74cfcff9f06687481fd0396a7b4c26ecfb09 Run brew link valgrind Error: Refusing to load formula louisbrunner/valgrind/valgrind from untrusted tap louisbrunner/valgrind. Run `brew trust --formula louisbrunner/valgrind/valgrind` or `brew trust louisbrunner/valgrind` to trust it. Error: Process completed with exit code 1. ``` ACKs for top commit: real-or-random: utACK 66260b78a2 hebasto: ACK 66260b78a2. Tree-SHA512: 447f7687d1cb2ed983f77efea509c7a5255e2436ee0260767b7f9faa71c2c81fca5bc24477761e36cf27c8afdd72acccbb7475371dc233f11cd35d1d1d78d268	2026-06-25 11:24:47 +02:00
fanquake	66260b78a2	ci: add 'brew trust' invocation to macOS CI ... Should fix issues like: > Error: Refusing to load formula louisbrunner/valgrind/valgrind from untrusted tap louisbrunner/valgrind. > Run `brew trust --formula louisbrunner/valgrind/valgrind` or `brew trust louisbrunner/valgrind` to trust it. > Error: Process completed with exit code 1.	2026-06-25 09:17:04 +01:00