349 Commits

Author	SHA1	Message	Date
Kgothatso Ngako	0bbf50187a	Merge branch 'review-fixes'	2026-09-04 02:56:23 +02:00
Kgothatso Ngako	903da53c06	prefractal: add the nested FROST+MuSig2 module (API, implementation, wiring) ... Adds `prefractal`, an experimental module that lets a FROST t-of-n group occupy ONE participant slot of an ordinary MuSig2 (BIP 327) session. Each member computes s_i = k1_i + b_frost*b_musig*k2_i + e*a*lambda_i*g*gacc*d_i and the group publishes one ordinary MuSig2 public nonce and one ordinary MuSig2 partial signature, so cosigners need no support for it and cannot tell a group is involved. Four public functions, all sessionless (every call takes its session parameters explicitly, so there are no new opaque types, magics or *_SIZE constants to keep synchronised): secp256k1_prefractal_nonce_agg group wire nonce + unscaled aggnonce secp256k1_prefractal_sign one member's partial signature secp256k1_prefractal_partial_sig_verify identifiable abort secp256k1_prefractal_partial_sig_agg sum -> musig partial signature Three deliberate deviations from BIP 445, all documented in the public header: 1. b_frost does not commit to the message. The target protocols publish the group's wire nonce before the message exists, so a message-committing coefficient could not be computed in round one and rebuilt later. The outer b_musig does commit to the message and multiplies this one, so the product still binds it. Same trade the iceberg module makes, for the same reason. The preimage is BIP 445's with the message dropped and the group key carried in full rather than x-only, since it is used as a full point downstream. 2. There is NO g_frost factor. Stock FROST normalises its threshold key to even Y (g_times_gacc_parity = gacc_parity ^ pk_odd, frost/session_impl.h :664) because it produces a BIP 340 x-only signature. Here the threshold key is an inner participant of the outer key aggregation and is used as a full point, so all key-side parity normalisation happens once, at the aggregate level, off the OUTER keyagg cache. Note this is NOT implied by the tweak cache being the identity: with an identity cache g_frost is still -1 for every odd-Y group key, i.e. about half of them. Importing frost's key-side parity here would yield a signer that works for even-Y groups and fails for odd-Y ones. 3. The FROST tweak cache must be the identity (tacc == 0, gacc_parity == 0). Checked in sign and partial_sig_verify, not only in partial_sig_agg, so the key a member signs under is tied to the cache that was validated; sign and verify additionally require thresh_pk to equal the cache's own key so the two arguments cannot disagree. The verification equation lives in one helper used both by sign's BIP 445 self-check and by partial_sig_verify, so the two cannot drift apart. Build wiring. Three files order their module blocks differently and the constraints point in opposite directions: - src/secp256k1.c: the include goes AFTER frost and musig, because the module calls their static internals. - src/CMakeLists.txt: the block goes BEFORE both, because its set() calls are only observed by blocks that run later. - configure.ac: the block likewise goes before the musig block, NOT at iceberg's position further down. configure.ac orders musig and frost ahead of iceberg, and iceberg's late enable_module_musig=yes is harmless only because musig defaults to yes. frost defaults to no, so a late force-enable would leave -DENABLE_MODULE_FROST=1 unemitted while AM_CONDITIONAL still observed the mutation - a library whose secp256k1.c never included frost, built alongside frost's own sources. frost is also the first default-OFF module anything depends on, which breaks the dependency-guard idiom used everywhere else in both build systems: the existing "DEFINED X AND NOT X" (CMake) and "x$X = xno" (autotools) tests read as "the user disabled it explicitly" only for default-ON modules, and are true by default for a default-OFF one. Since neither build system can distinguish an explicit disable from the default once both are in the cache, enabling prefractal simply implies frost; the guard is kept for musig, where it still means what it says. The CMake block additionally lifts both dependencies into the parent scope so the top-level configuration summary reports what was actually built rather than printing "frost OFF" while compiling frost in. Verified on both build systems: cmake -B build -DSECP256K1_ENABLE_MODULE_PREFRACTAL=ON -DSECP256K1_BUILD_TESTS=ON -> musig/frost/prefractal all ON, tests pass, 4 prefractal symbols exported cmake -B build -DSECP256K1_BUILD_TESTS=ON -> prefractal OFF, default build unchanged, tests pass ./configure --enable-experimental --enable-module-prefractal && make && make check -> frost=yes forced on, -DENABLE_MODULE_FROST=1 emitted, 3/3 pass ./configure --enable-module-prefractal -> correctly refused: "Prefractal module is experimental" tests_impl.h is a placeholder here so the module links; the real suite lands next.	2026-09-04 00:44:43 +02:00
Kgothatso Ngako	3765a82886	frost: document deterministic_sign's nonce derivation domain ... BIP 445's det_nonce_hash commits to the secret share, my_id, u, the sorted ids, the aggothernonce, the x-only tweaked threshold public key and the message. It does not commit to the pubshares, to the untweaked threshold public key, or to the accumulated tweaks. Because Q and -Q share an x-coordinate, two tweak caches can agree on everything the derivation hashes and still disagree on the sign g*gacc that multiplies the secret share -- a cache initialized from thresh_pk and one initialized from its negation being the smallest example. Two calls differing only in that emit the same pubnonce and partial signatures s = k + e*lambda*d and s' = k - e*lambda*d over the identical k = k1 + b*k2, so subtracting them yields the secret share. Demonstrated on a sole signer (u = 1, ids = {0}, pubshares = NULL) with thresh_sk = 0x11.. and msg = 0x42..: tweaked pk (cache A) 4f355bdc...075871aa tweaked pk (cache B) 4f355bdc...075871aa same x-only key pubnonce A == pubnonce B nonce reused sA - sB 0d7d9c4e...aa748ffa -2*e*d 0d7d9c4e...aa748ffa d recovered Nothing inside a single call can catch this. The self-verification that Sign performs passes in both cases, because each partial signature is individually valid under the cache it was produced with; validate_session_params likewise only ties the pubshares to the cache's own Q0, which both caches satisfy by construction. Note also that pubshares is optional, so there need not be a second value to disagree with. No code change: this is the specified derivation, and committing to Q0 or to gacc here would diverge from BIP 445 and invalidate the det_sign test vectors. The obligation is the caller's, so state it where the caller will meet it -- in the function's own documentation and alongside the existing secnonce and session_secrand32 rules in frost.md. The rule is that the tweak cache and the pubshares are fixed key material settled at key generation, never per-session parameters taken from a coordinator or a peer; under that discipline a repeated call is byte-identical and harmless, which is the point of a deterministic nonce. Worth raising against the BIP: the spec could close this by hashing the untweaked threshold public key, at the cost of new test vectors. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:37:22 +02:00
Kgothatso Ngako	e581abad00	iceberg: add the Iceberg threshold-MuSig module ... Port the experimental Iceberg module from the benchmark-iceberg tree (github.com/furszy/benchmark-iceberg, sources/secp256k1-kmp/native/ secp256k1) into this repo. Iceberg is a threshold scheme that lets a group of parties stand in for a single MuSig2 (BIP 327) participant: the group produces one ordinary MuSig2 public nonce and one ordinary MuSig2 partial signature, so cosigners cannot tell a group is involved and need no changes. Nonces are derived from a caller-chosen per-session label (sid32) rather than stored, so no signer holds a secret nonce between rounds; labels are public but must never be reused. A quorum of 2t-1 members (of whom up to t-1 may be corrupt) is needed in each round, so the threshold is at most half the group rounded up; combined with the scheme's other constraints the smallest usable group is 2-of-4. See doc/iceberg.md and the module header for the full usage notes. Module layout (src/modules/iceberg/, layered bottom-up, each layer may only use the ones above it -- that ordering is also the constant-time story): - scalar_poly.{h,_impl.h}: secret-carrying polynomial arithmetic, keeping secrets away from inversions (documented in the header). - rss.{h,_impl.h}: replicated secret sharing evaluation. - vpss.{h,_impl.h}: verifiable public shares; variable-time by design, sees only participant indices and published points. - keygen_impl.h: distributed key generation producing one share per member. - session_impl.h: nonce_gen/nonce_agg and partial_sign/ partial_sig_agg producing plain MuSig2 objects. - tests_impl.h: 28 tests including the shipped vectors.h vector suite and dealer known-answer tests. - bench_impl.h: benchmark definitions (wired in a follow-up commit). Public headers: include/secp256k1_iceberg.h (installed) and include/secp256k1_iceberg_dealer.h (in-tree only: a trusted dealer is not part of the shipped API, but tests, benchmarks and the example need to deal shares). Content adaptations relative to the source tree (the only changes to the ported code): three secp256k1_musig_nonce_process call sites in tests_impl.h gained a NULL adaptor argument, because this repo's musig is the zkp variant whose public nonce_process takes an optional adaptor point. All musig internals the module uses (ge_parse_ext, ge_serialize_ext, keyaggcoef, aggnonce_load, pubnonce_save, partial_sig_save, nonce_process_internal) are identical in both trees, as are all core headers the module touches; nothing else needed adaptation. Build wiring mirrors the chilldkg module: - configure.ac: --enable-module-iceberg (default no, experimental gate), hard dependency on the musig module with a configure error if musig is explicitly disabled (musig itself pulls in schnorrsig), AM_CONDITIONAL(ENABLE_MODULE_ICEBERG), summary line. - Makefile.am: include src/modules/iceberg/Makefile.am.include under the conditional. - src/secp256k1.c: guarded include of modules/iceberg/main_impl.h after the chilldkg block (musig is included earlier, so its internals are in scope). - src/tests.c: module test registration via MAKE_TEST_MODULE(iceberg). - CMakeLists.txt / src/CMakeLists.txt: SECP256K1_ENABLE_MODULE_ICEBERG option (OFF) with a dependency check on SECP256K1_ENABLE_MODULE_MUSIG (placed before the musig block so the force-enable takes effect), ENABLE_MODULE_ICEBERG=1 compile definition, public header export, summary line. Verified: ./configure --enable-experimental --enable-module-iceberg && make check passes; ./tests --target=iceberg runs the full module suite (28/28); CMake build + ctest pass; the musig dependency error fires correctly in both build systems.	2026-08-31 12:24:48 +02:00
Kgothatso Ngako	d48a1579cf	chilldkg: Phase 5 - recovery, recovery acks, investigation ... Complete the ChillDKG protocol surface with the recovery and blame- attribution procedures (bip-frost-dkg v0.3.0-dev, reference commit a91896883f85b159415ecf298d5e844879af112d). Recovery: - secp256k1_chilldkg_participant_recover / _coordinator_recover: parse the self-delimiting recovery layout u32be(t) || sum_coms(33t) || hostpubkeys(33n) || pubnonces(33n) || enc_secshares(32n, checked) || cert(64n), deriving n = (len-4-33t)/162 exactly as the reference's deserialize_recovery_data; re-verify the certificate, recompute the TapTweak and the receiver's ECDH/self pads from (hostseckey, pubnonces, enc_context), recompute the tweaked secshare, and sanity-check secshare*G == pubshares[own]. Also return hostpubkeys, n and t so callers can re-derive session params. RecoveryDataError / HostSeckeyError / params failures map to INVALID_INPUT (no index, as in the reference); an invalid pubnonce during decrypt passes through as FAULTY_PARTICIPANT_OR_COORDINATOR(i), matching the reference leaking that exception from recover(). Recovery acks: - secp256k1_chilldkg_recovery_ack_sign / _acks_verify: BIP-340 (standard BIP0340 tags) over pad33("BIP DKG/recovery acknowledgment") || u32be(i) || recovery_data. Verification failure maps to FAULTY_PARTICIPANT(i) (InvalidRecoveryAckError subclasses FaultyParticipantError in the reference). Investigation: - secp256k1_chilldkg_coordinator_investigate: builds one 65n-byte per-participant message (per-dealer encrypted partial secshares (32n) + partial pubshares (33n)) per call; the reference returns all n at once -- equivalent, the caller iterates. - secp256k1_chilldkg_participant_investigate: the reference's three-step blame attribution -- sum-of-pubshares check -> FAULTY_COORDINATOR; sum-of-secshares check -> FAULTY_COORDINATOR (covers the reference's SecshareSumError translation); per-dealer decrypted share vs commitment -> FAULTY_PARTICIPANT_OR_COORDINATOR(i) (or FAULTY_COORDINATOR for the own index); all-consistent -> INVALID_INPUT (the reference's uncaught RuntimeError). - Investigation data is transported via a new opaque, secret-bearing secp256k1_chilldkg_participant_inv_data object (4205 bytes, magic-validated save/load, secret-cleared) filled by participant_step2 on the UNKNOWN_FAULT paths. This amends the Phase 3 participant_step2 signature with a nullable inv_data out-param -- required because recomputing inside participant_investigate would duplicate step2's decrypt/verify logic. - New length helper secp256k1_chilldkg_investigation_msg_len (65n). tests_impl.h: chilldkg_recovery_test (recover roundtrips byte-exact vs the session outputs and reference vectors, tampered/truncated/ over-long recovery data, unknown/invalid hostseckey, ack sign byte-exact + verify with wrong-index and tampered-ack blame, params/recovery mismatch rejects, misuse) and chilldkg_investigate_test (two end-to-end public-API scenarios generated from the reference: dealer corrupting a participant's encrypted share, and coordinator tampering with an enc_secshare; cmsg1/cinv/inv_data byte-exact, blame codes and indices matching the reference's exception type and index; malformed cinv -> FAULTY_COORDINATOR; malformed pmsg1 -> FAULTY_PARTICIPANT(j); misuse). The all-consistent investigate path is not constructible without discrete logs and matches the reference's unreachable RuntimeError. Verified: make check 3/3 (incl. noverify); CMake ctest 369/369; make distdir clean.	2026-08-31 06:09:03 +02:00
Kgothatso Ngako	5409aae813	chilldkg: Phase 4 - public coordinator API ... Add the coordinator side of the ChillDKG protocol (bip-frost-dkg v0.3.0-dev, reference commit a91896883f85b159415ecf298d5e844879af112d), as thin wrappers over the Phase 2 encpedpop coordinator internals (whose cmsg1 output was already verified byte-identical to the reference coordinator_step1). Public API: - secp256k1_chilldkg_coordinator_step1: takes an array of pointers to the n participant pmsg1 messages (musig/frost-style convention), parses each with checked scalar parse, aggregates SimplPedPop and EncPedPop, builds eq_input (including the enc_secshares suffix, mirroring the reference) and emits cmsg1 (162n + 33(t-1) bytes). PoPs are not verified coordinator-side, exactly as the reference. - secp256k1_chilldkg_coordinator_finalize: concatenates the n CertEq pmsg2 signatures into the 64n-byte certificate, verifies all of them via certeq_verify (hostpubkeys recovered from eq_input at offset 4+33t), and outputs the coordinator-side DKG result: threshold pubkey, pubshares and recovery data -- no secshare. - secp256k1_chilldkg_coordinator_state: opaque, 21041 bytes, magic-validated, holds only t, n, eq_input, thresh_pk and pubshares -- no secret material, documented as freely copyable/persistable so a stateless coordinator is possible. Blame mapping (verified against chilldkg.py): - malformed pmsg1 (bad commitment encoding, overflowing encrypted share) -> FAULTY_PARTICIPANT(sender index), - invalid CertEq signature -> FAULTY_PARTICIPANT(failing index) (deliberately different from participant_finalize, which maps the same failure to FAULTY_COORDINATOR -- matching the reference), - invalid session params -> INVALID_INPUT; all outputs zeroed on failure. tests_impl.h: chilldkg_coordinator_api_test runs a full n=3,t=2 session through only the public APIs on both sides, byte-exact against the Python reference vectors and cross-checked against every participant's finalize outputs; blame cases (malformed pmsg1 and overflowing share -> FAULTY_PARTICIPANT with the right index, bad CertEq sig -> FAULTY_PARTICIPANT(2), zeroed outputs); misuse coverage (NULL args, corrupted state magic). Verified: make check 3/3 (incl. noverify); CMake ctest 365/365; ./tests --target=chilldkg green.	2026-08-31 05:33:42 +02:00
Kgothatso Ngako	2a0e14d076	chilldkg: Phase 3 - public participant API and CertEq ... Add the public participant-facing ChillDKG API to include/secp256k1_chilldkg.h and the CertEq sub-protocol, completing the participant side of the protocol (bip-frost-dkg v0.3.0-dev, reference pinned at a91896883f85b159415ecf298d5e844879af112d). New module files: - certeq.h / certeq_impl.h: CertEq sub-protocol. Participants sign pad33("BIP DKG/certeq message") || u32be(i) || eq_input with plain BIP0340-tagged Schnorr signatures under their host key (certeq_participant_step); verification is per-index against the x-only hostpubkeys[i][1:33] exactly as the reference (certeq_verify). The coordinator side reuses certeq_verify in Phase 4. Public API (all no-malloc, caller-allocated buffers, outputs zeroed on failure, secret paths cleared): - secp256k1_chilldkg_hostpubkey_gen: plain compressed host pubkey generation; rejects zero / >= group order seckeys. - secp256k1_chilldkg_params_hash: validates session params (participant and threshold ranges, strictly compressed non-infinity pubkeys, no duplicates) and computes TH("BIP DKG/params_hash", u32be(t) || hostpubkeys). - Message-length helpers so callers can size buffers: participant_msg1_len (33t+32n+97), coordinator_msg1_len (162n+33(t-1)), participant_msg2_len (64), coordinator_msg2_len (64n), recovery_data_len (4+33t+162n). - secp256k1_chilldkg_participant_step1: full EncPedPop step1 with seed=deckey=hostseckey; rejects zero randomness and hostseckeys not matching the claimed hostpubkey (input errors, not protocol faults). - secp256k1_chilldkg_participant_step2: parses and verifies cmsg1 via the Phase 2 encpedpop/simplpedpop participant path, computes the tweaked secshare/pubshares/threshold pubkey, appends enc_secshares to eq_input (matching the reference for recovery consistency), and emits the 64-byte CertEq signature. - secp256k1_chilldkg_participant_finalize: re-verifies all n CertEq signatures in the certificate, then outputs the 32-byte secshare, 33-byte threshold pubkey, n pubshares and the self-delimiting recovery data (eq_input || cert). Blame reporting without exceptions: public enum secp256k1_chilldkg_fault (OK / FAULTY_COORDINATOR / FAULTY_PARTICIPANT / FAULTY_PARTICIPANT_OR_COORDINATOR / UNKNOWN_FAULTY_PARTICIPANT_OR_COORDINATOR / INVALID_INPUT) plus an out fault_index, mapping the reference's exception taxonomy: - hostseckey invalid/mismatch -> INVALID_INPUT (HostSeckeyError), - cmsg1 scalar overflow/parse -> FAULTY_COORDINATOR (MsgParseError), - pubnonce/commitment/PoP faults -> FAULTY_PARTICIPANT_OR_COORDINATOR(i), - share-vs-pubshare mismatch -> UNKNOWN with fault_index = UINT32_MAX, - certificate signature failure -> FAULTY_COORDINATOR (documented deviation: fault_index carries the failing signature index as diagnostic info; the reference discards it). Enum-returning functions use a local CHILLDKG_ARG_CHECK that fires the illegal-argument callback and returns INVALID_INPUT (ARG_CHECK would return 0 = OK). Opaque state objects with magic-validated save/load (frost idiom): participant_state1 (4306 bytes, no secrets) and participant_state2 (21073 bytes, contains the secshare; documented keep-secret/no-copy). Fixed-size at SECP256K1_CHILLDKG_MAX_PARTICIPANTS = 128. Also fixes a noverify-build bug: state1_load ran point_load inside VERIFY_CHECK, which compiles out in noverify builds and left the commitment uninitialized; now called unconditionally. tests_impl.h: participant_api_test with full-session reference vectors (n=3, t=2; coordinator aggregation simulated through the internal Phase 2 coordinator step and verified byte-identical to the reference's coordinator_step1): msglen helpers, hostpubkey_gen and params_hash vectors incl. duplicate/invalid/infinity rejection, byte-exact pmsg1/cmsg1/CertEq sigs/secshare/thresh_pk/pubshares/ recovery, blame cases (tampered enc_secshare -> UNKNOWN, invalid pubnonce -> FAULTY_PARTICIPANT_OR_COORDINATOR(1), overflowing enc_secshare -> FAULTY_COORDINATOR, corrupted cert sig -> FAULTY_COORDINATOR with fault_index and zeroed outputs), NULL-arg misuse and bad-magic state rejection. Verified: make check 3/3 (incl. noverify); CMake ctest 363/363; make distdir includes all new files.	2026-08-31 05:22:53 +02:00
Kgothatso Ngako	49f3eba8f5	chilldkg: Phase 0 - module scaffolding and build wiring ... Add an empty, experimental `chilldkg` module as the foundation for a ChillDKG implementation (distributed key generation for FROST) per the bip-frost-dkg BIP draft (v0.3.0-dev): https://github.com/BlockstreamResearch/bip-frost-dkg The module lives in src/modules/chilldkg/ (separate from the frost module, per the implementation plan in .idea/docs/ chilldkg-implementation-plan.md: FROST signing (BIP 445) and ChillDKG are separate BIPs with separate reference repos, test vectors and review cycles; the dependency between them is one-way bytes). New files: - include/secp256k1_chilldkg.h: public header skeleton with the same "EXTREMELY DANGEROUS / work in progress" warning style as secp256k1_frost.h, plus a note that the BIP is a draft and tagged hashes/wire formats may change. No API yet (Phase 3+). - src/modules/chilldkg/main_impl.h: implementation skeleton including the public header. - src/modules/chilldkg/tests_impl.h: trivial scaffolding unit test (chilldkg_scaffolding_test) registered via the tests_chilldkg[] CASE1 array used by this repo's unit-test framework. - src/modules/chilldkg/Makefile.am.include: autotools file list, mirroring the frost module's. - src/modules/chilldkg/chilldkg.md: module doc stub (purpose, draft status, dependency on the schnorrsig and ecdh modules). Build wiring (mirrors the frost module exactly): - configure.ac: --enable-module-chilldkg (default no, experimental gate), dependency errors when schnorrsig or ecdh are explicitly disabled, AM_CONDITIONAL(ENABLE_MODULE_CHILLDKG), summary line. - Makefile.am: include src/modules/chilldkg/Makefile.am.include under ENABLE_MODULE_CHILLDKG. - src/secp256k1.c: guarded include of modules/chilldkg/main_impl.h after the frost module. - src/tests.c: guarded include of tests_impl.h and MAKE_TEST_MODULE(chilldkg) registration. - CMakeLists.txt: SECP256K1_ENABLE_MODULE_CHILLDKG option (OFF) + summary line. - src/CMakeLists.txt: dependency checks on SECP256K1_ENABLE_MODULE_SCHNORRSIG and SECP256K1_ENABLE_MODULE_ECDH, ENABLE_MODULE_CHILLDKG=1 compile definition, public header export. Verified: - ./autogen.sh && ./configure --enable-experimental --enable-module-chilldkg --enable-module-schnorrsig --enable-module-ecdh && make check: PASS 3/3 (tests, noverify_tests, exhaustive_tests). - configure fails with a clear error when schnorrsig or ecdh are disabled, or when experimental is not enabled. - CMake build with SECP256K1_ENABLE_MODULE_CHILLDKG=ON: ctest 345/345 passed; dependency errors fire correctly when schnorrsig/ecdh OFF.	2026-08-31 01:37:22 +02:00
Kgothatso Ngako	7afaab53dc	frost: close remaining gaps against the BIP 445 reference ... Four small divergences from the reference implementation and its API contract, none of which changes any signature: the differential harness (240 signing + 120 deterministic-signing cases against the Python reference) produces byte-identical output before and after. Length prefixes that do not fit ------------------------------- secp256k1_frost_sha256_write_prefixed asserted, via VERIFY_CHECK, that the length fits into its prefix. VERIFY_CHECK compiles away in release builds, so a length that does not fit was silently truncated modulo 2^(8*prefix_size) instead of being rejected, yielding a nonce that does not follow the spec. The reference raises OverflowError instead. Only the 4-byte extra_in prefix of nonce_hash is affected, and only where size_t is wider than 32 bits, so this needs an extra_in of 4 GiB to trigger. It is nevertheless a silent deviation, so write_prefixed now returns 0 without writing anything, and the failure is propagated: secp256k1_frost_nonce_function and secp256k1_frost_det_nonce_function return 0, and secp256k1_frost_nonce_gen returns 0 after wiping session_secrand32 and the nonces. Checking the shifted-out bits (which the loop already computes) rather than comparing extra_in_len against a 32-bit bound avoids a comparison that is always true on 32-bit platforms. The bound is now documented on the extra_in_len parameter. Identifiers equal to UINT32_MAX ------------------------------- BIP 445 derive_interpolating_value accepts every identifier in 0 <= id < 2^32, but secp256k1_frost_ids_are_valid rejected UINT32_MAX because the mapping to the polynomial x-coordinate, id + 1, overflows in uint32_t arithmetic. The +1 is now added in scalar arithmetic, where it cannot overflow, and the identifier restriction is gone. The denominator never needed the +1 at all, since x_j - x_i = (id_j + 1) - (my_id + 1) = id_j - my_id so it is computed directly from the identifiers. This was unreachable through the public API -- validate_session_params already bounds identifiers by n_participants, which is at most SECP256K1_FROST_MAX_PARTICIPANTS = 128 -- but it made an internal helper diverge from the algorithm it implements. frost_large_id_test covers it by reconstructing the constant term of a random degree-2 polynomial from shares held by identifiers 0, UINT32_MAX - 1 and UINT32_MAX. Zero-length messages -------------------- secp256k1_frost_session_init and secp256k1_frost_deterministic_sign required a non-NULL msg, so an empty message -- which the reference represents as the byte string b"" -- could only be passed as a pointer that is never dereferenced. Both now accept NULL when msglen is 0, matching secp256k1_schnorrsig_sign_custom and the msg parameter of secp256k1_frost_nonce_gen. secp256k1_sha256_write guards both of its memcpy calls on a non-zero length, so it is never reached with a NULL pointer. NonceGen keeps its distinction between a NULL msg and a zero-length msg: there the BIP really does distinguish msg = None (hashed as the single byte 0x00) from msg = b"" (hashed as 0x01 followed by an eight-byte zero length), and the API expresses that as NULL versus non-NULL. frost_empty_msg_test runs a signing round over a zero-length message passed both ways and checks that the two session objects are identical. The two API tests that relied on a NULL msg always being rejected now pass an explicit non-zero msglen; previously they passed a random msglen that could be 0. Header documentation -------------------- The parameter tables of eleven doc comments had names that did not line up with their block's continuation column. All parameter tables are now aligned consistently, with wrapped text two columns past the colon. Verification ------------ - gcc and clang, -std=c89 -pedantic-errors -Werror, with and without -DVERIFY: clean - tests (multiple seeds), noverify_tests and frost_example: pass - ctime_tests under MemorySanitizer: exits 0 with halt_on_error=1 - vectors.h still reproduces exactly from the spec's JSON vectors - 240 signing + 120 deterministic-signing differential cases against the BIP 445 Python reference: byte-identical to the previous commit Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-31 01:19:28 +02:00
Kgothatso Ngako	2d97cc2242	Frost Module logic.	2026-08-31 00:05:16 +02:00
DarkWindman	598e22dcde	whitelist: document the degenerate W = -P_i destination	2026-08-17 13:43:52 +03:00
DarkWindman	7ea12c2dca	whitelist: document that the parsed key count is untrusted	2026-08-17 13:40:33 +03:00
mllwchrry	cde28971a2	rangeproof: warn that nonce must not be reused across differing arguments	2026-08-13 17:52:40 +03:00
mllwchrry	b1f9e6e360	Merge branch 'master' into sync-ebf59432	2026-07-02 18:43:56 +03:00
Sebastian Falbesoner	40a0d874a6	doc: correct API docs for ECDSA signing out-params (s/array/signature object/)	2026-04-29 17:56:54 +02:00
DarkWindman	f7e7e6bb15	Merge branch 'master' into sync-7262adb4	2026-04-01 17:29:57 +03:00
Mykyta Redko	b96b655a82	include: fix a minor grammar mistake in the rangeproof description	2026-03-24 09:11:14 +02:00
furszy	0753f8b909	Add API to override SHA256 compression at runtime ... This introduces `secp256k1_context_set_sha256_compression()`, which allows users to provide their own SHA256 block-compression function at runtime. This is useful in setups where the fastest implementation can only be determined dynamically based on the available CPU features, and rebuilding the library is not possible. The callback is installed on the `secp256k1_context` and is then used by all operations that compute SHA256 hashes. As part of the setup, the library performs sanity checks to ensure that the supplied function is equivalent to the default transform. Passing NULL to the callback setter restores the built-in implementation.	2026-03-03 10:35:53 -03:00
mllwchrry	3b2ceb3e7a	Merge commits '14e56970 1605b02f cd49c57e 453949ab 57315a69 97de5120 c5da3bde 99ab4a10 d071aa56 1d146ac3 322d0a43 c7a7f732 ac561601 dfe042fe 3019186a 95e68158 10f546a2 c0a2aba0 ' into temp-merge-1811	2026-03-03 14:45:28 +02:00
merge-script	459eab20f2	Merge BlockstreamResearch/secp256k1-zkp#332: Upstream PRs 1763, 1771, 1761, 1774, 1779, 1784, 1788, 1778, 1783, 1790, 1764, 1793, 1800, 1796, 1808, 1809 ... dc0bda5731 bench: Port bitcoin-core/secp256k1#1796 to zkp-specific code (mllwchrry) fe48cc9fa5 generator: Port bitcoin-core/secp256k1#1764 to zkp-specific code (mllwchrry) d111d31293 generator: Port bitcoin-core/secp256k1#1779 to zkp-specific code (mllwchrry) d8e87e45f3 unit_test: bump MAX_ARGS from 150 to 200 (mllwchrry) 2542b43451 modules: Port bitcoin-core/secp256k1#1774 to zkp-specific code (mllwchrry) ae7eb729c0 release cleanup: bump version after 0.7.1 (Jonas Nick) 20a209f11c release: prepare for 0.7.1 (Jonas Nick) c4b6a81a60 changelog: update in preparation for the v0.7.1 release (Jonas Nick) c09215f7af bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS (kevkevinpal) 29ac4d8491 sage: verify Eisenstein integer connection for GLV constants (Justsomebuddy) bd5ced1fe1 doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult (kevkevinpal) 2f73e5281d group: Avoid using infinity field directly in other modules (Tim Ruffing) 0406cfc4d1 doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake (kevkevinpal) ae00c552df Add VERIFY_CHECKs that flags are 0 or 1 (John Moffett) 3b5b03f301 doc/bench: Added cmake build options to bench error messages (kevkevinpal) d822b29021 test: split monolithic ellswift test into independent cases (furszy) 3daab83a60 refactor: remove ret from secp256k1_ec_pubkey_serialize (kevkevinpal) 8bcda186d2 test: Add non-NULL checks for "pointer of array" API functions (Sebastian Falbesoner) 5a08c1bcdc Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL (Sebastian Falbesoner) f5e815f430 remove secp256k1_eckey_pubkey_serialize function (Sebastian Falbesoner) 0d3659c547 use new `_eckey_pubkey_serialize{33,65}` functions in modules (ellswift,musig) (Sebastian Falbesoner) adb76f82ea use new `_eckey_pubkey_serialize{33,65}` functions in public API (Sebastian Falbesoner) fc7458ca3e introduce `secp256k1_eckey_pubkey_serialize{33,65}` functions (Sebastian Falbesoner) 26166c4f5f ecmult_multi: reduce strauss memory usage by 30% (Jonas Nick) f252da7e6e ci: Use Python virtual environment in "x86_64-macos-native" job (Hennadii Stepanov) 153eea20c2 bench: Use `ALIGNMENT` macro instead of hardcoded value (Hennadii Stepanov) Pull request description: Merge bitcoin-core/secp256k1#1763: bench: Use `ALIGNMENT` macro instead of hardcoded value Merge bitcoin-core/secp256k1#1771: ci: Use Python virtual environment in "x86_64-macos-native" job Merge bitcoin-core/secp256k1#1761: ecmult_multi: reduce strauss memory usage by 30% Merge bitcoin-core/secp256k1#1774: refactor: split up internal pubkey serialization function into compressed/uncompressed variants Merge bitcoin-core/secp256k1#1779: Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL Merge bitcoin-core/secp256k1#1784: refactor: remove ret from secp256k1_ec_pubkey_serialize Merge bitcoin-core/secp256k1#1788: test: split monolithic ellswift test into independent cases Merge bitcoin-core/secp256k1#1778: doc/bench: Added cmake build options to bench error messages Merge bitcoin-core/secp256k1#1783: Add VERIFY_CHECKs and documentation that flags must be 0 or 1 Merge bitcoin-core/secp256k1#1790: doc: include arg -DSECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS=ON for cmake Merge bitcoin-core/secp256k1#1764: group: Avoid using infinity field directly in other modules Merge bitcoin-core/secp256k1#1793: doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult Merge bitcoin-core/secp256k1#1800: sage: verify Eisenstein integer connection for GLV constants Merge bitcoin-core/secp256k1#1796: bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS Merge bitcoin-core/secp256k1#1808: Prepare for 0.7.1 Merge bitcoin-core/secp256k1#1809: release cleanup: bump version after 0.7.1 This PR can be recreated with `./contrib/sync-upstream.sh -b master range c7a52400`. Tips: * Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit. * Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally. Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree. ACKs for top commit: real-or-random: ACK dc0bda5731 Tree-SHA512: a816729a8d3ce199154a1b670172f4639b03812071fd78db8e23dfad9a88a2fef882f30c9f34e1151ad79b85201fbb7eba890a572d68bb45ca8fb05496bc34e8	2026-03-03 13:28:45 +01:00
merge-script	f9fff348ea	Merge BlockstreamResearch/secp256k1-zkp#328: include: add description of range proofs ... 6f7c112cc8 include: add description of range proofs focusing on the differences between the implementation and the CA paper (Mykyta) Pull request description: Added the description of range proofs in Confidential Assets focusing on the differences between the description in the paper and the actual implementation. ACKs for top commit: real-or-random: ACK 6f7c112cc8 Tree-SHA512: c8568883648d6d1f0cbbe9a9730b08512665a90106b974733eecfc3dc628361ff54785c67c355216157af5a63b7fefa52d49df400ccaeec9cbf14d40a600707f	2026-03-02 20:24:33 +01:00
Mykyta	6f7c112cc8	include: add description of range proofs focusing on the differences between the implementation and the CA paper	2026-03-02 17:50:52 +02:00
mllwchrry	07d4de6433	Merge commits '115b135f c8206b1c b6c2a3cd e7f7083b be5e4f02 5c751833 540fec8a aa2a39c1 8d445730 f9a944ff 2d9137ce 4721e077 471e3a13 ebb35882 1a53f496 c7a52400 ' into temp-merge-1809	2026-03-02 15:56:43 +02:00
DarkWindman	f1e52fac20	Merge commits '88be4e8d b4756543 10dab907 58178851 de6af6ae baa26542 2b7337f6 a44a3393 f44c1ebd d543c0d9 43e7b115 7a2fff85 ' into temp-merge-1758	2026-02-27 14:47:34 +02:00
DarkWindman	38284aa008	Merge commits '2c076d90 20e3b447 74b8068c e523e4f9 d5997141 d2dcf520 f36afb8b 8113671f d93380fb 03fb60ad 4985ac0f 36e76952 ' into temp-merge-1738	2026-02-25 10:44:34 +02:00
mllwchrry	9dcd857d54	Merge commits '29e73f4b 89096c23 c4987790 ad60ef7e 943479a7 cbbbf3bd 73a69595 7c338042 5e74086d 6037833c 020ee604 a660a497 b9313c6e ' into temp-merge-1708	2026-02-24 13:31:44 +02:00
mllwchrry	79953d074b	Merge commits '1b1fc093 6c2a39da 31860823 abd25054 4ba1ba2a 03bbe8c6 13ed6f65 a7a51171 2abb35b0 e56716a3 3f54ed8c d84bb83e ' into temp-merge-1661	2026-02-20 18:29:53 +02:00
mllwchrry	a8e6a3cc34	Port bitcoin-core/secp256k1#1628 to zkp public API	2026-02-16 16:12:41 +02:00
mllwchrry	347d6adfd2	Merge commits 'a88aa935 01b58933 18f9b967 e59158b6 1fae76f5 f0868a9b 68b55209 9b7c59cb 1464f15c 9a8db52f 7d48f5ed a38d879a ' into temp-merge-1628	2026-02-16 16:04:51 +02:00
mllwchrry	8c7c24eb8a	docs: simplify README description, fix musig docs	2026-02-16 13:01:42 +02:00
mllwchrry	8d443b8030	musig: Re-add adaptor signatures support	2026-02-13 15:07:52 +02:00
mllwchrry	248358f2bc	Merge commit '3660fe5e' into temp-merge-1479	2026-02-13 13:08:00 +02:00
mllwchrry	21c24fdc7a	musig: Remove module in preparation for upstream merge	2026-02-13 11:36:52 +02:00
DarkWindman	551b5dd415	Merge commits 'fded437c cdf08c1a 642c885b f8c1b0e0 3fdf146b b3076144 19888550 2f2ccc46 472faaa8 4c57c7a5 ' into temp-merge-1554	2026-02-11 13:56:17 +02:00
DarkWindman	2cb2e312e9	extrakeys: Migrate to bitcoin-core/secp256k1#1518 secp256k1_ec_pubkey_sort	2026-02-05 19:02:49 +02:00
DarkWindman	3291b021bf	Merge commits 'bb528cf ' into temp-merge-1518	2026-02-05 18:50:53 +02:00
Hennadii Stepanov	13e3bee504	refactor: Remove trailing whitespace	2026-02-02 13:01:18 +00:00
kevkevinpal	0406cfc4d1	doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake	2025-12-19 09:51:39 -05:00
merge-script	baa265429f	Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once ... 4d90585fea docs: Improve API docs of _context_set_illegal_callback (Tim Ruffing) 895f53d1cf docs: Clarify that callback can be called more than once (Tim Ruffing) Pull request description: The tests in #1698 reminded me that some functions, e.g., `secp256k1_ec_pubkey_cmp`, may call the illegal callback more than once (see https://github.com/bitcoin-core/secp256k1/pull/1390#discussion_r1279194655 for more context). This PR clarifies the API docs to state explicitly that this is possible. This is the simplest solution. Any production code should crash anyway if it encounters a callback. And in debug code or in our test code, it doesn't really matter whether you see an error message once or twice. The alternative is to provide a guarantee that the callback is called only once. But that would make our code more complex for no good reason. The second commit fixes a few typos, wording, and consistency. ACKs for top commit: stratospher: ACK 4d90585. theStack: re-ACK 4d90585fea Tree-SHA512: 97c31d68851e845b21e9ec2530432603917c019580feba98b62014b538f61be94ba963bf619217720d8f7331ac830e97e62c76c02e7297d3cf73dd085e6f4ca2	2025-09-24 20:49:34 +02:00
Tim Ruffing	4d90585fea	docs: Improve API docs of _context_set_illegal_callback	2025-09-22 12:59:36 +02:00
Tim Ruffing	895f53d1cf	docs: Clarify that callback can be called more than once	2025-09-22 12:58:48 +02:00
Jonas Nick	7321bdf27b	doc: clarify API doc of secp256k1_ecdsa_recover return value ... Co-authored-by: Tim Ruffing <me@real-or-random.org>	2025-09-16 21:29:16 +02:00
Sebastian Falbesoner	806de38bfc	doc: mention ctx requirement for _ellswift_create (not secp256k1_context_static)	2025-09-05 19:11:29 +02:00
Tim Ruffing	ce7923874f	build: Add SECP256K1_NO_API_VISIBILITY_ATTRIBUTES	2025-07-18 13:54:48 +02:00
Tim Ruffing	e5297f6d79	build: Refactor visibility logic	2025-07-18 08:54:03 +02:00
Jonas Nick	1b6e081538	include: remove WARN_UNUSED_RESULT for functions always returning 1 ... This makes the usage of the atribute consistent. In the musig and ellswift module, functions that return 1 always already don't have the WARN_UNUSED_RESULT attribute. In secp256k1.h and the extrakeys module, this has only been the case partially. In all cases where this was removed, the function only returns 0 if the illegal callback has been called.	2025-03-13 09:36:03 +00:00
Jonas Nick	13ed6f65dc	Merge bitcoin-core/secp256k1#1593: Remove deprecated _ec_privkey_{negate,tweak_add,tweak_mul} aliases from API ... 37d2c60bec Remove deprecated _ec_privkey_{negate,tweak_add,tweak_mul} aliases (Sebastian Falbesoner) Pull request description: ACKs for top commit: real-or-random: utACK 37d2c60bec sipa: utACK 37d2c60bec jonasnick: ACK 37d2c60bec Tree-SHA512: 5d3c836c3c4d5cde143fe5b5235f9fc108174439b056f3418834f33d12ea28bdf09d11a81917d679b4b9a93da26304241c8fe389549e72796bbda116e9ff4945	2025-03-12 20:01:59 +00:00
Sebastian Falbesoner	37d2c60bec	Remove deprecated _ec_privkey_{negate,tweak_add,tweak_mul} aliases ... These function aliases have been described as DEPRECATED in the public API docs already many years ago (see #701, commit 41fc7856), and in addition explicit deprecation warnings are shown by the compiler at least since the first official release 0.2.0 (see PR #1089, commit fc94a2da), so it should be fine to just remove them by now. Co-authored-by: Tim Ruffing <crypto@timruffing.de>	2025-02-25 04:17:45 +01:00
Daniel Pfeifer	432ac57705	Make static context const	2025-02-24 17:25:27 +01:00
Ava Chow	694342fdb7	Name public API structs	2024-10-31 13:55:52 -04:00