31f84595c4 Add ellswift usage example (Sebastian Falbesoner)
fe4fbaa7f3 examples: fix case typos in secret clearing paragraphs (s/, Or/, or/) (Sebastian Falbesoner)
16685649d2 doc: Add convention for defaults (Tim Ruffing)
e2af491263 ci: Switch to the new default value of the precomputed table for signing (Hennadii Stepanov)
d94a9273f8 build: Adjust the default size of the precomputed table for signing (Hennadii Stepanov)
9420eece24 cmake: Bump CMake minimum required version up to 3.16 (Hennadii Stepanov)
b8fe33332b cmake: Fixed O3 replacement (Eduardo Menges Mattje)
4d9645bee0 cmake: Remove "AUTO" value of `SECP256K1_ECMULT_GEN_KB` option (Hennadii Stepanov)
a06805ee74 cmake: Remove "AUTO" value of `SECP256K1_ECMULT_WINDOW_SIZE` option (Hennadii Stepanov)
26b94ee92a autotools: Remove "auto" value of `--with-ecmult-gen-kb` option (Hennadii Stepanov)
122dbaeb37 autotools: Remove "auto" value of `--with-ecmult-window` option (Hennadii Stepanov)
158f9e5eae cmake: Do not modify build types when integrating by downstream project (Hennadii Stepanov)
4706be2cd0 cmake: Reimplement `SECP256K1_APPEND_CFLAGS` using Bitcoin Core approach (Hennadii Stepanov)
c2764dbb99 cmake: Rename `SECP256K1_LATE_CFLAGS` to `SECP256K1_APPEND_CFLAGS` (Hennadii Stepanov)
0e2fadb20c fix: typos in secp256k1.c (Elliot Lee)
f87a3589f4 cmake: Do not set `CTEST_TEST_TARGET_ALIAS` (Hennadii Stepanov)
7454a53736 README: mention ellswift module (Sebastian Falbesoner)
ec4c002faa cmake: Simplify `PROJECT_IS_TOP_LEVEL` emulation (Hennadii Stepanov)
cae9a7ad14 cmake: Do not set emulated PROJECT_IS_TOP_LEVEL as cache variable (Hennadii Stepanov)
Pull request description:
Merge bitcoin-core/secp256k1#1529: cmake: Fix cache issue when integrating by downstream project
Merge bitcoin-core/secp256k1#1548: README: mention ellswift module
Merge bitcoin-core/secp256k1#1545: cmake: Do not set `CTEST_TEST_TARGET_ALIAS`
Merge bitcoin-core/secp256k1#1550: fix: typos in secp256k1.c
Merge bitcoin-core/secp256k1#1546: cmake: Rename `SECP256K1_LATE_CFLAGS` and switch to Bitcoin Core's approach
Merge bitcoin-core/secp256k1#1543: cmake: Do not modify build types when integrating by downstream project
Merge bitcoin-core/secp256k1#1535: build: Replace hardcoded "auto" value with default one
Merge bitcoin-core/secp256k1#1555: Fixed O3 replacement
Merge bitcoin-core/secp256k1#1565: cmake: Bump CMake minimum required version up to 3.16
Merge bitcoin-core/secp256k1#1564: build, ci: Adjust the default size of the precomputed table for signing
Merge bitcoin-core/secp256k1#1563: doc: Add convention for defaults
Merge bitcoin-core/secp256k1#1551: Add ellswift usage example
This PR can be recreated with `./contrib/sync-upstream.sh -b master range 0055b86`.
Tips:
* Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit.
* Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally.
Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree.
ACKs for top commit:
real-or-random:
ACK d0dde4aa2a
Tree-SHA512: 8551626c0f183c495cbbc12d9c292e1995ce4b5558f950e1a2ca84188724884180117f9bcc10c0d2f3e73da054c5b4647efaa8282be74936f4d156038b1c10da
The LLVM apt repository uses legacy SHA1 signatures which are now
rejected by the stricter Sequoia PGP policy.
This change extends the 'sha1.second_preimage_resistance' cutoff date to
9999-01-01 in the default Sequoia config. This effectively whitelists
the legacy signature algorithm, preventing "OpenPGP signature
verification failed" errors during `apt-get update`.
See https://github.com/llvm/llvm-project/issues/153385.
2cb2e312e9 extrakeys: Migrate to bitcoin-core/secp256k1#1518 secp256k1_ec_pubkey_sort (DarkWindman)
7d2591ce12 Add secp256k1_pubkey_sort (Jonas Nick)
Pull request description:
Merge bitcoin-core/secp256k1#1518: Add secp256k1_pubkey_sort
This PR can be recreated with `./contrib/sync-upstream.sh -b master range bb528cf`.
Tip: Use `git show --remerge-diff` to show the changes manually added to the merge commit.
ACKs for top commit:
real-or-random:
ACK 2cb2e312e9
Tree-SHA512: dbdb6c5df2195d2ece9574367e0f684a651ea199806a80232c85b0ffd0ba6b930b108bd97385d9fab656754a85fa6de223a93b945046b043aab20ad7bb3d1bff
96a415b1c0 scalar: Port bitcoin-core/secp256k1#1393 to zkp-specific code (mllwchrry)
Pull request description:
Add the `SECP256K1_SCALAR_VERIFY` macro to the zkp-specific `secp256k1_scalar_set_u64` function.
This was missed when upstream PRs bitcoin-core/secp256k1#1373 and bitcoin-core/secp256k1#1393 were merged.
ACKs for top commit:
real-or-random:
ACK 96a415b1c0
Tree-SHA512: 4c3c6209e4c27bec7afc07398c9fc50aef7d44850fbbf5969ff4b57991279960c9645c8daeee5d78bee54dac7fe85bc3d9a01ba4b9deb761d574ae6221ef41c1
4c341f89ab Add changelog entry for SDMC (Pieter Wuille)
a043940253 Permit COMB_BITS < 256 for exhaustive tests (Pieter Wuille)
39b2f2a321 Add test case for ecmult_gen recoded = {-1,0,1} (Pieter Wuille)
644e86de9a Reintroduce projective blinding (Pieter Wuille)
07810d9abb Reduce side channels from single-bit reads (Peter Dettman)
a0d32b597d Optimization: use Nx32 representation for recoded bits (Peter Dettman)
e03dcc44b5 Make secp256k1_scalar_get_bits support 32-bit reads (Pieter Wuille)
5005abee60 Rename scalar_get_bits -> scalar_get_bits_limb32; return uint32_t (Pieter Wuille)
6247f485b6 Optimization: avoid unnecessary doublings in precomputation (Peter Dettman)
15d0cca2a6 Optimization: first table lookup needs no point addition (Pieter Wuille)
7a33db35cd Optimization: move (2^COMB_BITS-1)/2 term into ctx->scalar_offset (Pieter Wuille)
ed2a056f3d Provide 3 configurations accessible through ./configure (Pieter Wuille)
5f7be9f6a5 Always generate tables for current (blocks,teeth) config (Pieter Wuille)
fde1dfcd8d Signed-digit multi-comb ecmult_gen algorithm (Peter Dettman)
486518b350 Make exhaustive tests's scalar_inverse(&x,&x) work (Pieter Wuille)
ab45c3e089 Initial gej blinding -> final ge blinding (Pieter Wuille)
aa00a6b892 Introduce CEIL_DIV macro and use it (Tim Ruffing)
Pull request description:
[bitcoin-core/secp256k1#1058]: Signed-digit multi-comb ecmult_gen algorithm
This PR can be recreated with `./contrib/sync-upstream.sh -b master range da51507`.
Tip: Use `git show --remerge-diff` to show the changes manually added to the merge commit.
ACKs for top commit:
mllwchrry:
ACK 9a57e3c
real-or-random:
ACK 9a57e3c650
Tree-SHA512: 6de5961697ed1f23ce60a6437b622cdf1289273cf9e22f7abfeced08c1f279e30b1a807148f3405c723ad5d3c712eecf0499f994dfce8a1c687b4521b0ef60dd
db8750de46 sync-upstream: improve help text (Jonas Nick)
Pull request description:
ACKs for top commit:
real-or-random:
utACK db8750de46
Tree-SHA512: 06f28c5ebd74437c3c2ef5ae460bec66ff9f15c4bae3b76c74b1323e2ef24d8ec456b72d58df9d68a3d41fcd44d6dfbefe8115900ccb10b8f028a7b0952b6df1
Switch msg initialization from a string literal to a brace-enclosed
array to avoid -Wunterminated-string-initialization. Upstream removed
the trailing '!' from the message; this change retains it.
The previous code is correct and harmless to initialize an array with a
non-terminated character sequence using a string literal.
However, it requires exactly specifying the array size, which can be
cumbersome.
Also, GCC-15 may issue the -Wunterminated-string-initialization warning.
[1]
Fix both issues by using array initialization. This refactoring commit
does not change behavior.
[1] Example warning:
src/modules/schnorrsig/main_impl.h:48:46: error: initializer-string for array of 'unsigned char' is too long [-Werror=unterminated-string-initialization]
48 | static const unsigned char bip340_algo[13] = "BIP0340/nonce";
| ^~~~~~~~~~~~~~~
(cherry picked from commit fa67b6752d)
Conflicts:
src/testrand_impl.h (kept local name `secp256k1_testrand_seed`)
e2af491263 ci: Switch to the new default value of the precomputed table for signing (Hennadii Stepanov)
d94a9273f8 build: Adjust the default size of the precomputed table for signing (Hennadii Stepanov)
Pull request description:
This PR implements the [outcomes](https://github.com/bitcoin-core/secp256k1/issues/1549#issuecomment-2200559257) from today's IRC meeting:
1. The default size of the precomputed table for signing is now aligned with Bitcoin Core's [default](a057869aa3).
2. The default value in CI has been updated to reflect the new default.
ACKs for top commit:
sipa:
utACK e2af491263
real-or-random:
utACK e2af491263
Tree-SHA512: aa9db5bc2aec29a35a503a80617a4c096e9909648084fe1ce43b5dd7e74dd812e7642305bd5bc13eb581efc23f12904e200e13cb1a35955b773e05ab4f84be4e
9420eece24 cmake: Bump CMake minimum required version up to 3.16 (Hennadii Stepanov)
Pull request description:
Debian 10 [reached](https://wiki.debian.org/DebianReleases) EOL LTS yesterday, on 2024-06-30.
There no longer seem to be compelling reasons to maintain support for CMake 3.13.
The suggested minimum required version, CMake 3.16, is shipped with Ubuntu 20.04 LTS, which is [supported](https://wiki.ubuntu.com/Releases) until April 2025.
Debian 11 ships with CMake 3.18 (3.25 in backports). In [other](https://repology.org/project/cmake/versions) major distros and package managers, CMake versions are not older.
ACKs for top commit:
fanquake:
ACK 9420eece24 - If the only significant change is for some MSVC compat code, this doesn't seem super compelling, but seems ok either way.
real-or-random:
utACK 9420eece24
Tree-SHA512: 7066f053f9820f9ddeb27f9e8042edb67a31cd61e29eadff12b50d63bbe278f6ffd15f84035932bc4c337461a7eb342339ed62e46e100c5447106a702fad229c
b8fe33332b cmake: Fixed O3 replacement (Eduardo Menges Mattje)
Pull request description:
Old replacement of `O3` in `CMAKE_C_FLAGS_RELEASE` skip spaces, which is problematic. For instance, if `CMAKE_C_FLAGS_RELEASE = "-O3 -DFOO"`, regex will replace it with `-O2-DFOO`, which causes a compile error.
This patch changes this behavior, keeping whichever space exists between the flags.
If I may question, what is the rationale behind replacing `O3` with `O2`? Changing the user's flags is a bad practice overall, and I don't see how this replacement is beneficial.
ACKs for top commit:
hebasto:
re-ACK b8fe33332b.
Tree-SHA512: d84091eb594af695805784e87f49d38ac08a7cf42978c844383882196389a0d83fc5f72e6394887b9961cc3f96538962f4ee86ef3eeca2c96509c64428046c70
This should hopefully be useful as orientation for users implementing
the key exchange part of BIP324. Conceptually the example is not very
different to the ECDH one, so a lot of code/comments are just copied
(e.g. context creation, secret key generation, shared secret comparison,
console output, cleanup with secret key clearing).
