18 Commits

Author	SHA1	Message	Date
Kgothatso Ngako	3c962b00cc	frost_enrollment: fix the example's stale n and failure-path hygiene ... The last of the review findings, plus the comment and structure fixes it listed. The example's repair run used the pre-enrollment participant count. Two blocks earlier the example teaches that every participant must update its record of n from 3 to 4 after an enrollment, and the signing session duly uses N_PARTICIPANTS_AFTER. Then enroll() -- which hard-coded N_PARTICIPANTS -- ran the repair at n = 3. It worked only because the Lagrange math never involves n and every party in this single-process demo passed the same stale value. In a real post-enrollment repair it would not. n is bound into the parameters hash, so helpers feeding their updated n = 4 into shares_gen while the requester feeds n = 3 abort round 1.2 with no visible cause. enroll() now takes n_participants as a parameter, the repair passes N_PARTICIPANTS_AFTER, and both the function's contract comment and the repair call site say why. The repaired share is still byte-identical to the original, which is the point: n changes the hash, not the arithmetic. The example leaked secrets on its failure paths. enroll() erased the delta and sigma buffers only on success; four early returns left them live. sign_and_verify() returned from three places without erasing already-generated secnonces. Both now route every exit through a cleanup block. This example is otherwise more careful about erasure than its siblings, so the asymmetry was exactly what a reader copying it would carry into production -- on the fault paths where hygiene matters most. The double-wipe of session_secrand is gone with it: shares_gen and nonce_gen both wipe the seed on every path, and doing it again read as uncertainty about the contract. The comment now states the contract instead. The fill_random failure path does erase, since nothing else has touched the buffer there. The example's mismatch message asserted a cause it cannot know. It printed "Helper %u disagrees about the enrollment parameters" for what may equally be a corrupted share, per the previous commit's finding. It now says the helper "contributed a share this helper cannot use", with a comment noting that share_agg does not distinguish the two causes so neither can the message. Comment and structure fixes, all noted in the review: - The vector generator claimed case 4 was "the only case whose DERIVED public share has odd Y". It is not -- cases 1, 2 and 4 are odd and case 3 is even. The comment existed to justify a coverage choice and misinformed; both parity comments now describe the set accurately and say they document it rather than constrain it. Regenerating vectors.h still reproduces it byte for byte. - The secp256k1_frost_sort_ids declaration in frost/session.h no longer duplicates the definition's doc comment, which was two copies to keep in sync. It says what the function is for and points at the definition for the contract. - The t >= 2 rationale was stated in full in three places. The impl now states the conclusion and names frost_enrollment.md as the single place to edit if the policy moves. - The ctime_tests comments read ambiguously ("the parameters hash is public, the delta values are not" against a header calling deltas secret), and computing direct_hash without asserting anything invited a "forgotten assertion" reading. Both are now explicit. - The example moves next to frost_example in Makefile.am rather than after iceberg, matching the FROST-stack grouping used in configure.ac, ci.sh, ci.yml and README. - frost_enrollment.md now distinguishes what is unstable (the C API) from what is frozen (the wire-visible encodings), which the two statements together previously left easy to conflate. Not fixed, deliberately, and now recorded where the tree can see it: the plan called for a CHANGELOG.md entry. That file states in its first two lines that it is upstream libsecp256k1's changelog and not this fork's, and none of frost, chilldkg, iceberg or prefractal has an entry. Adding the first one is a decision about all five modules, not this one. The README link is the fork's actual convention for announcing a module and is in place. Verification: autotools builds warning-free and `make check` is 12/12 including the example; ctime_tests is clean under valgrind; `make dist` carries all nine frost_enrollment files; CMake with examples builds warning-free and ctest is 542/542; the example source is clean under gcc -std=c89 -pedantic -Wall -Wextra; regenerating vectors.h reproduces it byte for byte. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 10:27:17 +02:00
Kgothatso Ngako	303a7caeae	frost_enrollment: add the test suite and the regression vectors ... Fourth of six commits. Twelve tests replacing the Phase 2 smoke test, plus a vector generator and the frozen vectors it produces. The regression vectors are the one part of this worth being precise about, because they are easy to over-claim. FROST enrollment has no BIP and no published vectors, and the reference proof of concept draws its randomness from secrets.randbits, which is not seedable -- so there is nothing to cross-validate against. tools/test_vectors_frost_enrollment_generate.py therefore re-implements the math independently in stdlib-only Python, including the group arithmetic written from the secp256k1 parameters rather than borrowed, and freezes the output. What that buys: the two tag strings, the params hash serialization, the share-splitting derivation and the identifier conventions are now pinned, and changing any of them is a loud vector-breaking change. What it does not buy is evidence of protocol correctness. The generator header comment and the generated file both say so, as does frost_enrollment.md. The vectors passed on the first run against the C code, which is worth recording: two independent implementations agree byte for byte on the params hash, every delta, every sigma, the derived public share and the final share, across four cases (2-of-3 minimal, 2-of-3 oversized at u = 3 > t = 2, a 3-of-5 repair with a deliberately UNSORTED helper set, and a 4-of-6 enrollment), covering both threshold-key Y parities. The algebraic invariants are what actually carry correctness: - Reconstruction (PoC test_generate_frost_share): after a 2-of-3 group enrolls id 3, every pair {i, 3} reconstructs the original threshold secret, and so does the untouched pair {0, 1}. - Signing (PoC test_sign): a real BIP340 signature from {2, 3} verifying against the unchanged threshold public key, with every partial signature individually verified, plus the n -> n+1 bookkeeping -- secp256k1_frost_threshold_info_validate must accept the public share table extended with pubshare_derive's output at n+1. - Repair: byte-for-byte equality with the lost share, and the repaired participant keeps its old public share. - Oversized helper set: u = 3 and u = 2 over the same key material produce the same share and the same derived public share. - Randomized: COUNT iterations over 2 <= t <= u <= n <= 7, half enrollment and half repair, with EVERY HELPER GIVEN THE IDENTIFIER SET IN ITS OWN SHUFFLED ORDER. The params hash must come out identical while the delta buffers stay aligned per helper -- which is the whole point of canonicalizing ids inside the hash and nowhere else. Each iteration then checks every t-subset containing the new participant. The negative tests are organized around what each gate is actually for: - Fault injection flips a bit in one sigma. secshare_gen fails and wipes its output; the same call with expected_pubshare = NULL SUCCEEDS and returns a wrong share. That second assertion is the point -- it is the evidence that the parameter is load-bearing rather than decorative. Tampered public shares are caught earlier, by secp256k1_frost_threshold_info_validate, so the test exercises the recommended flow and not just the module. - Parameter mismatch, four angles: (a) one helper runs round 1.1 for a different target and every other helper's share_agg aborts naming it by identifier; (b) a caller that IGNORES that abort and finishes round 1.2 anyway still cannot produce a usable share, because the public-share check catches the inconsistent sum -- defence in depth, not a test of the test's own control flow; (c) the helpers agree with each other on new_id = 3 while the target expects 4, which round 1.2 cannot see and round 2's own recomputation does; (d) two groups with identical (t, n, ids, new_id) get different hashes, and a hash from one fails share_agg in the other. - Own-slot semantics: filling the caller's own slot of received_params_hashes32 with garbage changes nothing, because it is never read -- but the same garbage in a slot that IS read still aborts. That pair is what makes "recomputation, not string comparison" testable rather than merely asserted. - Invalid parameters, including both deliberate divergences: t = 1 refused, enrollment refused at n = 128 while repair at n = 128 is accepted, n_ids > 128 returning 0 with the output zeroed in a production build. Three bugs found while writing these, all in the tests, all worth naming: - pubshare_derive takes public shares ALIGNED WITH ids, and the test helper was handing it the participant-indexed table. Those coincide exactly when the helper set is 0..u-1, which every test until the repair case used, so the first non-contiguous helper set {0, 2} was what exposed it. There is now one helper that does the gather, with a comment saying which confusion it exists to prevent. - The fault-injection test compared against r.new_secshare without ever running round 2, and the mismatch test compared against r.params_hashes[0] one line before round 1.1 filled it. Both were reads of uninitialized memory that happened to pass; valgrind found both. The randomized test loops COUNT times so -i scales it, following the iceberg module (tests_impl.h:1322) rather than prefractal's run-once convention -- a fuzzing loop that ignores the iteration count is not much of one. Verification: all twelve tests pass at the default iteration count, at -i=200 and at -i=2000; ./tests, ./noverify_tests and ./exhaustive_tests exit 0 with all five FROST-stack modules enabled; the module runs clean under valgrind (0 errors from 0 contexts); ctime_tests is clean under valgrind; regenerating vectors.h reproduces it byte for byte. One note for anyone running these locally: ctime_tests must not be run against a CPPFLAGS='-DVERIFY' build. secp256k1_scalar_verify branches on scalar values, which ctime_tests deliberately marks secret, so every scalar operation in the library reports a finding -- 75997 of them, none in this module. The CI matrix already pairs -DVERIFY with CTIMETESTS: 'no' (.github/workflows/ci.yml:119, :596) for this reason. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 04:24:21 +02:00
Kgothatso Ngako	7afee05de8	tools: add the iceberg test vector generator ... src/modules/iceberg/vectors.h opens with regeneration instructions that name ./tools/test_vectors_iceberg_generate.py, and that script was never committed. The same header calls the file "the one thing in this repository that cannot be rebuilt from what the repository contains", which the missing generator made true twice over: neither the reference nor the tool that reads it was reachable from a clone. Recovered from the tree the Iceberg C is vendored in, at sources/secp256k1-kmp/native/secp256k1 of the benchmark repository (bitcoin-core/secp256k1 branch iceberg-module, commit 96201552, per that repository's PINS.txt). Confirmed to be the generator that produced the checked-in vectors before committing it: - its HEADER template reproduces the header of vectors.h exactly, including the ICEBERG_VECTOR_MAX_PARTICIPANTS 9 and ICEBERG_VECTOR_MAX_SEEDS 126 it computes from the configuration list; - its seed rule, sha256("iceberg test vectors|<label>|<rank>"), reproduces the checked-in 2of3 seeds byte for byte; - the whole of that tree's src/modules/iceberg/ matches this one byte for byte except tests_impl.h, which differs only because the tests here are ported to the unit_test.h test-module framework. The script cannot be re-run from a clone alone, by design: it takes the nkohen/Iceberg Python reference as its argument and that reference is deliberately not vendored, since it is not ours and pinning a copy would hide it drifting. Its docstring gives the clone and the pinned commit (7b55ef6d), which is now the whole of what regenerating requires. Also restore the executable bit on the frost and chilldkg generators. Both carry a usage line telling the reader to run them directly, and every other generator in tools/ is 0755. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-01 23:37:52 +02:00
Kgothatso Ngako	d1c817b528	chilldkg: Phase 6 - test vectors, FROST integration, docs, example ... Final phase of the ChillDKG module: upstream test vectors, a DKG->FROST integration test, boundary tests, full module documentation and a runnable example. Test vectors: - tools/test_vectors_chilldkg_generate.py converts all 10 upstream bip-frost-dkg JSON vector files into src/modules/chilldkg/vectors.h (modeled on tools/test_vectors_frost_generate.py; takes the vectors directory as an argument; upstream pinned to commit a91896883f85b159415ecf298d5e844879af112d, recorded in the generated header with the exact regeneration invocation; regeneration is reproducible byte-for-byte). - tests_impl.h vector runners execute 191 of 241 upstream cases through the public API: hostpubkey_gen, params_hash, participant_step1/step2/finalize/investigate, coordinator_step1/finalize/investigate, recover. Happy paths are byte-exact (pmsg1/cmsg1/pmsg2/cmsg2/dkg_output/recovery/cinv); error cases assert both the fault enum and fault_index against expectedError.participantId. The 50 skipped cases are wrong-length/wrong-count inputs not expressible with the fixed-size C API; each skip is documented in vectors.h. Boundary/robustness tests: t=1, t=n, n=2, a full n=128/t=2 session end-to-end with per-participant secshare*G == pubshare checks and a recovery roundtrip, and a state1 memcpy roundtrip (step2 from a copied state object). DKG->FROST integration test (guarded by ENABLE_MODULE_FROST): a full ChillDKG session (n=3, t=2) feeds (secshare, thresh_pk, pubshares) directly into the frost module. ChillDKG's thresh_pk is already TapTweak'ed, so frost_tweak_cache_init is called with no further tweaks (frost's tweaked x-only key asserted equal to the x-only part of the ChillDKG thresh_pk); signers 0 and 2 run nonce_gen, nonce_agg, session_init with the shared x = id+1 convention, frost_sign, partial_sig_verify and partial_sig_agg; the aggregate signature verifies as a plain BIP-340 signature against the threshold key. Example: examples/chilldkg.c runs a full 2-of-3 DKG session (host key generation, params hash, participant/coordinator steps, finalize, and a recovery roundtrip via participant_recover) with fixed-size buffers and secret erasure. Wired into Makefile.am and examples/CMakeLists.txt exactly like frost_example (runs as a TEST); chilldkg_example binary added to .gitignore. Docs: src/modules/chilldkg/chilldkg.md now documents the protocol summary, message-flow table with exact byte sizes, blame taxonomy, recovery workflow, security notes (host key reuse/retention, fresh randomness per session, state secrecy, recovery-data sensitivity) and the pinned reference commit; src/modules/frost/frost.md points at the new module as the intended DKG. Bug fix found by the vector runner (recover tcId 9): the internal recover() passed a possibly-NULL fault_index from coordinator_recover to certeq_verify, which dereferences it on failure; now uses a local. Verified: make check 10/10 (3 test suites + 7 examples incl. chilldkg_example, exit 0 when run); CMake ctest 428/428 with chilldkg + frost, and a no-frost build confirms the ENABLE_MODULE_FROST guard; make distdir includes vectors.h, the example and the generator. The module is feature-complete against bip-frost-dkg v0.3.0-dev at a91896883f85b159415ecf298d5e844879af112d. The BIP is still a draft; tagged hashes and wire formats may change upstream.	2026-08-31 06:52:58 +02:00
Kgothatso Ngako	7e73badcbd	frost: fix constant-time violations and C90 conformance ... The module's BIP 445 logic itself is unchanged and was independently validated against the pinned spec commit bb5396f (BIP v0.10.0), both via the checked-in test vectors and via differential testing against the Python reference over 360 randomised configurations (n up to 128, shuffled non-contiguous signer ids, mixed xonly/plain tweak chains, variable-length messages, pubshares present and absent). Every change below is structural: the differential harness produces byte-identical pubnonces, aggnonces, partial signatures and final signatures before and after. Two classes of problem prevented the module from passing CI. 1. Constant-time violations (ctime_tests) ----------------------------------------- The CI matrix enables FROST in rows that also run "valgrind --error-exitcode=42 ./ctime_tests" -- WITH_VALGRIND and CTIMETESTS both default to 'yes'. With the module enabled that job reported 639 "conditional jump depends on uninitialised value" errors, all originating from two sites: - secp256k1_frost_derive_coefficient returned !overflow && !secp256k1_scalar_is_zero(out) where the short-circuiting && branches on `overflow`, which is derived from the threshold secret key. The caller declassifies the return value, but the branch has already happened inside the callee. Replaced with a bitwise &, matching the existing idiom in secp256k1_scalar_set_b32_seckey (src/scalar_impl.h). - secp256k1_frost_sign_internal performs the self-verification recommended by BIP 445, which runs the *variable-time* secp256k1_ecmult over the partial signature s. nonce_pts and pk were already declassified ahead of that call; s was not. Since s is the public output of the function, declassifying it before the self-verification is both correct and sufficient. secp256k1_frost_deterministic_sign carried three more instances of the same class, invisible until now because ctime_tests did not exercise that path at all: - the `if (!valid)` check on secp256k1_scalar_set_b32_seckey lacked the declassify that the identical checks in secp256k1_frost_nonce_gen and secp256k1_frost_sign_internal already have; - secp256k1_frost_det_nonce_function used the same short-circuiting &&, here over the secret nonces; - the branch on that function's result was not declassified. The && in det_nonce_function is rewritten via two int locals rather than a bare bitwise &: clang's -Wbitwise-instead-of-logical fires when both operands are `!f(...)` expressions, which would break the -Werror clang builds. ctime_tests now also covers secp256k1_frost_deterministic_sign, so that path stays checked from here on. None of these leak anything of value in practice -- they reveal only negligible-probability events (a hash overflowing the curve order, a zero nonce) or whether a secret share is a valid secret key -- but they violate the project's declassification discipline and fail the ctime test. 2. C90 conformance (-Werror -pedantic-errors) --------------------------------------------- The project targets C90 (CMAKE_C_STANDARD 90, -std=c89 -pedantic) and CI passes WERROR_CFLAGS='-Werror -pedantic-errors'. Compiling src/tests.c with those flags produced 62 errors in three groups: - 40x "ISO C forbids empty initializer braces before C2X" in the generated vectors.h; empty {} initializers are C23-only. Fixed in tools/test_vectors_frost_generate.py so it survives regeneration: hexstr_to_intarray now emits "0" for an empty byte string (all six of its call sites wrap the result in braces), and init_group's `counted` helper emits "{ 0 }" for an empty group. In every affected slot the paired count/length field is 0, so the padding element is never read. - 1x "comma at end of enumerator list" (C99+), also in the generator. - 21x "initializer element is not computable at load time" across 11 lines of tests_impl.h. C90 requires constant expressions in initializers for automatic aggregates, so const secp256k1_frost_pubnonce *ptrs[2] = { &a, &b }; is invalid. Rewritten as a declaration plus assignments, the style the musig tests already use, which is why the pre-existing tree was green. vectors.h is regenerated from the spec's JSON vectors. Its hex payload is byte-identical (verified by hashing every 0xNN token) and the file still reproduces exactly from tools/test_vectors_frost_generate.py. Verification ------------ - gcc and clang, -std=c89 -pedantic-errors -Werror, with and without -DVERIFY: clean (was 62 errors) - ctime_tests under MemorySanitizer: 0 reports (was 639); exits 0 with halt_on_error=1 - tests, noverify_tests and frost_example: pass - vectors.h regenerates identically from the pinned spec vectors - 240 signing + 120 deterministic-signing differential cases against the BIP 445 Python reference: byte-identical to the pre-fix build Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-31 00:57:43 +02:00
Kgothatso Ngako	2d97cc2242	Frost Module logic.	2026-08-31 00:05:16 +02:00
Sebastian Falbesoner	7ebaa134a7	check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) ... The CMake library output location was changed from "src/" to "lib/" in PR #1553, supporting the old location shouldn't be necessary anymore.	2025-09-07 23:54:06 +02:00
Jonas Nick	4187a46649	Merge bitcoin-core/secp256k1#1492: tests: Add Wycheproof ECDH vectors ... e266ba11ae tests: Add Wycheproof ECDH vectors (RandomLattice) Pull request description: ACKs for top commit: jonasnick: ACK e266ba11ae Tree-SHA512: a5cc59886595b134dadcc50e6cd6f03ce036c2857cdd848f138f0c49d4bd742ae5eb5ebca7840ec8666b5d43fa9c4f67cde4d0fb2245b1cf56b079ca3f7c7f8e	2025-05-12 19:50:56 +00:00
RandomLattice	e266ba11ae	tests: Add Wycheproof ECDH vectors ... Adds a test for the ECDH module using the Wycheproof vectors. We use a python script to convert the JSON-formatted vectors into C code, in the same spirit as https://github.com/bitcoin-core/secp256k1/pull/1245 Co-authored-by: Sean Andersen <6730974+andozw@users.noreply.github.com>	2025-05-12 11:27:45 -04:00
Hennadii Stepanov	41d32ab2de	test: Add tools/symbol-check.py ... Co-authored-by: Tim Ruffing <crypto@timruffing.de>	2025-03-11 21:58:55 +00:00
Jonas Nick	a306bb7e90	tools: fix check-abi.sh after cmake out locations were changed	2024-11-04 15:59:41 +00:00
Jonas Nick	f411841a46	Add module "musig" that implements MuSig2 multi-signatures (BIP 327)	2024-10-07 14:03:42 +00:00
Jonas Nick	dd695563e6	check-abi: explicitly provide public headers ... Without this commit, the check-abi shell script outputs false positives because it consider some headers public that are actually not public.	2024-05-06 16:28:01 +00:00
Tim Ruffing	b37fdb28ce	check-abi: Minor UI improvements	2024-01-09 01:05:09 +01:00
Tim Ruffing	ad5f589a94	check-abi: Default to HEAD for new version	2024-01-09 01:00:02 +01:00
Hennadii Stepanov	e7f830e32c	Add tools/check-abi.sh ... Co-authored-by: Tim Ruffing <crypto@timruffing.de>	2023-12-20 17:37:39 +00:00
RandomLattice	35ada3b954	tests: lint wycheproof's python script ... This PR lints tests_wycheproof_generate.py according to pylint. This is a follow-up to PR #1245. Co-authored-by: Sean Andersen <6730974+andozw@users.noreply.github.com>	2023-04-14 18:59:35 +02:00
RandomLattice	e5de454609	tests: Add Wycheproof ECDSA vectors ... Adds a test using the Wycheproof vectors as outlined in #1106. The vectors are taken from the Wycheproof repo. We use a python script to convert the JSON-formatted vectors into C code. Co-authored-by: Sean Andersen <6730974+andozw@users.noreply.github.com>	2023-04-09 06:17:16 +02:00