secp256k1

secp256k1 copied to clipboard

Nonce functions

5

At the moment you can call `secp256k1_ecdsa_sign` with parameters `noncefp == NULL` and `noncedata != NULL`. This basically says "give me whatever function you think you should be the default...

real-or-random

Tests on embedded platforms

2

> right now the tests are hard to make run on any low memory target. Is this because of heap allocation? too much stack allocation? something else? if you could...

real-or-random

secp256k1_scalar_check_overflow is not constant time on S390

10

This is an odd architecture and is mostly interesting here just because its the only BE system available in the CI system. It compiles the following simple code into variable...

gmaxwell

Report build configuration in test/bench output

3

Suggested here: https://github.com/bitcoin-core/secp256k1/pull/793#issuecomment-671322287 This should include explicitly selected configuration options (the ones passed through through `libsecp256k1-config.h`), but also C-detected configuration like added in #787 (endianness) and #793 (__int128).

sipa

Use double-wide types for additions in scalar code

11

Suggested [here](https://github.com/bitcoin-core/secp256k1/pull/772#issuecomment-667884910) by Andy Polyakov. This is shorter, easier to reason about, more likely to not contain branches, and likely (slightly) faster too.

sipa

Remove lax DER parsing functions from contrib

9

This is an attempt at solving #758 and this is up for discussion. The underlying issue is that downstream copied the code of `ecdsa_signature_parse_der_lax` to their files (as initially intended)....

real-or-random

secp256k1_scalar_cmov not constant-time on ICC

5

AMD64 ICC 19.1.2.254 ``` ==407113== Conditional jump or move depends on uninitialised value(s) ==407113== at 0x485FB93: secp256k1_ec_pubkey_create (secp256k1.c:568) ==407113== by 0x401490: main (valgrind_ctime_test.c:56) ==407113== ==407113== Conditional jump or move depends...

real-or-random

Add valgrind constant-time test to `make check`

24

I'm not sure about the second commit. The local `./libtool` works for me and I see no reason why we should use the system libtool. Let's see what travis says....

real-or-random

Missing early clobber

3

In scalar_4x64_impl.h, function secp256k1_scalar_reduce_512. The first asm block is missing early clobber for m0~m2. The input %rsi is used after writing to m0, m1 and m2. Any of those write...

ehoffman2

see https://github.com/bitcoin/bitcoin/pull/19228#issuecomment-643406092 and also https://github.com/bitcoin/bitcoin/pull/19228#issuecomment-641795558

real-or-random