The previous implementation returns an off-curve point for the input t=0.
This rewrite addresses that issue by implicity returning the on-curve point
(d, sqrt(1 + b)), which is the point that the paper Indifferentiable Hashing
to Barreto–Naehrig Curves suggests returning in this case.
Note: At the moment it is cryptographically impossible for the input t to be 0.
b41caaafd2 bppp: replace memcmp in tests with secp256k1_memcmp_var (Jonas Nick)
6a3aae8f1d group_parse: use secp256k1_memcmp_var instead of memcmp (Jonas Nick)
e9d522fc64 ci: turn on -zkp modules in macos-native job (Jonas Nick)
c45b7c4fbb refactor: introduce testutil.h (deduplicate `random_fe_`, `ge_equals_` helpers) (Sebastian Falbesoner)
dc5514144f tests: simplify `random_fe_non_zero` (remove loop limit and unneeded normalize) (Sebastian Falbesoner)
d9d80fd155 ci: Bump major versions for docker actions (Hennadii Stepanov)
421d84855a ci: Align Autotools/CMake `CI_INSTALL` directory names (Hennadii Stepanov)
9f005c60d6 cmake: Install `libsecp256k1.pc` file (Hennadii Stepanov)
b0f7bfedc9 doc: Do not mention soname in CHANGELOG.md "ABI Compatibility" section (Hennadii Stepanov)
bd9d98d353 doc: Align documented scripts with CI ones (Hennadii Stepanov)
70303643cf tests: add CHECK_ERROR_VOID and use it in scratch tests (Jonas Nick)
f8d7ea68df tests: Replace counting_illegal_callbacks with CHECK_ILLEGAL_VOID (Jonas Nick)
a1d52e3e12 tests: remove unnecessary test in run_ec_pubkey_parse_test (Jonas Nick)
875b0ada25 tests: remove unnecessary set_illegal_callback (Jonas Nick)
9b118bc7fb release cleanup: bump version after 0.4.0 (Jonas Nick)
16339804c9 release: Prepare for 0.4.0 (Tim Ruffing)
d9a85065a9 changelog: Catch up in preparation of release (Tim Ruffing)
8659a01714 ci: Add `release` job (Hennadii Stepanov)
f9b38894ba ci: Update `actions/checkout` version (Hennadii Stepanov)
2635068abf ci/gha: Let MSan continue checking after errors in all jobs (Tim Ruffing)
e78c7b68eb ci/Dockerfile: Reduce size of Docker image further (Tim Ruffing)
2f0d3bbffb ci/Dockerfile: Warn if `ulimit -n` is too high when running Docker (Tim Ruffing)
4b8a647ad3 ci/gha: Add ARM64 QEMU jobs for clang and clang-snapshot (Tim Ruffing)
6ebe7d2bb3 ci/Dockerfile: Always use versioned clang packages (Tim Ruffing)
c223d7e33d ci: Switch macOS from Ventura to Monterey and add Valgrind (Hennadii Stepanov)
cce0456304 ci: Make repetitive command the default one (Hennadii Stepanov)
317a4c48f0 ci: Move `git config ...` to `run-in-docker-action` (Hennadii Stepanov)
676ed8f9cf ci: Move "C++ (public headers)" from Cirrus to GitHub Actions (Hennadii Stepanov)
61fc3a2dc8 ci: Move "C++ -fpermissive..." from Cirrus to GitHub Actions (Hennadii Stepanov)
d51fb0a533 ci: Move "MSan" from Cirrus to GitHub Actions (Hennadii Stepanov)
c22ac27529 ci: Move sanitizers task from Cirrus to GitHub Actions (Hennadii Stepanov)
ee1be62d84 ci: Use concurrency for pull requests only (Hennadii Stepanov)
fc3dea29ea ci: Move "ppc64le: Linux..." from Cirrus to GitHub Actions (Hennadii Stepanov)
7782dc8276 ci: Move "ARM64: Linux..." from Cirrus to GitHub Actions (Hennadii Stepanov)
0a16de671c ci: Move "ARM32: Linux..." from Cirrus to GitHub Actions (Hennadii Stepanov)
ea33914e00 ci: Move "s390x (big-endian): Linux..." from Cirrus to GitHub Actions (Hennadii Stepanov)
880be8af99 ci: Move "i686: Linux (Debian stable)" from Cirrus to GiHub Actions (Hennadii Stepanov)
e10878f58e ci, gha: Drop `driver-opts.network` input for `setup-buildx-action` (Hennadii Stepanov)
4ad4914bd1 ci, gha: Add `retry_builder` Docker image builder (Hennadii Stepanov)
6617a620d9 ci: Remove "x86_64: Linux (Debian stable)" task from Cirrus CI (Hennadii Stepanov)
03c9e6508c ci, gha: Add "x86_64: Linux (Debian stable)" GitHub Actions job (Hennadii Stepanov)
ad3e65d9fe ci: Remove GCC build files and sage to reduce size of Docker image (Tim Ruffing)
ef9fe959de ci: Drop no longer needed workaround (Hennadii Stepanov)
87d35f30c0 ci: Rename `cirrus.sh` to more general `ci.sh` (Hennadii Stepanov)
d6281dd008 ci: Remove Windows tasks from Cirrus CI (Hennadii Stepanov)
2b6f9cd546 ci, gha: Add Windows jobs based on Linux image (Hennadii Stepanov)
b0886fd35c ci, gha: Ensure only a single workflow processes `github.ref` at a time (Hennadii Stepanov)
d23da6d557 use secp256k1_scalar_verify checks (stratospher)
c7d0454932 add verification for scalars (stratospher)
ad152151b0 update max scalar in scalar_cmov_test and fix schnorrsig_verify exhaustive test (stratospher)
d78bec7001 ci: Remove Windows MSVC tasks from Cirrus CI (Hennadii Stepanov)
3545dc2b9b ci, gha: Run all MSVC tests on Windows natively (Hennadii Stepanov)
54058d16fe field: remove `secp256k1_fe_equal_var` (siv2r)
bb4efd6404 tests: remove unwanted `secp256k1_fe_normalize_weak` call (siv2r)
c2f6435802 ci: Add comment about switching macOS to M1 on GHA later (Tim Ruffing)
4a24fae0bc ci: Remove "arm64: macOS Ventura" task from Cirrus CI (Hennadii Stepanov)
8e54a346d2 ci, gha: Run "x86_64: macOS Ventura" job on GitHub Actions (Hennadii Stepanov)
747ada3587 test: Silent noisy clang warnings about Valgrind code on macOS x86_64 (Hennadii Stepanov)
d62db57427 ci: Use Homebrew's gcc in native macOS task (Hennadii Stepanov)
b7c685e74a Save _normalize_weak calls in group add methods (Peter Dettman)
c83afa66e0 Tighten group magnitude limits (Peter Dettman)
173e8d061a Implement current magnitude assumptions (Peter Dettman)
49afd2f5d8 Take use of _fe_verify_magnitude in field_impl.h (Sebastian Falbesoner)
4e9661fc42 Add _fe_verify_magnitude (no-op unless VERIFY is enabled) (Peter Dettman)
690b0fc05a add missing group element invariant checks (Sebastian Falbesoner)
9c91ea41b1 ci: Enable ellswift module where it's missing (Tim Ruffing)
db32a24761 ctimetests: Use new SECP256K1_CHECKMEM macros also for ellswift (Tim Ruffing)
8408dfdc4c Revert "ci: Run sage prover on CI" (Hennadii Stepanov)
c8d9914fb1 ci, gha: Run "SageMath prover" job on GitHub Actions (Hennadii Stepanov)
f1774e5ec4 ci, gha: Make MSVC job presentation more explicit (Hennadii Stepanov)
5ee039bb58 ci: Remove "Windows (VS 2022)" task from Cirrus CI (Hennadii Stepanov)
a2f7ccdecc ci: Run "Windows (VS 2022)" job on GitHub Actions (Hennadii Stepanov)
175db31149 ci: Drop no longer needed `PATH` variable update on Windows (Hennadii Stepanov)
116d2ab3df cmake: Set `ENVIRONMENT` property for examples on Windows (Hennadii Stepanov)
cef373997c cmake, refactor: Use helper function instead of interface library (Hennadii Stepanov)
a1bd4971d6 refactor: take use of `secp256k1_scalar_{zero,one}` constants (part 2) (Sebastian Falbesoner)
Pull request description:
[bitcoin-core/secp256k1#1391]: refactor: take use of `secp256k1_scalar_{zero,one}` constants (part 2)
[bitcoin-core/secp256k1#1290]: cmake: Set `ENVIRONMENT` property for examples on Windows
[bitcoin-core/secp256k1#1389]: ci: Run "Windows (VS 2022)" job on GitHub Actions
[bitcoin-core/secp256k1#1397]: ci: Remove "Windows (VS 2022)" task from Cirrus CI
[bitcoin-core/secp256k1#1399]: ci, gha: Run "SageMath prover" job on GitHub Actions
[bitcoin-core/secp256k1#1400]: ctimetests: Use new SECP256K1_CHECKMEM macros also for ellswift
[bitcoin-core/secp256k1#1348]: tighten group magnitude limits, save normalize_weak calls in group add methods (revival of #1032)
[bitcoin-core/secp256k1#1402]: ci: Use Homebrew'\''s gcc in native macOS task
[bitcoin-core/secp256k1#1274]: test: Silent noisy clang warnings about Valgrind code on macOS x86_64
[bitcoin-core/secp256k1#1394]: ci, gha: Run "x86_64: macOS Ventura" job on GitHub Actions
[bitcoin-core/secp256k1#1404]: ci: Remove "arm64: macOS Ventura" task from Cirrus CI
[bitcoin-core/secp256k1#1062]: Removes `_fe_equal_var`, and unwanted `_fe_normalize_weak` calls (in tests)
[bitcoin-core/secp256k1#1401]: ci, gha: Run all MSVC tests on Windows natively
[bitcoin-core/secp256k1#1373]: Add invariant checking for scalars
[bitcoin-core/secp256k1#1403]: ci, gha: Ensure only a single workflow processes `github.ref` at a time
[bitcoin-core/secp256k1#1398]: ci, gha: Add Windows jobs based on Linux image
[bitcoin-core/secp256k1#1405]: ci: Drop no longer needed workaround
[bitcoin-core/secp256k1#1396]: ci, gha: Add "x86_64: Linux (Debian stable)" GitHub Actions job
[bitcoin-core/secp256k1#1406]: ci, gha: Move more non-x86_64 tasks from Cirrus CI to GitHub Actions
[bitcoin-core/secp256k1#1410]: ci: Use concurrency for pull requests only
[bitcoin-core/secp256k1#1409]: ci: Move remained task from Cirrus to GitHub Actions
[bitcoin-core/secp256k1#1411]: ci: Make repetitive command the default one
[bitcoin-core/secp256k1#1412]: ci: Switch macOS from Ventura to Monterey and add Valgrind
[bitcoin-core/secp256k1#1414]: ci/gha: Add ARM64 QEMU jobs for clang and clang-snapshot
[bitcoin-core/secp256k1#1413]: ci: Add `release` job
[bitcoin-core/secp256k1#1415]: release: Prepare for 0.4.0
[bitcoin-core/secp256k1#1417]: release cleanup: bump version after 0.4.0
[bitcoin-core/secp256k1#1390]: tests: Replace counting_illegal_callbacks with CHECK_ILLEGAL_VOID
[bitcoin-core/secp256k1#1416]: doc: Align documented scripts with CI ones
[bitcoin-core/secp256k1#1422]: cmake: Install `libsecp256k1.pc` file
[bitcoin-core/secp256k1#1424]: ci: Bump major versions for docker actions
[bitcoin-core/secp256k1#1395]: tests: simplify `random_fe_non_zero` (remove loop limit and unneeded normalize)
This PR can be recreated with `./contrib/sync-upstream.sh -b master range ee7aaf213ea3eb42fc8960c7d178b5ffb286440f`.
Tip: Use `git show --remerge-diff` to show the changes manually added to the merge commit.' --web
- Replace fe_equal_var with fe_equal
- Use CHECK_ILLEGAL instead of CHECK/ecount
- Turn on secp256k1-zkp specific modules in CI
ACKs for top commit:
real-or-random:
ACK b41caaafd2
Tree-SHA512: e8994fa2590d6e277d60a130d3f11b0256dc7fbe67e8a2b85463d9849d3f9fbfccf366b17b3904f1974f8b7b27a24128d2a04a3337c1b8409d000d136714bf90
c45b7c4fbb refactor: introduce testutil.h (deduplicate `random_fe_`, `ge_equals_` helpers) (Sebastian Falbesoner)
dc5514144f tests: simplify `random_fe_non_zero` (remove loop limit and unneeded normalize) (Sebastian Falbesoner)
Pull request description:
`random_fe_non_zero` contains a loop iteration limit that ensures that we abort if `random_fe` ever yielded zero more than ten times in a row. This construct was first introduced in PR #19 (commit 09ca4f32) for random non-square field elements and was later refactored into the non-zero helper in PR #25 (commit 6d6102fe). The copy-over to the exhaustive tests happened recently in PR #1118 (commit 0f864207).
This case seems to be practically irrelevant and I'd argue for keeping things simple and removing it (which was already suggested in https://github.com/bitcoin-core/secp256k1/pull/1118#discussion_r1067259954); if there's really a worry that the test's random generator is heavily biased towards certain values or value ranges then there should consequently be checks at other places too (e.g. directly in `random_fe` for 256-bit values that repeatedly overflow, i.e. >= p).
Also, the _fe_normalize call is not needed and can be removed, as the result of `random_fe` is already normalized.
ACKs for top commit:
real-or-random:
utACK c45b7c4fbb
siv2r:
ACK `c45b7c4` (reviewed the changes and tests for both the commits passed locally).
Tree-SHA512: 4ffa66dd0b8392d7d0083a71e7b0682ad18f9261fd4ce8548c3059b497d3462db97e16114fded9787661ca447a877a27f5b996bd7d47e6f91c4454079d28a8ac
9b118bc7fb release cleanup: bump version after 0.4.0 (Jonas Nick)
Pull request description:
based on #1415
ACKs for top commit:
sipa:
ACK 9b118bc7fb
hebasto:
ACK 9b118bc7fb
real-or-random:
ACK 9b118bc7fb
Tree-SHA512: 76df87c41bdc3379df4e88619645f5110010d7713ebe20bad3e7c99472bd62b90f4bd3c6b558ad5a23119acc4734e39383d96a9800e4a43dfadc086ef66fd0ab
This commit also explicitly initializes shortpubkey. For some reason, removing
surrounding, unrelated lines results in gcc warnings when configured with
--enable-ctime-tests=no --with-valgrind=no.
8659a01714 ci: Add `release` job (Hennadii Stepanov)
f9b38894ba ci: Update `actions/checkout` version (Hennadii Stepanov)
Pull request description:
This PR introduces a new "Release" job that conducts sanity checks as defined in [`doc/release-process.md`](https://github.com/bitcoin-core/secp256k1/blob/master/doc/release-process.md#sanity-checks).
ACKs for top commit:
sipa:
ACK 8659a01714
real-or-random:
ACK 8659a01714
Tree-SHA512: 84e03fa07f8c41aec0f6d1ccb4ac3643e85d370ef7e388b335365deadb555f2d9ef7e5d80e1255a18e790a774e04ca66f265b9441402b183d4c535a97688f20f
2635068abf ci/gha: Let MSan continue checking after errors in all jobs (Tim Ruffing)
e78c7b68eb ci/Dockerfile: Reduce size of Docker image further (Tim Ruffing)
2f0d3bbffb ci/Dockerfile: Warn if `ulimit -n` is too high when running Docker (Tim Ruffing)
4b8a647ad3 ci/gha: Add ARM64 QEMU jobs for clang and clang-snapshot (Tim Ruffing)
6ebe7d2bb3 ci/Dockerfile: Always use versioned clang packages (Tim Ruffing)
Pull request description:
Solves one item in https://github.com/bitcoin-core/secp256k1/issues/1392.
This PR also has a few tweaks to the Dockerfile, see individual commits.
---
I'll follow up soon with a PR for ARM64/gcc. This will rely on Cirrus CI.
ACKs for top commit:
hebasto:
ACK 2635068abf.
Tree-SHA512: d290bdd8e8e2a2a2b6ccb1b25ecdc9662c51dab745068a98044b9abed75232d13cb9d2ddc2c63c908dcff6a12317f0c7a35db3288c57bc3b814793f7fce059fd
This commit switches to a new strategy to make sure we're installing the
most recent LLVM packages. Before this commit, we used the unversioned
LLVM packages (e.g., `clang` instead of `clang-18`), which are supposed
to provide the latest snapshot, but this is broken for arm64 [1],
which we want to add in a later PR.
Anyway, the new approach is cleaner because it does not require us to
fiddle with the installed `clang` package by removing a symlink.
[1] https://github.com/llvm/llvm-project/issues/64790
Co-authored-by: Hennadii Stepanov <32963518+hebasto@users.noreply.github.com>
cce0456304 ci: Make repetitive command the default one (Hennadii Stepanov)
317a4c48f0 ci: Move `git config ...` to `run-in-docker-action` (Hennadii Stepanov)
Pull request description:
This PR addresses the https://github.com/bitcoin-core/secp256k1/pull/1409#discussion_r1301767281:
> couldn't we add this to `run-in-docker-action` to avoid duplication?
ACKs for top commit:
real-or-random:
ACK cce0456304
Tree-SHA512: 793cec3d99853a23e06680fe35a7cae2dc8771f22e3940c4a4f36357273164f2d92e196768118d146e956ffca9ef59d4e5f86e1cba5576ebfdc59343581c9924
676ed8f9cf ci: Move "C++ (public headers)" from Cirrus to GitHub Actions (Hennadii Stepanov)
61fc3a2dc8 ci: Move "C++ -fpermissive..." from Cirrus to GitHub Actions (Hennadii Stepanov)
d51fb0a533 ci: Move "MSan" from Cirrus to GitHub Actions (Hennadii Stepanov)
c22ac27529 ci: Move sanitizers task from Cirrus to GitHub Actions (Hennadii Stepanov)
Pull request description:
This PR concludes the migration from Cirrus CI to GitHub Actions.
ACKs for top commit:
real-or-random:
ACK 676ed8f9cf
Tree-SHA512: d8ea91a20297ff4c2c11a02c0a52f19413fde442c71e2e8b660737c09d62e55e4ae3f9bdbdeb0d967f6720a3dffa1566b7f94e0e32bcd490ac052819d5427c84
ee1be62d84 ci: Use concurrency for pull requests only (Hennadii Stepanov)
Pull request description:
This PR is an amendment for https://github.com/bitcoin-core/secp256k1/pull/1403.
It avoids skipping builds when some pushes were done consequentially.
From GitHub Actions [docs](https://docs.github.com/en/actions/using-jobs/using-concurrency):
> When a concurrent ... workflow is queued, if another ... workflow using the same concurrency group in the repository is in progress, the queued ... workflow will be pending. **Any previously pending ... workflow in the concurrency group will be canceled.**
No behavior change for pull requests.
Same as https://github.com/bitcoin/bitcoin/pull/28322.
ACKs for top commit:
real-or-random:
ACK ee1be62d84
Tree-SHA512: ce26378c3224a7647eb3b351d19e9308650ad49b933a68d37a0eca8516767a63f55580a33b02864caa539392c9aab0b4b54ecbace85bea6082bf533539a37c9c
Russell O'Connor
Tim Ruffing
roconnor-blockstream
Jonas Nick
Jon Griffiths
Hennadii Stepanov