Skip to content

Commit b98f1c6

Browse files
fanquakeComputerCraftr
authored andcommitted
Merge bitcoin#19228: Update libsecp256k1 subtree
e10439c scripted-diff: rename privkey with seckey in secp256k1 interface (Pieter Wuille) ca8bc42 Drop --disable-jni from libsecp256k1 configure options (Pieter Wuille) ddc2419 Update MSVC build config for libsecp256k1 (Pieter Wuille) 67f232b Squashed 'src/secp256k1/' changes from b19c000..2ed54da (Pieter Wuille) Pull request description: It's been abound a year since the subtree was updated. Here is a list of the included PRs: * bitcoin-core/secp256k1#755: Recovery signing: add to constant time test, and eliminate non ct operators * bitcoin-core/secp256k1#754: Fix uninit values passed into cmov * bitcoin-core/secp256k1#752: autoconf: Use ":" instead of "dnl" as a noop * bitcoin-core/secp256k1#750: Add macOS to the CI * bitcoin-core/secp256k1#701: Make ec_ arithmetic more consistent and add documentation * bitcoin-core/secp256k1#732: Retry if r is zero during signing * bitcoin-core/secp256k1#742: Fix typo in ecmult_const_impl.h * bitcoin-core/secp256k1#740: Make recovery/main_impl.h non-executable * bitcoin-core/secp256k1#735: build: fix OpenSSL EC detection on macOS * bitcoin-core/secp256k1#728: Suppress a harmless variable-time optimization by clang in memczero * bitcoin-core/secp256k1#722: Context isn't freed in the ECDH benchmark * bitcoin-core/secp256k1#700: Allow overriding default flags * bitcoin-core/secp256k1#708: Constant-time behaviour test using valgrind memtest. * bitcoin-core/secp256k1#710: Eliminate harmless non-constant time operations on secret data. * bitcoin-core/secp256k1#718: Clarify that a secp256k1_ecdh_hash_function must return 0 or 1 * bitcoin-core/secp256k1#714: doc: document the length requirements of output parameter. * bitcoin-core/secp256k1#682: Remove Java Native Interface * bitcoin-core/secp256k1#713: Docstrings * bitcoin-core/secp256k1#704: README: add a section for test coverage * bitcoin-core/secp256k1#709: Remove secret-dependant non-constant time operation in ecmult_const. * bitcoin-core/secp256k1#703: Overhaul README.md * bitcoin-core/secp256k1#689: Remove "except in benchmarks" exception for fp math * bitcoin-core/secp256k1#679: Add SECURITY.md * bitcoin-core/secp256k1#685: Fix issue where travis does not show the ./tests seed… * bitcoin-core/secp256k1#690: Add valgrind check to travis * bitcoin-core/secp256k1#678: Preventing compiler optimizations in benchmarks without a memory fence * bitcoin-core/secp256k1#688: Fix ASM setting in travis * bitcoin-core/secp256k1#684: Make no-float policy explicit * bitcoin-core/secp256k1#677: Remove note about heap allocation in secp256k1_ecmult_odd_multiples_table_storage_var * bitcoin-core/secp256k1#647: Increase robustness against UB in secp256k1_scalar_cadd_bit * bitcoin-core/secp256k1#664: Remove mention of ec_privkey_export because it doesn't exist * bitcoin-core/secp256k1#337: variable sized precomputed table for signing * bitcoin-core/secp256k1#661: Make ./configure string consistent * bitcoin-core/secp256k1#657: Fix a nit in the recovery tests * bitcoin-core/secp256k1#650: secp256k1/src/tests.c: Properly handle sscanf return value * bitcoin-core/secp256k1#654: Fix typo (∞) * bitcoin-core/secp256k1#583: JNI: fix use sig array * bitcoin-core/secp256k1#644: Avoid optimizing out a verify_check * bitcoin-core/secp256k1#652: README.md: update instruction to run tests * bitcoin-core/secp256k1#651: Fix typo in secp256k1_preallocated.h * bitcoin-core/secp256k1#640: scalar_impl.h: fix includes * bitcoin-core/secp256k1#655: jni: Use only Guava for hex encoding and decoding * bitcoin-core/secp256k1#634: Add a descriptive comment for secp256k1_ecmult_const. * bitcoin-core/secp256k1#631: typo in comment for secp256k1_ec_pubkey_tweak_mul () * bitcoin-core/secp256k1#629: Avoid calling _is_zero when _set_b32 fails. * bitcoin-core/secp256k1#630: Note intention of timing sidechannel freeness. * bitcoin-core/secp256k1#628: Fix ability to compile tests without -DVERIFY. * bitcoin-core/secp256k1#627: Guard memcmp in tests against mixed size inputs. * bitcoin-core/secp256k1#578: Avoid implementation-defined and undefined behavior when dealing with sizes * bitcoin-core/secp256k1#595: Allow to use external default callbacks * bitcoin-core/secp256k1#600: scratch space: use single allocation * bitcoin-core/secp256k1#592: Use trivial algorithm in ecmult_multi if scratch space is small * bitcoin-core/secp256k1#566: Enable context creation in preallocated memory * bitcoin-core/secp256k1#596: Make WINDOW_G configurable * bitcoin-core/secp256k1#561: Respect LDFLAGS and #undef STATIC_PRECOMPUTATION if using basic config * bitcoin-core/secp256k1#533: Make sure we're not using an uninitialized variable in secp256k1_wnaf_const(...) * bitcoin-core/secp256k1#617: Pass scalar by reference in secp256k1_wnaf_const() * bitcoin-core/secp256k1#619: Clear a copied secret key after negation * bitcoin-core/secp256k1#612: Allow field_10x26_arm.s to compile for ARMv7 architecture ACKs for top commit: real-or-random: ACK e10439c I verified the diff (subtree matches my local tree, manual inspection of other commits) but I didn't tested the resulting code fanquake: ACK e10439c Sjors: ACK e10439c jonasnick: reACK e10439c Tree-SHA512: eb6284a485da78e9d2ed3f771df85560d47c770ebf480a0d4121ab356ad26be101a2b973efe412f26e6c142bc1dbd2efbb5cc08774233e41918c59fe3dff3387
1 parent 077eb62 commit b98f1c6

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+2435
-2476
lines changed

build_msvc/libsecp256k1_config.h

+3
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,7 @@
2626
#define USE_FIELD_10X26 1
2727
#define USE_SCALAR_8X32 1
2828

29+
#define ECMULT_GEN_PREC_BITS 4
30+
#define ECMULT_WINDOW_SIZE 15
31+
2932
#endif /* BITCOIN_LIBSECP256K1_CONFIG_H */

configure.ac

+1-1
Original file line numberDiff line numberDiff line change
@@ -1637,7 +1637,7 @@ if test x$need_bundled_univalue = xyes; then
16371637
AC_CONFIG_SUBDIRS([src/univalue])
16381638
fi
16391639

1640-
ac_configure_args="${ac_configure_args} --disable-shared --with-pic --enable-benchmark=no --with-bignum=no --enable-module-recovery --disable-jni"
1640+
ac_configure_args="${ac_configure_args} --disable-shared --with-pic --enable-benchmark=no --with-bignum=no --enable-module-recovery"
16411641
AC_CONFIG_SUBDIRS([src/secp256k1])
16421642

16431643
AC_OUTPUT

src/key.cpp

+39-39
Original file line numberDiff line numberDiff line change
@@ -31,46 +31,46 @@ static secp256k1_context* secp256k1_context_sign = nullptr;
3131
*
3232
* out32 must point to an output buffer of length at least 32 bytes.
3333
*/
34-
static int ec_privkey_import_der(const secp256k1_context* ctx, unsigned char *out32, const unsigned char *privkey, size_t privkeylen) {
35-
const unsigned char *end = privkey + privkeylen;
34+
static int ec_seckey_import_der(const secp256k1_context* ctx, unsigned char *out32, const unsigned char *seckey, size_t seckeylen) {
35+
const unsigned char *end = seckey + seckeylen;
3636
memset(out32, 0, 32);
3737
/* sequence header */
38-
if (end - privkey < 1 || *privkey != 0x30u) {
38+
if (end - seckey < 1 || *seckey != 0x30u) {
3939
return 0;
4040
}
41-
privkey++;
41+
seckey++;
4242
/* sequence length constructor */
43-
if (end - privkey < 1 || !(*privkey & 0x80u)) {
43+
if (end - seckey < 1 || !(*seckey & 0x80u)) {
4444
return 0;
4545
}
46-
ptrdiff_t lenb = *privkey & ~0x80u; privkey++;
46+
ptrdiff_t lenb = *seckey & ~0x80u; seckey++;
4747
if (lenb < 1 || lenb > 2) {
4848
return 0;
4949
}
50-
if (end - privkey < lenb) {
50+
if (end - seckey < lenb) {
5151
return 0;
5252
}
5353
/* sequence length */
54-
ptrdiff_t len = privkey[lenb-1] | (lenb > 1 ? privkey[lenb-2] << 8 : 0u);
55-
privkey += lenb;
56-
if (end - privkey < len) {
54+
ptrdiff_t len = seckey[lenb-1] | (lenb > 1 ? seckey[lenb-2] << 8 : 0u);
55+
seckey += lenb;
56+
if (end - seckey < len) {
5757
return 0;
5858
}
5959
/* sequence element 0: version number (=1) */
60-
if (end - privkey < 3 || privkey[0] != 0x02u || privkey[1] != 0x01u || privkey[2] != 0x01u) {
60+
if (end - seckey < 3 || seckey[0] != 0x02u || seckey[1] != 0x01u || seckey[2] != 0x01u) {
6161
return 0;
6262
}
63-
privkey += 3;
63+
seckey += 3;
6464
/* sequence element 1: octet string, up to 32 bytes */
65-
if (end - privkey < 2 || privkey[0] != 0x04u) {
65+
if (end - seckey < 2 || seckey[0] != 0x04u) {
6666
return 0;
6767
}
68-
ptrdiff_t oslen = privkey[1];
69-
privkey += 2;
70-
if (oslen > 32 || end - privkey < oslen) {
68+
ptrdiff_t oslen = seckey[1];
69+
seckey += 2;
70+
if (oslen > 32 || end - seckey < oslen) {
7171
return 0;
7272
}
73-
memcpy(out32 + (32 - oslen), privkey, oslen);
73+
memcpy(out32 + (32 - oslen), seckey, oslen);
7474
if (!secp256k1_ec_seckey_verify(ctx, out32)) {
7575
memset(out32, 0, 32);
7676
return 0;
@@ -83,17 +83,17 @@ static int ec_privkey_import_der(const secp256k1_context* ctx, unsigned char *ou
8383
* <http://www.secg.org/sec1-v2.pdf>. The optional parameters and publicKey fields are
8484
* included.
8585
*
86-
* privkey must point to an output buffer of length at least CKey::SIZE bytes.
87-
* privkeylen must initially be set to the size of the privkey buffer. Upon return it
86+
* seckey must point to an output buffer of length at least CKey::SIZE bytes.
87+
* seckeylen must initially be set to the size of the seckey buffer. Upon return it
8888
* will be set to the number of bytes used in the buffer.
8989
* key32 must point to a 32-byte raw private key.
9090
*/
91-
static int ec_privkey_export_der(const secp256k1_context *ctx, unsigned char *privkey, size_t *privkeylen, const unsigned char *key32, bool compressed) {
92-
assert(*privkeylen >= CKey::SIZE);
91+
static int ec_seckey_export_der(const secp256k1_context *ctx, unsigned char *seckey, size_t *seckeylen, const unsigned char *key32, bool compressed) {
92+
assert(*seckeylen >= CKey::SIZE);
9393
secp256k1_pubkey pubkey;
9494
size_t pubkeylen = 0;
9595
if (!secp256k1_ec_pubkey_create(ctx, &pubkey, key32)) {
96-
*privkeylen = 0;
96+
*seckeylen = 0;
9797
return 0;
9898
}
9999
if (compressed) {
@@ -111,15 +111,15 @@ static int ec_privkey_export_der(const secp256k1_context *ctx, unsigned char *pr
111111
0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
112112
0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x24,0x03,0x22,0x00
113113
};
114-
unsigned char *ptr = privkey;
114+
unsigned char *ptr = seckey;
115115
memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
116116
memcpy(ptr, key32, 32); ptr += 32;
117117
memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
118118
pubkeylen = CPubKey::COMPRESSED_SIZE;
119119
secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED);
120120
ptr += pubkeylen;
121-
*privkeylen = ptr - privkey;
122-
assert(*privkeylen == CKey::COMPRESSED_SIZE);
121+
*seckeylen = ptr - seckey;
122+
assert(*seckeylen == CKey::COMPRESSED_SIZE);
123123
} else {
124124
static const unsigned char begin[] = {
125125
0x30,0x82,0x01,0x13,0x02,0x01,0x01,0x04,0x20
@@ -137,15 +137,15 @@ static int ec_privkey_export_der(const secp256k1_context *ctx, unsigned char *pr
137137
0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
138138
0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x44,0x03,0x42,0x00
139139
};
140-
unsigned char *ptr = privkey;
140+
unsigned char *ptr = seckey;
141141
memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
142142
memcpy(ptr, key32, 32); ptr += 32;
143143
memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
144144
pubkeylen = CPubKey::SIZE;
145145
secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
146146
ptr += pubkeylen;
147-
*privkeylen = ptr - privkey;
148-
assert(*privkeylen == CKey::SIZE);
147+
*seckeylen = ptr - seckey;
148+
assert(*seckeylen == CKey::SIZE);
149149
}
150150
return 1;
151151
}
@@ -165,20 +165,20 @@ void CKey::MakeNewKey(bool fCompressedIn) {
165165
bool CKey::Negate()
166166
{
167167
assert(fValid);
168-
return secp256k1_ec_privkey_negate(secp256k1_context_sign, keydata.data());
168+
return secp256k1_ec_seckey_negate(secp256k1_context_sign, keydata.data());
169169
}
170170

171171
CPrivKey CKey::GetPrivKey() const {
172172
assert(fValid);
173-
CPrivKey privkey;
173+
CPrivKey seckey;
174174
int ret;
175-
size_t privkeylen;
176-
privkey.resize(SIZE);
177-
privkeylen = SIZE;
178-
ret = ec_privkey_export_der(secp256k1_context_sign, privkey.data(), &privkeylen, begin(), fCompressed);
175+
size_t seckeylen;
176+
seckey.resize(SIZE);
177+
seckeylen = SIZE;
178+
ret = ec_seckey_export_der(secp256k1_context_sign, seckey.data(), &seckeylen, begin(), fCompressed);
179179
assert(ret);
180-
privkey.resize(privkeylen);
181-
return privkey;
180+
seckey.resize(seckeylen);
181+
return seckey;
182182
}
183183

184184
CPubKey CKey::GetPubKey() const {
@@ -258,8 +258,8 @@ bool CKey::SignCompact(const uint256 &hash, std::vector<unsigned char>& vchSig)
258258
return true;
259259
}
260260

261-
bool CKey::Load(const CPrivKey &privkey, const CPubKey &vchPubKey, bool fSkipCheck=false) {
262-
if (!ec_privkey_import_der(secp256k1_context_sign, (unsigned char*)begin(), privkey.data(), privkey.size()))
261+
bool CKey::Load(const CPrivKey &seckey, const CPubKey &vchPubKey, bool fSkipCheck=false) {
262+
if (!ec_seckey_import_der(secp256k1_context_sign, (unsigned char*)begin(), seckey.data(), seckey.size()))
263263
return false;
264264
fCompressed = vchPubKey.IsCompressed();
265265
fValid = true;
@@ -284,7 +284,7 @@ bool CKey::Derive(CKey& keyChild, ChainCode &ccChild, unsigned int nChild, const
284284
}
285285
memcpy(ccChild.begin(), vout.data()+32, 32);
286286
memcpy((unsigned char*)keyChild.begin(), begin(), 32);
287-
bool ret = secp256k1_ec_privkey_tweak_add(secp256k1_context_sign, (unsigned char*)keyChild.begin(), vout.data());
287+
bool ret = secp256k1_ec_seckey_tweak_add(secp256k1_context_sign, (unsigned char*)keyChild.begin(), vout.data());
288288
keyChild.fCompressed = true;
289289
keyChild.fValid = ret;
290290
return ret;

src/secp256k1/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ bench_internal
99
tests
1010
exhaustive_tests
1111
gen_context
12+
valgrind_ctime_test
1213
*.exe
1314
*.so
1415
*.a

src/secp256k1/.travis.yml

+56-16
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,23 @@
11
language: c
2-
os: linux
2+
os:
3+
- linux
4+
- osx
5+
6+
dist: bionic
7+
# Valgrind currently supports upto macOS 10.13, the latest xcode of that version is 10.1
8+
osx_image: xcode10.1
39
addons:
410
apt:
5-
packages: libgmp-dev
11+
packages:
12+
- libgmp-dev
13+
- valgrind
14+
- libtool-bin
615
compiler:
716
- clang
817
- gcc
9-
cache:
10-
directories:
11-
- src/java/guava/
1218
env:
1319
global:
14-
- FIELD=auto BIGNUM=auto SCALAR=auto ENDOMORPHISM=no STATICPRECOMPUTATION=yes ASM=no BUILD=check EXTRAFLAGS= HOST= ECDH=no RECOVERY=no EXPERIMENTAL=no JNI=no
15-
- GUAVA_URL=https://search.maven.org/remotecontent?filepath=com/google/guava/guava/18.0/guava-18.0.jar GUAVA_JAR=src/java/guava/guava-18.0.jar
20+
- FIELD=auto BIGNUM=auto SCALAR=auto ENDOMORPHISM=no STATICPRECOMPUTATION=yes ECMULTGENPRECISION=auto ASM=no BUILD=check EXTRAFLAGS= HOST= ECDH=no RECOVERY=no EXPERIMENTAL=no CTIMETEST=yes BENCH=yes ITERS=2
1621
matrix:
1722
- SCALAR=32bit RECOVERY=yes
1823
- SCALAR=32bit FIELD=32bit ECDH=yes EXPERIMENTAL=yes
@@ -26,43 +31,78 @@ env:
2631
- BIGNUM=no
2732
- BIGNUM=no ENDOMORPHISM=yes RECOVERY=yes EXPERIMENTAL=yes
2833
- BIGNUM=no STATICPRECOMPUTATION=no
29-
- BUILD=distcheck
30-
- EXTRAFLAGS=CPPFLAGS=-DDETERMINISTIC
31-
- EXTRAFLAGS=CFLAGS=-O0
32-
- BUILD=check-java JNI=yes ECDH=yes EXPERIMENTAL=yes
34+
- BUILD=distcheck CTIMETEST= BENCH=
35+
- CPPFLAGS=-DDETERMINISTIC
36+
- CFLAGS=-O0 CTIMETEST=
37+
- ECMULTGENPRECISION=2
38+
- ECMULTGENPRECISION=8
39+
- VALGRIND=yes ENDOMORPHISM=yes BIGNUM=no ASM=x86_64 EXPERIMENTAL=yes ECDH=yes RECOVERY=yes EXTRAFLAGS="--disable-openssl-tests" CPPFLAGS=-DVALGRIND BUILD=
40+
- VALGRIND=yes BIGNUM=no ASM=x86_64 EXPERIMENTAL=yes ECDH=yes RECOVERY=yes EXTRAFLAGS="--disable-openssl-tests" CPPFLAGS=-DVALGRIND BUILD=
3341
matrix:
3442
fast_finish: true
3543
include:
3644
- compiler: clang
45+
os: linux
3746
env: HOST=i686-linux-gnu ENDOMORPHISM=yes
3847
addons:
3948
apt:
4049
packages:
4150
- gcc-multilib
4251
- libgmp-dev:i386
52+
- valgrind
53+
- libtool-bin
54+
- libc6-dbg:i386
4355
- compiler: clang
4456
env: HOST=i686-linux-gnu
57+
os: linux
4558
addons:
4659
apt:
4760
packages:
4861
- gcc-multilib
62+
- valgrind
63+
- libtool-bin
64+
- libc6-dbg:i386
4965
- compiler: gcc
5066
env: HOST=i686-linux-gnu ENDOMORPHISM=yes
67+
os: linux
5168
addons:
5269
apt:
5370
packages:
5471
- gcc-multilib
72+
- valgrind
73+
- libtool-bin
74+
- libc6-dbg:i386
5575
- compiler: gcc
76+
os: linux
5677
env: HOST=i686-linux-gnu
5778
addons:
5879
apt:
5980
packages:
6081
- gcc-multilib
6182
- libgmp-dev:i386
62-
before_install: mkdir -p `dirname $GUAVA_JAR`
63-
install: if [ ! -f $GUAVA_JAR ]; then wget $GUAVA_URL -O $GUAVA_JAR; fi
83+
- valgrind
84+
- libtool-bin
85+
- libc6-dbg:i386
86+
87+
# We use this to install macOS dependencies instead of the built in `homebrew` plugin,
88+
# because in xcode earlier than 11 they have a bug requiring updating the system which overall takes ~8 minutes.
89+
# https://travis-ci.community/t/macos-build-fails-because-of-homebrew-bundle-unknown-command/7296
90+
before_install:
91+
- if [ "${TRAVIS_OS_NAME}" = "osx" ]; then HOMEBREW_NO_AUTO_UPDATE=1 brew install gmp valgrind gcc@9; fi
92+
6493
before_script: ./autogen.sh
94+
95+
# travis auto terminates jobs that go for 10 minutes without printing to stdout, but travis_wait doesn't work well with forking programs like valgrind (https://docs.travis-ci.com/user/common-build-problems/#build-times-out-because-no-output-was-received https://github.com/bitcoin-core/secp256k1/pull/750#issuecomment-623476860)
6596
script:
66-
- if [ -n "$HOST" ]; then export USE_HOST="--host=$HOST"; fi
67-
- if [ "x$HOST" = "xi686-linux-gnu" ]; then export CC="$CC -m32"; fi
68-
- ./configure --enable-experimental=$EXPERIMENTAL --enable-endomorphism=$ENDOMORPHISM --with-field=$FIELD --with-bignum=$BIGNUM --with-scalar=$SCALAR --enable-ecmult-static-precomputation=$STATICPRECOMPUTATION --enable-module-ecdh=$ECDH --enable-module-recovery=$RECOVERY --enable-jni=$JNI $EXTRAFLAGS $USE_HOST && make -j2 $BUILD
97+
- function keep_alive() { while true; do echo -en "\a"; sleep 60; done }
98+
- keep_alive &
99+
- ./contrib/travis.sh
100+
- kill %keep_alive
101+
102+
after_script:
103+
- cat ./tests.log
104+
- cat ./exhaustive_tests.log
105+
- cat ./valgrind_ctime_test.log
106+
- cat ./bench.log
107+
- $CC --version
108+
- valgrind --version

0 commit comments

Comments
 (0)