dc0bda5731 bench: Port bitcoin-core/secp256k1#1796 to zkp-specific code (mllwchrry)
fe48cc9fa5 generator: Port bitcoin-core/secp256k1#1764 to zkp-specific code (mllwchrry)
d111d31293 generator: Port bitcoin-core/secp256k1#1779 to zkp-specific code (mllwchrry)
d8e87e45f3 unit_test: bump MAX_ARGS from 150 to 200 (mllwchrry)
2542b43451 modules: Port bitcoin-core/secp256k1#1774 to zkp-specific code (mllwchrry)
ae7eb729c0 release cleanup: bump version after 0.7.1 (Jonas Nick)
20a209f11c release: prepare for 0.7.1 (Jonas Nick)
c4b6a81a60 changelog: update in preparation for the v0.7.1 release (Jonas Nick)
c09215f7af bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS (kevkevinpal)
29ac4d8491 sage: verify Eisenstein integer connection for GLV constants (Justsomebuddy)
bd5ced1fe1 doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult (kevkevinpal)
2f73e5281d group: Avoid using infinity field directly in other modules (Tim Ruffing)
0406cfc4d1 doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake (kevkevinpal)
ae00c552df Add VERIFY_CHECKs that flags are 0 or 1 (John Moffett)
3b5b03f301 doc/bench: Added cmake build options to bench error messages (kevkevinpal)
d822b29021 test: split monolithic ellswift test into independent cases (furszy)
3daab83a60 refactor: remove ret from secp256k1_ec_pubkey_serialize (kevkevinpal)
8bcda186d2 test: Add non-NULL checks for "pointer of array" API functions (Sebastian Falbesoner)
5a08c1bcdc Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL (Sebastian Falbesoner)
f5e815f430 remove secp256k1_eckey_pubkey_serialize function (Sebastian Falbesoner)
0d3659c547 use new `_eckey_pubkey_serialize{33,65}` functions in modules (ellswift,musig) (Sebastian Falbesoner)
adb76f82ea use new `_eckey_pubkey_serialize{33,65}` functions in public API (Sebastian Falbesoner)
fc7458ca3e introduce `secp256k1_eckey_pubkey_serialize{33,65}` functions (Sebastian Falbesoner)
26166c4f5f ecmult_multi: reduce strauss memory usage by 30% (Jonas Nick)
f252da7e6e ci: Use Python virtual environment in "x86_64-macos-native" job (Hennadii Stepanov)
153eea20c2 bench: Use `ALIGNMENT` macro instead of hardcoded value (Hennadii Stepanov)
Pull request description:
Merge bitcoin-core/secp256k1#1763: bench: Use `ALIGNMENT` macro instead of hardcoded value
Merge bitcoin-core/secp256k1#1771: ci: Use Python virtual environment in "x86_64-macos-native" job
Merge bitcoin-core/secp256k1#1761: ecmult_multi: reduce strauss memory usage by 30%
Merge bitcoin-core/secp256k1#1774: refactor: split up internal pubkey serialization function into compressed/uncompressed variants
Merge bitcoin-core/secp256k1#1779: Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL
Merge bitcoin-core/secp256k1#1784: refactor: remove ret from secp256k1_ec_pubkey_serialize
Merge bitcoin-core/secp256k1#1788: test: split monolithic ellswift test into independent cases
Merge bitcoin-core/secp256k1#1778: doc/bench: Added cmake build options to bench error messages
Merge bitcoin-core/secp256k1#1783: Add VERIFY_CHECKs and documentation that flags must be 0 or 1
Merge bitcoin-core/secp256k1#1790: doc: include arg -DSECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS=ON for cmake
Merge bitcoin-core/secp256k1#1764: group: Avoid using infinity field directly in other modules
Merge bitcoin-core/secp256k1#1793: doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult
Merge bitcoin-core/secp256k1#1800: sage: verify Eisenstein integer connection for GLV constants
Merge bitcoin-core/secp256k1#1796: bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS
Merge bitcoin-core/secp256k1#1808: Prepare for 0.7.1
Merge bitcoin-core/secp256k1#1809: release cleanup: bump version after 0.7.1
This PR can be recreated with `./contrib/sync-upstream.sh -b master range c7a52400`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK dc0bda5731
Tree-SHA512: a816729a8d3ce199154a1b670172f4639b03812071fd78db8e23dfad9a88a2fef882f30c9f34e1151ad79b85201fbb7eba890a572d68bb45ca8fb05496bc34e8
c49c9be504 bench: Update help functions in bench and bench_internal (kevkevinpal)
Pull request description:
### Motivation
This change is motivated by https://github.com/bitcoin-core/secp256k1/pull/1793#pullrequestreview-3644885897
> While aligning implementation across all benchmarks, argv could be passed to the help() in bench.c and bench_internal.c.
### Description
In the `bench` and `bench_internal` `help` functions `argv` was not being passed. In this change, we pass in argv and use it in the help text.
ACKs for top commit:
real-or-random:
ACK c49c9be504
Tree-SHA512: 77184db4bf5c16827f19d888af73939f4139cc2e84ae5256d995cf61f606d5865928480fc009a0185e1a6843f3c38dd1b858d1316e524c9b165459c7367f2318
8d0eda07e9 testrand: Remove testrand_finish (Tim Ruffing)
Pull request description:
This removes printing of the "random run = " at the end of the tests. I haven't seen a single case where this proved to be useful. And as of 48789dafc2, this is anyway printed only at the end of the exhaustive tests and not the normal tests, so the probability that this will be useful in the future is very low.
ACKs for top commit:
sipa:
ACK 8d0eda07e9
Tree-SHA512: e0a688e2c81afbf7a11204f1be71b472eb3ec23086c7dc742a069b7ddfc837fcf9ade9e04f8c3f79e8b07d38d05bf4979f6e3ca68a480e45de0c1ecb94b0a6f5
6f7c112cc8 include: add description of range proofs focusing on the differences between the implementation and the CA paper (Mykyta)
Pull request description:
Added the description of range proofs in Confidential Assets focusing on the differences between the description in the paper and the actual implementation.
ACKs for top commit:
real-or-random:
ACK 6f7c112cc8
Tree-SHA512: c8568883648d6d1f0cbbe9a9730b08512665a90106b974733eecfc3dc628361ff54785c67c355216157af5a63b7fefa52d49df400ccaeec9cbf14d40a600707f
This removes printing of the "random run = " at the end of the tests. I
haven't seen a single case where this proved to be useful. And as of
48789dafc2, this is anyway printed only at
the end of the exhaustive tests and not the normal tests, so the
probability that this will be useful in the future is very low.
3f7a9429ad ecdsa_adaptor: batch affine conversion in dleq_pair and dleq_prove (mllwchrry)
d380549e38 ecdsa_adaptor: optimize encrypt with batch affine conversion (mllwchrry)
Pull request description:
Replace pairs of `secp256k1_ge_set_gej` calls with single `secp256k1_ge_set_all_gej[_var]` calls, saving one expensive field inversion per operation.
`secp256k1_ecdsa_adaptor_encrypt`:
- Batch convert nonce points `R'` and `R` using `secp256k1_ge_set_all_gej`.
- Add early `enckey` validation: `secp256k1_ge_set_all_gej` requires non-infinity inputs, but invalid `enckey` could cause `secp256k1_ecmult_const` to produce infinity.
- Add early return when `secp256k1_dleq_prove` fails.
`secp256k1_dleq_pair`:
- Batch convert points `p[0]` and `p[1]` using `secp256k1_ge_set_all_gej`.
`secp256k1_dleq_prove`:
- Add early return with `secp256k1_declassify` when nonce generation fails, ensuring the nonce `k` passed to `secp256k1_dleq_pair` is always non-zero (required by `secp256k1_ge_set_all_gej`).
`secp256k1_dleq_verify`:
- Batch convert using variable-time `secp256k1_ge_set_all_gej_var` (already uses variable-time operations, processes public data).
ACKs for top commit:
real-or-random:
ACK 3f7a9429ad
Tree-SHA512: 706ab9df439f0803d1ec0181caf94a6f480f8e2c9337eae966c6b7a94b5c3ad14e71fc1a223a7d0f2b8d6db0c46a059b83712adff1d74e2d63ac3fc915234698
7111d365fb modules, tests: Port bitcoin-core/secp256k1#1734 to zkp-specific code (DarkWindman)
7699fe9aa6 modules: Port bitcoin-core/secp256k1#1735 to zkp-specific code (DarkWindman)
c09519f0e3 ci: Drop workaround for Valgrind older than 3.20.0 (Hennadii Stepanov)
8bc50b72ff ci: Switch to macOS 15 Sequoia Intel-based image (Hennadii Stepanov)
2f4546ce56 test: add --log option to display tests execution (furszy)
95b9953ea4 test: Add option to display all available tests (furszy)
953f7b0088 test: support running specific tests/modules targets (furszy)
0302c1a3d7 test: add --help for command-line options (furszy)
9ec3bfe22d test: adapt modules to the new test infrastructure (furszy)
48789dafc2 test: introduce (mini) unit test framework (furszy)
9cce703863 refactor: move 'gettime_i64()' to tests_common.h (furszy)
15d014804e ci: Drop default for `inputs.command` in `run-in-docker-action` (Hennadii Stepanov)
1decc49a1f ci: Use YAML anchor and aliases for repeated "CI script" steps (Hennadii Stepanov)
dff1bc107d ci, refactor: Generalize use of `matrix.configuration.env_vars` (Hennadii Stepanov)
4b644da199 ci: Use YAML anchor and aliases for repeated "Print logs" steps (Hennadii Stepanov)
a889cd93df ci: Bump `actions/checkout` version (Hennadii Stepanov)
574c2f3080 ci: Use YAML anchor and aliases for repeated "Checkout" steps (Hennadii Stepanov)
53585f93b7 ci: Use clang-snapshot in "MSan" job (Hennadii Stepanov)
6894c964f3 Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan (Hennadii Stepanov)
f163c35897 ci: Set `DEBIAN_FRONTEND=noninteractive` (Hennadii Stepanov)
70ae177ca0 ci: Bump `docker/build-push-action` version (Hennadii Stepanov)
b2a95a420f ci: Drop `tags` input for `docker/build-push-action` (Hennadii Stepanov)
122014edb3 ci: Add `scope` parameter to `cache-{to,from}` options (Hennadii Stepanov)
4d90585fea docs: Improve API docs of _context_set_illegal_callback (Tim Ruffing)
895f53d1cf docs: Clarify that callback can be called more than once (Tim Ruffing)
dfe284ed2d bench: improve context creation in ECDH benchmark (Sebastian Falbesoner)
ab560078aa build: Fix warnings in x86_64 assembly check (Hennadii Stepanov)
7321bdf27b doc: clarify API doc of `secp256k1_ecdsa_recover` return value (Jonas Nick)
0c91c56041 test: introduce group order byte-array constant for deduplication (Sebastian Falbesoner)
399b582a5f Split memclear into two versions (John Moffett)
Pull request description:
Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign
Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication
Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value
Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check
Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark
Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once
Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements
Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job
Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors
Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework
Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image
Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0
This PR can be recreated with `./contrib/sync-upstream.sh -b master range 7a2fff8`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK 7111d365fb
Tree-SHA512: 9f8fd21eee9ad3b7ea8d688f79783a43baffdeafb6b313372761ce368a24219a83c430c49070413f9972813ae03adde9a8660abfe4b0893b3700e241a81e5b13
f48b1bfa5d hash: add midstate initializer and use it for tagged hashes (w0xlt)
Pull request description:
Each tagged hash midstate function (e.g., `secp256k1_schnorrsig_sha256_tagged`) calls `secp256k1_sha256_initialize` before immediately overwriting every field it sets: `s[0]` through `s[7]` and `bytes`. The `buf[64]` member does not need initialization either, because `bytes` is set to 64, which means the buffer position (`bytes & 0x3F`) (`= bytes % 64`) is 0, so buf is always written before being read.
Remove the 11 redundant `secp256k1_sha256_initialize` calls across the `schnorrsig`, `ellswift`, and `musig` modules.
ACKs for top commit:
real-or-random:
utACK f48b1bfa5d
theStack:
Code-review ACK f48b1bfa5d
Tree-SHA512: 769beb96f3921cc3c180ed0d17484ffa0dc78041c889a8e56603679d8eaca5fe13e63759ada78f83d8e0ff7aae392e6bcbc1a9fe8b959105ea4a3d8ef51abf15
Introduce secp256k1_sha256_initialize_midstate() in the hash layer and use it at all tagged-hash midstate call sites across schnorrsig, musig, and ellswift.
Document the byte-counter contract at the declaration site in hash.h and add run_sha256_initialize_midstate_tests() to directly verify helper behavior against initialize_tagged.
Also switch the helper to take const uint32_t state[8] to reduce argument-order risk at call sites.
01b1b916eb modules: Port bitcoin-core/secp256k1#1725 to zkp-specific code (DarkWindman)
7ebaa134a7 check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) (Sebastian Falbesoner)
806de38bfc doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) (Sebastian Falbesoner)
737912430d ci: Add more tests for clang-cl (Hennadii Stepanov)
7379a5bed3 doc: Recommend clang-cl when building on Windows (Hennadii Stepanov)
325d65a8cf Rename and clear var containing k or -k (John Moffett)
960ba5f9c6 Use size_t instead of int for RFC6979 outlen copy (John Moffett)
5153cf1c91 tests: refactor tagged hash tests (josibake)
489a43d1bf docs: fix broken link to eprint cache.pdf paper (VolodymyrBg)
0458def51e doc: Add `--gcov-ignore-parse-errors=all` option to `gcovr` invocations (Hennadii Stepanov)
1aecce5936 doc: Add `--merge-mode-functions=separate` option to `gcovr` invocations (Hennadii Stepanov)
106a7cbf41 doc: Exclude modules' `bench_impl.h` headers from coverage report (Hennadii Stepanov)
a9e955d3ea autotools, docs: Adjust help string for `--enable-coverage` option (Hennadii Stepanov)
24ba8ff168 chore(ci): Fix typo in Dockerfile comment (Maximilian Hubert)
c25c3c8a88 test: update wycheproof test vectors (josibake)
7b07b22957 cmake: Avoid contaminating parent project's cache with BUILD_SHARED_LIBS (Hennadii Stepanov)
5433648ca0 Fix typos and spellings (Adrien Ufferte)
9ea54c69b7 tests: update Wycheproof files (fanquake)
Pull request description:
Merge bitcoin-core/secp256k1#1711: tests: update Wycheproof
Merge bitcoin-core/secp256k1#1688: cmake: Avoid contaminating parent project's cache with `BUILD_SHARED_LIBS`
Merge bitcoin-core/secp256k1#1717: test: update wycheproof test vectors
Merge bitcoin-core/secp256k1#1720: chore(ci): Fix typo in Dockerfile comment
Merge bitcoin-core/secp256k1#1722: docs: Exclude modules' `bench_impl.h` headers from coverage report
Merge bitcoin-core/secp256k1#1726: docs: fix broken link to Tromer's cache.pdf paper
Merge bitcoin-core/secp256k1#1725: tests: refactor tagged hash verification
Merge bitcoin-core/secp256k1#1729: hash: Use size_t instead of int for RFC6979 outlen copy
Merge bitcoin-core/secp256k1#1731: schnorrsig: Securely clear buf containing k or its negation
Merge bitcoin-core/secp256k1#1681: doc: Recommend clang-cl when building on Windows
Merge bitcoin-core/secp256k1#1737: doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static)
Merge bitcoin-core/secp256k1#1738: check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so)
This PR can be recreated with `./contrib/sync-upstream.sh -b master range 36e7695`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK 01b1b916eb
Tree-SHA512: 3d945e55313eb0afde66bd2064edd169854294f9e1e185e6199beec2a079f872cd3172d00e9c4da6cda25ccf296ddd3f205280076f94d009941eab4e319bcd0a
7ab8b0cc01 release cleanup: bump version after 0.7.0 (Jonas Nick)
a3e742d947 release: Prepare for 0.7.0 (Tim Ruffing)
f67b0ac1a0 ci: Don't hardcode ABI version (Tim Ruffing)
cde4130898 musig/tests: initialize keypair (Jonas Nick)
40b4a06520 changelog: update (Jonas Nick)
8d967a602b musig/test: Remove dead code (Tim Ruffing)
983711cd6d musig/tests: Refactor vectors_signverify (Tim Ruffing)
c82d84bb86 build: add CMake option for disabling symbol visibility attributes (Cory Fields)
ce7923874f build: Add SECP256K1_NO_API_VISIBILITY_ATTRIBUTES (Tim Ruffing)
e5297f6d79 build: Refactor visibility logic (Tim Ruffing)
bf082221ff cmake: Make `secp256k1_objs` inherit interface defines from `secp256k1` (Hennadii Stepanov)
3352f9d667 ci: enable musig module for native macOS arm64 job (Sebastian Falbesoner)
44b205e9ee Revert "cmake: configure libsecp256k1.pc during install" (Daniel Pfeifer)
004f57fcd8 ci: Move Valgrind build for `arm64` from Cirrus to GHA (Hennadii Stepanov)
5fafdfc30f ci: Move `gcc-snapshot` build for `arm64` from Cirrus to GHA (Hennadii Stepanov)
e814b79a8b ci: Switch `arm64_debian` from QEMU to native `arm64` Docker image (Hennadii Stepanov)
bcf77346b9 ci: Add `arm64` architecture to `docker_cache` job (Hennadii Stepanov)
b77aae9226 ci: Rename Docker image tag to reflect architecture (Hennadii Stepanov)
0dfe387dbe cmake: support the use of launchers in ctest -S scripts (Daniel Pfeifer)
7106dce6fd cmake: configure libsecp256k1.pc during install (Daniel Pfeifer)
37dd422b5c cmake: Emulate Libtool's behavior on FreeBSD (Hennadii Stepanov)
Pull request description:
Merge bitcoin-core/secp256k1#1685: cmake: Emulate Libtool's behavior on FreeBSD
Merge bitcoin-core/secp256k1#1692: cmake: configure libsecp256k1.pc during install
Merge bitcoin-core/secp256k1#1687: cmake: support the use of launchers in ctest -S scripts
Merge bitcoin-core/secp256k1#1689: ci: Convert `arm64` Cirrus tasks to GHA jobs
Merge bitcoin-core/secp256k1#1694: Revert "cmake: configure libsecp256k1.pc during install"
Merge bitcoin-core/secp256k1#1699: ci: enable musig module for native macOS arm64 job
Merge bitcoin-core/secp256k1#1704: cmake: Make `secp256k1_objs` inherit interface defines from `secp256k1`
Merge bitcoin-core/secp256k1#1696: build: Refactor visibility logic and add override
Merge bitcoin-core/secp256k1#1705: musig/test: Remove dead code
Merge bitcoin-core/secp256k1#1702: changelog: update
Merge bitcoin-core/secp256k1#1706: musig/tests: initialize keypair
Merge bitcoin-core/secp256k1#1707: release: Prepare for 0.7.0
Merge bitcoin-core/secp256k1#1708: release cleanup: bump version after 0.7.0
This PR can be recreated with `./contrib/sync-upstream.sh -b master range b9313c6e`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK 9dcd857d54
Tree-SHA512: 4f5844185006fc4d3551febc6803096a36bcf49b0b9042e8d6ed0d7f6856de6bba44a69063406bb421b644708a91981a378133683f850ee1cf23275eab13b0c8
76e92cfeea Revert "ci, docker: Fix LLVM repository signature failure" (Hennadii Stepanov)
Pull request description:
This reverts commit 0ffb1749a5, as the underlying [issue](https://github.com/llvm/llvm-project/issues/153385) has been resolved.
ACKs for top commit:
real-or-random:
ACK 76e92cfeea
Tree-SHA512: 3cab40ab5d3c1d180b81414ec212481468898ec36dba22acce5fd0dc0b506c0beefc5d9df27bf9e94c1aa006ba18f70072bb1fcbc31acdddaead678009f82c19
4dda31229e ci: Use Python virtual environment in x86_64-macos-native job (mllwchrry)
795f19af1f ci: Switch to macOS 15 Sequoia Intel-based image (Hennadii Stepanov)
2f057a145f ci: Don't hardcode ABI version (Tim Ruffing)
17ad196018 schnorrsig_halfagg: Fix symbol visibility for internal function (mllwchrry)
ec343f0b2f Port bitcoin-core/secp256k1#1642 to zkp-specific code (mllwchrry)
20b05c9d3f configure: Show exhaustive tests in summary (Tim Ruffing)
1b6e081538 include: remove WARN_UNUSED_RESULT for functions always returning 1 (Jonas Nick)
d87c3bc58f ci: Fix exiting from ci.sh on error (Tim Ruffing)
51907fa918 tests: remove unused uncounting_illegal_callback_fn (Jonas Nick)
d1478763a5 build: Drop no longer needed `-fvisibility=hidden` compiler option (Hennadii Stepanov)
8ed1d83d92 ci: Run `tools/symbol-check.py` (Hennadii Stepanov)
41d32ab2de test: Add `tools/symbol-check.py` (Hennadii Stepanov)
88548058b3 Introduce `SECP256K1_LOCAL_VAR` macro (Hennadii Stepanov)
37d2c60bec Remove deprecated _ec_privkey_{negate,tweak_add,tweak_mul} aliases (Sebastian Falbesoner)
59860bcc24 gha: Print all *.log files, in a separate action (Tim Ruffing)
4c50d73dd9 ci: Add new "Windows (clang-cl)" job (Hennadii Stepanov)
84c0bd1f72 cmake: Adjust diagnostic flags for clang-cl (Hennadii Stepanov)
961ec25a83 musig: Fix clearing of pubnonces (Tim Ruffing)
64228a648f musig: Use _ge_set_all_gej for own public nonces (Tim Ruffing)
300aab1c05 tests: Improve _ge_set_all_gej(_var) tests (Tim Ruffing)
365f274ce3 group: Simplify secp256k1_ge_set_all_gej (Tim Ruffing)
d3082ddead group: Add constant-time secp256k1_ge_set_all_gej (Tim Ruffing)
432ac57705 Make static context const (Daniel Pfeifer)
1823594761 Verify `compressed` argument in `secp256k1_eckey_pubkey_serialize` (Sebastian Falbesoner)
Pull request description:
Merge bitcoin-core/secp256k1#1642: Verify `compressed` argument in `secp256k1_eckey_pubkey_serialize`
Merge bitcoin-core/secp256k1#1639: Make static context const
Merge bitcoin-core/secp256k1#1614: Add _ge_set_all_gej and use it in musig for own public nonces
Merge bitcoin-core/secp256k1#1656: musig: Fix clearing of pubnonces
Merge bitcoin-core/secp256k1#1647: cmake: Adjust diagnostic flags for `clang-cl`
Merge bitcoin-core/secp256k1#1655: gha: Print all *.log files, in a separate action
Merge bitcoin-core/secp256k1#1593: Remove deprecated `_ec_privkey_{negate,tweak_add,tweak_mul}` aliases from API
Merge bitcoin-core/secp256k1#1359: Fix symbol visibility issues, add test for it
Merge bitcoin-core/secp256k1#1657: tests: remove unused uncounting_illegal_callback_fn
Merge bitcoin-core/secp256k1#1660: ci: Fix exiting from ci.sh on error
Merge bitcoin-core/secp256k1#1659: include: remove WARN_UNUSED_RESULT for functions always returning 1
Merge bitcoin-core/secp256k1#1661: configure: Show exhaustive tests in summary
This PR can be recreated with `./contrib/sync-upstream.sh -b master range d84bb83e`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
Additional fixes:
* schnorrsig_halfagg: Added `static` to internal helper function to pass `symbol-check.py` introduced in bitcoin-core/secp256k1#1359.
* ci: Cherry-picked bitcoin-core/secp256k1@f67b0ac1 to fix hardcoded DLL version in symbol-check (zkp produces `libsecp256k1-0.dll`, not `-5.dll`)
ACKs for top commit:
real-or-random:
ACK 4dda31229e
Tree-SHA512: 56c6a7dc977fec9cd57330db2a4513b82ee2284e905b70f83d50e9b84f4606b83f695be8eece653ffd88b9852f0a7903662f8ab215434c56c7d3bf3062a3ed16
e3bddfa750 modules: Port bitcoin-core/secp256k1#1579 to zkp-specific code (DarkWindman)
13d389629a CONTRIBUTING: mention that `EXIT_` codes should be used (Sebastian Falbesoner)
c855581728 test, bench, precompute_ecmult: use `EXIT_...` constants for `main` return values (Sebastian Falbesoner)
965393fcea examples: use `EXIT_...` constants for `main` return values (Sebastian Falbesoner)
b682dbcf84 README: add instructions for verifying GPG signatures (James O'Beirne)
a82287fb85 schnorrsig: clear out masked secret key in BIP-340 nonce function (Sebastian Falbesoner)
2ac9f558c4 doc: Improve cmake instructions in README (Fabian Jahr)
39705450eb Fix some misspellings (Nicolas Iooss)
c97059f594 release cleanup: bump version after 0.6.0 (Jonas Nick)
39d5dfd542 release: prepare for 0.6.0 (Jonas Nick)
df2eceb279 build: add ellswift.md and musig.md to release tarball (Jonas Nick)
a306bb7e90 tools: fix check-abi.sh after cmake out locations were changed (Jonas Nick)
145868a84d Do not export `secp256k1_musig_nonce_gen_internal` (Hennadii Stepanov)
765ef53335 Clear _gej instances after point multiplication to avoid potential leaks (Sebastian Falbesoner)
349e6ab916 Introduce separate _clear functions for hash module (Tim Ruffing)
99cc9fd6d0 Don't rely on memset to set signed integers to 0 (Tim Ruffing)
97c57f42ba Implement various _clear() functions with secp256k1_memclear() (Tim Ruffing)
9bb368d146 Use secp256k1_memclear() to clear stack memory instead of memset() (Tim Ruffing)
e3497bbf00 Separate between clearing memory and setting to zero in tests (Tim Ruffing)
d79a6ccd43 Separate secp256k1_fe_set_int( . , 0 ) from secp256k1_fe_clear() (Tim Ruffing)
1c08126222 Add secp256k1_memclear() for clearing secret data (Tim Ruffing)
e7d384488e Don't clear secrets in pippenger implementation (Tim Ruffing)
Pull request description:
Merge bitcoin-core/secp256k1#1579: Clear sensitive memory without getting optimized out (revival of #636)
Merge bitcoin-core/secp256k1#1631: release: prepare for 0.6.0
Merge bitcoin-core/secp256k1#1633: release cleanup: bump version after 0.6.0
Merge bitcoin-core/secp256k1#1634: Fix some misspellings
Merge bitcoin-core/secp256k1#1641: doc: Improve cmake instructions in README
Merge bitcoin-core/secp256k1#1650: schnorrsig: clear out masked secret key in BIP-340 nonce function
Merge bitcoin-core/secp256k1#1646: README: add instructions for verifying GPG signatures
Merge bitcoin-core/secp256k1#1654: use `EXIT_` constants over magic numbers for indicating program execution status
This PR can be recreated with `./contrib/sync-upstream.sh -b master range c0d9480`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
### zkp fixes for Valgrind compatibility
PR #1579 introduced `secp256k1_memclear` that marks cleared memory as undefined. Updated rangeproof to use `memset`/`secp256k1_scalar_set_int` for initialization, keeping `memclear` only for cleanup.
ACKs for top commit:
real-or-random:
ACK e3bddfa750
Tree-SHA512: 7a089d1c6cb34dd0706d53a9a92c0aecc6183a60c77de147ba97db9133bb96031aa2178e0cc07017c76fb30048697c1d976eb7b6c206fa50984d28487cf023f6
a8e6a3cc34 Port bitcoin-core/secp256k1#1628 to zkp public API (mllwchrry)
694342fdb7 Name public API structs (Ava Chow)
0f73caf7c6 test, ci: Lower default iteration count to 16 (Hennadii Stepanov)
87384f5c0f cmake, test: Add `secp256k1_` prefix to test names (Hennadii Stepanov)
980c08df80 util: Remove unused (u)int64_t formatting macros (Tim Ruffing)
096e3e23f6 ci: Update macOS image (Hennadii Stepanov)
57eda3ba30 musig: ctimetests: fix _declassify range for generated nonce points (Sebastian Falbesoner)
447334cb06 include: Avoid visibility("default") on Windows (Tim Ruffing)
8be3839fb2 Remove unused scratch space from API (Jonas Nick)
c232486d84 Revert "cmake: Set `ENVIRONMENT` property for examples on Windows" (Hennadii Stepanov)
26e4a7c214 cmake: Set top-level target output locations (Hennadii Stepanov)
5bab8f6d3c examples: make key generation doc consistent (Jonas Nick)
e8908221a4 examples: do not retry generating seckey randomness in musig (Jonas Nick)
70b6be1834 extrakeys: improve doc of keypair_create (don't suggest retry) (Jonas Nick)
cd4f84f3ba Improve examples/documentation: remove key generation loops (cheapshot003)
ef7ff03407 f can never equal -m (Russell O'Connor)
Pull request description:
Merge bitcoin-core/secp256k1#1603: f can never equal -m
Merge bitcoin-core/secp256k1#1599: #1570 improve examples: remove key generation loop
Merge bitcoin-core/secp256k1#1616: examples: do not retry generating seckey randomness in musig
Merge bitcoin-core/secp256k1#1553: cmake: Set top-level target output locations
Merge bitcoin-core/secp256k1#1620: Remove unused scratch space from API
Merge bitcoin-core/secp256k1#1595: build: 45839th attempt to fix symbol visibility on Windows
Merge bitcoin-core/secp256k1#1619: musig: ctimetests: fix _declassify range for generated nonce points
Merge bitcoin-core/secp256k1#1624: ci: Update macOS image
Merge bitcoin-core/secp256k1#1625: util: Remove unused (u)int64_t formatting macros
Merge bitcoin-core/secp256k1#1582: cmake, test: Add `secp256k1_` prefix to test names
Merge bitcoin-core/secp256k1#1581: test, ci: Lower default iteration count to 16
Merge bitcoin-core/secp256k1#1628: Name public API structs
This PR can be recreated with `./contrib/sync-upstream.sh -b master range a38d879a`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK a8e6a3cc34
Tree-SHA512: 662518c9f569066402d4b5890abe33d7dc9662bcc2006b42ad83cc08f0a2be6ff923a792681a797b191ed7dd7882155c1eadbc8387011e9c5a10d06183cefb56
b99a94c382 Add tests for bad scalar inputs in ellswift XDH (gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf)
307b49f1b9 ellswift: fix overflow flag handling in secp256k1_ellswift_xdh (gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf)
Pull request description:
The secp256k1_ellswift_xdh function uses overflow = secp256k1_scalar_is_zero(&s) which overwrites the overflow flag from the preceding secp256k1_scalar_set_b32 call. This means secret keys >= the curve order are silently accepted (reduced mod n) instead of being rejected.
The fix changes = to |=, matching the correct pattern already used in secp256k1_ecdh (main_impl.h, line 51).
The ECDH module's test suite explicitly tests overflow rejection (passes secp256k1_group_order_bytes as a key and checks the function returns 0). The ellswift test suite has no corresponding test, which is why this went undetected.
Previous PR to the wrong repository: https://github.com/bitcoin/bitcoin/pull/34558
ACKs for top commit:
kevkevinpal:
ACK b99a94c382
real-or-random:
utACK b99a94c382
theStack:
re-ACK b99a94c382
Tree-SHA512: 6222cd7616c7429f4c05180257f925720b7f9743fa440667a2327f94cb134a160cdf498dca1713ffc470ab3a6ca3275aafbd14b2e790766fe10ddb5ce6970e80
