Skip to content

Commit c443375

Browse files
apoelstraapoelstra
committedSep 11, 2022
Squashed 'src/secp256k1/' changes from 7a30cb0c9d9..14620d13125
14620d13125 rangeproof: add a "net blinding factor" API for Elements d22774e248c Merge BlockstreamResearch/secp256k1-zkp#203: MuSig doc fixes dd83e72d52d Add ordinary tweak info d26100cab26 Exclude nonce_process from pre-processing steps b7607f93f23 Fix reference to xonly_tweak_add f7e9a8544f3 Merge BlockstreamResearch/secp256k1-zkp#201: rangeproof: add secp256k1_rangeproof_max_size function to estimate rangeproof size 6b6ced9839f rangeproof: add more max_size tests 34876ecb5fa rangeproof: add more static test vectors 310e5170619 rangeproof: add a bunch more testing f1410cb67a2 rangeproof: add secp256k1_rangeproof_max_size function to estimate rangeproof size c137ddbdff7 Merge BlockstreamResearch/secp256k1-zkp#200: build: automatically enable module dependencies 0202d839fb1 Merge BlockstreamResearch/secp256k1-zkp#199: surjectionproof: make sure that n_used_pubkeys > 0 in generate 5ac8fb035e8 surjectionproof: make sure that n_used_pubkeys > 0 in generate 7ff446df8b9 Merge BlockstreamResearch/secp256k1-zkp#198: rangeproof: add a test for all-zero blinding factors 5a40f3d99bb replace memcmp with secp256k1_memcmp_var throughout the codebase 92820d944b5 rangeproof: add a test for all-zero blinding factors 171b294a1c7 build: improve error message if --enable-experimental is missed 58ab152bb4b build: move all output concerning enabled modules at single place 1493113e61e build: automatically enable module dependencies 4fd7e1eabda Merge BlockstreamResearch/secp256k1-zkp#197: fix include paths in all the -zkp modules 347f96d94a6 fix include paths in all the -zkp modules d1d6e47c17c Merge BlockstreamResearch/secp256k1-zkp#196: surjectionproof: fail to generate proofs when an input equals the output d1175d265d5 surjectionproof: use secp256k1_memcmp_var rather than bare memcmp bf18ff5a8c6 surjectionproof: fix generation to fail when any input == the output 4ff6e4274d4 surjectionproof: add test for existing behavior on input=output proofs 71a206fa5bb Merge BlockstreamResearch/secp256k1-zkp#194: extrakeys: rename swap/swap64 to fix OpenBSD 7.1 compilation db648478c3c extrakeys: rename swap/swap64 to fix OpenBSD 7.1 compilation git-subtree-dir: src/secp256k1 git-subtree-split: 14620d131250b141f4d3ab352fedac0aef45eb30
1 parent 35d6112 commit c443375

25 files changed

+1320
-197
lines changed
 

‎configure.ac

+33-50
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,10 @@ SECP_CFLAGS="$SECP_CFLAGS $WERROR_CFLAGS"
385385
### Handle module options
386386
###
387387

388+
# Besides testing whether modules are enabled, the following code also enables
389+
# module dependencies. The order of the tests matters: the dependency must be
390+
# tested first.
391+
388392
if test x"$enable_module_ecdh" = x"yes"; then
389393
AC_DEFINE(ENABLE_MODULE_ECDH, 1, [Define this symbol to enable the ECDH module])
390394
fi
@@ -398,30 +402,30 @@ if test x"$enable_module_recovery" = x"yes"; then
398402
AC_DEFINE(ENABLE_MODULE_RECOVERY, 1, [Define this symbol to enable the ECDSA pubkey recovery module])
399403
fi
400404

401-
if test x"$enable_module_generator" = x"yes"; then
402-
AC_DEFINE(ENABLE_MODULE_GENERATOR, 1, [Define this symbol to enable the NUMS generator module])
405+
if test x"$enable_module_whitelist" = x"yes"; then
406+
enable_module_rangeproof=yes
407+
AC_DEFINE(ENABLE_MODULE_WHITELIST, 1, [Define this symbol to enable the key whitelisting module])
408+
fi
409+
410+
if test x"$enable_module_surjectionproof" = x"yes"; then
411+
enable_module_rangeproof=yes
412+
AC_DEFINE(ENABLE_MODULE_SURJECTIONPROOF, 1, [Define this symbol to enable the surjection proof module])
403413
fi
404414

405415
if test x"$enable_module_rangeproof" = x"yes"; then
416+
enable_module_generator=yes
406417
AC_DEFINE(ENABLE_MODULE_RANGEPROOF, 1, [Define this symbol to enable the Pedersen / zero knowledge range proof module])
407418
fi
408419

409-
if test x"$enable_module_whitelist" = x"yes"; then
410-
AC_DEFINE(ENABLE_MODULE_WHITELIST, 1, [Define this symbol to enable the key whitelisting module])
420+
if test x"$enable_module_generator" = x"yes"; then
421+
AC_DEFINE(ENABLE_MODULE_GENERATOR, 1, [Define this symbol to enable the NUMS generator module])
411422
fi
412423

413-
if test x"$enable_module_surjectionproof" = x"yes"; then
414-
AC_DEFINE(ENABLE_MODULE_SURJECTIONPROOF, 1, [Define this symbol to enable the surjection proof module])
415-
fi
416-
# Test if extrakeys is set _after_ the MuSig module to allow the MuSig
417-
# module to set enable_module_schnorrsig=yes
418424
if test x"$enable_module_schnorrsig" = x"yes"; then
419425
AC_DEFINE(ENABLE_MODULE_SCHNORRSIG, 1, [Define this symbol to enable the schnorrsig module])
420426
enable_module_extrakeys=yes
421427
fi
422428

423-
# Test if extrakeys is set after the schnorrsig module to allow the schnorrsig
424-
# module to set enable_module_extrakeys=yes
425429
if test x"$enable_module_extrakeys" = x"yes"; then
426430
AC_DEFINE(ENABLE_MODULE_EXTRAKEYS, 1, [Define this symbol to enable the extrakeys module])
427431
fi
@@ -450,37 +454,24 @@ if test x"$enable_experimental" = x"yes"; then
450454
AC_MSG_NOTICE([******])
451455
AC_MSG_NOTICE([WARNING: experimental build])
452456
AC_MSG_NOTICE([Experimental features do not have stable APIs or properties, and may not be safe for production use.])
453-
AC_MSG_NOTICE([Building NUMS generator module: $enable_module_generator])
454-
AC_MSG_NOTICE([Building range proof module: $enable_module_rangeproof])
455-
AC_MSG_NOTICE([Building key whitelisting module: $enable_module_whitelist])
456-
AC_MSG_NOTICE([Building surjection proof module: $enable_module_surjectionproof])
457-
AC_MSG_NOTICE([Building MuSig module: $enable_module_musig])
458-
AC_MSG_NOTICE([Building ECDSA sign-to-contract module: $enable_module_ecdsa_s2c])
459-
AC_MSG_NOTICE([Building ECDSA adaptor signatures module: $enable_module_ecdsa_adaptor])
460457
AC_MSG_NOTICE([******])
461-
462-
463-
if test x"$enable_module_schnorrsig" != x"yes"; then
464-
if test x"$enable_module_musig" = x"yes"; then
465-
AC_MSG_ERROR([MuSig module requires the schnorrsig module. Use --enable-module-schnorrsig to allow.])
466-
fi
458+
else
459+
# The order of the following tests matters. If the user enables a dependent
460+
# module (which automatically enables the module dependencies) we want to
461+
# print an error for the dependent module, not the module dependency. Hence,
462+
# we first test dependent modules.
463+
if test x"$enable_module_whitelist" = x"yes"; then
464+
AC_MSG_ERROR([Key whitelisting module is experimental. Use --enable-experimental to allow.])
467465
fi
468-
469-
if test x"$enable_module_generator" != x"yes"; then
470-
if test x"$enable_module_rangeproof" = x"yes"; then
471-
AC_MSG_ERROR([Rangeproof module requires the generator module. Use --enable-module-generator to allow.])
472-
fi
466+
if test x"$enable_module_surjectionproof" = x"yes"; then
467+
AC_MSG_ERROR([Surjection proof module is experimental. Use --enable-experimental to allow.])
473468
fi
474-
475-
if test x"$enable_module_rangeproof" != x"yes"; then
476-
if test x"$enable_module_whitelist" = x"yes"; then
477-
AC_MSG_ERROR([Whitelist module requires the rangeproof module. Use --enable-module-rangeproof to allow.])
478-
fi
479-
if test x"$enable_module_surjectionproof" = x"yes"; then
480-
AC_MSG_ERROR([Surjection proof module requires the rangeproof module. Use --enable-module-rangeproof to allow.])
481-
fi
469+
if test x"$enable_module_rangeproof" = x"yes"; then
470+
AC_MSG_ERROR([Range proof module is experimental. Use --enable-experimental to allow.])
471+
fi
472+
if test x"$enable_module_generator" = x"yes"; then
473+
AC_MSG_ERROR([NUMS generator module is experimental. Use --enable-experimental to allow.])
482474
fi
483-
else
484475
if test x"$enable_module_musig" = x"yes"; then
485476
AC_MSG_ERROR([MuSig module is experimental. Use --enable-experimental to allow.])
486477
fi
@@ -493,18 +484,6 @@ else
493484
if test x"$set_asm" = x"arm"; then
494485
AC_MSG_ERROR([ARM assembly optimization is experimental. Use --enable-experimental to allow.])
495486
fi
496-
if test x"$enable_module_generator" = x"yes"; then
497-
AC_MSG_ERROR([NUMS generator module is experimental. Use --enable-experimental to allow.])
498-
fi
499-
if test x"$enable_module_rangeproof" = x"yes"; then
500-
AC_MSG_ERROR([Range proof module is experimental. Use --enable-experimental to allow.])
501-
fi
502-
if test x"$enable_module_whitelist" = x"yes"; then
503-
AC_MSG_ERROR([Key whitelisting module is experimental. Use --enable-experimental to allow.])
504-
fi
505-
if test x"$enable_module_surjectionproof" = x"yes"; then
506-
AC_MSG_ERROR([Surjection proof module is experimental. Use --enable-experimental to allow.])
507-
fi
508487
fi
509488

510489
###
@@ -555,6 +534,10 @@ echo " module ecdh = $enable_module_ecdh"
555534
echo " module recovery = $enable_module_recovery"
556535
echo " module extrakeys = $enable_module_extrakeys"
557536
echo " module schnorrsig = $enable_module_schnorrsig"
537+
echo " module generator = $enable_module_generator"
538+
echo " module rangeproof = $enable_module_rangeproof"
539+
echo " module surjectionproof = $enable_module_surjectionproof"
540+
echo " module whitelist = $enable_module_whitelist"
558541
echo " module musig = $enable_module_musig"
559542
echo " module ecdsa-s2c = $enable_module_ecdsa_s2c"
560543
echo " module ecdsa-adaptor = $enable_module_ecdsa_adaptor"

‎include/secp256k1_rangeproof.h

+81-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,15 @@ extern "C" {
1010

1111
#include <stdint.h>
1212

13+
/** Length of a message that can be embedded into a maximally-sized rangeproof
14+
*
15+
* It is not be possible to fit a message of this size into a non-maximally-sized
16+
* rangeproof, but it is guaranteed that any embeddable message can fit into an
17+
* array of this size. This constant is intended to be used for memory allocations
18+
* and sanity checks.
19+
*/
20+
#define SECP256K1_RANGEPROOF_MAX_MESSAGE_LEN 3968
21+
1322
/** Opaque data structure that stores a Pedersen commitment
1423
*
1524
* The exact representation of data inside is implementation defined and not
@@ -119,6 +128,49 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_pedersen_verify_tally(
119128
size_t ncnt
120129
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
121130

131+
/** Compute the "net blinding factor" for an asset/amount pair of Pedersen commitments
132+
*
133+
* Returns 0 if either input is out of range, otherwise 1
134+
* Args: ctx: a secp256k1 context object.
135+
* Out: output: 32-byte array into which the result will be written
136+
* In: val: the value of the amount commitment
137+
* vbf: the amount commitment's blinding factor
138+
* abf: the asset commitment's blinding factor
139+
*
140+
* This computse val*abf + vbf
141+
*/
142+
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_netbf_compute(
143+
const secp256k1_context* ctx,
144+
unsigned char* output,
145+
uint64_t val,
146+
const unsigned char* vbf,
147+
const unsigned char* abf
148+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
149+
150+
/** Accumulate a net blinding factor
151+
*
152+
* Returns 0 if the input is out of range, otherwise 1
153+
* Args: ctx: a secp256k1 context object.
154+
* In/Out: acc: initially set to the current state of the accumulator; updated in place
155+
* In: nbf: the net blinding factor to add to the accumulator
156+
*/
157+
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_netbf_acc(
158+
const secp256k1_context* ctx,
159+
unsigned char* acc,
160+
const unsigned char* nbf
161+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
162+
163+
/** Negate a(n accumulated) net blinding factor
164+
*
165+
* Returns 0 if the input is out of range, otherwise 1
166+
* Args: ctx: a secp256k1 context object.
167+
* In/Out: acc: initially set to the bf to negate; changed to the negated version
168+
*/
169+
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_netbf_neg(
170+
const secp256k1_context* ctx,
171+
unsigned char* output
172+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2);
173+
122174
/** Sets the final Pedersen blinding factor correctly when the generators themselves
123175
* have blinding factors.
124176
*
@@ -227,7 +279,8 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_rangeproof_rewind(
227279
* proof: pointer to array to receive the proof, can be up to 5134 bytes. (cannot be NULL)
228280
* min_value: constructs a proof where the verifer can tell the minimum value is at least the specified amount.
229281
* commit: the commitment being proved.
230-
* blind: 32-byte blinding factor used by commit.
282+
* blind: 32-byte blinding factor used by commit. The blinding factor may be all-zeros as long as min_bits is set to 3 or greater.
283+
* This is a side-effect of the underlying crypto, not a deliberate API choice, but it may be useful when balancing CT transactions.
231284
* nonce: 32-byte secret nonce used to initialize the proof (value can be reverse-engineered out of the proof if this secret is known.)
232285
* exp: Base-10 exponent. Digits below above will be made public, but the proof will be made smaller. Allowed range is -1 to 18.
233286
* (-1 is a special case that makes the value public. 0 is the most private.)
@@ -286,6 +339,33 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_rangeproof_info(
286339
size_t plen
287340
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
288341

342+
/** Returns an upper bound on the size of a rangeproof with the given parameters
343+
*
344+
* An actual rangeproof may be smaller, for example if the actual value
345+
* is less than both the provided `max_value` and 2^`min_bits`, or if
346+
* the `exp` parameter to `secp256k1_rangeproof_sign` is set such that
347+
* the proven range is compressed. In particular this function will always
348+
* overestimate the size of single-value proofs. Also, if `min_value`
349+
* is set to 0 in the proof, the result will usually, but not always,
350+
* be 8 bytes smaller than if a nonzero value had been passed.
351+
*
352+
* The goal of this function is to provide a useful upper bound for
353+
* memory allocation or fee estimation purposes, without requiring
354+
* too many parameters be fixed in advance.
355+
*
356+
* To obtain the size of largest possible proof, set `max_value` to
357+
* `UINT64_MAX` (and `min_bits` to any valid value such as 0).
358+
*
359+
* In: ctx: pointer to a context object
360+
* max_value: the maximum value that might be passed for `value` for the proof.
361+
* min_bits: the value that will be passed as `min_bits` for the proof.
362+
*/
363+
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT size_t secp256k1_rangeproof_max_size(
364+
const secp256k1_context* ctx,
365+
uint64_t max_value,
366+
int min_bits
367+
) SECP256K1_ARG_NONNULL(1);
368+
289369
# ifdef __cplusplus
290370
}
291371
# endif

‎src/modules/ecdsa_adaptor/main_impl.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
#ifndef SECP256K1_MODULE_ECDSA_ADAPTOR_MAIN_H
88
#define SECP256K1_MODULE_ECDSA_ADAPTOR_MAIN_H
99

10-
#include "include/secp256k1_ecdsa_adaptor.h"
11-
#include "modules/ecdsa_adaptor/dleq_impl.h"
10+
#include "../../../include/secp256k1_ecdsa_adaptor.h"
11+
#include "dleq_impl.h"
1212

1313
/* (R, R', s', dleq_proof) */
1414
static int secp256k1_ecdsa_adaptor_sig_serialize(unsigned char *adaptor_sig162, secp256k1_ge *r, secp256k1_ge *rp, const secp256k1_scalar *sp, const secp256k1_scalar *dleq_proof_e, const secp256k1_scalar *dleq_proof_s) {

‎src/modules/ecdsa_adaptor/tests_impl.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#ifndef SECP256K1_MODULE_ECDSA_ADAPTOR_TESTS_H
22
#define SECP256K1_MODULE_ECDSA_ADAPTOR_TESTS_H
33

4-
#include "include/secp256k1_ecdsa_adaptor.h"
4+
#include "../../../include/secp256k1_ecdsa_adaptor.h"
55

66
void rand_scalar(secp256k1_scalar *scalar) {
77
unsigned char buf32[32];

‎src/modules/ecdsa_s2c/main_impl.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
#ifndef SECP256K1_MODULE_ECDSA_S2C_MAIN_H
88
#define SECP256K1_MODULE_ECDSA_S2C_MAIN_H
99

10-
#include "include/secp256k1.h"
11-
#include "include/secp256k1_ecdsa_s2c.h"
10+
#include "../../../include/secp256k1.h"
11+
#include "../../../include/secp256k1_ecdsa_s2c.h"
1212

1313
static void secp256k1_ecdsa_s2c_opening_save(secp256k1_ecdsa_s2c_opening* opening, secp256k1_ge* ge) {
1414
secp256k1_pubkey_save((secp256k1_pubkey*) opening, ge);

‎src/modules/ecdsa_s2c/tests_impl.h

+5-5
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
#ifndef SECP256K1_MODULE_ECDSA_S2C_TESTS_H
88
#define SECP256K1_MODULE_ECDSA_S2C_TESTS_H
99

10-
#include "include/secp256k1_ecdsa_s2c.h"
10+
#include "../../../include/secp256k1_ecdsa_s2c.h"
1111

1212
static void test_ecdsa_s2c_tagged_hash(void) {
1313
unsigned char tag_data[14] = "s2c/ecdsa/data";
@@ -78,7 +78,7 @@ void run_s2c_opening_test(void) {
7878
* points' x-coordinates are uniformly random */
7979
if (secp256k1_ecdsa_s2c_opening_parse(none, &opening, input) == 1) {
8080
CHECK(secp256k1_ecdsa_s2c_opening_serialize(none, output, &opening) == 1);
81-
CHECK(memcmp(output, input, sizeof(output)) == 0);
81+
CHECK(secp256k1_memcmp_var(output, input, sizeof(output)) == 0);
8282
}
8383
secp256k1_testrand256(&input[1]);
8484
/* Set pubkey oddness tag to first bit of input[1] */
@@ -255,7 +255,7 @@ static void test_ecdsa_s2c_fixed_vectors(void) {
255255
secp256k1_ecdsa_signature signature;
256256
CHECK(secp256k1_ecdsa_s2c_sign(ctx, &signature, &s2c_opening, message, privkey, test->s2c_data) == 1);
257257
CHECK(secp256k1_ecdsa_s2c_opening_serialize(ctx, opening_ser, &s2c_opening) == 1);
258-
CHECK(memcmp(test->expected_s2c_opening, opening_ser, sizeof(opening_ser)) == 0);
258+
CHECK(secp256k1_memcmp_var(test->expected_s2c_opening, opening_ser, sizeof(opening_ser)) == 0);
259259
CHECK(secp256k1_ecdsa_s2c_verify_commit(ctx, &signature, test->s2c_data, &s2c_opening) == 1);
260260
}
261261
}
@@ -331,7 +331,7 @@ static void test_ecdsa_anti_exfil_signer_commit(void) {
331331
const ecdsa_s2c_test *test = &ecdsa_s2c_tests[i];
332332
CHECK(secp256k1_ecdsa_anti_exfil_signer_commit(ctx, &s2c_opening, message, privkey, test->s2c_data) == 1);
333333
CHECK(secp256k1_ecdsa_s2c_opening_serialize(ctx, buf, &s2c_opening) == 1);
334-
CHECK(memcmp(test->expected_s2c_exfil_opening, buf, sizeof(buf)) == 0);
334+
CHECK(secp256k1_memcmp_var(test->expected_s2c_exfil_opening, buf, sizeof(buf)) == 0);
335335
}
336336
}
337337

@@ -397,7 +397,7 @@ static void test_ecdsa_anti_exfil(void) {
397397
CHECK(secp256k1_ecdsa_verify(ctx, &signature, host_msg, &signer_pubkey) == 1);
398398
CHECK(secp256k1_anti_exfil_host_verify(ctx, &signature, host_msg, &signer_pubkey, host_nonce_contribution, &s2c_opening) == 0);
399399
CHECK(secp256k1_anti_exfil_host_verify(ctx, &signature, host_msg, &signer_pubkey, bad_nonce_contribution, &s2c_opening) == 1);
400-
CHECK(memcmp(&s2c_opening, &orig_opening, sizeof(s2c_opening)) != 0);
400+
CHECK(secp256k1_memcmp_var(&s2c_opening, &orig_opening, sizeof(s2c_opening)) != 0);
401401
}
402402
}
403403

‎src/modules/extrakeys/hsort_impl.h

+7-7
Original file line numberDiff line numberDiff line change
@@ -23,20 +23,20 @@ static SECP256K1_INLINE size_t child2(size_t i) {
2323
return child1(i)+1;
2424
}
2525

26-
static SECP256K1_INLINE void swap64(unsigned char *a, size_t i, size_t j, size_t stride) {
26+
static SECP256K1_INLINE void heap_swap64(unsigned char *a, size_t i, size_t j, size_t stride) {
2727
unsigned char tmp[64];
2828
VERIFY_CHECK(stride <= 64);
2929
memcpy(tmp, a + i*stride, stride);
3030
memmove(a + i*stride, a + j*stride, stride);
3131
memcpy(a + j*stride, tmp, stride);
3232
}
3333

34-
static SECP256K1_INLINE void swap(unsigned char *a, size_t i, size_t j, size_t stride) {
34+
static SECP256K1_INLINE void heap_swap(unsigned char *a, size_t i, size_t j, size_t stride) {
3535
while (64 < stride) {
36-
swap64(a + (stride - 64), i, j, 64);
36+
heap_swap64(a + (stride - 64), i, j, 64);
3737
stride -= 64;
3838
}
39-
swap64(a, i, j, stride);
39+
heap_swap64(a, i, j, stride);
4040
}
4141

4242
static SECP256K1_INLINE void heap_down(unsigned char *a, size_t i, size_t heap_size, size_t stride,
@@ -71,7 +71,7 @@ static SECP256K1_INLINE void heap_down(unsigned char *a, size_t i, size_t heap_s
7171
if (child2(i) < heap_size
7272
&& 0 <= cmp(a + child2(i)*stride, a + child1(i)*stride, cmp_data)) {
7373
if (0 < cmp(a + child2(i)*stride, a + i*stride, cmp_data)) {
74-
swap(a, i, child2(i), stride);
74+
heap_swap(a, i, child2(i), stride);
7575
i = child2(i);
7676
} else {
7777
/* At this point we have [child2(i)] >= [child1(i)] and we have
@@ -80,7 +80,7 @@ static SECP256K1_INLINE void heap_down(unsigned char *a, size_t i, size_t heap_s
8080
return;
8181
}
8282
} else if (0 < cmp(a + child1(i)*stride, a + i*stride, cmp_data)) {
83-
swap(a, i, child1(i), stride);
83+
heap_swap(a, i, child1(i), stride);
8484
i = child1(i);
8585
} else {
8686
return;
@@ -106,7 +106,7 @@ static void secp256k1_hsort(void *ptr, size_t count, size_t size,
106106
}
107107
for(i = count; 1 < i; --i) {
108108
/* Extract the largest value from the heap */
109-
swap(ptr, 0, i-1, size);
109+
heap_swap(ptr, 0, i-1, size);
110110

111111
/* Repair the heap condition */
112112
heap_down(ptr, 0, i-1, size, cmp, cmp_data);

‎src/modules/generator/main_impl.h

+4-4
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@
99

1010
#include <stdio.h>
1111

12-
#include "field.h"
13-
#include "group.h"
14-
#include "hash.h"
15-
#include "scalar.h"
12+
#include "../../field.h"
13+
#include "../../group.h"
14+
#include "../../hash.h"
15+
#include "../../scalar.h"
1616

1717
static void secp256k1_generator_load(secp256k1_ge* ge, const secp256k1_generator* gen) {
1818
int succeed;

‎src/modules/generator/tests_impl.h

+9-9
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@
1010
#include <string.h>
1111
#include <stdio.h>
1212

13-
#include "group.h"
14-
#include "scalar.h"
15-
#include "testrand.h"
16-
#include "util.h"
13+
#include "../../group.h"
14+
#include "../../scalar.h"
15+
#include "../../testrand.h"
16+
#include "../../util.h"
1717

18-
#include "include/secp256k1_generator.h"
18+
#include "../../../include/secp256k1_generator.h"
1919

2020
void test_generator_api(void) {
2121
unsigned char key[32];
@@ -134,7 +134,7 @@ void test_shallue_van_de_woestijne(void) {
134134
shallue_van_de_woestijne(&ge, &fe);
135135
secp256k1_ge_to_storage(&ges, &ge);
136136

137-
CHECK(memcmp(&ges, &results[i * 2 + s - 2], sizeof(secp256k1_ge_storage)) == 0);
137+
CHECK(secp256k1_memcmp_var(&ges, &results[i * 2 + s - 2], sizeof(secp256k1_ge_storage)) == 0);
138138
}
139139
}
140140
}
@@ -188,11 +188,11 @@ void test_generator_generate(void) {
188188
CHECK(secp256k1_generator_generate_blinded(ctx, &gen, v, s));
189189
secp256k1_generator_load(&ge, &gen);
190190
secp256k1_ge_to_storage(&ges, &ge);
191-
CHECK(memcmp(&ges, &results[i - 1], sizeof(secp256k1_ge_storage)) == 0);
191+
CHECK(secp256k1_memcmp_var(&ges, &results[i - 1], sizeof(secp256k1_ge_storage)) == 0);
192192
CHECK(secp256k1_generator_generate(ctx, &gen, v));
193193
secp256k1_generator_load(&ge, &gen);
194194
secp256k1_ge_to_storage(&ges, &ge);
195-
CHECK(memcmp(&ges, &results[i - 1], sizeof(secp256k1_ge_storage)) == 0);
195+
CHECK(secp256k1_memcmp_var(&ges, &results[i - 1], sizeof(secp256k1_ge_storage)) == 0);
196196
}
197197

198198
/* There is no range restriction on the value, but the blinder must be a
@@ -215,7 +215,7 @@ void test_generator_fixed_vector(void) {
215215

216216
CHECK(secp256k1_generator_parse(ctx, &parse, two_g));
217217
CHECK(secp256k1_generator_serialize(ctx, result, &parse));
218-
CHECK(memcmp(two_g, result, 33) == 0);
218+
CHECK(secp256k1_memcmp_var(two_g, result, 33) == 0);
219219

220220
result[0] = 0x0a;
221221
CHECK(secp256k1_generator_parse(ctx, &parse, result));

‎src/modules/musig/musig.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Therefore, users of the musig module must take great care to make sure of the fo
2323
# Key Aggregation and (Taproot) Tweaking
2424

2525
Given a set of public keys, the aggregate public key is computed with `secp256k1_musig_pubkey_agg`.
26-
A (Taproot) tweak can be added to the resulting public key with `secp256k1_xonly_pubkey_tweak_add`.
26+
A (Taproot) tweak can be added to the resulting public key with `secp256k1_xonly_pubkey_tweak_add` and an ordinary tweak can be added with `secp256k1_ec_pubkey_tweak_add`.
2727

2828
# Signing
2929

@@ -32,7 +32,7 @@ Essentially, the protocol proceeds in the following steps:
3232

3333
1. Generate a keypair with `secp256k1_keypair_create` and obtain the xonly public key with `secp256k1_keypair_xonly_pub`.
3434
2. Call `secp256k1_musig_pubkey_agg` with the xonly pubkeys of all participants.
35-
3. Optionally add a (Taproot) tweak with `secp256k1_musig_pubkey_tweak_add`.
35+
3. Optionally add a (Taproot) tweak with `secp256k1_musig_pubkey_xonly_tweak_add` and an ordinary tweak with `secp256k1_musig_pubkey_ec_tweak_add`.
3636
4. Generate a pair of secret and public nonce with `secp256k1_musig_nonce_gen` and send the public nonce to the other signers.
3737
5. Someone (not necessarily the signer) aggregates the public nonce with `secp256k1_musig_nonce_agg` and sends it to the signers.
3838
6. Process the aggregate nonce with `secp256k1_musig_nonce_process`.
@@ -42,10 +42,10 @@ Essentially, the protocol proceeds in the following steps:
4242

4343
The aggregate signature can be verified with `secp256k1_schnorrsig_verify`.
4444

45-
Note that steps 1 to 6 can happen before the message to be signed is known to the signers.
45+
Note that steps 1 to 5 can happen before the message to be signed is known to the signers.
4646
Therefore, the communication round to exchange nonces can be viewed as a pre-processing step that is run whenever convenient to the signers.
4747
This disables some of the defense-in-depth measures that may protect against API misuse in some cases.
48-
Similarly, the API supports an alternative protocol flow where generating the aggregate key (steps 1 to 3) is allowed to happen after exchanging nonces (steps 4 to 6).
48+
Similarly, the API supports an alternative protocol flow where generating the aggregate key (steps 1 to 3) is allowed to happen after exchanging nonces (steps 4 to 5).
4949

5050
# Verification
5151

‎src/modules/musig/tests_impl.h

+18-18
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,7 @@ void musig_api_tests(secp256k1_scratch_space *scratch) {
360360
secp256k1_musig_pubnonce tmp;
361361
CHECK(secp256k1_musig_pubnonce_serialize(none, pubnonce_ser, &pubnonce[0]) == 1);
362362
CHECK(secp256k1_musig_pubnonce_parse(none, &tmp, pubnonce_ser) == 1);
363-
CHECK(memcmp(&tmp, &pubnonce[0], sizeof(tmp)) == 0);
363+
CHECK(secp256k1_memcmp_var(&tmp, &pubnonce[0], sizeof(tmp)) == 0);
364364
}
365365

366366
/** Receive nonces and aggregate **/
@@ -414,7 +414,7 @@ void musig_api_tests(secp256k1_scratch_space *scratch) {
414414
secp256k1_musig_aggnonce tmp;
415415
CHECK(secp256k1_musig_aggnonce_serialize(none, aggnonce_ser, &aggnonce) == 1);
416416
CHECK(secp256k1_musig_aggnonce_parse(none, &tmp, aggnonce_ser) == 1);
417-
CHECK(memcmp(&tmp, &aggnonce, sizeof(tmp)) == 0);
417+
CHECK(secp256k1_memcmp_var(&tmp, &aggnonce, sizeof(tmp)) == 0);
418418
}
419419

420420
/** Process nonces **/
@@ -444,7 +444,7 @@ void musig_api_tests(secp256k1_scratch_space *scratch) {
444444
memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
445445
CHECK(secp256k1_musig_partial_sign(none, &partial_sig[0], &secnonce_tmp, &keypair[0], &keyagg_cache, &session) == 1);
446446
/* The secnonce is set to 0 and subsequent signing attempts fail */
447-
CHECK(memcmp(&secnonce_tmp, zeros68, sizeof(secnonce_tmp)) == 0);
447+
CHECK(secp256k1_memcmp_var(&secnonce_tmp, zeros68, sizeof(secnonce_tmp)) == 0);
448448
CHECK(secp256k1_musig_partial_sign(none, &partial_sig[0], &secnonce_tmp, &keypair[0], &keyagg_cache, &session) == 0);
449449
CHECK(ecount == 1);
450450
memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
@@ -496,7 +496,7 @@ void musig_api_tests(secp256k1_scratch_space *scratch) {
496496
secp256k1_musig_partial_sig tmp;
497497
CHECK(secp256k1_musig_partial_sig_serialize(none, buf, &partial_sig[0]) == 1);
498498
CHECK(secp256k1_musig_partial_sig_parse(none, &tmp, buf) == 1);
499-
CHECK(memcmp(&tmp, &partial_sig[0], sizeof(tmp)) == 0);
499+
CHECK(secp256k1_memcmp_var(&tmp, &partial_sig[0], sizeof(tmp)) == 0);
500500
}
501501

502502
/** Partial signature verification */
@@ -582,10 +582,10 @@ void musig_api_tests(secp256k1_scratch_space *scratch) {
582582
/** Secret adaptor can be extracted from signature */
583583
ecount = 0;
584584
CHECK(secp256k1_musig_extract_adaptor(none, sec_adaptor1, final_sig, pre_sig, nonce_parity) == 1);
585-
CHECK(memcmp(sec_adaptor, sec_adaptor1, 32) == 0);
585+
CHECK(secp256k1_memcmp_var(sec_adaptor, sec_adaptor1, 32) == 0);
586586
/* wrong nonce parity */
587587
CHECK(secp256k1_musig_extract_adaptor(none, sec_adaptor1, final_sig, pre_sig, !nonce_parity) == 1);
588-
CHECK(memcmp(sec_adaptor, sec_adaptor1, 32) != 0);
588+
CHECK(secp256k1_memcmp_var(sec_adaptor, sec_adaptor1, 32) != 0);
589589
CHECK(secp256k1_musig_extract_adaptor(none, NULL, final_sig, pre_sig, 0) == 0);
590590
CHECK(ecount == 1);
591591
CHECK(secp256k1_musig_extract_adaptor(none, sec_adaptor1, NULL, pre_sig, 0) == 0);
@@ -764,7 +764,7 @@ void scriptless_atomic_swap(secp256k1_scratch_space *scratch) {
764764
CHECK(secp256k1_musig_partial_sign(ctx, &partial_sig_a[1], &secnonce_a[1], &keypair_a[1], &keyagg_cache_a, &session_a) == 1);
765765
CHECK(secp256k1_musig_partial_sig_agg(ctx, pre_sig_a, &session_a, partial_sig_a_ptr, 2) == 1);
766766
CHECK(secp256k1_musig_extract_adaptor(ctx, sec_adaptor_extracted, final_sig_b, pre_sig_b, nonce_parity_b) == 1);
767-
CHECK(memcmp(sec_adaptor_extracted, sec_adaptor, sizeof(sec_adaptor)) == 0); /* in real life we couldn't check this, of course */
767+
CHECK(secp256k1_memcmp_var(sec_adaptor_extracted, sec_adaptor, sizeof(sec_adaptor)) == 0); /* in real life we couldn't check this, of course */
768768
CHECK(secp256k1_musig_adapt(ctx, final_sig_a, pre_sig_a, sec_adaptor_extracted, nonce_parity_a) == 1);
769769
CHECK(secp256k1_schnorrsig_verify(ctx, final_sig_a, msg32_a, sizeof(msg32_a), &agg_pk_a) == 1);
770770
}
@@ -794,7 +794,7 @@ void sha256_tag_test_internal(secp256k1_sha256 *sha_tagged, unsigned char *tag,
794794
secp256k1_sha256_write(sha_tagged, buf, 32);
795795
secp256k1_sha256_finalize(&sha, buf);
796796
secp256k1_sha256_finalize(sha_tagged, buf2);
797-
CHECK(memcmp(buf, buf2, 32) == 0);
797+
CHECK(secp256k1_memcmp_var(buf, buf2, 32) == 0);
798798
}
799799

800800
/* Checks that the initialized tagged hashes initialized have the expected
@@ -904,7 +904,7 @@ void musig_tweak_test(secp256k1_scratch_space *scratch) {
904904
} else {
905905
secp256k1_pubkey tmp_key = P[i-1];
906906
CHECK(secp256k1_ec_pubkey_tweak_add(ctx, &tmp_key, tweak));
907-
CHECK(memcmp(&tmp_key, &P[i], sizeof(tmp_key)) == 0);
907+
CHECK(secp256k1_memcmp_var(&tmp_key, &P[i], sizeof(tmp_key)) == 0);
908908
}
909909
/* Test signing for P[i] */
910910
musig_tweak_test_helper(&P_xonly[i], sk[0], sk[1], &keyagg_cache);
@@ -1138,7 +1138,7 @@ void musig_test_vectors_noncegen(void) {
11381138
for (j = 0; j < 2; j++) {
11391139
unsigned char k32[32];
11401140
secp256k1_scalar_get_b32(k32, &k[i][j]);
1141-
CHECK(memcmp(k32, k32_expected[i][j], 32) == 0);
1141+
CHECK(secp256k1_memcmp_var(k32, k32_expected[i][j], 32) == 0);
11421142
}
11431143
}
11441144
}
@@ -1264,7 +1264,7 @@ void musig_test_vectors_sign(void) {
12641264
CHECK(musig_test_pk_parity(&keyagg_cache) == 1);
12651265
CHECK(!musig_test_is_second_pk(&keyagg_cache, sk));
12661266
CHECK(fin_nonce_parity == 1);
1267-
CHECK(memcmp(sig, sig_expected, 32) == 0);
1267+
CHECK(secp256k1_memcmp_var(sig, sig_expected, 32) == 0);
12681268
}
12691269
{
12701270
/* This is a test where the aggregate public key point has an _even_ y
@@ -1281,7 +1281,7 @@ void musig_test_vectors_sign(void) {
12811281
CHECK(musig_test_pk_parity(&keyagg_cache) == 0);
12821282
CHECK(musig_test_is_second_pk(&keyagg_cache, sk));
12831283
CHECK(fin_nonce_parity == 0);
1284-
CHECK(memcmp(sig, sig_expected, 32) == 0);
1284+
CHECK(secp256k1_memcmp_var(sig, sig_expected, 32) == 0);
12851285
}
12861286
{
12871287
/* This is a test where the parity of aggregate public key point (1) is unequal to the
@@ -1297,7 +1297,7 @@ void musig_test_vectors_sign(void) {
12971297
CHECK(musig_test_pk_parity(&keyagg_cache) == 1);
12981298
CHECK(fin_nonce_parity == 0);
12991299
CHECK(!musig_test_is_second_pk(&keyagg_cache, sk));
1300-
CHECK(memcmp(sig, sig_expected, 32) == 0);
1300+
CHECK(secp256k1_memcmp_var(sig, sig_expected, 32) == 0);
13011301
}
13021302
{
13031303
/* This is a test that includes an xonly public key tweak. */
@@ -1319,7 +1319,7 @@ void musig_test_vectors_sign(void) {
13191319
CHECK(musig_test_pk_parity(&keyagg_cache) == 1);
13201320
CHECK(!musig_test_is_second_pk(&keyagg_cache, sk));
13211321
CHECK(fin_nonce_parity == 1);
1322-
CHECK(memcmp(sig, sig_expected, 32) == 0);
1322+
CHECK(secp256k1_memcmp_var(sig, sig_expected, 32) == 0);
13231323
}
13241324
{
13251325
/* This is a test that includes an ordinary public key tweak. */
@@ -1341,7 +1341,7 @@ void musig_test_vectors_sign(void) {
13411341
CHECK(musig_test_pk_parity(&keyagg_cache) == 1);
13421342
CHECK(!musig_test_is_second_pk(&keyagg_cache, sk));
13431343
CHECK(fin_nonce_parity == 0);
1344-
CHECK(memcmp(sig, sig_expected, 32) == 0);
1344+
CHECK(secp256k1_memcmp_var(sig, sig_expected, 32) == 0);
13451345
}
13461346
{
13471347
/* This is a test that includes an ordinary and an x-only public key tweak. */
@@ -1371,7 +1371,7 @@ void musig_test_vectors_sign(void) {
13711371
CHECK(musig_test_pk_parity(&keyagg_cache) == 0);
13721372
CHECK(!musig_test_is_second_pk(&keyagg_cache, sk));
13731373
CHECK(fin_nonce_parity == 0);
1374-
CHECK(memcmp(sig, sig_expected, 32) == 0);
1374+
CHECK(secp256k1_memcmp_var(sig, sig_expected, 32) == 0);
13751375
}
13761376
{
13771377
/* This is a test with four tweaks: x-only, ordinary, x-only, ordinary. */
@@ -1412,7 +1412,7 @@ void musig_test_vectors_sign(void) {
14121412
CHECK(musig_test_pk_parity(&keyagg_cache) == 0);
14131413
CHECK(!musig_test_is_second_pk(&keyagg_cache, sk));
14141414
CHECK(fin_nonce_parity == 1);
1415-
CHECK(memcmp(sig, sig_expected, 32) == 0);
1415+
CHECK(secp256k1_memcmp_var(sig, sig_expected, 32) == 0);
14161416
}
14171417
{
14181418
/* This is a test that includes an adaptor. */
@@ -1435,7 +1435,7 @@ void musig_test_vectors_sign(void) {
14351435
CHECK(musig_test_pk_parity(&keyagg_cache) == 1);
14361436
CHECK(!musig_test_is_second_pk(&keyagg_cache, sk));
14371437
CHECK(fin_nonce_parity == 1);
1438-
CHECK(memcmp(sig, sig_expected, 32) == 0);
1438+
CHECK(secp256k1_memcmp_var(sig, sig_expected, 32) == 0);
14391439
}
14401440
}
14411441

‎src/modules/rangeproof/borromean.h

+5-5
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@
88
#ifndef _SECP256K1_BORROMEAN_H_
99
#define _SECP256K1_BORROMEAN_H_
1010

11-
#include "scalar.h"
12-
#include "field.h"
13-
#include "group.h"
14-
#include "ecmult.h"
15-
#include "ecmult_gen.h"
11+
#include "../../scalar.h"
12+
#include "../../field.h"
13+
#include "../../group.h"
14+
#include "../../ecmult.h"
15+
#include "../../ecmult_gen.h"
1616

1717
int secp256k1_borromean_verify(secp256k1_scalar *evalues, const unsigned char *e0, const secp256k1_scalar *s,
1818
const secp256k1_gej *pubs, const size_t *rsizes, size_t nrings, const unsigned char *m, size_t mlen);

‎src/modules/rangeproof/borromean_impl.h

+8-8
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,13 @@
88
#ifndef _SECP256K1_BORROMEAN_IMPL_H_
99
#define _SECP256K1_BORROMEAN_IMPL_H_
1010

11-
#include "scalar.h"
12-
#include "field.h"
13-
#include "group.h"
14-
#include "hash.h"
15-
#include "eckey.h"
16-
#include "ecmult.h"
17-
#include "ecmult_gen.h"
11+
#include "../../scalar.h"
12+
#include "../../field.h"
13+
#include "../../group.h"
14+
#include "../../hash.h"
15+
#include "../../eckey.h"
16+
#include "../../ecmult.h"
17+
#include "../../ecmult_gen.h"
1818
#include "borromean.h"
1919

2020
#include <limits.h>
@@ -105,7 +105,7 @@ int secp256k1_borromean_verify(secp256k1_scalar *evalues, const unsigned char *e
105105
}
106106
secp256k1_sha256_write(&sha256_e0, m, mlen);
107107
secp256k1_sha256_finalize(&sha256_e0, tmp);
108-
return memcmp(e0, tmp, 32) == 0;
108+
return secp256k1_memcmp_var(e0, tmp, 32) == 0;
109109
}
110110

111111
int secp256k1_borromean_sign(const secp256k1_ecmult_gen_context *ecmult_gen_ctx,

‎src/modules/rangeproof/main_impl.h

+84-4
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@
77
#ifndef SECP256K1_MODULE_RANGEPROOF_MAIN
88
#define SECP256K1_MODULE_RANGEPROOF_MAIN
99

10-
#include "group.h"
10+
#include "../../group.h"
1111

12-
#include "modules/rangeproof/pedersen_impl.h"
13-
#include "modules/rangeproof/borromean_impl.h"
14-
#include "modules/rangeproof/rangeproof_impl.h"
12+
#include "pedersen_impl.h"
13+
#include "borromean_impl.h"
14+
#include "rangeproof_impl.h"
1515

1616
/** Alternative generator for secp256k1.
1717
* This is the sha256 of 'g' after standard encoding (without compression),
@@ -165,6 +165,74 @@ int secp256k1_pedersen_verify_tally(const secp256k1_context* ctx, const secp256k
165165
return secp256k1_gej_is_infinity(&accj);
166166
}
167167

168+
int secp256k1_netbf_compute(const secp256k1_context* ctx, unsigned char* output, uint64_t val, const unsigned char* vbf, const unsigned char* abf) {
169+
int overflow = 0;
170+
secp256k1_scalar vbf_s;
171+
secp256k1_scalar abf_s;
172+
173+
VERIFY_CHECK(ctx != NULL);
174+
ARG_CHECK(output != NULL);
175+
ARG_CHECK(vbf != NULL);
176+
ARG_CHECK(abf != NULL);
177+
(void) ctx;
178+
179+
secp256k1_scalar_set_b32(&abf_s, abf, &overflow);
180+
if (overflow == 1) {
181+
return 0;
182+
}
183+
secp256k1_scalar_set_u64(&vbf_s, val);
184+
secp256k1_scalar_mul(&abf_s, &abf_s, &vbf_s);
185+
186+
secp256k1_scalar_set_b32(&vbf_s, vbf, &overflow);
187+
if (overflow == 1) {
188+
return 0;
189+
}
190+
secp256k1_scalar_add(&vbf_s, &vbf_s, &abf_s);
191+
192+
secp256k1_scalar_get_b32(output, &vbf_s);
193+
return 1;
194+
}
195+
196+
int secp256k1_netbf_acc(const secp256k1_context* ctx, unsigned char* acc, const unsigned char* nbf) {
197+
int overflow = 0;
198+
secp256k1_scalar ret_s;
199+
secp256k1_scalar nbf_s;
200+
201+
VERIFY_CHECK(ctx != NULL);
202+
ARG_CHECK(acc != NULL);
203+
ARG_CHECK(nbf != NULL);
204+
205+
secp256k1_scalar_set_b32(&ret_s, acc, &overflow);
206+
if (overflow == 1) {
207+
return 0;
208+
}
209+
secp256k1_scalar_set_b32(&nbf_s, nbf, &overflow);
210+
if (overflow == 1) {
211+
return 0;
212+
}
213+
214+
secp256k1_scalar_add(&ret_s, &ret_s, &nbf_s);
215+
secp256k1_scalar_get_b32(acc, &ret_s);
216+
return 1;
217+
}
218+
219+
int secp256k1_netbf_neg(const secp256k1_context* ctx, unsigned char* acc) {
220+
int overflow = 0;
221+
secp256k1_scalar ret_s;
222+
223+
VERIFY_CHECK(ctx != NULL);
224+
ARG_CHECK(acc != NULL);
225+
226+
secp256k1_scalar_set_b32(&ret_s, acc, &overflow);
227+
if (overflow == 1) {
228+
return 0;
229+
}
230+
231+
secp256k1_scalar_negate(&ret_s, &ret_s);
232+
secp256k1_scalar_get_b32(acc, &ret_s);
233+
return 1;
234+
}
235+
168236
int secp256k1_pedersen_blind_generator_blind_sum(const secp256k1_context* ctx, const uint64_t *value, const unsigned char* const* generator_blind, unsigned char* const* blinding_factor, size_t n_total, size_t n_inputs) {
169237
secp256k1_scalar sum;
170238
secp256k1_scalar tmp;
@@ -304,4 +372,16 @@ int secp256k1_rangeproof_sign(const secp256k1_context* ctx, unsigned char *proof
304372
proof, plen, min_value, &commitp, blind, nonce, exp, min_bits, value, message, msg_len, extra_commit, extra_commit_len, &genp);
305373
}
306374

375+
size_t secp256k1_rangeproof_max_size(const secp256k1_context* ctx, uint64_t max_value, int min_bits) {
376+
const int val_mantissa = max_value > 0 ? 64 - secp256k1_clz64_var(max_value) : 1;
377+
const int mantissa = min_bits > val_mantissa ? min_bits : val_mantissa;
378+
const size_t rings = (mantissa + 1) / 2;
379+
const size_t npubs = rings * 4 - 2 * (mantissa % 2);
380+
381+
VERIFY_CHECK(ctx != NULL);
382+
(void) ctx;
383+
384+
return 10 + 32 * (npubs + rings - 1) + 32 + ((rings - 1 + 7) / 8);
385+
}
386+
307387
#endif

‎src/modules/rangeproof/pedersen.h

+3-3
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@
77
#ifndef _SECP256K1_PEDERSEN_H_
88
#define _SECP256K1_PEDERSEN_H_
99

10-
#include "ecmult_gen.h"
11-
#include "group.h"
12-
#include "scalar.h"
10+
#include "../../ecmult_gen.h"
11+
#include "../../group.h"
12+
#include "../../scalar.h"
1313

1414
#include <stdint.h>
1515

‎src/modules/rangeproof/pedersen_impl.h

+7-7
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@
99

1010
#include <string.h>
1111

12-
#include "eckey.h"
13-
#include "ecmult_const.h"
14-
#include "ecmult_gen.h"
15-
#include "group.h"
16-
#include "field.h"
17-
#include "scalar.h"
18-
#include "util.h"
12+
#include "../../eckey.h"
13+
#include "../../ecmult_const.h"
14+
#include "../../ecmult_gen.h"
15+
#include "../../group.h"
16+
#include "../../field.h"
17+
#include "../../scalar.h"
18+
#include "../../util.h"
1919

2020
static void secp256k1_pedersen_scalar_set_u64(secp256k1_scalar *sec, uint64_t value) {
2121
unsigned char data[32];

‎src/modules/rangeproof/rangeproof.h

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@
77
#ifndef _SECP256K1_RANGEPROOF_H_
88
#define _SECP256K1_RANGEPROOF_H_
99

10-
#include "scalar.h"
11-
#include "group.h"
12-
#include "ecmult.h"
13-
#include "ecmult_gen.h"
10+
#include "../../scalar.h"
11+
#include "../../group.h"
12+
#include "../../ecmult.h"
13+
#include "../../ecmult_gen.h"
1414

1515
static int secp256k1_rangeproof_verify_impl(const secp256k1_ecmult_gen_context* ecmult_gen_ctx,
1616
unsigned char *blindout, uint64_t *value_out, unsigned char *message_out, size_t *outlen, const unsigned char *nonce,

‎src/modules/rangeproof/rangeproof_impl.h

+9-10
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,15 @@
77
#ifndef _SECP256K1_RANGEPROOF_IMPL_H_
88
#define _SECP256K1_RANGEPROOF_IMPL_H_
99

10-
#include "eckey.h"
11-
#include "scalar.h"
12-
#include "group.h"
13-
#include "rangeproof.h"
14-
#include "hash_impl.h"
15-
#include "pedersen_impl.h"
16-
#include "util.h"
10+
#include "../../eckey.h"
11+
#include "../../scalar.h"
12+
#include "../../group.h"
13+
#include "../../hash_impl.h"
14+
#include "../../util.h"
1715

18-
#include "modules/rangeproof/pedersen.h"
19-
#include "modules/rangeproof/borromean.h"
16+
#include "pedersen.h"
17+
#include "rangeproof.h"
18+
#include "borromean.h"
2019

2120
SECP256K1_INLINE static void secp256k1_rangeproof_pub_expand(secp256k1_gej *pubs,
2221
int exp, size_t *rsizes, size_t rings, const secp256k1_ge* genp) {
@@ -402,7 +401,7 @@ SECP256K1_INLINE static int secp256k1_rangeproof_rewind_inner(secp256k1_scalar *
402401
idx = npub + rsizes[rings - 1] - 1 - j;
403402
secp256k1_scalar_get_b32(tmp, &s[idx]);
404403
secp256k1_rangeproof_ch32xor(tmp, &prep[idx * 32]);
405-
if ((tmp[0] & 128) && (memcmp(&tmp[16], &tmp[24], 8) == 0) && (memcmp(&tmp[8], &tmp[16], 8) == 0)) {
404+
if ((tmp[0] & 128) && (secp256k1_memcmp_var(&tmp[16], &tmp[24], 8) == 0) && (secp256k1_memcmp_var(&tmp[8], &tmp[16], 8) == 0)) {
406405
value = 0;
407406
for (i = 0; i < 8; i++) {
408407
value = (value << 8) + tmp[24 + i];

‎src/modules/rangeproof/tests_impl.h

+953-20
Large diffs are not rendered by default.

‎src/modules/surjection/main_impl.h

+19-11
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@
1313
#include "libsecp256k1-config.h"
1414
#endif
1515

16-
#include "include/secp256k1_rangeproof.h"
17-
#include "include/secp256k1_surjectionproof.h"
18-
#include "modules/rangeproof/borromean.h"
19-
#include "modules/surjection/surjection_impl.h"
20-
#include "hash.h"
16+
#include "../../../include/secp256k1_rangeproof.h"
17+
#include "../../../include/secp256k1_surjectionproof.h"
18+
#include "../rangeproof/borromean.h"
19+
#include "surjection_impl.h"
20+
#include "../../hash.h"
2121

2222
#ifdef USE_REDUCED_SURJECTION_PROOF_SIZE
2323
#undef SECP256K1_SURJECTIONPROOF_MAX_USED_INPUTS
@@ -243,7 +243,7 @@ int secp256k1_surjectionproof_initialize(const secp256k1_context* ctx, secp256k1
243243
while (1) {
244244
size_t next_input_index;
245245
next_input_index = secp256k1_surjectionproof_csprng_next(&csprng, n_input_tags);
246-
if (memcmp(&fixed_input_tags[next_input_index], fixed_output_tag, sizeof(*fixed_output_tag)) == 0) {
246+
if (secp256k1_memcmp_var(&fixed_input_tags[next_input_index], fixed_output_tag, sizeof(*fixed_output_tag)) == 0) {
247247
*input_index = next_input_index;
248248
has_output_tag = 1;
249249
}
@@ -298,6 +298,10 @@ int secp256k1_surjectionproof_generate(const secp256k1_context* ctx, secp256k1_s
298298
CHECK(proof->initialized == 1);
299299
#endif
300300

301+
n_used_pubkeys = secp256k1_surjectionproof_n_used_inputs(ctx, proof);
302+
/* This must be true if the proof was created with surjectionproof_initialize */
303+
ARG_CHECK(n_used_pubkeys > 0);
304+
301305
/* Compute secret key */
302306
secp256k1_scalar_set_b32(&tmps, input_blinding_key, &overflow);
303307
if (overflow) {
@@ -307,17 +311,21 @@ int secp256k1_surjectionproof_generate(const secp256k1_context* ctx, secp256k1_s
307311
if (overflow) {
308312
return 0;
309313
}
310-
/* The only time the input may equal the output is if neither one was blinded in the first place,
311-
* i.e. both blinding keys are zero. Otherwise this is a privacy leak. */
312-
if (secp256k1_scalar_eq(&tmps, &blinding_key) && !secp256k1_scalar_is_zero(&blinding_key)) {
313-
return 0;
314+
/* If any input tag is equal to an output tag, verification will fail, because our ring
315+
* signature logic would receive a zero-key, which is illegal. This is unfortunate but
316+
* it is deployed on Liquid and cannot be fixed without a hardfork. We should review
317+
* this at the same time that we relax the max-256-inputs rule. */
318+
for (i = 0; i < n_ephemeral_input_tags; i++) {
319+
if (secp256k1_memcmp_var(ephemeral_input_tags[i].data, ephemeral_output_tag->data, sizeof(ephemeral_output_tag->data)) == 0) {
320+
return 0;
321+
}
314322
}
315323
secp256k1_scalar_negate(&tmps, &tmps);
316324
secp256k1_scalar_add(&blinding_key, &blinding_key, &tmps);
317325

318326
/* Compute public keys */
319327
n_total_pubkeys = secp256k1_surjectionproof_n_total_inputs(ctx, proof);
320-
n_used_pubkeys = secp256k1_surjectionproof_n_used_inputs(ctx, proof);
328+
321329
if (n_used_pubkeys > n_total_pubkeys || n_total_pubkeys != n_ephemeral_input_tags) {
322330
return 0;
323331
}

‎src/modules/surjection/surjection.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
#ifndef _SECP256K1_SURJECTION_H_
88
#define _SECP256K1_SURJECTION_H_
99

10-
#include "group.h"
11-
#include "scalar.h"
10+
#include "../../group.h"
11+
#include "../../scalar.h"
1212

1313
SECP256K1_INLINE static int secp256k1_surjection_genmessage(unsigned char *msg32, secp256k1_ge *ephemeral_input_tags, size_t n_input_tags, secp256k1_ge *ephemeral_output_tag);
1414

‎src/modules/surjection/surjection_impl.h

+4-4
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,10 @@
1010
#include <assert.h>
1111
#include <string.h>
1212

13-
#include "eckey.h"
14-
#include "group.h"
15-
#include "scalar.h"
16-
#include "hash.h"
13+
#include "../../eckey.h"
14+
#include "../../group.h"
15+
#include "../../scalar.h"
16+
#include "../../hash.h"
1717

1818
SECP256K1_INLINE static void secp256k1_surjection_genmessage(unsigned char *msg32, const secp256k1_generator *ephemeral_input_tags, size_t n_input_tags, const secp256k1_generator *ephemeral_output_tag) {
1919
/* compute message */

‎src/modules/surjection/tests_impl.h

+53-13
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@
77
#ifndef SECP256K1_MODULE_SURJECTIONPROOF_TESTS
88
#define SECP256K1_MODULE_SURJECTIONPROOF_TESTS
99

10-
#include "testrand.h"
11-
#include "group.h"
12-
#include "include/secp256k1_generator.h"
13-
#include "include/secp256k1_rangeproof.h"
14-
#include "include/secp256k1_surjectionproof.h"
10+
#include "../../testrand.h"
11+
#include "../../group.h"
12+
#include "../../../include/secp256k1_generator.h"
13+
#include "../../../include/secp256k1_rangeproof.h"
14+
#include "../../../include/secp256k1_surjectionproof.h"
1515

1616
static void test_surjectionproof_api(void) {
1717
unsigned char seed[32];
@@ -173,31 +173,45 @@ static void test_surjectionproof_api(void) {
173173
CHECK(secp256k1_surjectionproof_verify(vrfy, &proof, ephemeral_input_tags, n_inputs, NULL) == 0);
174174
CHECK(ecount == 16);
175175

176+
/* Test how surjectionproof_generate fails when the proof was not created
177+
* with surjectionproof_initialize */
178+
ecount = 0;
179+
CHECK(secp256k1_surjectionproof_generate(sign, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 1);
180+
{
181+
secp256k1_surjectionproof tmp_proof = proof;
182+
tmp_proof.n_inputs = 0;
183+
CHECK(secp256k1_surjectionproof_generate(sign, &tmp_proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 0);
184+
}
185+
CHECK(ecount == 1);
186+
187+
CHECK(secp256k1_surjectionproof_generate(sign, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 1);
188+
176189
/* Check serialize */
190+
ecount = 0;
177191
serialized_len = sizeof(serialized_proof);
178192
CHECK(secp256k1_surjectionproof_serialize(none, serialized_proof, &serialized_len, &proof) != 0);
179-
CHECK(ecount == 16);
193+
CHECK(ecount == 0);
180194
serialized_len = sizeof(serialized_proof);
181195
CHECK(secp256k1_surjectionproof_serialize(none, NULL, &serialized_len, &proof) == 0);
182-
CHECK(ecount == 17);
196+
CHECK(ecount == 1);
183197
serialized_len = sizeof(serialized_proof);
184198
CHECK(secp256k1_surjectionproof_serialize(none, serialized_proof, NULL, &proof) == 0);
185-
CHECK(ecount == 18);
199+
CHECK(ecount == 2);
186200
serialized_len = sizeof(serialized_proof);
187201
CHECK(secp256k1_surjectionproof_serialize(none, serialized_proof, &serialized_len, NULL) == 0);
188-
CHECK(ecount == 19);
202+
CHECK(ecount == 3);
189203

190204
serialized_len = sizeof(serialized_proof);
191205
CHECK(secp256k1_surjectionproof_serialize(none, serialized_proof, &serialized_len, &proof) != 0);
192206
/* Check parse */
193207
CHECK(secp256k1_surjectionproof_parse(none, &proof, serialized_proof, serialized_len) != 0);
194-
CHECK(ecount == 19);
208+
CHECK(ecount == 3);
195209
CHECK(secp256k1_surjectionproof_parse(none, NULL, serialized_proof, serialized_len) == 0);
196-
CHECK(ecount == 20);
210+
CHECK(ecount == 4);
197211
CHECK(secp256k1_surjectionproof_parse(none, &proof, NULL, serialized_len) == 0);
198-
CHECK(ecount == 21);
212+
CHECK(ecount == 5);
199213
CHECK(secp256k1_surjectionproof_parse(none, &proof, serialized_proof, 0) == 0);
200-
CHECK(ecount == 21);
214+
CHECK(ecount == 5);
201215

202216
secp256k1_context_destroy(none);
203217
secp256k1_context_destroy(sign);
@@ -524,6 +538,31 @@ void test_bad_parse(void) {
524538
CHECK(secp256k1_surjectionproof_parse(ctx, &proof, serialized_proof2, sizeof(serialized_proof2)) == 0);
525539
}
526540

541+
void test_input_eq_output(void) {
542+
secp256k1_surjectionproof proof;
543+
secp256k1_fixed_asset_tag fixed_tag;
544+
secp256k1_generator ephemeral_tag;
545+
unsigned char blinding_key[32];
546+
unsigned char entropy[32];
547+
size_t input_index;
548+
549+
secp256k1_testrand256(fixed_tag.data);
550+
secp256k1_testrand256(blinding_key);
551+
secp256k1_testrand256(entropy);
552+
553+
CHECK(secp256k1_surjectionproof_initialize(ctx, &proof, &input_index, &fixed_tag, 1, 1, &fixed_tag, 100, entropy) == 1);
554+
CHECK(input_index == 0);
555+
556+
/* Generation should fail */
557+
CHECK(secp256k1_generator_generate_blinded(ctx, &ephemeral_tag, fixed_tag.data, blinding_key));
558+
CHECK(!secp256k1_surjectionproof_generate(ctx, &proof, &ephemeral_tag, 1, &ephemeral_tag, input_index, blinding_key, blinding_key));
559+
560+
/* ...even when the blinding key is zero */
561+
memset(blinding_key, 0, 32);
562+
CHECK(secp256k1_generator_generate_blinded(ctx, &ephemeral_tag, fixed_tag.data, blinding_key));
563+
CHECK(!secp256k1_surjectionproof_generate(ctx, &proof, &ephemeral_tag, 1, &ephemeral_tag, input_index, blinding_key, blinding_key));
564+
}
565+
527566
void test_fixed_vectors(void) {
528567
const unsigned char tag0_ser[] = {
529568
0x0a,
@@ -672,6 +711,7 @@ void test_fixed_vectors(void) {
672711

673712
void run_surjection_tests(void) {
674713
test_surjectionproof_api();
714+
test_input_eq_output();
675715
test_fixed_vectors();
676716

677717
test_input_selection(0);

‎src/modules/whitelist/main_impl.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
#ifndef SECP256K1_MODULE_WHITELIST_MAIN
88
#define SECP256K1_MODULE_WHITELIST_MAIN
99

10-
#include "include/secp256k1_whitelist.h"
11-
#include "modules/whitelist/whitelist_impl.h"
10+
#include "../../../include/secp256k1_whitelist.h"
11+
#include "whitelist_impl.h"
1212

1313
#define MAX_KEYS SECP256K1_WHITELIST_MAX_N_KEYS /* shorter alias */
1414

‎src/modules/whitelist/tests_impl.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
#ifndef SECP256K1_MODULE_WHITELIST_TESTS
88
#define SECP256K1_MODULE_WHITELIST_TESTS
99

10-
#include "include/secp256k1_whitelist.h"
10+
#include "../../../include/secp256k1_whitelist.h"
1111

1212
void test_whitelist_end_to_end_internal(const unsigned char *summed_seckey, const unsigned char *online_seckey, const secp256k1_pubkey *online_pubkeys, const secp256k1_pubkey *offline_pubkeys, const secp256k1_pubkey *sub_pubkey, const size_t signer_i, const size_t n_keys) {
1313
unsigned char serialized[32 + 4 + 32 * SECP256K1_WHITELIST_MAX_N_KEYS] = {0};

0 commit comments

Comments
 (0)
Please sign in to comment.