These were generated by testing more than 10^12 random test vectors
for coverage on instrumented (comparison operator outcomes) 32-bit
and 64-bit code, plus additional edge condition requirements (e.g.
inputs of 0, 1, -1) and then solving a minimum set cover problem.
The required responses were generated with Sage.
This significantly improves the lcov branch coverage report and
makes the tests much more sensitive to mutation testing of the
scalar code.
The challenges and responses are in the form of pairs of scalars:
C1 * C2 == R1
(C1 * C2) * (1 / C2) == C1
C2 * (1 / C2) == 1
C1 * C1 == R2
C1^2 == R2
Makes secp256k1_ec_pubkey_serialize set the length to zero on failure,
also makes secp256k1_ec_pubkey_create set the pubkey to zeros when
the key argument is NULL.
Also adds many additional ARGCHECK tests.
These functions are intended for compatibility with legacy software,
and are not normally needed in new secp256k1 applications.
They also do not obeying any particular standard (and likely cannot
without without undermining their compatibility), and so are a
better fit for contrib.
This avoids data=NULL and data = zeros to producing the same nonce.
Previously the code tried to avoid the case where some data inputs
aliased algo16 inputs by always padding out the data.
But because algo16 and data are different lengths they cannot
emulate each other, and the padding would match a data value of
all zeros.
ECDSA signature verification now requires normalized signatures (with S in the
lower half of the range). In case the input cannot be guaranteed to provide this,
a new function secp256k1_ecdsa_signature_normalize is provided to preprocess it.
There are now 2 encoding formats supported: 64-byte "compact" and DER.
The latter is strict: the data has to be exact DER, though the values
inside don't need to be valid.
This also makes use of optional valgrind instrumentation if -DVALGRIND
is set.
This also moves secp256k1.c above secp256k1.h in tests.c or otherwise
we get non-null macros on the public functions which may defeat some
of the VERIFY checks.
This makes it more clear that a null check is intended. Avoiding the
use of a pointer as a test condition alse increases the type-safety
of the comparisons.
(This is also MISRA C 2012 rules 14.4 and 11.9)
486b9bb Use a flags bitfield for compressed option to secp256k1_ec_pubkey_serialize and secp256k1_ec_privkey_export (Luke Dashjr)
05732c5 Callback data: Accept pointers to either const or non-const data (Luke Dashjr)
1973c73 Bugfix: Reinitialise buffer lengths that have been used as outputs (Luke Dashjr)
788038d Use size_t for lengths (at least in external API) (Luke Dashjr)
c9d7c2a secp256k1_context_set_{error,illegal}_callback: Restore default handler by passing NULL as function argument (Luke Dashjr)
9aac008 secp256k1_context_destroy: Allow NULL argument as a no-op (Luke Dashjr)
64b730b secp256k1_context_create: Use unsigned type for flags bitfield (Luke Dashjr)
