3427 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Kgothatso Ngako	0bbf50187a	Merge branch 'review-fixes'	2026-09-04 02:56:23 +02:00
Kgothatso Ngako	46a59c2ad5	Merge branch 'prefractal' ... Adds the prefractal module: a nested FROST+MuSig2 scheme letting a FROST t-of-n group occupy one participant slot of an ordinary MuSig2 (BIP 327) session. Three deliberate deviations from BIP 445, all documented in doc/prefractal.md: the nonce coefficient does not commit to the message (so a group can publish its wire nonce before the message exists); there is no g_frost factor, because the threshold key is an inner participant of the outer aggregation and is used as a full point; and the frost tweak cache must be the identity. Merged the same way the iceberg module was.	2026-09-04 01:56:08 +02:00
Kgothatso Ngako	b66c757b7f	prefractal: document the deviations and add the constant-time test ... doc/prefractal.md writes down the three deliberate deviations from BIP 445 where a reviewer will find them, since none of them is visible from the API and two of them are actively counterintuitive: 1. b_frost does not commit to the message, because the target protocols publish the group's wire nonce before the message exists. The outer b_musig does commit to it and multiplies b_frost everywhere it appears. 2. There is no g_frost factor, and the reason is NOT that the tweak cache is the identity. The frost key-side factor is g*gacc; an identity cache gives gacc = 1, but g is still -1 for every odd-Y threshold key. The doc spells this out because "identity cache, therefore no key term" is the plausible wrong reason, and acting on it yields a signer that works for even-Y groups and fails for odd-Y ones. 3. The frost tweak cache must be the identity, checked at signing and verification and not only at aggregation, so the key a member signs under is tied to the cache that was validated. It also records the two caller obligations the module cannot enforce - one secnonce per signature, and round-two signers EQUAL to round-one contributors - and notes that iceberg tolerates a round-two subset where this module must not, since callers moving between the two would otherwise transpose the rule. The build section documents the three-way ordering constraint rather than leaving the next person to copy iceberg's positions, which are wrong for configure.ac. The ctime test adds a 2-of-2 nested group with a stock musig cosigner, taken as far as one signature share, marking the threshold key, the secret shares and the session randomness as secret and everything else as public. Nonce generation passes msg = NULL, which is how the module is actually driven. Verified: valgrind -q ./build/bin/ctime_tests exits 0, so nothing in the prefractal signing path branches on secret data. Full test suite green. The example program from the plan's optional list is not included; the test suite covers the same ground and the doc carries the usage rules.	2026-09-04 01:06:14 +02:00
Kgothatso Ngako	f0014c4c49	prefractal: add the module test suite ... Ten tests covering the round trip, the three deliberate deviations from BIP 445, and the failure modes the module cannot catch for its caller. The centrepiece is a pair of FIXED threshold secret keys, one whose threshold public key has even Y and one whose has odd Y. The nested equation has no g_frost factor, and the reason is NOT that the tweak cache is the identity: stock frost's key-side factor is g*gacc with g = -1 for an odd-Y threshold key (frost/session_impl.h:664, :797-800), so an implementation that imported frost's key-side parity works for even-Y groups and fails for odd-Y ones. With a randomly seeded fixture that is a coin flip per run. This was verified by mutation rather than assumed. Injecting the pk_odd negation into prefractal_session_values and rebuilding: run_prefractal_odd_y_group_key_test FAILED same test with the even-Y fixture PASSED so the fixed odd-Y fixture is what makes the trap detectable, and the parity of the fixture is itself asserted in the test so it cannot quietly stop testing what it is named after. The suite: midstate pins the Prefractal/noncecoef tagged hash against a freshly initialised one. Nothing else in the tree would notice a changed b_frost; it would just produce signatures that do not verify. e2e the round trip over {2-of-2, 3-of-2, 5-of-3, 4-of-3, 7-of-5} x both lexicographic positions of the group key x both group-key Y parities x with and without the outer BIP 341 tweak, against a stock musig cosigner, judged by secp256k1_schnorrsig_verify on the outer aggregate key. Both key orders matter because BIP 327 KeyAgg gives the second distinct key a coefficient of exactly 1. odd_y_group_key the odd-Y case alone, so a regression names its cause instead of surfacing as one iteration of that matrix. partial_sig_verify accepts a good share; rejects a tampered one, the right share against the wrong member, a share made for a different signer set (lambda_i is defined over the participating set), and a different message. identity_cache a tweaked frost cache is refused by sign, by partial_sig_verify and by partial_sig_agg, and the same agg call succeeds with the identity cache, so the refusal is about the tweak and not the arguments. key_cache_mismatch thresh_pk and the tweak cache must describe one key. infinity_nonce both nonce columns can reach infinity independently - the first is passed through unscaled, the second only after the b_frost multiplication - and a musig pubnonce can encode neither, so both are refused; the untouched set still aggregates. nonce_reuse the secnonce is wiped, including on calls that then fail for another reason, so a refused member cannot retry with the same nonce. Reuse takes the illegal-argument path via secnonce_load's ARG_CHECK, as stock frost_sign does, so it is checked with CHECK_ILLEGAL. negative_control wrong key order and a missing outer tweak both produce shares that are individually well formed and only fail at the final BIP 340 verification. These are the mistakes the module cannot catch for the caller, so the tests pin where they do surface. api duplicate identifiers, out-of-range counts, an id outside the signer set, a share not matching its pubshare, and NULL pubshares skipping that check as documented. Also fixes the outer tweak in the identity-cache test, which declared its throwaway output as secp256k1_pubkey where frost_pubkey_xonly_tweak_add wants secp256k1_xonly_pubkey. Both are data[64] so it ran correctly, but it is a type error and -Wincompatible-pointer-types flags it. Verified: cmake ... -DSECP256K1_ENABLE_MODULE_PREFRACTAL=ON -> 10/10 prefractal tests pass, full suite green ./configure --enable-experimental --enable-module-prefractal && make check -> 3/3 pass -Wall -Wextra -Wcast-align -Wshadow -Wundef -std=c89 -pedantic -> no warnings from any prefractal file	2026-09-04 01:02:56 +02:00
Kgothatso Ngako	903da53c06	prefractal: add the nested FROST+MuSig2 module (API, implementation, wiring) ... Adds `prefractal`, an experimental module that lets a FROST t-of-n group occupy ONE participant slot of an ordinary MuSig2 (BIP 327) session. Each member computes s_i = k1_i + b_frost*b_musig*k2_i + e*a*lambda_i*g*gacc*d_i and the group publishes one ordinary MuSig2 public nonce and one ordinary MuSig2 partial signature, so cosigners need no support for it and cannot tell a group is involved. Four public functions, all sessionless (every call takes its session parameters explicitly, so there are no new opaque types, magics or *_SIZE constants to keep synchronised): secp256k1_prefractal_nonce_agg group wire nonce + unscaled aggnonce secp256k1_prefractal_sign one member's partial signature secp256k1_prefractal_partial_sig_verify identifiable abort secp256k1_prefractal_partial_sig_agg sum -> musig partial signature Three deliberate deviations from BIP 445, all documented in the public header: 1. b_frost does not commit to the message. The target protocols publish the group's wire nonce before the message exists, so a message-committing coefficient could not be computed in round one and rebuilt later. The outer b_musig does commit to the message and multiplies this one, so the product still binds it. Same trade the iceberg module makes, for the same reason. The preimage is BIP 445's with the message dropped and the group key carried in full rather than x-only, since it is used as a full point downstream. 2. There is NO g_frost factor. Stock FROST normalises its threshold key to even Y (g_times_gacc_parity = gacc_parity ^ pk_odd, frost/session_impl.h :664) because it produces a BIP 340 x-only signature. Here the threshold key is an inner participant of the outer key aggregation and is used as a full point, so all key-side parity normalisation happens once, at the aggregate level, off the OUTER keyagg cache. Note this is NOT implied by the tweak cache being the identity: with an identity cache g_frost is still -1 for every odd-Y group key, i.e. about half of them. Importing frost's key-side parity here would yield a signer that works for even-Y groups and fails for odd-Y ones. 3. The FROST tweak cache must be the identity (tacc == 0, gacc_parity == 0). Checked in sign and partial_sig_verify, not only in partial_sig_agg, so the key a member signs under is tied to the cache that was validated; sign and verify additionally require thresh_pk to equal the cache's own key so the two arguments cannot disagree. The verification equation lives in one helper used both by sign's BIP 445 self-check and by partial_sig_verify, so the two cannot drift apart. Build wiring. Three files order their module blocks differently and the constraints point in opposite directions: - src/secp256k1.c: the include goes AFTER frost and musig, because the module calls their static internals. - src/CMakeLists.txt: the block goes BEFORE both, because its set() calls are only observed by blocks that run later. - configure.ac: the block likewise goes before the musig block, NOT at iceberg's position further down. configure.ac orders musig and frost ahead of iceberg, and iceberg's late enable_module_musig=yes is harmless only because musig defaults to yes. frost defaults to no, so a late force-enable would leave -DENABLE_MODULE_FROST=1 unemitted while AM_CONDITIONAL still observed the mutation - a library whose secp256k1.c never included frost, built alongside frost's own sources. frost is also the first default-OFF module anything depends on, which breaks the dependency-guard idiom used everywhere else in both build systems: the existing "DEFINED X AND NOT X" (CMake) and "x$X = xno" (autotools) tests read as "the user disabled it explicitly" only for default-ON modules, and are true by default for a default-OFF one. Since neither build system can distinguish an explicit disable from the default once both are in the cache, enabling prefractal simply implies frost; the guard is kept for musig, where it still means what it says. The CMake block additionally lifts both dependencies into the parent scope so the top-level configuration summary reports what was actually built rather than printing "frost OFF" while compiling frost in. Verified on both build systems: cmake -B build -DSECP256K1_ENABLE_MODULE_PREFRACTAL=ON -DSECP256K1_BUILD_TESTS=ON -> musig/frost/prefractal all ON, tests pass, 4 prefractal symbols exported cmake -B build -DSECP256K1_BUILD_TESTS=ON -> prefractal OFF, default build unchanged, tests pass ./configure --enable-experimental --enable-module-prefractal && make && make check -> frost=yes forced on, -DENABLE_MODULE_FROST=1 emitted, 3/3 pass ./configure --enable-module-prefractal -> correctly refused: "Prefractal module is experimental" tests_impl.h is a placeholder here so the module links; the real suite lands next.	2026-09-04 00:44:43 +02:00
Kgothatso Ngako	42f827a7d9	build: distribute the frost, chilldkg and iceberg documentation ... README.md gained three links when the modules landed -- to src/modules/frost/frost.md, src/modules/chilldkg/chilldkg.md and doc/iceberg.md -- and none of the three files was added to EXTRA_DIST, so make dist produced a tarball whose README pointed at files that were not in it. doc/iceberg.md is the clearest case: every other file under doc/ is listed, so it was simply missed. The two module documents follow the existing pattern for module-local documentation, where src/modules/surjection/surjection.md and src/modules/whitelist/whitelist.md are equally absent and equally linked from README.md. That pattern is inherited and is left for a separate change; adding the two this fork introduced at least makes the fork's own additions self-consistent. Verified with a from-scratch autogen.sh, configure and make dist in a clean copy of the tree: the tarball now carries doc/ellswift.md, doc/musig.md, doc/iceberg.md, src/modules/frost/frost.md and src/modules/chilldkg/chilldkg.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:38:15 +02:00
Kgothatso Ngako	67e9424552	build: gate the experimental modules on SECP256K1_EXPERIMENTAL in CMake ... configure.ac refuses --enable-module-frost, --enable-module-chilldkg and --enable-module-iceberg outright unless --enable-experimental is also given. The CMake build had no equivalent, so -DSECP256K1_ENABLE_MODULE_ICEBERG=ON produced a library with no warning banner and no acknowledgement that anything experimental was requested. Of the three, iceberg is the one this matters most for: doc/iceberg.md tells the reader not to put money behind it, and the CMake path let a build acquire it without the reader ever passing a flag that says so. Add the three checks to the existing NOT SECP256K1_EXPERIMENTAL block, next to the ARM32 assembly check and worded the same way. The options are declared well above it, so the values are set by the time the block runs. Verified both directions: the configure fails with "Iceberg module is experimental. Use -DSECP256K1_EXPERIMENTAL=ON to allow." without the flag, and succeeds with it. This deliberately leaves the other zkp experimental modules alone. They are ON by default in CMake and gating them would change every existing CMake build; the three added here are OFF by default, so nobody is relying on the ungated path. While here, correct doc/iceberg.md, which claimed the module "builds by default here". SECP_SET_DEFAULT(enable_module_iceberg, no, yes) makes it off by default and on in dev mode, which is now what the paragraph says, along with the experimental requirement it did not previously mention. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:38:05 +02:00
Kgothatso Ngako	7afee05de8	tools: add the iceberg test vector generator ... src/modules/iceberg/vectors.h opens with regeneration instructions that name ./tools/test_vectors_iceberg_generate.py, and that script was never committed. The same header calls the file "the one thing in this repository that cannot be rebuilt from what the repository contains", which the missing generator made true twice over: neither the reference nor the tool that reads it was reachable from a clone. Recovered from the tree the Iceberg C is vendored in, at sources/secp256k1-kmp/native/secp256k1 of the benchmark repository (bitcoin-core/secp256k1 branch iceberg-module, commit 96201552, per that repository's PINS.txt). Confirmed to be the generator that produced the checked-in vectors before committing it: - its HEADER template reproduces the header of vectors.h exactly, including the ICEBERG_VECTOR_MAX_PARTICIPANTS 9 and ICEBERG_VECTOR_MAX_SEEDS 126 it computes from the configuration list; - its seed rule, sha256("iceberg test vectors|<label>|<rank>"), reproduces the checked-in 2of3 seeds byte for byte; - the whole of that tree's src/modules/iceberg/ matches this one byte for byte except tests_impl.h, which differs only because the tests here are ported to the unit_test.h test-module framework. The script cannot be re-run from a clone alone, by design: it takes the nkohen/Iceberg Python reference as its argument and that reference is deliberately not vendored, since it is not ours and pinning a copy would hide it drifting. Its docstring gives the clone and the pinned commit (7b55ef6d), which is now the whole of what regenerating requires. Also restore the executable bit on the frost and chilldkg generators. Both carry a usage line telling the reader to run them directly, and every other generator in tools/ is 0755. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:37:52 +02:00
Kgothatso Ngako	c9952bd10a	chilldkg: enforce the tag length bounds in noverify builds ... secp256k1_chilldkg_pad33 and secp256k1_chilldkg_schnorrsig_sha256_tagged each guarded a memcpy into a fixed-size stack buffer with VERIFY_CHECK, which is compiled out in noverify (release) builds. In pad33 the consequence is worse than the overflowing copy: the following memset(out33 + len, 0, 33 - len) underflows its length to a huge value when len exceeds 33. Neither is reachable today. Every call site passes a string literal of this module: "BIP DKG/certeq message" (22) and "BIP DKG/recovery acknowledgment" (31) for pad33, and at most "BIP DKG/pop message" || "/challenge" (29 of 64) for the tagged-hash helper. This is the same shape as the persisted-state guards promoted in ceccb50a, without the attacker-controlled input path -- so the change is defence in depth, to keep a future longer tag from smashing the stack in a release build rather than failing a debug assertion. Enforce both bounds outside VERIFY_CHECK and keep VERIFY_CHECK(0) inside the branch as the debug-build diagnostic, matching the existing idiom in this module (see the point_load fallbacks in the state loaders). The tagged-hash helper clamps rather than returning early: an early return would leave the caller's secp256k1_sha256 uninitialized and every call site writes into it immediately, which is a worse failure than the one being fixed. A clamped tag changes every hash the module computes, so the chilldkg vectors would fail loudly rather than silently. No behaviour change on any reachable input: the full test suite, including the chilldkg vectors, is unaffected in both verify and noverify builds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:37:35 +02:00
Kgothatso Ngako	3765a82886	frost: document deterministic_sign's nonce derivation domain ... BIP 445's det_nonce_hash commits to the secret share, my_id, u, the sorted ids, the aggothernonce, the x-only tweaked threshold public key and the message. It does not commit to the pubshares, to the untweaked threshold public key, or to the accumulated tweaks. Because Q and -Q share an x-coordinate, two tweak caches can agree on everything the derivation hashes and still disagree on the sign g*gacc that multiplies the secret share -- a cache initialized from thresh_pk and one initialized from its negation being the smallest example. Two calls differing only in that emit the same pubnonce and partial signatures s = k + e*lambda*d and s' = k - e*lambda*d over the identical k = k1 + b*k2, so subtracting them yields the secret share. Demonstrated on a sole signer (u = 1, ids = {0}, pubshares = NULL) with thresh_sk = 0x11.. and msg = 0x42..: tweaked pk (cache A) 4f355bdc...075871aa tweaked pk (cache B) 4f355bdc...075871aa same x-only key pubnonce A == pubnonce B nonce reused sA - sB 0d7d9c4e...aa748ffa -2*e*d 0d7d9c4e...aa748ffa d recovered Nothing inside a single call can catch this. The self-verification that Sign performs passes in both cases, because each partial signature is individually valid under the cache it was produced with; validate_session_params likewise only ties the pubshares to the cache's own Q0, which both caches satisfy by construction. Note also that pubshares is optional, so there need not be a second value to disagree with. No code change: this is the specified derivation, and committing to Q0 or to gacc here would diverge from BIP 445 and invalidate the det_sign test vectors. The obligation is the caller's, so state it where the caller will meet it -- in the function's own documentation and alongside the existing secnonce and session_secrand32 rules in frost.md. The rule is that the tweak cache and the pubshares are fixed key material settled at key generation, never per-session parameters taken from a coordinator or a peer; under that discipline a repeated call is byte-identical and harmless, which is the point of a deterministic nonce. Worth raising against the BIP: the spec could close this by hashing the untweaked threshold public key, at the cost of new test vectors. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:37:22 +02:00
Kgothatso Ngako	34fa8e0b2e	frost: zero the trusted dealer outputs when key generation fails ... secp256k1_frost_trusted_dealer_keygen clears secshares32, thresh_pk and pubshares up front, under a comment promising that "the outputs are unusable if this function fails". The per-participant loop then fills them in one participant at a time, and every failure after that point leaves the shares written so far in the caller's buffer while returning 0. The reachable failure is the zero-share check inside the loop, which has negligible probability, so this is hygiene rather than a live leak. It still contradicts the stated contract, and the buffer it leaves populated holds real secret shares for participants 0..i-1 of a setup the caller has been told to discard. Re-zero all three outputs on the failure path. secshares32 goes through secp256k1_memzero_explicit rather than memset because it is secret and the buffer is dead afterwards. n_participants is validated before any path that can reach the cleanup label, so the lengths are safe to use there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:36:54 +02:00
Kgothatso Ngako	bf31d42486	frost: fix stack buffer overflow in frost_nonce_test ... frost_nonce_test_internal declares extra_in as 16 bytes and filled it with testrand256, which writes 32. Three iterations of the loop each overflowed the array by 16 bytes. AddressSanitizer is unambiguous about it: ERROR: AddressSanitizer: stack-buffer-overflow WRITE of size 1 ... in testrand256 src/testrand_impl.h:90 #1 frost_nonce_test_internal src/modules/frost/tests_impl.h:533 [4336, 4352) 'extra_in' (line 510) <== Memory access at offset 4352 overflows this variable The plain test suite passes regardless, which is why this survived: under the current stack layout the 16 stray bytes land on secshare, which is re-derived into pubshare_tmp immediately afterwards, so the two stay consistent and nothing downstream notices. That is luck, not correctness -- the target is whatever the compiler happens to place next, and msglen, extra_in_len or i are equally plausible. This should have been failing CI already: the sanitizers_debian job in .github/workflows/ci.yml sets FROST: 'yes' alongside CFLAGS: '-fsanitize=undefined,address -g'. Use testrand_bytes_test with an explicit length, matching how the musig tests fill their own extra_input (src/modules/musig/tests_impl.h:578). extra_in_len is already drawn from testrand_int(sizeof(extra_in) + 1), so the buffer stays 16 bytes and the value range is unchanged. Scanned all three new test files for other fixed-width writers aimed at undersized arrays; this was the only one. With the fix, the frost, chilldkg and iceberg suites run clean under -fsanitize=address,undefined. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:36:43 +02:00
Kgothatso Ngako	03db82815f	Merge branch 'iceberg'	2026-09-01 00:31:57 +02:00
Kgothatso Ngako	ff9c49cb7b	chilldkg: add regression tests for the recovery/state bounds fixes ... Add chilldkg_input_bounds_test covering the two review findings that the vector suite cannot catch (the memory-safe Python reference never exercises fixed-size-array overflows, so no upstream vector encodes them): - Recovery data with t = 129 (one past MAX_PARTICIPANTS) and t = 30000, both with n = 0: previously a stack buffer overflow in deserialize_recovery_data (ASan-confirmed: this test reports a stack-buffer-overflow on sum_coms against the unfixed code); now both participant_recover and coordinator_recover return INVALID_INPUT with outputs zeroed. Plus a t = 0 case. - Tampered persisted state objects (valid magic, n = 100000) for all four state types: participant_step2, participant_finalize, coordinator_finalize and participant_investigate fire the illegal-argument callback and return INVALID_INPUT instead of indexing out of bounds, in both verify and noverify builds. Verified: the test fails (ASan stack-buffer-overflow) against the pre-fix parser and passes against the fixed code, in the default, noverify and ASan builds.	2026-08-31 13:25:41 +02:00
Kgothatso Ngako	ceccb50a5a	chilldkg: harden persisted-state bounds checks for noverify builds ... The four opaque-state loaders (participant state1, state2, coordinator state, inv_data) guarded the t/n/participant_id fields read from the serialized object with VERIFY_CHECK, which is compiled out in noverify (release) builds. chilldkg.md explicitly recommends persisting state1 and the coordinator state between rounds, which turns the persisted file into an attack surface: a state1 with n altered to 100000 and the magic bytes left intact crashed participant_step2 with out-of-bounds array indexing in a noverify build. Promote all four guards to ARG_CHECK, consistent with the magic-byte check right above them: the illegal-argument callback fires, the load returns 0, and the public entry points (participant_step2, participant_finalize, coordinator_finalize, participant_investigate) return SECP256K1_CHILLDKG_INVALID_INPUT before any state-derived size is used -- verified in both verify and noverify builds.	2026-08-31 13:25:26 +02:00
Kgothatso Ngako	c43f645f15	chilldkg: fix out-of-bounds write in recovery data parsing ... secp256k1_chilldkg_deserialize_recovery_data read the threshold t from the first four bytes of the recovery blob and used it directly as the loop bound writing into the fixed-size sum_coms[SECP256K1_CHILLDKG_MAX_PARTICIPANTS] array. params_validate would reject an out-of-range t, but it only runs after the parse -- the overflow happens first. The reference implementation is safe only because Python lists grow dynamically; the C port lost that implicit bound. Reachable with attacker-supplied input from both public entry points, secp256k1_chilldkg_participant_recover and secp256k1_chilldkg_coordinator_recover (recovery data is untrusted by design: participants who never received cmsg2 are expected to accept recovery data from third parties). Confirmed with AddressSanitizer: t = 129 with a 4261-byte blob writes one group element past the array; t = 30000 with a ~1 MB blob writes ~1.2 MB of attacker- controlled group elements past it. The spec's own "invalid threshold" recovery vector cannot catch this because the memory-safe reference never exercises a t large enough to overflow a fixed C array. Fix: reject t < 1 and t > SECP256K1_CHILLDKG_MAX_PARTICIPANTS right after reading t, before any use as a loop bound, and reject recovery_len > SECP256K1_CHILLDKG_MAX_RECOVERY_LEN up front for consistency with the recovery-ack paths (the macro moves next to the parser; with t and n bounded the length cap is redundant, but it documents and enforces the invariant at the single choke point). Invalid recovery data is a plain input error (RecoveryDataError in the reference), so this maps to SECP256K1_CHILLDKG_INVALID_INPUT with outputs zeroed, like any other malformed blob.	2026-08-31 13:25:26 +02:00
Kgothatso Ngako	d9549a6c5a	tests: raise MAX_ARGS from 200 to 400 ... With the chilldkg (and iceberg) modules enabled, the unit test binary registers more than 200 tests (213 with all modules on), tripping the "Number of tests exceeds MAX_ARGS" internal error in unit_test.c and bailing before running anything -- both tests and noverify_tests were unrunnable in the all-modules CI rows. MAX_ARGS must be at least the total number of registered tests; 400 leaves headroom for future modules and vector-suite growth.	2026-08-31 13:25:26 +02:00
Kgothatso Ngako	a68cae31ca	iceberg: list the module in the README feature list ... Add the Iceberg module to the "Added features" section, after the ChillDKG entry, linking doc/iceberg.md.	2026-08-31 12:25:55 +02:00
Kgothatso Ngako	2473c76871	iceberg: wire the module into CI ... - ci/ci.sh: new ICEBERG environment variable, printed in the reproduction header and passed to configure as --enable-module-iceberg (mirroring CHILLDKG); bench_iceberg runs in the bench step when the module is enabled, as in the source tree's CI. - .github/workflows/ci.yml: ICEBERG: 'no' default; ICEBERG: 'yes' in the 20 jobs that enable musig + schnorrsig + experimental (the same jobs that build chilldkg). Jobs that deliberately build without musig or its dependencies are left at 'no'. Verified programmatically: the YAML parses and every ICEBERG: 'yes' context also has MUSIG, SCHNORRSIG and EXPERIMENTAL set to 'yes'.	2026-08-31 12:25:55 +02:00
Kgothatso Ngako	8c4bf548ed	iceberg: cover the module in ctime_tests ... Port the source tree's own iceberg ctime_tests block (guarded by ENABLE_MODULE_ICEBERG, after the chilldkg block): a 3-of-5 group run through shares_gen, a share serialize/parse roundtrip, share_cache_create (with a CHECKMEM_CHECK proving the cache holds no secrets), pubshare_gen, pubkey_agg, nonce_gen, nonce_agg and partial_sign, with share secrets undefined and all protocol outputs defined, following the frost/chilldkg annotation style. Both memory checkers pass with zero new declassifies needed -- the module's constant-time layering (vpss variable-time but secret-free, scalar_poly keeping secrets away from inversions) was already in place. Verified: valgrind ./ctime_tests exits 0, and the clang MemorySanitizer build exits 0 (with the chilldkg block unaffected).	2026-08-31 12:25:55 +02:00
Kgothatso Ngako	da13028c0d	iceberg: add the bench_iceberg benchmark binary ... Port src/bench_iceberg.c, the standalone benchmark binary the module's bench_impl.h is written for (this repo's bench harness has no per-module include pattern for it, so the source tree's own wiring is mirrored instead): noinst_PROGRAMS under USE_BENCHMARK + ENABLE_MODULE_ICEBERG in Makefile.am, a bench_iceberg target in src/CMakeLists.txt, and a .gitignore entry. The benchmark covers the group configurations 2-of-3, 3-of-5, 4-of-7, 5-of-9 and 5-of-10. Verified: ./bench_iceberg builds and runs under both build systems.	2026-08-31 12:25:33 +02:00
Kgothatso Ngako	072f6631f3	iceberg: add the example program ... Port examples/iceberg.c from the source tree: a full Iceberg session demonstrating the call order from the module docs -- distributed key generation, pubshare_gen/pubkey_agg to obtain the group public key, nonce_gen/nonce_agg into an ordinary MuSig2 public nonce, and partial_sign/partial_sig_agg into an ordinary MuSig2 partial signature. One content adaptation: the secp256k1_musig_nonce_process call gains a NULL adaptor argument, matching this repo's zkp musig variant. Wired like the chilldkg example: autotools noinst_PROGRAMS + TESTS entry under ENABLE_MODULE_ICEBERG (the example runs as part of make check), CMake example target in examples/CMakeLists.txt, and iceberg_example added to .gitignore. Verified: ./iceberg_example runs to completion (exit 0) under both build systems.	2026-08-31 12:25:09 +02:00
Kgothatso Ngako	e581abad00	iceberg: add the Iceberg threshold-MuSig module ... Port the experimental Iceberg module from the benchmark-iceberg tree (github.com/furszy/benchmark-iceberg, sources/secp256k1-kmp/native/ secp256k1) into this repo. Iceberg is a threshold scheme that lets a group of parties stand in for a single MuSig2 (BIP 327) participant: the group produces one ordinary MuSig2 public nonce and one ordinary MuSig2 partial signature, so cosigners cannot tell a group is involved and need no changes. Nonces are derived from a caller-chosen per-session label (sid32) rather than stored, so no signer holds a secret nonce between rounds; labels are public but must never be reused. A quorum of 2t-1 members (of whom up to t-1 may be corrupt) is needed in each round, so the threshold is at most half the group rounded up; combined with the scheme's other constraints the smallest usable group is 2-of-4. See doc/iceberg.md and the module header for the full usage notes. Module layout (src/modules/iceberg/, layered bottom-up, each layer may only use the ones above it -- that ordering is also the constant-time story): - scalar_poly.{h,_impl.h}: secret-carrying polynomial arithmetic, keeping secrets away from inversions (documented in the header). - rss.{h,_impl.h}: replicated secret sharing evaluation. - vpss.{h,_impl.h}: verifiable public shares; variable-time by design, sees only participant indices and published points. - keygen_impl.h: distributed key generation producing one share per member. - session_impl.h: nonce_gen/nonce_agg and partial_sign/ partial_sig_agg producing plain MuSig2 objects. - tests_impl.h: 28 tests including the shipped vectors.h vector suite and dealer known-answer tests. - bench_impl.h: benchmark definitions (wired in a follow-up commit). Public headers: include/secp256k1_iceberg.h (installed) and include/secp256k1_iceberg_dealer.h (in-tree only: a trusted dealer is not part of the shipped API, but tests, benchmarks and the example need to deal shares). Content adaptations relative to the source tree (the only changes to the ported code): three secp256k1_musig_nonce_process call sites in tests_impl.h gained a NULL adaptor argument, because this repo's musig is the zkp variant whose public nonce_process takes an optional adaptor point. All musig internals the module uses (ge_parse_ext, ge_serialize_ext, keyaggcoef, aggnonce_load, pubnonce_save, partial_sig_save, nonce_process_internal) are identical in both trees, as are all core headers the module touches; nothing else needed adaptation. Build wiring mirrors the chilldkg module: - configure.ac: --enable-module-iceberg (default no, experimental gate), hard dependency on the musig module with a configure error if musig is explicitly disabled (musig itself pulls in schnorrsig), AM_CONDITIONAL(ENABLE_MODULE_ICEBERG), summary line. - Makefile.am: include src/modules/iceberg/Makefile.am.include under the conditional. - src/secp256k1.c: guarded include of modules/iceberg/main_impl.h after the chilldkg block (musig is included earlier, so its internals are in scope). - src/tests.c: module test registration via MAKE_TEST_MODULE(iceberg). - CMakeLists.txt / src/CMakeLists.txt: SECP256K1_ENABLE_MODULE_ICEBERG option (OFF) with a dependency check on SECP256K1_ENABLE_MODULE_MUSIG (placed before the musig block so the force-enable takes effect), ENABLE_MODULE_ICEBERG=1 compile definition, public header export, summary line. Verified: ./configure --enable-experimental --enable-module-iceberg && make check passes; ./tests --target=iceberg runs the full module suite (28/28); CMake build + ctest pass; the musig dependency error fires correctly in both build systems.	2026-08-31 12:24:48 +02:00
Kgothatso Ngako	e9f171f197	chilldkg: list the module in the README feature list ... Add the ChillDKG module to the "Added features" section of the README, next to the FROST entry, linking to the module documentation.	2026-08-31 10:58:24 +02:00
Kgothatso Ngako	3b68633f59	chilldkg: CI wiring, ctime_tests coverage, declassify fixes ... CI: - ci/ci.sh: new CHILLDKG environment variable, passed to configure as --enable-module-chilldkg (mirroring FROST). - .github/workflows/ci.yml: default CHILLDKG: 'no' and CHILLDKG: 'yes' in every job that enables FROST, except the x86_64 matrix entry that deliberately builds without the ecdh module (chilldkg requires schnorrsig + ecdh; the configure-time dependency error would fire there). YAML validity and per-job dependency presence checked programmatically. ctime_tests: - src/ctime_tests.c: run a full ChillDKG session (n = 2, t = 2) through the public API under the memory checker: hostpubkey_gen, params_hash, participant_step1, coordinator_step1, participant_step2, coordinator_finalize, participant_finalize, participant_recover and recovery_ack_sign. Host secret keys, session randomness, aux randomness and the resulting secret shares are undefined (secret); all protocol messages, the certificate, threshold public key, public shares, recovery data, ack signature and the secret-free state1 objects are defined (public). state2 stays secret (contains the secret share). Constant-time fixes found by running the new block under MemorySanitizer (valgrind unavailable locally; MSan build via clang + CMake). All are missing declassifications of secret-derived but public (or public-outcome) values, following the frost module's secp256k1_declassify pattern with justification comments; no real constant-time bugs were found: - hostpubkey_gen: declassify the computed host public key before serialization (public output). - participant_step1: declassify the zero-randomness check result (only reveals "the RNG returned 32 zero bytes", which aborts the session). - encpedpop participant_step1: declassify the pubnonce point before serialization (public, part of pmsg1). - chilldkg_schnorrsig_sign: declassify the signer public key before normalization/parity branch, and declassify the return value (a failure only reveals a zero derived nonce, negligible probability). - vss_commit: declassify the VSS commitments before serialization (public, part of pmsg1). - vss_verify_secshare: declassify secshare*G before the infinity/eq checks (equals the public pubshare in honest runs; the discrete log is not revealed). - simplpedpop_participant_investigate (proactive audit; not reached by ctime_tests): declassify the secshare-sum comparison result (the public fault code reveals it anyway). Verified: MSan ctime_tests exits 0; autotools make check 10/10 (the local tree is configured without --enable-ctime-tests because neither valgrind nor an MSan-instrumented gcc build is available; CI runs ctime_tests under valgrind as before); CMake ctest 428/428; ./tests --target=chilldkg and ./chilldkg_example pass.	2026-08-31 10:25:14 +02:00
Kgothatso Ngako	d1c817b528	chilldkg: Phase 6 - test vectors, FROST integration, docs, example ... Final phase of the ChillDKG module: upstream test vectors, a DKG->FROST integration test, boundary tests, full module documentation and a runnable example. Test vectors: - tools/test_vectors_chilldkg_generate.py converts all 10 upstream bip-frost-dkg JSON vector files into src/modules/chilldkg/vectors.h (modeled on tools/test_vectors_frost_generate.py; takes the vectors directory as an argument; upstream pinned to commit a91896883f85b159415ecf298d5e844879af112d, recorded in the generated header with the exact regeneration invocation; regeneration is reproducible byte-for-byte). - tests_impl.h vector runners execute 191 of 241 upstream cases through the public API: hostpubkey_gen, params_hash, participant_step1/step2/finalize/investigate, coordinator_step1/finalize/investigate, recover. Happy paths are byte-exact (pmsg1/cmsg1/pmsg2/cmsg2/dkg_output/recovery/cinv); error cases assert both the fault enum and fault_index against expectedError.participantId. The 50 skipped cases are wrong-length/wrong-count inputs not expressible with the fixed-size C API; each skip is documented in vectors.h. Boundary/robustness tests: t=1, t=n, n=2, a full n=128/t=2 session end-to-end with per-participant secshare*G == pubshare checks and a recovery roundtrip, and a state1 memcpy roundtrip (step2 from a copied state object). DKG->FROST integration test (guarded by ENABLE_MODULE_FROST): a full ChillDKG session (n=3, t=2) feeds (secshare, thresh_pk, pubshares) directly into the frost module. ChillDKG's thresh_pk is already TapTweak'ed, so frost_tweak_cache_init is called with no further tweaks (frost's tweaked x-only key asserted equal to the x-only part of the ChillDKG thresh_pk); signers 0 and 2 run nonce_gen, nonce_agg, session_init with the shared x = id+1 convention, frost_sign, partial_sig_verify and partial_sig_agg; the aggregate signature verifies as a plain BIP-340 signature against the threshold key. Example: examples/chilldkg.c runs a full 2-of-3 DKG session (host key generation, params hash, participant/coordinator steps, finalize, and a recovery roundtrip via participant_recover) with fixed-size buffers and secret erasure. Wired into Makefile.am and examples/CMakeLists.txt exactly like frost_example (runs as a TEST); chilldkg_example binary added to .gitignore. Docs: src/modules/chilldkg/chilldkg.md now documents the protocol summary, message-flow table with exact byte sizes, blame taxonomy, recovery workflow, security notes (host key reuse/retention, fresh randomness per session, state secrecy, recovery-data sensitivity) and the pinned reference commit; src/modules/frost/frost.md points at the new module as the intended DKG. Bug fix found by the vector runner (recover tcId 9): the internal recover() passed a possibly-NULL fault_index from coordinator_recover to certeq_verify, which dereferences it on failure; now uses a local. Verified: make check 10/10 (3 test suites + 7 examples incl. chilldkg_example, exit 0 when run); CMake ctest 428/428 with chilldkg + frost, and a no-frost build confirms the ENABLE_MODULE_FROST guard; make distdir includes vectors.h, the example and the generator. The module is feature-complete against bip-frost-dkg v0.3.0-dev at a91896883f85b159415ecf298d5e844879af112d. The BIP is still a draft; tagged hashes and wire formats may change upstream.	2026-08-31 06:52:58 +02:00
Kgothatso Ngako	d48a1579cf	chilldkg: Phase 5 - recovery, recovery acks, investigation ... Complete the ChillDKG protocol surface with the recovery and blame- attribution procedures (bip-frost-dkg v0.3.0-dev, reference commit a91896883f85b159415ecf298d5e844879af112d). Recovery: - secp256k1_chilldkg_participant_recover / _coordinator_recover: parse the self-delimiting recovery layout u32be(t) || sum_coms(33t) || hostpubkeys(33n) || pubnonces(33n) || enc_secshares(32n, checked) || cert(64n), deriving n = (len-4-33t)/162 exactly as the reference's deserialize_recovery_data; re-verify the certificate, recompute the TapTweak and the receiver's ECDH/self pads from (hostseckey, pubnonces, enc_context), recompute the tweaked secshare, and sanity-check secshare*G == pubshares[own]. Also return hostpubkeys, n and t so callers can re-derive session params. RecoveryDataError / HostSeckeyError / params failures map to INVALID_INPUT (no index, as in the reference); an invalid pubnonce during decrypt passes through as FAULTY_PARTICIPANT_OR_COORDINATOR(i), matching the reference leaking that exception from recover(). Recovery acks: - secp256k1_chilldkg_recovery_ack_sign / _acks_verify: BIP-340 (standard BIP0340 tags) over pad33("BIP DKG/recovery acknowledgment") || u32be(i) || recovery_data. Verification failure maps to FAULTY_PARTICIPANT(i) (InvalidRecoveryAckError subclasses FaultyParticipantError in the reference). Investigation: - secp256k1_chilldkg_coordinator_investigate: builds one 65n-byte per-participant message (per-dealer encrypted partial secshares (32n) + partial pubshares (33n)) per call; the reference returns all n at once -- equivalent, the caller iterates. - secp256k1_chilldkg_participant_investigate: the reference's three-step blame attribution -- sum-of-pubshares check -> FAULTY_COORDINATOR; sum-of-secshares check -> FAULTY_COORDINATOR (covers the reference's SecshareSumError translation); per-dealer decrypted share vs commitment -> FAULTY_PARTICIPANT_OR_COORDINATOR(i) (or FAULTY_COORDINATOR for the own index); all-consistent -> INVALID_INPUT (the reference's uncaught RuntimeError). - Investigation data is transported via a new opaque, secret-bearing secp256k1_chilldkg_participant_inv_data object (4205 bytes, magic-validated save/load, secret-cleared) filled by participant_step2 on the UNKNOWN_FAULT paths. This amends the Phase 3 participant_step2 signature with a nullable inv_data out-param -- required because recomputing inside participant_investigate would duplicate step2's decrypt/verify logic. - New length helper secp256k1_chilldkg_investigation_msg_len (65n). tests_impl.h: chilldkg_recovery_test (recover roundtrips byte-exact vs the session outputs and reference vectors, tampered/truncated/ over-long recovery data, unknown/invalid hostseckey, ack sign byte-exact + verify with wrong-index and tampered-ack blame, params/recovery mismatch rejects, misuse) and chilldkg_investigate_test (two end-to-end public-API scenarios generated from the reference: dealer corrupting a participant's encrypted share, and coordinator tampering with an enc_secshare; cmsg1/cinv/inv_data byte-exact, blame codes and indices matching the reference's exception type and index; malformed cinv -> FAULTY_COORDINATOR; malformed pmsg1 -> FAULTY_PARTICIPANT(j); misuse). The all-consistent investigate path is not constructible without discrete logs and matches the reference's unreachable RuntimeError. Verified: make check 3/3 (incl. noverify); CMake ctest 369/369; make distdir clean.	2026-08-31 06:09:03 +02:00
Kgothatso Ngako	5409aae813	chilldkg: Phase 4 - public coordinator API ... Add the coordinator side of the ChillDKG protocol (bip-frost-dkg v0.3.0-dev, reference commit a91896883f85b159415ecf298d5e844879af112d), as thin wrappers over the Phase 2 encpedpop coordinator internals (whose cmsg1 output was already verified byte-identical to the reference coordinator_step1). Public API: - secp256k1_chilldkg_coordinator_step1: takes an array of pointers to the n participant pmsg1 messages (musig/frost-style convention), parses each with checked scalar parse, aggregates SimplPedPop and EncPedPop, builds eq_input (including the enc_secshares suffix, mirroring the reference) and emits cmsg1 (162n + 33(t-1) bytes). PoPs are not verified coordinator-side, exactly as the reference. - secp256k1_chilldkg_coordinator_finalize: concatenates the n CertEq pmsg2 signatures into the 64n-byte certificate, verifies all of them via certeq_verify (hostpubkeys recovered from eq_input at offset 4+33t), and outputs the coordinator-side DKG result: threshold pubkey, pubshares and recovery data -- no secshare. - secp256k1_chilldkg_coordinator_state: opaque, 21041 bytes, magic-validated, holds only t, n, eq_input, thresh_pk and pubshares -- no secret material, documented as freely copyable/persistable so a stateless coordinator is possible. Blame mapping (verified against chilldkg.py): - malformed pmsg1 (bad commitment encoding, overflowing encrypted share) -> FAULTY_PARTICIPANT(sender index), - invalid CertEq signature -> FAULTY_PARTICIPANT(failing index) (deliberately different from participant_finalize, which maps the same failure to FAULTY_COORDINATOR -- matching the reference), - invalid session params -> INVALID_INPUT; all outputs zeroed on failure. tests_impl.h: chilldkg_coordinator_api_test runs a full n=3,t=2 session through only the public APIs on both sides, byte-exact against the Python reference vectors and cross-checked against every participant's finalize outputs; blame cases (malformed pmsg1 and overflowing share -> FAULTY_PARTICIPANT with the right index, bad CertEq sig -> FAULTY_PARTICIPANT(2), zeroed outputs); misuse coverage (NULL args, corrupted state magic). Verified: make check 3/3 (incl. noverify); CMake ctest 365/365; ./tests --target=chilldkg green.	2026-08-31 05:33:42 +02:00
Kgothatso Ngako	2a0e14d076	chilldkg: Phase 3 - public participant API and CertEq ... Add the public participant-facing ChillDKG API to include/secp256k1_chilldkg.h and the CertEq sub-protocol, completing the participant side of the protocol (bip-frost-dkg v0.3.0-dev, reference pinned at a91896883f85b159415ecf298d5e844879af112d). New module files: - certeq.h / certeq_impl.h: CertEq sub-protocol. Participants sign pad33("BIP DKG/certeq message") || u32be(i) || eq_input with plain BIP0340-tagged Schnorr signatures under their host key (certeq_participant_step); verification is per-index against the x-only hostpubkeys[i][1:33] exactly as the reference (certeq_verify). The coordinator side reuses certeq_verify in Phase 4. Public API (all no-malloc, caller-allocated buffers, outputs zeroed on failure, secret paths cleared): - secp256k1_chilldkg_hostpubkey_gen: plain compressed host pubkey generation; rejects zero / >= group order seckeys. - secp256k1_chilldkg_params_hash: validates session params (participant and threshold ranges, strictly compressed non-infinity pubkeys, no duplicates) and computes TH("BIP DKG/params_hash", u32be(t) || hostpubkeys). - Message-length helpers so callers can size buffers: participant_msg1_len (33t+32n+97), coordinator_msg1_len (162n+33(t-1)), participant_msg2_len (64), coordinator_msg2_len (64n), recovery_data_len (4+33t+162n). - secp256k1_chilldkg_participant_step1: full EncPedPop step1 with seed=deckey=hostseckey; rejects zero randomness and hostseckeys not matching the claimed hostpubkey (input errors, not protocol faults). - secp256k1_chilldkg_participant_step2: parses and verifies cmsg1 via the Phase 2 encpedpop/simplpedpop participant path, computes the tweaked secshare/pubshares/threshold pubkey, appends enc_secshares to eq_input (matching the reference for recovery consistency), and emits the 64-byte CertEq signature. - secp256k1_chilldkg_participant_finalize: re-verifies all n CertEq signatures in the certificate, then outputs the 32-byte secshare, 33-byte threshold pubkey, n pubshares and the self-delimiting recovery data (eq_input || cert). Blame reporting without exceptions: public enum secp256k1_chilldkg_fault (OK / FAULTY_COORDINATOR / FAULTY_PARTICIPANT / FAULTY_PARTICIPANT_OR_COORDINATOR / UNKNOWN_FAULTY_PARTICIPANT_OR_COORDINATOR / INVALID_INPUT) plus an out fault_index, mapping the reference's exception taxonomy: - hostseckey invalid/mismatch -> INVALID_INPUT (HostSeckeyError), - cmsg1 scalar overflow/parse -> FAULTY_COORDINATOR (MsgParseError), - pubnonce/commitment/PoP faults -> FAULTY_PARTICIPANT_OR_COORDINATOR(i), - share-vs-pubshare mismatch -> UNKNOWN with fault_index = UINT32_MAX, - certificate signature failure -> FAULTY_COORDINATOR (documented deviation: fault_index carries the failing signature index as diagnostic info; the reference discards it). Enum-returning functions use a local CHILLDKG_ARG_CHECK that fires the illegal-argument callback and returns INVALID_INPUT (ARG_CHECK would return 0 = OK). Opaque state objects with magic-validated save/load (frost idiom): participant_state1 (4306 bytes, no secrets) and participant_state2 (21073 bytes, contains the secshare; documented keep-secret/no-copy). Fixed-size at SECP256K1_CHILLDKG_MAX_PARTICIPANTS = 128. Also fixes a noverify-build bug: state1_load ran point_load inside VERIFY_CHECK, which compiles out in noverify builds and left the commitment uninitialized; now called unconditionally. tests_impl.h: participant_api_test with full-session reference vectors (n=3, t=2; coordinator aggregation simulated through the internal Phase 2 coordinator step and verified byte-identical to the reference's coordinator_step1): msglen helpers, hostpubkey_gen and params_hash vectors incl. duplicate/invalid/infinity rejection, byte-exact pmsg1/cmsg1/CertEq sigs/secshare/thresh_pk/pubshares/ recovery, blame cases (tampered enc_secshare -> UNKNOWN, invalid pubnonce -> FAULTY_PARTICIPANT_OR_COORDINATOR(1), overflowing enc_secshare -> FAULTY_COORDINATOR, corrupted cert sig -> FAULTY_COORDINATOR with fault_index and zeroed outputs), NULL-arg misuse and bad-magic state rejection. Verified: make check 3/3 (incl. noverify); CMake ctest 363/363; make distdir includes all new files.	2026-08-31 05:22:53 +02:00
Kgothatso Ngako	580e4f6502	chilldkg: Phase 2 - SimplPedPop and EncPedPop layers ... Port the two sub-protocol layers of the ChillDKG reference implementation (bip-frost-dkg v0.3.0-dev, upstream commit a91896883f85b159415ecf298d5e844879af112d) to C, keeping the same function decomposition as simplpedpop.py / encpedpop.py so the code stays diffable against the reference. simplpedpop.h / simplpedpop_impl.h (mirrors simplpedpop.py): - simplpedpop_participant_step1: VSS coefficient generation and commitment, per-participant shares, proof of possession. The PoP is a BIP-340 signature with custom tag prefix "BIP DKG/pop message" over u32be(participant_id), signed with the constant coefficient f(0), using TH("BIP DKG/simplpedpop aux", simpl_seed) as aux_rand. - simplpedpop_coordinator_step / assemble_sum_coms: echo per-dealer constant-term commitments, sum non-constant-term commitments, collect PoPs (not verified by the coordinator, as in the reference). - simplpedpop_participant_step2: own-commitment echo check, per-dealer infinity rejection and PoP verification against the x-only coms_to_secrets[i], TapTweak applied before share verification (secshare vs pubshare check on tweaked values), eq_input = u32be(t) || sum_coms committing to the UNTWEAKED summed commitment. encpedpop.h / encpedpop_impl.h (mirrors encpedpop.py): - simpl_seed / aux / secnonce derivations from (hostseckey, random, enc_context) via "BIP DKG/encpedpop seed", "BIP DKG/simplpedpop aux" and "BIP DKG/encpedpop secnonce"; pubnonce = pubkey_gen_plain(secnonce). - encaps_multi / encrypt_multi: per-recipient pad context u32be(i) || enc_context, self-pad at the own index (no ECDH), libsecp256k1-style ECDH pad otherwise with sender-first ordering; encryption is additive mod n so the coordinator can sum encrypted shares per recipient. - decaps_multi / decrypt_sum: receiver-side pads, invalid or infinity pubnonce maps to FAULTY_PARTICIPANT_OR_COORDINATOR(sender). - coordinator_step: checked scalar parse of encrypted shares (overflow blames the sender), per-recipient summation. - participant_step2: pubnonce echo check (mismatch -> FAULTY_COORDINATOR), decrypt, delegate to simplpedpop step2, eq_input extended with enckeys || pubnonces. util.h: add SECP256K1_CHILLDKG_MAX_PARTICIPANTS (128, matching frost) and the internal fault enum mirroring the reference's exception taxonomy (FAULTY_COORDINATOR, FAULTY_PARTICIPANT, FAULTY_PARTICIPANT_OR_COORDINATOR, UNKNOWN_FAULTY_PARTICIPANT_OR_COORDINATOR, INVALID_INPUT). The public blame-reporting enum arrives with the Phase 3 API. State structs are fixed-size (no malloc, cap 128 participants). All secret temporaries are cleared; negligible-probability secret- dependent failures are declassified before branching. Documented deviations where the reference crashes with non-protocol errors: infinity sum_coms[0] in invalid_taproot_commit (unreachable after PoP verification) and tweak-hash overflow (negligible) return UNKNOWN_FAULTY_PARTICIPANT_OR_COORDINATOR; a wrong cmsg length maps to FAULTY_COORDINATOR. Investigation procedures are deferred to Phase 5 per the plan. tests_impl.h: byte-exact n=3/t=2 happy-path vectors for both layers generated from the Python reference (pmsg/cmsg/eq_input/enc_secshares and all DKG outputs), plus PoP reject cases (tampered, wrong index, infinity commitment, wrong echo, tampered non-constant-term sum), coordinator blame (bad commitment, overflowing encrypted share), encaps/decaps pad symmetry for all sender/receiver pairs including self-pad, encrypt->sum->decrypt_sum roundtrip, tampered encrypted share, invalid pubnonce blame, and input-validation rejects. Verified: make check 3/3 suites pass (incl. noverify_tests running the module); CMake ctest 361/361; ./tests --target=chilldkg runs all 9 module tests green.	2026-08-31 04:47:38 +02:00
Kgothatso Ngako	e462f7c1ac	chilldkg: Phase 1 - internal primitives (util, vss) ... Add the byte-exact internal primitives for the ChillDKG module, mirroring the Python reference implementation of the bip-frost-dkg draft (v0.3.0-dev), pinned to upstream commit a91896883f85b159415ecf298d5e844879af112d. util.h / util_impl.h (mirrors chilldkg_ref/util.py): - Point (de)serialization with explicit point-at-infinity support: 33 zero bytes <-> infinity, otherwise SEC compressed. Checked parse rejects invalid encodings and out-of-range x coordinates (point_save/point_load, xonly_save/xonly_load). - Internal parameterized-tag BIP-340 Schnorr sign/verify (chilldkg_schnorrsig_sign/_verify): tag prefix selects the <prefix>/aux, /nonce, /challenge subtags ("BIP DKG/pop message" for proofs of possession, "BIP0340" for CertEq signatures and recovery acks), arbitrary-length messages, pad33 zero-padding helper. The public schnorrsig API hardcodes BIP0340/32-byte messages, so the algorithm is replicated from secp256k1_schnorrsig_sign_internal with a custom tag; cross-checked against secp256k1_schnorrsig_sign32. - Tagged hashes via secp256k1_sha256_initialize_tagged: "BIP DKG/params_hash", "BIP DKG/encpedpop seed", "BIP DKG/simplpedpop aux", "BIP DKG/encpedpop secnonce", "BIP DKG/encpedpop ecdh", "BIP DKG/encaps_multi self_pad", "BIP DKG/vss coeffs", and BIP-341 "TapTweak" (32-byte x-only input). - params_hash = TH("BIP DKG/params_hash", u32be(t) || hostpubkeys) (note: plan had the operand order reversed; the reference hashes t first). - ECDH pads: reuses the ecdh module's SHA256-of-compressed-shared- point hash, then TH("BIP DKG/encpedpop ecdh", ecdh || sender_pubnonce || receiver_hostpubkey || context) with a sending flag fixing the sender|receiver order; self_pad for the own index. Pads are parsed wrapping (mod-n reduction); wire scalars, VSS coefficients and the TapTweak are parsed checked. vss.h / vss_impl.h (mirrors chilldkg_ref/vss.py): - vss_gen_coeffs: per-coefficient TH("BIP DKG/vss coeffs", seed || u32be(j)), checked parse with bitwise error accumulation. - vss_poly_eval (Horner) and vss_secshare_for with the x = id+1 convention (safe at UINT32_MAX). - vss_commit (constant-time ecmult_gen, zero coefficient -> infinity), vss_pubshare (powers-of-x over commitments, skips infinity), vss_commitment_add, vss_verify_secshare. - vss_invalid_taproot_commit: TapTweak applied to the x-only constant term so the Taproot script path is unspendable; returns tweak and pubtweak. tests_impl.h: 7 vector tests (tagged hashes, params_hash, point serialization incl. infinity roundtrip and parity prefixes, checked vs wrapping scalar parse at the group order boundary, custom-tag schnorrsig incl. wrong-tag/key/msg rejection, ECDH pad sender/receiver symmetry, VSS coeff derivation/Horner/commitment/pubshare/tweak) with expected values generated once from the Python reference (committed into the test file, reference commit recorded). Verified: make check 3/3 suites pass; CMake ctest all pass; ./tests --target=chilldkg runs all 7 new tests green in both verify and noverify builds.	2026-08-31 04:05:15 +02:00
Kgothatso Ngako	49f3eba8f5	chilldkg: Phase 0 - module scaffolding and build wiring ... Add an empty, experimental `chilldkg` module as the foundation for a ChillDKG implementation (distributed key generation for FROST) per the bip-frost-dkg BIP draft (v0.3.0-dev): https://github.com/BlockstreamResearch/bip-frost-dkg The module lives in src/modules/chilldkg/ (separate from the frost module, per the implementation plan in .idea/docs/ chilldkg-implementation-plan.md: FROST signing (BIP 445) and ChillDKG are separate BIPs with separate reference repos, test vectors and review cycles; the dependency between them is one-way bytes). New files: - include/secp256k1_chilldkg.h: public header skeleton with the same "EXTREMELY DANGEROUS / work in progress" warning style as secp256k1_frost.h, plus a note that the BIP is a draft and tagged hashes/wire formats may change. No API yet (Phase 3+). - src/modules/chilldkg/main_impl.h: implementation skeleton including the public header. - src/modules/chilldkg/tests_impl.h: trivial scaffolding unit test (chilldkg_scaffolding_test) registered via the tests_chilldkg[] CASE1 array used by this repo's unit-test framework. - src/modules/chilldkg/Makefile.am.include: autotools file list, mirroring the frost module's. - src/modules/chilldkg/chilldkg.md: module doc stub (purpose, draft status, dependency on the schnorrsig and ecdh modules). Build wiring (mirrors the frost module exactly): - configure.ac: --enable-module-chilldkg (default no, experimental gate), dependency errors when schnorrsig or ecdh are explicitly disabled, AM_CONDITIONAL(ENABLE_MODULE_CHILLDKG), summary line. - Makefile.am: include src/modules/chilldkg/Makefile.am.include under ENABLE_MODULE_CHILLDKG. - src/secp256k1.c: guarded include of modules/chilldkg/main_impl.h after the frost module. - src/tests.c: guarded include of tests_impl.h and MAKE_TEST_MODULE(chilldkg) registration. - CMakeLists.txt: SECP256K1_ENABLE_MODULE_CHILLDKG option (OFF) + summary line. - src/CMakeLists.txt: dependency checks on SECP256K1_ENABLE_MODULE_SCHNORRSIG and SECP256K1_ENABLE_MODULE_ECDH, ENABLE_MODULE_CHILLDKG=1 compile definition, public header export. Verified: - ./autogen.sh && ./configure --enable-experimental --enable-module-chilldkg --enable-module-schnorrsig --enable-module-ecdh && make check: PASS 3/3 (tests, noverify_tests, exhaustive_tests). - configure fails with a clear error when schnorrsig or ecdh are disabled, or when experimental is not enabled. - CMake build with SECP256K1_ENABLE_MODULE_CHILLDKG=ON: ctest 345/345 passed; dependency errors fire correctly when schnorrsig/ecdh OFF.	2026-08-31 01:37:22 +02:00
Kgothatso Ngako	7afaab53dc	frost: close remaining gaps against the BIP 445 reference ... Four small divergences from the reference implementation and its API contract, none of which changes any signature: the differential harness (240 signing + 120 deterministic-signing cases against the Python reference) produces byte-identical output before and after. Length prefixes that do not fit ------------------------------- secp256k1_frost_sha256_write_prefixed asserted, via VERIFY_CHECK, that the length fits into its prefix. VERIFY_CHECK compiles away in release builds, so a length that does not fit was silently truncated modulo 2^(8*prefix_size) instead of being rejected, yielding a nonce that does not follow the spec. The reference raises OverflowError instead. Only the 4-byte extra_in prefix of nonce_hash is affected, and only where size_t is wider than 32 bits, so this needs an extra_in of 4 GiB to trigger. It is nevertheless a silent deviation, so write_prefixed now returns 0 without writing anything, and the failure is propagated: secp256k1_frost_nonce_function and secp256k1_frost_det_nonce_function return 0, and secp256k1_frost_nonce_gen returns 0 after wiping session_secrand32 and the nonces. Checking the shifted-out bits (which the loop already computes) rather than comparing extra_in_len against a 32-bit bound avoids a comparison that is always true on 32-bit platforms. The bound is now documented on the extra_in_len parameter. Identifiers equal to UINT32_MAX ------------------------------- BIP 445 derive_interpolating_value accepts every identifier in 0 <= id < 2^32, but secp256k1_frost_ids_are_valid rejected UINT32_MAX because the mapping to the polynomial x-coordinate, id + 1, overflows in uint32_t arithmetic. The +1 is now added in scalar arithmetic, where it cannot overflow, and the identifier restriction is gone. The denominator never needed the +1 at all, since x_j - x_i = (id_j + 1) - (my_id + 1) = id_j - my_id so it is computed directly from the identifiers. This was unreachable through the public API -- validate_session_params already bounds identifiers by n_participants, which is at most SECP256K1_FROST_MAX_PARTICIPANTS = 128 -- but it made an internal helper diverge from the algorithm it implements. frost_large_id_test covers it by reconstructing the constant term of a random degree-2 polynomial from shares held by identifiers 0, UINT32_MAX - 1 and UINT32_MAX. Zero-length messages -------------------- secp256k1_frost_session_init and secp256k1_frost_deterministic_sign required a non-NULL msg, so an empty message -- which the reference represents as the byte string b"" -- could only be passed as a pointer that is never dereferenced. Both now accept NULL when msglen is 0, matching secp256k1_schnorrsig_sign_custom and the msg parameter of secp256k1_frost_nonce_gen. secp256k1_sha256_write guards both of its memcpy calls on a non-zero length, so it is never reached with a NULL pointer. NonceGen keeps its distinction between a NULL msg and a zero-length msg: there the BIP really does distinguish msg = None (hashed as the single byte 0x00) from msg = b"" (hashed as 0x01 followed by an eight-byte zero length), and the API expresses that as NULL versus non-NULL. frost_empty_msg_test runs a signing round over a zero-length message passed both ways and checks that the two session objects are identical. The two API tests that relied on a NULL msg always being rejected now pass an explicit non-zero msglen; previously they passed a random msglen that could be 0. Header documentation -------------------- The parameter tables of eleven doc comments had names that did not line up with their block's continuation column. All parameter tables are now aligned consistently, with wrapped text two columns past the colon. Verification ------------ - gcc and clang, -std=c89 -pedantic-errors -Werror, with and without -DVERIFY: clean - tests (multiple seeds), noverify_tests and frost_example: pass - ctime_tests under MemorySanitizer: exits 0 with halt_on_error=1 - vectors.h still reproduces exactly from the spec's JSON vectors - 240 signing + 120 deterministic-signing differential cases against the BIP 445 Python reference: byte-identical to the previous commit Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-31 01:19:28 +02:00
Kgothatso Ngako	7e73badcbd	frost: fix constant-time violations and C90 conformance ... The module's BIP 445 logic itself is unchanged and was independently validated against the pinned spec commit bb5396f (BIP v0.10.0), both via the checked-in test vectors and via differential testing against the Python reference over 360 randomised configurations (n up to 128, shuffled non-contiguous signer ids, mixed xonly/plain tweak chains, variable-length messages, pubshares present and absent). Every change below is structural: the differential harness produces byte-identical pubnonces, aggnonces, partial signatures and final signatures before and after. Two classes of problem prevented the module from passing CI. 1. Constant-time violations (ctime_tests) ----------------------------------------- The CI matrix enables FROST in rows that also run "valgrind --error-exitcode=42 ./ctime_tests" -- WITH_VALGRIND and CTIMETESTS both default to 'yes'. With the module enabled that job reported 639 "conditional jump depends on uninitialised value" errors, all originating from two sites: - secp256k1_frost_derive_coefficient returned !overflow && !secp256k1_scalar_is_zero(out) where the short-circuiting && branches on `overflow`, which is derived from the threshold secret key. The caller declassifies the return value, but the branch has already happened inside the callee. Replaced with a bitwise &, matching the existing idiom in secp256k1_scalar_set_b32_seckey (src/scalar_impl.h). - secp256k1_frost_sign_internal performs the self-verification recommended by BIP 445, which runs the *variable-time* secp256k1_ecmult over the partial signature s. nonce_pts and pk were already declassified ahead of that call; s was not. Since s is the public output of the function, declassifying it before the self-verification is both correct and sufficient. secp256k1_frost_deterministic_sign carried three more instances of the same class, invisible until now because ctime_tests did not exercise that path at all: - the `if (!valid)` check on secp256k1_scalar_set_b32_seckey lacked the declassify that the identical checks in secp256k1_frost_nonce_gen and secp256k1_frost_sign_internal already have; - secp256k1_frost_det_nonce_function used the same short-circuiting &&, here over the secret nonces; - the branch on that function's result was not declassified. The && in det_nonce_function is rewritten via two int locals rather than a bare bitwise &: clang's -Wbitwise-instead-of-logical fires when both operands are `!f(...)` expressions, which would break the -Werror clang builds. ctime_tests now also covers secp256k1_frost_deterministic_sign, so that path stays checked from here on. None of these leak anything of value in practice -- they reveal only negligible-probability events (a hash overflowing the curve order, a zero nonce) or whether a secret share is a valid secret key -- but they violate the project's declassification discipline and fail the ctime test. 2. C90 conformance (-Werror -pedantic-errors) --------------------------------------------- The project targets C90 (CMAKE_C_STANDARD 90, -std=c89 -pedantic) and CI passes WERROR_CFLAGS='-Werror -pedantic-errors'. Compiling src/tests.c with those flags produced 62 errors in three groups: - 40x "ISO C forbids empty initializer braces before C2X" in the generated vectors.h; empty {} initializers are C23-only. Fixed in tools/test_vectors_frost_generate.py so it survives regeneration: hexstr_to_intarray now emits "0" for an empty byte string (all six of its call sites wrap the result in braces), and init_group's `counted` helper emits "{ 0 }" for an empty group. In every affected slot the paired count/length field is 0, so the padding element is never read. - 1x "comma at end of enumerator list" (C99+), also in the generator. - 21x "initializer element is not computable at load time" across 11 lines of tests_impl.h. C90 requires constant expressions in initializers for automatic aggregates, so const secp256k1_frost_pubnonce *ptrs[2] = { &a, &b }; is invalid. Rewritten as a declaration plus assignments, the style the musig tests already use, which is why the pre-existing tree was green. vectors.h is regenerated from the spec's JSON vectors. Its hex payload is byte-identical (verified by hashing every 0xNN token) and the file still reproduces exactly from tools/test_vectors_frost_generate.py. Verification ------------ - gcc and clang, -std=c89 -pedantic-errors -Werror, with and without -DVERIFY: clean (was 62 errors) - ctime_tests under MemorySanitizer: 0 reports (was 639); exits 0 with halt_on_error=1 - tests, noverify_tests and frost_example: pass - vectors.h regenerates identically from the pinned spec vectors - 240 signing + 120 deterministic-signing differential cases against the BIP 445 Python reference: byte-identical to the pre-fix build Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-31 00:57:43 +02:00
Kgothatso Ngako	2d97cc2242	Frost Module logic.	2026-08-31 00:05:16 +02:00
Andrew Poelstra	10366dbbbf	Merge BlockstreamResearch/secp256k1-zkp#365: tests: Port hash context tests to zkp modules ... 72867fd682 tests: Port hash context tests to zkp modules (mllwchrry) Pull request description: Ports the hash context tests from bitcoin-core/secp256k1#1777 to the zkp-specific modules. ACKs for top commit: apoelstra: ACK 72867fd682279ff2c79cf13f4f8d8484048d2527; successfully ran local tests Tree-SHA512: 1714a4c5fd793b32a0f00a92670a48709e4d01917bb81739428601c6e88e89f871cdc1294024e6df7272d6c16e681309d9b3448adcd07ce37bfa2be2dc3f4172	2026-08-19 14:32:07 +00:00
Andrew Poelstra	e166e4024f	Merge BlockstreamResearch/secp256k1-zkp#371: whitelist, bppp: defensive hardening and documentation ... 598e22dcde whitelist: document the degenerate W = -P_i destination (DarkWindman) 7ea12c2dca whitelist: document that the parsed key count is untrusted (DarkWindman) e8c3396597 whitelist: honour the documented parse initialization guarantee (DarkWindman) 1de3864ff9 bppp: check for overflow in generator allocation (DarkWindman) Pull request description: Small defensive fixes + docs for whitelist/bppp: - bppp: overflow check in `generators_create` allocation. - whitelist: signature_parse always leaves `sig` in a valid-or-canonically-invalid state; guard serialize against untrusted `n_keys`. - whitelist: document that `n_keys` is attacker-controlled and must not be used to size the arrays passed to `_verify`. - whitelist: document the accepted degenerate `W = -P_i` destination. No API/format changes. New tests cover theallocation overflow and the parse-failure guarantee. ACKs for top commit: apoelstra: ACK 598e22dcde2152003c6a60f04196cc5fe2e2a090; successfully ran local tests mllwchrry: ACK 598e22d. Tree-SHA512: 4c218775a4c2e53091f3ac11e5d93caf17083216afa167fb5c1a1cc38c0a7a2cb1e0564cf9e63c5391d72aba9fc42d90a64b9a5f288ae763f0bf9b4b20f3b2e1	2026-08-19 14:31:55 +00:00
Andrew Poelstra	a8b5410e73	Merge BlockstreamResearch/secp256k1-zkp#367: Fix missing clears on secret values ... a69a662d05 Fix missing clears on secret values (mllwchrry) Pull request description: Several zkp module functions leave secret scalars and buffers live on the stack after use. Adds the missing clears. Also removes a redundant `prep` clear in `secp256k1_rangeproof_sign_impl` that was already cleared earlier on the same path. ACKs for top commit: apoelstra: ACK a69a662d052f2a3839798fdb7d98864d26ccf2cb; successfully ran local tests Tree-SHA512: b11acfaad3bbc26b7597918afdb90aaa563eb2974bc2522626f70457fa354bad349bc698b72371de9df9004bc1e16fee3afb437135cafb1e0c85dcc2535e2987	2026-08-19 14:31:39 +00:00
mllwchrry	72867fd682	tests: Port hash context tests to zkp modules	2026-08-17 16:39:17 +03:00
mllwchrry	a69a662d05	Fix missing clears on secret values	2026-08-17 16:17:43 +03:00
DarkWindman	598e22dcde	whitelist: document the degenerate W = -P_i destination	2026-08-17 13:43:52 +03:00
DarkWindman	7ea12c2dca	whitelist: document that the parsed key count is untrusted	2026-08-17 13:40:33 +03:00
DarkWindman	e8c3396597	whitelist: honour the documented parse initialization guarantee	2026-08-14 12:01:58 +03:00
DarkWindman	1de3864ff9	bppp: check for overflow in generator allocation	2026-08-14 12:01:43 +03:00
Jonas Nick	a2b001cc20	Merge elementsproject/secp256k1-zkp#369: surjection: bind genrand nonce to the full statement ... 65093e1444 surjection: prevent s-value reuse for different proof inputs (mllwchrry) Pull request description: ACKs for top commit: jonasnick: ACK 65093e1444 Tree-SHA512: 563c91fc40d962064efed2fcfc70bbf6f25fc9be049feff95f88cbf62141056cfbe16ae000e828cdbde023aa271436910ed8f4930e244221fc49fb9e838fe2bd	2026-08-14 07:31:46 +00:00
Jonas Nick	f8841c14d5	Merge elementsproject/secp256k1-zkp#370: rangeproof: warn that nonce must not be reused across differing arguments ... cde28971a2 rangeproof: warn that nonce must not be reused across differing arguments (mllwchrry) Pull request description: ACKs for top commit: apoelstra: ACK cde28971a2274beeeb2e9df27342d956b5664d44; successfully ran local tests jonasnick: ACK cde28971a2 Tree-SHA512: 890100ed778e06d1e4ed6fed03080a74676ff804c5f6844e3d2530b7f26a4ec715b8c1f81e3d1fdbbd25c28f50d966802115e493993bfc64ba336296593e7a71	2026-08-14 06:49:59 +00:00
mllwchrry	cde28971a2	rangeproof: warn that nonce must not be reused across differing arguments	2026-08-13 17:52:40 +03:00
mllwchrry	65093e1444	surjection: prevent s-value reuse for different proof inputs ... The s-values produced by secp256k1_surjection_genrand previously depended only on their indices and the difference between input_blinding_key and output_blinding_key. Calls with the same difference therefore reused s-values even when their proof inputs differed. For proofs with the same used-input selection and honest input index, the same generated s-value was used as the signing nonce. Reusing this nonce across different proof messages allowed recovery of the blinding-key difference. The remaining repeated s-values also revealed the honest input index. This commit affects proof generation only; verification is unchanged.	2026-08-13 17:35:31 +03:00
merge-script	2af926dc30	Merge BlockstreamResearch/secp256k1-zkp#366: Upstream PRs 1851, 1852, 1861, 1855, 1864, 1867, 1860, 1865, 1859, 1879, 1881, 1845, 1877, 1882, 1884 ... 217fe59bbf tests: register run_util_tests and run_ec_commit, remove dead print_vector (mllwchrry) 21645c03a2 SECURITY.md: remove Jonas Nick from trusted keys (Jonas Nick) 6a599a4428 scalar: correct `_scalar_get_bits_{limb32,var}` input condition docs (Sebastian Falbesoner) 994b35010d field: correct fe_equal's b magnitude bound (Lőrinc) 0cad3df503 Improve checks for scalar _get_bits methods (Peter.Dettman) 9d75769dec tests: Fix GCC 17 snapshot warning (Tim Ruffing) 66260b78a2 ci: add 'brew trust' invocation to macOS CI (fanquake) 71fcd8410e field: force-inline 5x52 mul and sqr (Lőrinc) a77dacad9a test: enable -Wunused-function in test suite (Fix #1831) (kallal79) 1eab757207 cmake: Fix shared library versioning on OpenBSD (Hennadii Stepanov) a401c5145a cmake: Fix shared library versioning on NetBSD (Hennadii Stepanov) 8a0f4002c7 cmake, refactor: Improve documenting in `SetLibtoolAbiVersion` module (Hennadii Stepanov) acf2084aa7 cmake, refactor: Introduce `SetLibtoolAbiVersion` module (Hennadii Stepanov) d7125e517d test: musig: fix dead "aggnonce encodes two points at infinity" check (Sebastian Falbesoner) 2ee79e77e6 test: add unit test for `_ecmult_gen_ge` (Sebastian Falbesoner) ca68daf8e1 test: refactor: simplify tests by using `_ecmult_gen_ge` helper (Sebastian Falbesoner) 240578eef5 bench: add internal benchmark for `secp256k1_fe_normalize_var` (Sebastian Falbesoner) 9e017e5062 refactor: rename `_ecmult_gen` -> `_ecmult_gen_gej` for consistency (Sebastian Falbesoner) a3296d5e23 refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks) (Sebastian Falbesoner) 5698e66c64 Add exhaustive test for ECDH module (Sebastian Falbesoner) 40a0d874a6 doc: correct API docs for ECDSA signing out-params (s/array/signature object/) (Sebastian Falbesoner) Pull request description: *Note: This PR has been created by a GitHub Actions workflow without human involvement.* This PR syncs the following upstream PRs: * bitcoin-core/secp256k1#1851: doc: correct API docs for ECDSA signing out-params (s/array/signature object/) * bitcoin-core/secp256k1#1852: Add exhaustive test for ECDH module * bitcoin-core/secp256k1#1861: refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks) * bitcoin-core/secp256k1#1855: bench: add internal benchmark for `secp256k1_fe_normalize_var` * bitcoin-core/secp256k1#1864: test: refactor: simplify tests by using `_ecmult_gen_ge` helper, add test * bitcoin-core/secp256k1#1867: test: musig: fix dead "aggnonce encodes two points at infinity" check * bitcoin-core/secp256k1#1860: cmake: Emulate Libtool's behavior on NetBSD and OpenBSD * bitcoin-core/secp256k1#1865: test: enable -Wunused-function in test suite (Fix #1831) * bitcoin-core/secp256k1#1859: field: force-inline 5x52 mul and sqr * bitcoin-core/secp256k1#1879: ci: add 'brew trust' invocation to macOS CI * bitcoin-core/secp256k1#1881: tests: Fix GCC 17 snapshot warning * bitcoin-core/secp256k1#1845: Improve checks for scalar _get_bits methods * bitcoin-core/secp256k1#1877: field: correct `fe_equal` magnitude bound for `b` * bitcoin-core/secp256k1#1882: scalar: correct `_scalar_get_bits_{limb32,var}` input condition docs * bitcoin-core/secp256k1#1884: SECURITY.md: remove Jonas Nick from trusted keys Usage hints: * If this PR has merge conflicts, resolve these by switching to the PR branch and merging the base branch into it using `git merge <base-branch>`. * To show the conflict resolution diff from an existing merge commit, use `git show --remerge-diff <merge-commit>`. * In case you are recreating the PR branch locally, you can (during the conflict resolution state) replay this conflict resolution diff using `git read-tree --reset -u <merge-commit>`. Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree. ACKs for top commit: DarkWindman: ACK 217fe59bbf real-or-random: ACK 217fe59bbf Tree-SHA512: 761fb08be08afcbaa3a43f7432c92a5e65113545a2a25131baf3385d7e354d2a913856f667c8478729877a074d98c0e58fc0c92b17b70a583cbd96d1f478d7f2	2026-07-09 11:31:18 +02:00
mllwchrry	217fe59bbf	tests: register run_util_tests and run_ec_commit, remove dead print_vector	2026-07-03 15:17:36 +03:00