Kgothatso Ngako 7afaab53dc frost: close remaining gaps against the BIP 445 reference ...

Four small divergences from the reference implementation and its API
contract, none of which changes any signature: the differential harness
(240 signing + 120 deterministic-signing cases against the Python
reference) produces byte-identical output before and after.

Length prefixes that do not fit
-------------------------------

secp256k1_frost_sha256_write_prefixed asserted, via VERIFY_CHECK, that
the length fits into its prefix. VERIFY_CHECK compiles away in release
builds, so a length that does not fit was silently truncated modulo
2^(8*prefix_size) instead of being rejected, yielding a nonce that does
not follow the spec. The reference raises OverflowError instead.

Only the 4-byte extra_in prefix of nonce_hash is affected, and only where
size_t is wider than 32 bits, so this needs an extra_in of 4 GiB to
trigger. It is nevertheless a silent deviation, so write_prefixed now
returns 0 without writing anything, and the failure is propagated:
secp256k1_frost_nonce_function and secp256k1_frost_det_nonce_function
return 0, and secp256k1_frost_nonce_gen returns 0 after wiping
session_secrand32 and the nonces. Checking the shifted-out bits (which
the loop already computes) rather than comparing extra_in_len against a
32-bit bound avoids a comparison that is always true on 32-bit platforms.
The bound is now documented on the extra_in_len parameter.

Identifiers equal to UINT32_MAX
-------------------------------

BIP 445 derive_interpolating_value accepts every identifier in
0 <= id < 2^32, but secp256k1_frost_ids_are_valid rejected UINT32_MAX
because the mapping to the polynomial x-coordinate, id + 1, overflows in
uint32_t arithmetic. The +1 is now added in scalar arithmetic, where it
cannot overflow, and the identifier restriction is gone. The denominator
never needed the +1 at all, since

    x_j - x_i = (id_j + 1) - (my_id + 1) = id_j - my_id

so it is computed directly from the identifiers.

This was unreachable through the public API -- validate_session_params
already bounds identifiers by n_participants, which is at most
SECP256K1_FROST_MAX_PARTICIPANTS = 128 -- but it made an internal helper
diverge from the algorithm it implements. frost_large_id_test covers it
by reconstructing the constant term of a random degree-2 polynomial from
shares held by identifiers 0, UINT32_MAX - 1 and UINT32_MAX.

Zero-length messages
--------------------

secp256k1_frost_session_init and secp256k1_frost_deterministic_sign
required a non-NULL msg, so an empty message -- which the reference
represents as the byte string b"" -- could only be passed as a pointer
that is never dereferenced. Both now accept NULL when msglen is 0,
matching secp256k1_schnorrsig_sign_custom and the msg parameter of
secp256k1_frost_nonce_gen. secp256k1_sha256_write guards both of its
memcpy calls on a non-zero length, so it is never reached with a NULL
pointer.

NonceGen keeps its distinction between a NULL msg and a zero-length msg:
there the BIP really does distinguish msg = None (hashed as the single
byte 0x00) from msg = b"" (hashed as 0x01 followed by an eight-byte zero
length), and the API expresses that as NULL versus non-NULL.

frost_empty_msg_test runs a signing round over a zero-length message
passed both ways and checks that the two session objects are identical.
The two API tests that relied on a NULL msg always being rejected now
pass an explicit non-zero msglen; previously they passed a random msglen
that could be 0.

Header documentation
--------------------

The parameter tables of eleven doc comments had names that did not line
up with their block's continuation column. All parameter tables are now
aligned consistently, with wrapped text two columns past the colon.

Verification
------------

  - gcc and clang, -std=c89 -pedantic-errors -Werror, with and without
    -DVERIFY: clean
  - tests (multiple seeds), noverify_tests and frost_example: pass
  - ctime_tests under MemorySanitizer: exits 0 with halt_on_error=1
  - vectors.h still reproduces exactly from the spec's JSON vectors
  - 240 signing + 120 deterministic-signing differential cases against
    the BIP 445 Python reference: byte-identical to the previous commit

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-31 01:19:28 +02:00

..

secp256k1_bppp.h

Merge commits '56582094 427bc3cd 0cf2fb91 9c8c4f44 70be3cad f16a709f 464a9115 1d8f3675 afd8b23b 2bca0a5c 2d51a454 4e682626 a0f4644f 145078c4 7b7503da ec98fced 346a053d ' into temp-merge-1269

2023-07-24 13:46:43 +00:00

secp256k1_ecdh.h

include: in doc, remove article in front of "pointer"

2024-01-05 13:06:50 +00:00

secp256k1_ecdsa_adaptor.h

include: make docs more consistent

2024-01-23 16:04:45 +01:00

secp256k1_ecdsa_s2c.h

Port bitcoin-core/secp256k1#1628 to zkp public API

2026-02-16 16:12:41 +02:00

secp256k1_ellswift.h

doc: mention ctx requirement for _ellswift_create (not secp256k1_context_static)

2025-09-05 19:11:29 +02:00

secp256k1_extrakeys.h

extrakeys: Migrate to bitcoin-core/secp256k1#1518 secp256k1_ec_pubkey_sort

2026-02-05 19:02:49 +02:00

secp256k1_frost.h

frost: close remaining gaps against the BIP 445 reference

2026-08-31 01:19:28 +02:00

secp256k1_generator.h

Port bitcoin-core/secp256k1#1628 to zkp public API

2026-02-16 16:12:41 +02:00

secp256k1_musig.h

Merge commits 'a88aa935 01b58933 18f9b967 e59158b6 1fae76f5 f0868a9b 68b55209 9b7c59cb 1464f15c 9a8db52f 7d48f5ed a38d879a ' into temp-merge-1628

2026-02-16 16:04:51 +02:00

secp256k1_preallocated.h

include: in doc, remove article in front of "pointer"

2024-01-05 13:06:50 +00:00

secp256k1_rangeproof.h

rangeproof: warn that nonce must not be reused across differing arguments

2026-08-13 17:52:40 +03:00

secp256k1_recovery.h

doc: correct API docs for ECDSA signing out-params (s/array/signature object/)

2026-04-29 17:56:54 +02:00

secp256k1_schnorrsig_halfagg.h

New Experimental Module: Incremental Half-Aggregation for Schnorr Signatures

2024-02-27 14:04:40 +01:00

secp256k1_schnorrsig.h

Name public API structs

2024-10-31 13:55:52 -04:00

secp256k1_surjectionproof.h

Port bitcoin-core/secp256k1#1628 to zkp public API

2026-02-16 16:12:41 +02:00

secp256k1_whitelist.h

whitelist: document the degenerate W = -P_i destination

2026-08-17 13:43:52 +03:00

secp256k1.h

doc: correct API docs for ECDSA signing out-params (s/array/signature object/)

2026-04-29 17:56:54 +02:00