16 Commits

Author	SHA1	Message	Date
Kgothatso Ngako	7afee05de8	tools: add the iceberg test vector generator ... src/modules/iceberg/vectors.h opens with regeneration instructions that name ./tools/test_vectors_iceberg_generate.py, and that script was never committed. The same header calls the file "the one thing in this repository that cannot be rebuilt from what the repository contains", which the missing generator made true twice over: neither the reference nor the tool that reads it was reachable from a clone. Recovered from the tree the Iceberg C is vendored in, at sources/secp256k1-kmp/native/secp256k1 of the benchmark repository (bitcoin-core/secp256k1 branch iceberg-module, commit 96201552, per that repository's PINS.txt). Confirmed to be the generator that produced the checked-in vectors before committing it: - its HEADER template reproduces the header of vectors.h exactly, including the ICEBERG_VECTOR_MAX_PARTICIPANTS 9 and ICEBERG_VECTOR_MAX_SEEDS 126 it computes from the configuration list; - its seed rule, sha256("iceberg test vectors|<label>|<rank>"), reproduces the checked-in 2of3 seeds byte for byte; - the whole of that tree's src/modules/iceberg/ matches this one byte for byte except tests_impl.h, which differs only because the tests here are ported to the unit_test.h test-module framework. The script cannot be re-run from a clone alone, by design: it takes the nkohen/Iceberg Python reference as its argument and that reference is deliberately not vendored, since it is not ours and pinning a copy would hide it drifting. Its docstring gives the clone and the pinned commit (7b55ef6d), which is now the whole of what regenerating requires. Also restore the executable bit on the frost and chilldkg generators. Both carry a usage line telling the reader to run them directly, and every other generator in tools/ is 0755. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:37:52 +02:00
Kgothatso Ngako	d1c817b528	chilldkg: Phase 6 - test vectors, FROST integration, docs, example ... Final phase of the ChillDKG module: upstream test vectors, a DKG->FROST integration test, boundary tests, full module documentation and a runnable example. Test vectors: - tools/test_vectors_chilldkg_generate.py converts all 10 upstream bip-frost-dkg JSON vector files into src/modules/chilldkg/vectors.h (modeled on tools/test_vectors_frost_generate.py; takes the vectors directory as an argument; upstream pinned to commit a91896883f85b159415ecf298d5e844879af112d, recorded in the generated header with the exact regeneration invocation; regeneration is reproducible byte-for-byte). - tests_impl.h vector runners execute 191 of 241 upstream cases through the public API: hostpubkey_gen, params_hash, participant_step1/step2/finalize/investigate, coordinator_step1/finalize/investigate, recover. Happy paths are byte-exact (pmsg1/cmsg1/pmsg2/cmsg2/dkg_output/recovery/cinv); error cases assert both the fault enum and fault_index against expectedError.participantId. The 50 skipped cases are wrong-length/wrong-count inputs not expressible with the fixed-size C API; each skip is documented in vectors.h. Boundary/robustness tests: t=1, t=n, n=2, a full n=128/t=2 session end-to-end with per-participant secshare*G == pubshare checks and a recovery roundtrip, and a state1 memcpy roundtrip (step2 from a copied state object). DKG->FROST integration test (guarded by ENABLE_MODULE_FROST): a full ChillDKG session (n=3, t=2) feeds (secshare, thresh_pk, pubshares) directly into the frost module. ChillDKG's thresh_pk is already TapTweak'ed, so frost_tweak_cache_init is called with no further tweaks (frost's tweaked x-only key asserted equal to the x-only part of the ChillDKG thresh_pk); signers 0 and 2 run nonce_gen, nonce_agg, session_init with the shared x = id+1 convention, frost_sign, partial_sig_verify and partial_sig_agg; the aggregate signature verifies as a plain BIP-340 signature against the threshold key. Example: examples/chilldkg.c runs a full 2-of-3 DKG session (host key generation, params hash, participant/coordinator steps, finalize, and a recovery roundtrip via participant_recover) with fixed-size buffers and secret erasure. Wired into Makefile.am and examples/CMakeLists.txt exactly like frost_example (runs as a TEST); chilldkg_example binary added to .gitignore. Docs: src/modules/chilldkg/chilldkg.md now documents the protocol summary, message-flow table with exact byte sizes, blame taxonomy, recovery workflow, security notes (host key reuse/retention, fresh randomness per session, state secrecy, recovery-data sensitivity) and the pinned reference commit; src/modules/frost/frost.md points at the new module as the intended DKG. Bug fix found by the vector runner (recover tcId 9): the internal recover() passed a possibly-NULL fault_index from coordinator_recover to certeq_verify, which dereferences it on failure; now uses a local. Verified: make check 10/10 (3 test suites + 7 examples incl. chilldkg_example, exit 0 when run); CMake ctest 428/428 with chilldkg + frost, and a no-frost build confirms the ENABLE_MODULE_FROST guard; make distdir includes vectors.h, the example and the generator. The module is feature-complete against bip-frost-dkg v0.3.0-dev at a91896883f85b159415ecf298d5e844879af112d. The BIP is still a draft; tagged hashes and wire formats may change upstream.	2026-08-31 06:52:58 +02:00
Kgothatso Ngako	7e73badcbd	frost: fix constant-time violations and C90 conformance ... The module's BIP 445 logic itself is unchanged and was independently validated against the pinned spec commit bb5396f (BIP v0.10.0), both via the checked-in test vectors and via differential testing against the Python reference over 360 randomised configurations (n up to 128, shuffled non-contiguous signer ids, mixed xonly/plain tweak chains, variable-length messages, pubshares present and absent). Every change below is structural: the differential harness produces byte-identical pubnonces, aggnonces, partial signatures and final signatures before and after. Two classes of problem prevented the module from passing CI. 1. Constant-time violations (ctime_tests) ----------------------------------------- The CI matrix enables FROST in rows that also run "valgrind --error-exitcode=42 ./ctime_tests" -- WITH_VALGRIND and CTIMETESTS both default to 'yes'. With the module enabled that job reported 639 "conditional jump depends on uninitialised value" errors, all originating from two sites: - secp256k1_frost_derive_coefficient returned !overflow && !secp256k1_scalar_is_zero(out) where the short-circuiting && branches on `overflow`, which is derived from the threshold secret key. The caller declassifies the return value, but the branch has already happened inside the callee. Replaced with a bitwise &, matching the existing idiom in secp256k1_scalar_set_b32_seckey (src/scalar_impl.h). - secp256k1_frost_sign_internal performs the self-verification recommended by BIP 445, which runs the *variable-time* secp256k1_ecmult over the partial signature s. nonce_pts and pk were already declassified ahead of that call; s was not. Since s is the public output of the function, declassifying it before the self-verification is both correct and sufficient. secp256k1_frost_deterministic_sign carried three more instances of the same class, invisible until now because ctime_tests did not exercise that path at all: - the `if (!valid)` check on secp256k1_scalar_set_b32_seckey lacked the declassify that the identical checks in secp256k1_frost_nonce_gen and secp256k1_frost_sign_internal already have; - secp256k1_frost_det_nonce_function used the same short-circuiting &&, here over the secret nonces; - the branch on that function's result was not declassified. The && in det_nonce_function is rewritten via two int locals rather than a bare bitwise &: clang's -Wbitwise-instead-of-logical fires when both operands are `!f(...)` expressions, which would break the -Werror clang builds. ctime_tests now also covers secp256k1_frost_deterministic_sign, so that path stays checked from here on. None of these leak anything of value in practice -- they reveal only negligible-probability events (a hash overflowing the curve order, a zero nonce) or whether a secret share is a valid secret key -- but they violate the project's declassification discipline and fail the ctime test. 2. C90 conformance (-Werror -pedantic-errors) --------------------------------------------- The project targets C90 (CMAKE_C_STANDARD 90, -std=c89 -pedantic) and CI passes WERROR_CFLAGS='-Werror -pedantic-errors'. Compiling src/tests.c with those flags produced 62 errors in three groups: - 40x "ISO C forbids empty initializer braces before C2X" in the generated vectors.h; empty {} initializers are C23-only. Fixed in tools/test_vectors_frost_generate.py so it survives regeneration: hexstr_to_intarray now emits "0" for an empty byte string (all six of its call sites wrap the result in braces), and init_group's `counted` helper emits "{ 0 }" for an empty group. In every affected slot the paired count/length field is 0, so the padding element is never read. - 1x "comma at end of enumerator list" (C99+), also in the generator. - 21x "initializer element is not computable at load time" across 11 lines of tests_impl.h. C90 requires constant expressions in initializers for automatic aggregates, so const secp256k1_frost_pubnonce *ptrs[2] = { &a, &b }; is invalid. Rewritten as a declaration plus assignments, the style the musig tests already use, which is why the pre-existing tree was green. vectors.h is regenerated from the spec's JSON vectors. Its hex payload is byte-identical (verified by hashing every 0xNN token) and the file still reproduces exactly from tools/test_vectors_frost_generate.py. Verification ------------ - gcc and clang, -std=c89 -pedantic-errors -Werror, with and without -DVERIFY: clean (was 62 errors) - ctime_tests under MemorySanitizer: 0 reports (was 639); exits 0 with halt_on_error=1 - tests, noverify_tests and frost_example: pass - vectors.h regenerates identically from the pinned spec vectors - 240 signing + 120 deterministic-signing differential cases against the BIP 445 Python reference: byte-identical to the pre-fix build Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-31 00:57:43 +02:00
Kgothatso Ngako	2d97cc2242	Frost Module logic.	2026-08-31 00:05:16 +02:00
Sebastian Falbesoner	7ebaa134a7	check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) ... The CMake library output location was changed from "src/" to "lib/" in PR #1553, supporting the old location shouldn't be necessary anymore.	2025-09-07 23:54:06 +02:00
Jonas Nick	4187a46649	Merge bitcoin-core/secp256k1#1492: tests: Add Wycheproof ECDH vectors ... e266ba11ae tests: Add Wycheproof ECDH vectors (RandomLattice) Pull request description: ACKs for top commit: jonasnick: ACK e266ba11ae Tree-SHA512: a5cc59886595b134dadcc50e6cd6f03ce036c2857cdd848f138f0c49d4bd742ae5eb5ebca7840ec8666b5d43fa9c4f67cde4d0fb2245b1cf56b079ca3f7c7f8e	2025-05-12 19:50:56 +00:00
RandomLattice	e266ba11ae	tests: Add Wycheproof ECDH vectors ... Adds a test for the ECDH module using the Wycheproof vectors. We use a python script to convert the JSON-formatted vectors into C code, in the same spirit as https://github.com/bitcoin-core/secp256k1/pull/1245 Co-authored-by: Sean Andersen <6730974+andozw@users.noreply.github.com>	2025-05-12 11:27:45 -04:00
Hennadii Stepanov	41d32ab2de	test: Add tools/symbol-check.py ... Co-authored-by: Tim Ruffing <crypto@timruffing.de>	2025-03-11 21:58:55 +00:00
Jonas Nick	a306bb7e90	tools: fix check-abi.sh after cmake out locations were changed	2024-11-04 15:59:41 +00:00
Jonas Nick	f411841a46	Add module "musig" that implements MuSig2 multi-signatures (BIP 327)	2024-10-07 14:03:42 +00:00
Jonas Nick	dd695563e6	check-abi: explicitly provide public headers ... Without this commit, the check-abi shell script outputs false positives because it consider some headers public that are actually not public.	2024-05-06 16:28:01 +00:00
Tim Ruffing	b37fdb28ce	check-abi: Minor UI improvements	2024-01-09 01:05:09 +01:00
Tim Ruffing	ad5f589a94	check-abi: Default to HEAD for new version	2024-01-09 01:00:02 +01:00
Hennadii Stepanov	e7f830e32c	Add tools/check-abi.sh ... Co-authored-by: Tim Ruffing <crypto@timruffing.de>	2023-12-20 17:37:39 +00:00
RandomLattice	35ada3b954	tests: lint wycheproof's python script ... This PR lints tests_wycheproof_generate.py according to pylint. This is a follow-up to PR #1245. Co-authored-by: Sean Andersen <6730974+andozw@users.noreply.github.com>	2023-04-14 18:59:35 +02:00
RandomLattice	e5de454609	tests: Add Wycheproof ECDSA vectors ... Adds a test using the Wycheproof vectors as outlined in #1106. The vectors are taken from the Wycheproof repo. We use a python script to convert the JSON-formatted vectors into C code. Co-authored-by: Sean Andersen <6730974+andozw@users.noreply.github.com>	2023-04-09 06:17:16 +02:00