musig: Invalidate secnonce in secp256k1_musig_partial_sign by john-moffett · Pull Request #1735 · bitcoin-core/secp256k1

john-moffett · 2025-09-04T19:12:28Z

Replace memset which can still be optimized out as secnonce isn't read later in this function. The API makes it clear the callee is responsible for it, so we need to assure it's cleared properly.

real-or-random · 2025-09-05T06:49:38Z

Replace memset which can still be optimized out as secnonce isn't read later in this function.

Why do you think it can be optimized out? I think it can be optimized out if the compiler can prove that no other code will read it. That seems unlikely, as the call is an API call. But if the compiler can prove this, then it's indeed fine to optimize it out? Or are you saying we should make absolutely sure that it's cleared out, even if the caller won't read it? Perhaps.

real-or-random · 2025-09-05T08:44:43Z

cc @jonasnick who wrote this module

jonasnick

Thanks @john-moffett. I think it would be an improvement to use secp256k1_memclear in this case.

But if the compiler can prove this, then it's indeed fine to optimize it out?

I think in this case it still makes sense to clear it to try to avoid having secret data in memory that we don't use anymore. This is also the argument for clearing local secret variables at the end of functions.

john-moffett · 2025-09-05T14:20:25Z

Why do you think it can be optimized out? I think it can be optimized out if the compiler can prove that no other code will read it. That seems unlikely, as the call is an API call.

I agree that it's unlikely to be optimized out, and I confirmed on my setup (arm64 macOS Clang 17.0.0) that even with -O3 and full LTO that it wasn't. However, that's not guaranteed since it's possible a different compiler (or later version) can prove no later reads, so I figured it's just best practice to use a wiper much less likely to be DSE'd.

But if the compiler can prove this, then it's indeed fine to optimize it out? Or are you saying we should make absolutely sure that it's cleared out, even if the caller won't read it?

The latter. If they assumed the callee wiped the memory (as is promised in the API comment), they might not bother themselves and it could be left in caller memory.

jonasnick · 2025-09-05T17:59:13Z

@john-moffett Can you remove the remaining declassify call as well?

jonasnick

ACK d872a08

real-or-random · 2025-09-08T07:40:31Z

I agree it's better to prevent the compiler from optimizing out that store.

I'm not sure if this PR adds another code smell. I know it's me who suggested secp256k1_memclear above. In the rest of the code base, we use secp256k1_memclear to nuke memory contents. This is true here as well, but here we want the additional guarantee that the memory is overwritten by zero bytes. That fits the current implementation but not the documented contract of secp256k1_memclear. An implementation that overwrites everything with 0x42 is equally correct. We simply picked 0x00 because it appears to be faster. I doubt that will change in the future, but I still think we should avoid the contract violation.

What could we do instead?

We could use secp256k1_memclear but rename secp256k1_memclear to secp256k1_memzero and change its docs to guarantee it writes zeros. There's nothing wrong with adding that guarantee, but I don't think the result will be much cleaner if we only do this. We use SECP256K1_CHECKMEM_UNDEFINE inside this function for a reason. If the goal is to nuke a buffer, then there should be no legitimate reason to read the buffer again (as @jonasnick pointed out above). So nuking and zeroing are different concerns, and neither is a strict subset of the other. What we want in this specific case of zeroing the secnonce is simply both.

We could instead call secp256k1_memzero (after renaming) and then call SECP256K1_CHECKMEM_DEFINE. That's totally fine, and that's my suggestion. But we really should call SECP256K1_CHECKMEM_DEFINE inside the function and not only in the tests. If we provide the API guarantee that the secnonce is zeroed, then it's totally legitimate that the API user reads (if only in a test). And we don't want the user to get a Valgrind false positive when doing that!

We could also call secp256k1_memclear and then memset(..., 0, ...). That's also good. It may be a performance hit, but in any case a tiny one. (On Linux, the compiler should not be able to remove the second memset due to the memory barrier. But I wouldn't care too much.)

edit: @john-moffett Sorry that this PR escalated quickly given that the issue is seemingly simple...

jonasnick · 2025-09-08T12:12:17Z

If we provide the API guarantee that the secnonce is zeroed, then it's totally legitimate that the API user reads (if only in a test). And we don't want the user to get a Valgrind false positive when doing that!

That's a good point that I hadn't considered.

An alternative to your suggestion is to have both a memclear and memzero function, where the latter differs from the former by guaranteeing that the memory is overwritten with 0s and not calling CHECKMEM_UNDEFINE. We'd clear memory if we never read it again (and therefore do not care what it's being overwritten with) and we zero memory if we care what it's being overwritten with because it might be read again. I think this is cleaner because we wouldn't have to call CHECKMEM_DEFINE in musig_partial_sign (which seems like a code smell in and of itself).

john-moffett · 2025-09-08T12:35:04Z

An alternative to your suggestion is to have both a memclear and memzero function, where the latter differs from the former by guaranteeing that the memory is overwritten with 0s and not calling CHECKMEM_UNDEFINE

I was going to make the same suggestion. But is there any value in just reusing memczero and making it non-elidable in the same way memclear is (though SecureZeroMemory would have to be replaced with something suitable for conditional erase)? As a separate matter, is it worth making memczero non-elidable anyway? Perhaps not given its current usage.

@john-moffett Sorry that this PR escalated quickly given that the issue is seemingly simple..

No problem! I should've been aware of the issue from the start, but I've learned a lot, so I'm happy.

At this point, I think the memclear and (new) memzero separation is the cleanest.

john-moffett · 2025-09-08T13:20:43Z

I suppose this usage of memczero suffers from the same potential issue I initially raised in this PR, so maybe memczero ought to be hardened? I agree that it's unlikely that any current compiler would actually DSE any of the calls we've been discussing, but is the possibility enough to warrant a change?

real-or-random · 2025-09-08T13:28:48Z

An alternative to your suggestion is to have both a memclear and memzero function, where the latter differs from the former by guaranteeing that the memory is overwritten with 0s and not calling CHECKMEM_UNDEFINE

Ok, sure, that's another option. Concept ACK .

I was considering that option too, but I didn't mention it because I had the feeling that the existence of two functions may confuse future devs. But now that I think about it, I guess it's fine. Perhaps then we can make it clear from the naming that both variants protect against optimization, e.g., by adding an _explicit (inspired by memzero_explicit in the Linux kernel) or _secure suffix.

But is there any value in just reusing memczero and making it non-elidable in the same way memclear is (though SecureZeroMemory would have to be replaced with something suitable for conditional erase)?

As a separate matter, is it worth making memczero non-elidable anyway? Perhaps not given its current usage.

That's an interesting point you raise.

Regarding its usage: I think it was initially introduced to clear the pubkey when the secret key is invalid, but without leaking the fact that it is. But protecting the fact that it is already "above and beyond" and just defense-in-depth. And perhaps a bit questionable, though it won't hurt.

But all its three usages in musig/session_impl.h (two of them wrapped by _musig_secnonce_invalidate) are for clearing secrets, and this is where it gets interesting. In this case, I believe there's a tension here between protecting against two kinds of side-channels, namely timing/memory access (protecting the secrecy of the flag) vs. someone stealing secrets from a memory dump such as a crash dump (protecting the secrecy of the memory region).

How would a function look like that is both non-elidable and protects the flag? I have no idea, exactly due to platform-specific APIs such as SecureZeroMemory. That's the right way(TM) to clear memory on Windows, and I'm not at all convinced that it's a good idea to replace it, e.g., by a handrolled version. Or by falling back to the "volatile" function pointer trick, which is supposed to be portable, but who knows what compilers will do in the future and what they will do when they encounter "volatile", which pretty much has implementation-defined semantics. The nice thing about SecureMemoryZero is really that we get a guarantee from MSVC not to elide it. So I think memczero should stay entirely separate from memclear and memzero, at least for now.

So if we can't have the best of both worlds, we need to decide what protection we want. Currently, whenever we use memczero, we implicitly favor the protection of the flag, and this seems to be a questionable choice for its usages in musig/session_impl.h (or in general when clearing out secrets). I'd much rather give the attacker that one bit whether the secret key was invalid vs. taking the risk to keep the entire secnonce (or the entire nonce seed) somewhere on the stack. If we believe that this PR is a good idea, i.e., the clearing of the secnonce should better be non-elidable, then I think we should arrive at the same conclusion for the other three uses. And in particular this use here, where the flag is a constant anyway:

secp256k1/src/modules/musig/session_impl.h

Line 485 in 03fb60a

secp256k1_musig_secnonce_invalidate(ctx, secnonce, 1);

But this may be a larger discussion, and I'd like to hear @jonasnick's opinion on it. So my suggestion is to leave memczero for a follow-up PR. This PR here could then just add memzero as a variant of memclear, perhaps add a suffix to the names, and use it in _musig_partial_sign.

secp256k1_memclear has the side effect of undefining bytes for valgrind checks. In some cases, we may want to zero bytes but allow subsequent reads. So we split memclear into memclear_explicit, which makes no guarantees about the content of the buffer on return, and memzero_explicit, which guarantees zero value on return. Change the memset in partial_sign to use memzero_explicit.

real-or-random

utACK 399b582 thanks!

jonasnick · 2025-09-11T06:49:06Z

we use memczero, we implicitly favor the protection of the flag, and this seems to be a questionable choice for its usages in musig/session_impl.h. [...] And in particular this use here, where the flag is a constant anyway

I agree. We have issue #1621 pointing out the inconsistencies in handling constant-timeness with respect to invalid arguments in the library.

jonasnick

ACK 399b582

theStack · 2025-09-12T13:34:41Z

post-merge ACK 399b582

d543c0d917 Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework f44c1ebd96 Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors a44a339384 Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job 15d014804e ci: Drop default for `inputs.command` in `run-in-docker-action` 1decc49a1f ci: Use YAML anchor and aliases for repeated "CI script" steps dff1bc107d ci, refactor: Generalize use of `matrix.configuration.env_vars` 4b644da199 ci: Use YAML anchor and aliases for repeated "Print logs" steps a889cd93df ci: Bump `actions/checkout` version 574c2f3080 ci: Use YAML anchor and aliases for repeated "Checkout" steps 53585f93b7 ci: Use clang-snapshot in "MSan" job 6894c964f3 Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan 2b7337f63a Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements f163c35897 ci: Set `DEBIAN_FRONTEND=noninteractive` 70ae177ca0 ci: Bump `docker/build-push-action` version b2a95a420f ci: Drop `tags` input for `docker/build-push-action` 122014edb3 ci: Add `scope` parameter to `cache-{to,from}` options 2f4546ce56 test: add --log option to display tests execution 95b9953ea4 test: Add option to display all available tests 953f7b0088 test: support running specific tests/modules targets 0302c1a3d7 test: add --help for command-line options 9ec3bfe22d test: adapt modules to the new test infrastructure 48789dafc2 test: introduce (mini) unit test framework baa265429f Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once 4d90585fea docs: Improve API docs of _context_set_illegal_callback 895f53d1cf docs: Clarify that callback can be called more than once de6af6ae35 Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark 5817885153 Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check ab560078aa build: Fix warnings in x86_64 assembly check 10dab907e7 Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value dfe284ed2d bench: improve context creation in ECDH benchmark 7321bdf27b doc: clarify API doc of `secp256k1_ecdsa_recover` return value b475654302 Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication 9cce703863 refactor: move 'gettime_i64()' to tests_common.h 0c91c56041 test: introduce group order byte-array constant for deduplication 88be4e8d86 Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign 36e76952cb Merge bitcoin-core/secp256k1#1738: check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) 399b582a5f Split memclear into two versions 4985ac0f89 Merge bitcoin-core/secp256k1#1737: doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) 7ebaa134a7 check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) 806de38bfc doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) 03fb60ad2e Merge bitcoin-core/secp256k1#1681: doc: Recommend clang-cl when building on Windows d93380fb35 Merge bitcoin-core/secp256k1#1731: schnorrsig: Securely clear buf containing k or its negation 8113671f80 Merge bitcoin-core/secp256k1#1729: hash: Use size_t instead of int for RFC6979 outlen copy 325d65a8cf Rename and clear var containing k or -k 960ba5f9c6 Use size_t instead of int for RFC6979 outlen copy 737912430d ci: Add more tests for clang-cl 7379a5bed3 doc: Recommend clang-cl when building on Windows f36afb8b3d Merge bitcoin-core/secp256k1#1725: tests: refactor tagged hash verification 5153cf1c91 tests: refactor tagged hash tests d2dcf52091 Merge bitcoin-core/secp256k1#1726: docs: fix broken link to Tromer's cache.pdf paper 489a43d1bf docs: fix broken link to eprint cache.pdf paper d599714147 Merge bitcoin-core/secp256k1#1722: docs: Exclude modules' `bench_impl.h` headers from coverage report 0458def51e doc: Add `--gcov-ignore-parse-errors=all` option to `gcovr` invocations 1aecce5936 doc: Add `--merge-mode-functions=separate` option to `gcovr` invocations 106a7cbf41 doc: Exclude modules' `bench_impl.h` headers from coverage report a9e955d3ea autotools, docs: Adjust help string for `--enable-coverage` option e523e4f90e Merge bitcoin-core/secp256k1#1720: chore(ci): Fix typo in Dockerfile comment 24ba8ff168 chore(ci): Fix typo in Dockerfile comment 74b8068c5d Merge bitcoin-core/secp256k1#1717: test: update wycheproof test vectors c25c3c8a88 test: update wycheproof test vectors 20e3b44746 Merge bitcoin-core/secp256k1#1688: cmake: Avoid contaminating parent project's cache with `BUILD_SHARED_LIBS` 2c076d907a Merge bitcoin-core/secp256k1#1711: tests: update Wycheproof 7b07b22957 cmake: Avoid contaminating parent project's cache with BUILD_SHARED_LIBS 5433648ca0 Fix typos and spellings 9ea54c69b7 tests: update Wycheproof files git-subtree-dir: src/secp256k1 git-subtree-split: d543c0d917a76a201578948701cc30ef336e0fe6

1a53f4961f Merge bitcoin-core/secp256k1#1808: Prepare for 0.7.1 20a209f11c release: prepare for 0.7.1 c4b6a81a60 changelog: update in preparation for the v0.7.1 release ebb35882da Merge bitcoin-core/secp256k1#1796: bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS c09215f7af bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS 471e3a130d Merge bitcoin-core/secp256k1#1800: sage: verify Eisenstein integer connection for GLV constants 29ac4d8491 sage: verify Eisenstein integer connection for GLV constants 4721e077b4 Merge bitcoin-core/secp256k1#1793: doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult bd5ced1fe1 doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult 2d9137ce9d Merge bitcoin-core/secp256k1#1764: group: Avoid using infinity field directly in other modules f9a944ff2d Merge bitcoin-core/secp256k1#1790: doc: include arg -DSECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS=ON for cmake 0406cfc4d1 doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake 8d445730ec Merge bitcoin-core/secp256k1#1783: Add VERIFY_CHECKs and documentation that flags must be 0 or 1 aa2a39c1a7 Merge bitcoin-core/secp256k1#1778: doc/bench: Added cmake build options to bench error messages 540fec8ae9 Merge bitcoin-core/secp256k1#1788: test: split monolithic ellswift test into independent cases d822b29021 test: split monolithic ellswift test into independent cases ae00c552df Add VERIFY_CHECKs that flags are 0 or 1 5c75183344 Merge bitcoin-core/secp256k1#1784: refactor: remove ret from secp256k1_ec_pubkey_serialize be5e4f02fd Merge bitcoin-core/secp256k1#1779: Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3daab83a60 refactor: remove ret from secp256k1_ec_pubkey_serialize 8bcda186d2 test: Add non-NULL checks for "pointer of array" API functions 5a08c1bcdc Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3b5b03f301 doc/bench: Added cmake build options to bench error messages e7f7083b53 Merge bitcoin-core/secp256k1#1774: refactor: split up internal pubkey serialization function into compressed/uncompressed variants b6c2a3cd77 Merge bitcoin-core/secp256k1#1761: ecmult_multi: reduce strauss memory usage by 30% f5e815f430 remove secp256k1_eckey_pubkey_serialize function 0d3659c547 use new `_eckey_pubkey_serialize{33,65}` functions in modules (ellswift,musig) adb76f82ea use new `_eckey_pubkey_serialize{33,65}` functions in public API fc7458ca3e introduce `secp256k1_eckey_pubkey_serialize{33,65}` functions c8206b1ce6 Merge bitcoin-core/secp256k1#1771: ci: Use Python virtual environment in "x86_64-macos-native" job f252da7e6e ci: Use Python virtual environment in "x86_64-macos-native" job 115b135fe8 Merge bitcoin-core/secp256k1#1763: bench: Use `ALIGNMENT` macro instead of hardcoded value 2f73e5281d group: Avoid using infinity field directly in other modules 153eea20c2 bench: Use `ALIGNMENT` macro instead of hardcoded value 26166c4f5f ecmult_multi: reduce strauss memory usage by 30% 7a2fff85e8 Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0 43e7b115f7 Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image 8bc50b72ff ci: Switch to macOS 15 Sequoia Intel-based image c09519f0e3 ci: Drop workaround for Valgrind older than 3.20.0 d543c0d917 Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework f44c1ebd96 Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors a44a339384 Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job 15d014804e ci: Drop default for `inputs.command` in `run-in-docker-action` 1decc49a1f ci: Use YAML anchor and aliases for repeated "CI script" steps dff1bc107d ci, refactor: Generalize use of `matrix.configuration.env_vars` 4b644da199 ci: Use YAML anchor and aliases for repeated "Print logs" steps a889cd93df ci: Bump `actions/checkout` version 574c2f3080 ci: Use YAML anchor and aliases for repeated "Checkout" steps 53585f93b7 ci: Use clang-snapshot in "MSan" job 6894c964f3 Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan 2b7337f63a Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements f163c35897 ci: Set `DEBIAN_FRONTEND=noninteractive` 70ae177ca0 ci: Bump `docker/build-push-action` version b2a95a420f ci: Drop `tags` input for `docker/build-push-action` 122014edb3 ci: Add `scope` parameter to `cache-{to,from}` options 2f4546ce56 test: add --log option to display tests execution 95b9953ea4 test: Add option to display all available tests 953f7b0088 test: support running specific tests/modules targets 0302c1a3d7 test: add --help for command-line options 9ec3bfe22d test: adapt modules to the new test infrastructure 48789dafc2 test: introduce (mini) unit test framework baa265429f Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once 4d90585fea docs: Improve API docs of _context_set_illegal_callback 895f53d1cf docs: Clarify that callback can be called more than once de6af6ae35 Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark 5817885153 Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check ab560078aa build: Fix warnings in x86_64 assembly check 10dab907e7 Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value dfe284ed2d bench: improve context creation in ECDH benchmark 7321bdf27b doc: clarify API doc of `secp256k1_ecdsa_recover` return value b475654302 Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication 9cce703863 refactor: move 'gettime_i64()' to tests_common.h 0c91c56041 test: introduce group order byte-array constant for deduplication 88be4e8d86 Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign 36e76952cb Merge bitcoin-core/secp256k1#1738: check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) 399b582a5f Split memclear into two versions 4985ac0f89 Merge bitcoin-core/secp256k1#1737: doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) 7ebaa134a7 check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) 806de38bfc doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) 03fb60ad2e Merge bitcoin-core/secp256k1#1681: doc: Recommend clang-cl when building on Windows d93380fb35 Merge bitcoin-core/secp256k1#1731: schnorrsig: Securely clear buf containing k or its negation 8113671f80 Merge bitcoin-core/secp256k1#1729: hash: Use size_t instead of int for RFC6979 outlen copy 325d65a8cf Rename and clear var containing k or -k 960ba5f9c6 Use size_t instead of int for RFC6979 outlen copy 737912430d ci: Add more tests for clang-cl 7379a5bed3 doc: Recommend clang-cl when building on Windows f36afb8b3d Merge bitcoin-core/secp256k1#1725: tests: refactor tagged hash verification 5153cf1c91 tests: refactor tagged hash tests d2dcf52091 Merge bitcoin-core/secp256k1#1726: docs: fix broken link to Tromer's cache.pdf paper 489a43d1bf docs: fix broken link to eprint cache.pdf paper d599714147 Merge bitcoin-core/secp256k1#1722: docs: Exclude modules' `bench_impl.h` headers from coverage report 0458def51e doc: Add `--gcov-ignore-parse-errors=all` option to `gcovr` invocations 1aecce5936 doc: Add `--merge-mode-functions=separate` option to `gcovr` invocations 106a7cbf41 doc: Exclude modules' `bench_impl.h` headers from coverage report a9e955d3ea autotools, docs: Adjust help string for `--enable-coverage` option e523e4f90e Merge bitcoin-core/secp256k1#1720: chore(ci): Fix typo in Dockerfile comment 24ba8ff168 chore(ci): Fix typo in Dockerfile comment 74b8068c5d Merge bitcoin-core/secp256k1#1717: test: update wycheproof test vectors c25c3c8a88 test: update wycheproof test vectors 20e3b44746 Merge bitcoin-core/secp256k1#1688: cmake: Avoid contaminating parent project's cache with `BUILD_SHARED_LIBS` 2c076d907a Merge bitcoin-core/secp256k1#1711: tests: update Wycheproof 7b07b22957 cmake: Avoid contaminating parent project's cache with BUILD_SHARED_LIBS 5433648ca0 Fix typos and spellings 9ea54c69b7 tests: update Wycheproof files git-subtree-dir: src/secp256k1 git-subtree-split: 1a53f4961f337b4d166c25fce72ef0dc88806618

…p256k1#1734 to zkp-specific code

1a53f496 Merge bitcoin-core/secp256k1#1808: Prepare for 0.7.1 20a209f1 release: prepare for 0.7.1 c4b6a81a changelog: update in preparation for the v0.7.1 release ebb35882 Merge bitcoin-core/secp256k1#1796: bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS c09215f7 bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS 471e3a13 Merge bitcoin-core/secp256k1#1800: sage: verify Eisenstein integer connection for GLV constants 29ac4d84 sage: verify Eisenstein integer connection for GLV constants 4721e077 Merge bitcoin-core/secp256k1#1793: doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult bd5ced1f doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult 2d9137ce Merge bitcoin-core/secp256k1#1764: group: Avoid using infinity field directly in other modules f9a944ff Merge bitcoin-core/secp256k1#1790: doc: include arg -DSECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS=ON for cmake 0406cfc4 doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake 8d445730 Merge bitcoin-core/secp256k1#1783: Add VERIFY_CHECKs and documentation that flags must be 0 or 1 aa2a39c1 Merge bitcoin-core/secp256k1#1778: doc/bench: Added cmake build options to bench error messages 540fec8a Merge bitcoin-core/secp256k1#1788: test: split monolithic ellswift test into independent cases d822b290 test: split monolithic ellswift test into independent cases ae00c552 Add VERIFY_CHECKs that flags are 0 or 1 5c751833 Merge bitcoin-core/secp256k1#1784: refactor: remove ret from secp256k1_ec_pubkey_serialize be5e4f02 Merge bitcoin-core/secp256k1#1779: Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3daab83a refactor: remove ret from secp256k1_ec_pubkey_serialize 8bcda186 test: Add non-NULL checks for "pointer of array" API functions 5a08c1bc Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3b5b03f3 doc/bench: Added cmake build options to bench error messages e7f7083b Merge bitcoin-core/secp256k1#1774: refactor: split up internal pubkey serialization function into compressed/uncompressed variants b6c2a3cd Merge bitcoin-core/secp256k1#1761: ecmult_multi: reduce strauss memory usage by 30% f5e815f4 remove secp256k1_eckey_pubkey_serialize function 0d3659c5 use new `_eckey_pubkey_serialize{33,65}` functions in modules (ellswift,musig) adb76f82 use new `_eckey_pubkey_serialize{33,65}` functions in public API fc7458ca introduce `secp256k1_eckey_pubkey_serialize{33,65}` functions c8206b1c Merge bitcoin-core/secp256k1#1771: ci: Use Python virtual environment in "x86_64-macos-native" job f252da7e ci: Use Python virtual environment in "x86_64-macos-native" job 115b135f Merge bitcoin-core/secp256k1#1763: bench: Use `ALIGNMENT` macro instead of hardcoded value 2f73e528 group: Avoid using infinity field directly in other modules 153eea20 bench: Use `ALIGNMENT` macro instead of hardcoded value 26166c4f ecmult_multi: reduce strauss memory usage by 30% 7a2fff85 Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0 43e7b115 Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image 8bc50b72 ci: Switch to macOS 15 Sequoia Intel-based image c09519f0 ci: Drop workaround for Valgrind older than 3.20.0 d543c0d9 Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework f44c1ebd Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors a44a3393 Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job 15d01480 ci: Drop default for `inputs.command` in `run-in-docker-action` 1decc49a ci: Use YAML anchor and aliases for repeated "CI script" steps dff1bc10 ci, refactor: Generalize use of `matrix.configuration.env_vars` 4b644da1 ci: Use YAML anchor and aliases for repeated "Print logs" steps a889cd93 ci: Bump `actions/checkout` version 574c2f30 ci: Use YAML anchor and aliases for repeated "Checkout" steps 53585f93 ci: Use clang-snapshot in "MSan" job 6894c964 Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan 2b7337f6 Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements f163c358 ci: Set `DEBIAN_FRONTEND=noninteractive` 70ae177c ci: Bump `docker/build-push-action` version b2a95a42 ci: Drop `tags` input for `docker/build-push-action` 122014ed ci: Add `scope` parameter to `cache-{to,from}` options 2f4546ce test: add --log option to display tests execution 95b9953e test: Add option to display all available tests 953f7b00 test: support running specific tests/modules targets 0302c1a3 test: add --help for command-line options 9ec3bfe2 test: adapt modules to the new test infrastructure 48789daf test: introduce (mini) unit test framework baa26542 Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once 4d90585f docs: Improve API docs of _context_set_illegal_callback 895f53d1 docs: Clarify that callback can be called more than once de6af6ae Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark 58178851 Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check ab560078 build: Fix warnings in x86_64 assembly check 10dab907 Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value dfe284ed bench: improve context creation in ECDH benchmark 7321bdf2 doc: clarify API doc of `secp256k1_ecdsa_recover` return value b4756543 Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication 9cce7038 refactor: move 'gettime_i64()' to tests_common.h 0c91c560 test: introduce group order byte-array constant for deduplication 88be4e8d Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign 36e76952 Merge bitcoin-core/secp256k1#1738: check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) 399b582a Split memclear into two versions 4985ac0f Merge bitcoin-core/secp256k1#1737: doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) 7ebaa134 check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) 806de38b doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) 03fb60ad Merge bitcoin-core/secp256k1#1681: doc: Recommend clang-cl when building on Windows d93380fb Merge bitcoin-core/secp256k1#1731: schnorrsig: Securely clear buf containing k or its negation 8113671f Merge bitcoin-core/secp256k1#1729: hash: Use size_t instead of int for RFC6979 outlen copy 325d65a8 Rename and clear var containing k or -k 960ba5f9 Use size_t instead of int for RFC6979 outlen copy 73791243 ci: Add more tests for clang-cl 7379a5be doc: Recommend clang-cl when building on Windows f36afb8b Merge bitcoin-core/secp256k1#1725: tests: refactor tagged hash verification 5153cf1c tests: refactor tagged hash tests d2dcf520 Merge bitcoin-core/secp256k1#1726: docs: fix broken link to Tromer's cache.pdf paper 489a43d1 docs: fix broken link to eprint cache.pdf paper d5997141 Merge bitcoin-core/secp256k1#1722: docs: Exclude modules' `bench_impl.h` headers from coverage report 0458def5 doc: Add `--gcov-ignore-parse-errors=all` option to `gcovr` invocations 1aecce59 doc: Add `--merge-mode-functions=separate` option to `gcovr` invocations 106a7cbf doc: Exclude modules' `bench_impl.h` headers from coverage report a9e955d3 autotools, docs: Adjust help string for `--enable-coverage` option e523e4f9 Merge bitcoin-core/secp256k1#1720: chore(ci): Fix typo in Dockerfile comment 24ba8ff1 chore(ci): Fix typo in Dockerfile comment 74b8068c Merge bitcoin-core/secp256k1#1717: test: update wycheproof test vectors c25c3c8a test: update wycheproof test vectors 20e3b447 Merge bitcoin-core/secp256k1#1688: cmake: Avoid contaminating parent project's cache with `BUILD_SHARED_LIBS` 2c076d90 Merge bitcoin-core/secp256k1#1711: tests: update Wycheproof 7b07b229 cmake: Avoid contaminating parent project's cache with BUILD_SHARED_LIBS 5433648c Fix typos and spellings 9ea54c69 tests: update Wycheproof files b9313c6e Merge bitcoin-core/secp256k1#1708: release cleanup: bump version after 0.7.0 7ab8b0cc release cleanup: bump version after 0.7.0 git-subtree-dir: Vendor/secp256k1 git-subtree-split: 1a53f4961f337b4d166c25fce72ef0dc88806618

* chore: clean stale extractions for secp256k1 * Squashed 'Vendor/secp256k1/' content from commit a660a497 git-subtree-dir: Vendor/secp256k1 git-subtree-split: a660a4976efe880bae7982ee410b9e0dc59ac983 * Squashed 'Vendor/secp256k1/' changes from a660a497..1a53f496 1a53f496 Merge bitcoin-core/secp256k1#1808: Prepare for 0.7.1 20a209f1 release: prepare for 0.7.1 c4b6a81a changelog: update in preparation for the v0.7.1 release ebb35882 Merge bitcoin-core/secp256k1#1796: bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS c09215f7 bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS 471e3a13 Merge bitcoin-core/secp256k1#1800: sage: verify Eisenstein integer connection for GLV constants 29ac4d84 sage: verify Eisenstein integer connection for GLV constants 4721e077 Merge bitcoin-core/secp256k1#1793: doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult bd5ced1f doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult 2d9137ce Merge bitcoin-core/secp256k1#1764: group: Avoid using infinity field directly in other modules f9a944ff Merge bitcoin-core/secp256k1#1790: doc: include arg -DSECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS=ON for cmake 0406cfc4 doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake 8d445730 Merge bitcoin-core/secp256k1#1783: Add VERIFY_CHECKs and documentation that flags must be 0 or 1 aa2a39c1 Merge bitcoin-core/secp256k1#1778: doc/bench: Added cmake build options to bench error messages 540fec8a Merge bitcoin-core/secp256k1#1788: test: split monolithic ellswift test into independent cases d822b290 test: split monolithic ellswift test into independent cases ae00c552 Add VERIFY_CHECKs that flags are 0 or 1 5c751833 Merge bitcoin-core/secp256k1#1784: refactor: remove ret from secp256k1_ec_pubkey_serialize be5e4f02 Merge bitcoin-core/secp256k1#1779: Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3daab83a refactor: remove ret from secp256k1_ec_pubkey_serialize 8bcda186 test: Add non-NULL checks for "pointer of array" API functions 5a08c1bc Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3b5b03f3 doc/bench: Added cmake build options to bench error messages e7f7083b Merge bitcoin-core/secp256k1#1774: refactor: split up internal pubkey serialization function into compressed/uncompressed variants b6c2a3cd Merge bitcoin-core/secp256k1#1761: ecmult_multi: reduce strauss memory usage by 30% f5e815f4 remove secp256k1_eckey_pubkey_serialize function 0d3659c5 use new `_eckey_pubkey_serialize{33,65}` functions in modules (ellswift,musig) adb76f82 use new `_eckey_pubkey_serialize{33,65}` functions in public API fc7458ca introduce `secp256k1_eckey_pubkey_serialize{33,65}` functions c8206b1c Merge bitcoin-core/secp256k1#1771: ci: Use Python virtual environment in "x86_64-macos-native" job f252da7e ci: Use Python virtual environment in "x86_64-macos-native" job 115b135f Merge bitcoin-core/secp256k1#1763: bench: Use `ALIGNMENT` macro instead of hardcoded value 2f73e528 group: Avoid using infinity field directly in other modules 153eea20 bench: Use `ALIGNMENT` macro instead of hardcoded value 26166c4f ecmult_multi: reduce strauss memory usage by 30% 7a2fff85 Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0 43e7b115 Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image 8bc50b72 ci: Switch to macOS 15 Sequoia Intel-based image c09519f0 ci: Drop workaround for Valgrind older than 3.20.0 d543c0d9 Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework f44c1ebd Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors a44a3393 Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job 15d01480 ci: Drop default for `inputs.command` in `run-in-docker-action` 1decc49a ci: Use YAML anchor and aliases for repeated "CI script" steps dff1bc10 ci, refactor: Generalize use of `matrix.configuration.env_vars` 4b644da1 ci: Use YAML anchor and aliases for repeated "Print logs" steps a889cd93 ci: Bump `actions/checkout` version 574c2f30 ci: Use YAML anchor and aliases for repeated "Checkout" steps 53585f93 ci: Use clang-snapshot in "MSan" job 6894c964 Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan 2b7337f6 Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements f163c358 ci: Set `DEBIAN_FRONTEND=noninteractive` 70ae177c ci: Bump `docker/build-push-action` version b2a95a42 ci: Drop `tags` input for `docker/build-push-action` 122014ed ci: Add `scope` parameter to `cache-{to,from}` options 2f4546ce test: add --log option to display tests execution 95b9953e test: Add option to display all available tests 953f7b00 test: support running specific tests/modules targets 0302c1a3 test: add --help for command-line options 9ec3bfe2 test: adapt modules to the new test infrastructure 48789daf test: introduce (mini) unit test framework baa26542 Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once 4d90585f docs: Improve API docs of _context_set_illegal_callback 895f53d1 docs: Clarify that callback can be called more than once de6af6ae Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark 58178851 Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check ab560078 build: Fix warnings in x86_64 assembly check 10dab907 Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value dfe284ed bench: improve context creation in ECDH benchmark 7321bdf2 doc: clarify API doc of `secp256k1_ecdsa_recover` return value b4756543 Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication 9cce7038 refactor: move 'gettime_i64()' to tests_common.h 0c91c560 test: introduce group order byte-array constant for deduplication 88be4e8d Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign 36e76952 Merge bitcoin-core/secp256k1#1738: check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) 399b582a Split memclear into two versions 4985ac0f Merge bitcoin-core/secp256k1#1737: doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) 7ebaa134 check-abi: remove support for obsolete CMake library output location (src/libsecp256k1.so) 806de38b doc: mention ctx requirement for `_ellswift_create` (not secp256k1_context_static) 03fb60ad Merge bitcoin-core/secp256k1#1681: doc: Recommend clang-cl when building on Windows d93380fb Merge bitcoin-core/secp256k1#1731: schnorrsig: Securely clear buf containing k or its negation 8113671f Merge bitcoin-core/secp256k1#1729: hash: Use size_t instead of int for RFC6979 outlen copy 325d65a8 Rename and clear var containing k or -k 960ba5f9 Use size_t instead of int for RFC6979 outlen copy 73791243 ci: Add more tests for clang-cl 7379a5be doc: Recommend clang-cl when building on Windows f36afb8b Merge bitcoin-core/secp256k1#1725: tests: refactor tagged hash verification 5153cf1c tests: refactor tagged hash tests d2dcf520 Merge bitcoin-core/secp256k1#1726: docs: fix broken link to Tromer's cache.pdf paper 489a43d1 docs: fix broken link to eprint cache.pdf paper d5997141 Merge bitcoin-core/secp256k1#1722: docs: Exclude modules' `bench_impl.h` headers from coverage report 0458def5 doc: Add `--gcov-ignore-parse-errors=all` option to `gcovr` invocations 1aecce59 doc: Add `--merge-mode-functions=separate` option to `gcovr` invocations 106a7cbf doc: Exclude modules' `bench_impl.h` headers from coverage report a9e955d3 autotools, docs: Adjust help string for `--enable-coverage` option e523e4f9 Merge bitcoin-core/secp256k1#1720: chore(ci): Fix typo in Dockerfile comment 24ba8ff1 chore(ci): Fix typo in Dockerfile comment 74b8068c Merge bitcoin-core/secp256k1#1717: test: update wycheproof test vectors c25c3c8a test: update wycheproof test vectors 20e3b447 Merge bitcoin-core/secp256k1#1688: cmake: Avoid contaminating parent project's cache with `BUILD_SHARED_LIBS` 2c076d90 Merge bitcoin-core/secp256k1#1711: tests: update Wycheproof 7b07b229 cmake: Avoid contaminating parent project's cache with BUILD_SHARED_LIBS 5433648c Fix typos and spellings 9ea54c69 tests: update Wycheproof files b9313c6e Merge bitcoin-core/secp256k1#1708: release cleanup: bump version after 0.7.0 7ab8b0cc release cleanup: bump version after 0.7.0 git-subtree-dir: Vendor/secp256k1 git-subtree-split: 1a53f4961f337b4d166c25fce72ef0dc88806618 * chore(deps): update subtree secp256k1 to v0.7.1 * refactor: remove unit test framework files Remove unit_test.c and unit_test.h which are no longer needed after the test infrastructure refactoring. These files provided the mini unit test framework that has been replaced by the new test infrastructure. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: csjones <csjones@users.noreply.github.com>

…50, 1719, 1734, 1759, 1758 7111d36 modules, tests: Port bitcoin-core/secp256k1#1734 to zkp-specific code (DarkWindman) 7699fe9 modules: Port bitcoin-core/secp256k1#1735 to zkp-specific code (DarkWindman) c09519f ci: Drop workaround for Valgrind older than 3.20.0 (Hennadii Stepanov) 8bc50b7 ci: Switch to macOS 15 Sequoia Intel-based image (Hennadii Stepanov) 2f4546c test: add --log option to display tests execution (furszy) 95b9953 test: Add option to display all available tests (furszy) 953f7b0 test: support running specific tests/modules targets (furszy) 0302c1a test: add --help for command-line options (furszy) 9ec3bfe test: adapt modules to the new test infrastructure (furszy) 48789da test: introduce (mini) unit test framework (furszy) 9cce703 refactor: move 'gettime_i64()' to tests_common.h (furszy) 15d0148 ci: Drop default for `inputs.command` in `run-in-docker-action` (Hennadii Stepanov) 1decc49 ci: Use YAML anchor and aliases for repeated "CI script" steps (Hennadii Stepanov) dff1bc1 ci, refactor: Generalize use of `matrix.configuration.env_vars` (Hennadii Stepanov) 4b644da ci: Use YAML anchor and aliases for repeated "Print logs" steps (Hennadii Stepanov) a889cd9 ci: Bump `actions/checkout` version (Hennadii Stepanov) 574c2f3 ci: Use YAML anchor and aliases for repeated "Checkout" steps (Hennadii Stepanov) 53585f9 ci: Use clang-snapshot in "MSan" job (Hennadii Stepanov) 6894c96 Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan (Hennadii Stepanov) f163c35 ci: Set `DEBIAN_FRONTEND=noninteractive` (Hennadii Stepanov) 70ae177 ci: Bump `docker/build-push-action` version (Hennadii Stepanov) b2a95a4 ci: Drop `tags` input for `docker/build-push-action` (Hennadii Stepanov) 122014e ci: Add `scope` parameter to `cache-{to,from}` options (Hennadii Stepanov) 4d90585 docs: Improve API docs of _context_set_illegal_callback (Tim Ruffing) 895f53d docs: Clarify that callback can be called more than once (Tim Ruffing) dfe284e bench: improve context creation in ECDH benchmark (Sebastian Falbesoner) ab56007 build: Fix warnings in x86_64 assembly check (Hennadii Stepanov) 7321bdf doc: clarify API doc of `secp256k1_ecdsa_recover` return value (Jonas Nick) 0c91c56 test: introduce group order byte-array constant for deduplication (Sebastian Falbesoner) 399b582 Split memclear into two versions (John Moffett) Pull request description: Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0 This PR can be recreated with `./contrib/sync-upstream.sh -b master range 7a2fff8`. Tips: * Use `git show --remerge-diff <pr-branch>` to show the conflict resolution in the merge commit. * Use `git read-tree --reset -u <pr-branch>` to replay these resolutions during the conflict resolution stage when recreating the PR branch locally. Be aware that this may discard your index as well as the uncommitted changes and untracked files in your worktree. ACKs for top commit: real-or-random: ACK 7111d36 Tree-SHA512: 9f8fd21eee9ad3b7ea8d688f79783a43baffdeafb6b313372761ce368a24219a83c430c49070413f9972813ae03adde9a8660abfe4b0893b3700e241a81e5b13

56751a4c Merge BlockstreamResearch/secp256k1-zkp#331: Upstream PRs 1735, 1745, 1741, 1749, 1748, 1727, 1756, 1750, 1719, 1734, 1759, 1758 7111d365 modules, tests: Port bitcoin-core/secp256k1#1734 to zkp-specific code 7699fe9a modules: Port bitcoin-core/secp256k1#1735 to zkp-specific code f1e52fac Merge commits '88be4e8d b4756543 10dab907 58178851 de6af6ae baa26542 2b7337f6 a44a3393 f44c1ebd d543c0d9 43e7b115 7a2fff85 ' into temp-merge-1758 7a2fff85 Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0 43e7b115 Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image 8bc50b72 ci: Switch to macOS 15 Sequoia Intel-based image c09519f0 ci: Drop workaround for Valgrind older than 3.20.0 d543c0d9 Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework f44c1ebd Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors a44a3393 Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job 15d01480 ci: Drop default for `inputs.command` in `run-in-docker-action` 1decc49a ci: Use YAML anchor and aliases for repeated "CI script" steps dff1bc10 ci, refactor: Generalize use of `matrix.configuration.env_vars` 4b644da1 ci: Use YAML anchor and aliases for repeated "Print logs" steps a889cd93 ci: Bump `actions/checkout` version 574c2f30 ci: Use YAML anchor and aliases for repeated "Checkout" steps 53585f93 ci: Use clang-snapshot in "MSan" job 6894c964 Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan 2b7337f6 Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements f163c358 ci: Set `DEBIAN_FRONTEND=noninteractive` 70ae177c ci: Bump `docker/build-push-action` version b2a95a42 ci: Drop `tags` input for `docker/build-push-action` 122014ed ci: Add `scope` parameter to `cache-{to,from}` options 2f4546ce test: add --log option to display tests execution 95b9953e test: Add option to display all available tests 953f7b00 test: support running specific tests/modules targets 0302c1a3 test: add --help for command-line options 9ec3bfe2 test: adapt modules to the new test infrastructure 48789daf test: introduce (mini) unit test framework baa26542 Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once 4d90585f docs: Improve API docs of _context_set_illegal_callback 895f53d1 docs: Clarify that callback can be called more than once de6af6ae Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark 58178851 Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check ab560078 build: Fix warnings in x86_64 assembly check 10dab907 Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value dfe284ed bench: improve context creation in ECDH benchmark 7321bdf2 doc: clarify API doc of `secp256k1_ecdsa_recover` return value b4756543 Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication 9cce7038 refactor: move 'gettime_i64()' to tests_common.h 0c91c560 test: introduce group order byte-array constant for deduplication 88be4e8d Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign 399b582a Split memclear into two versions git-subtree-dir: Vendor/secp256k1-zkp git-subtree-split: 56751a4cf069b48ec8562b81dedff7e306679d59

* chore: clean stale extractions for secp256k1-zkp * Squashed 'Vendor/secp256k1-zkp/' changes from 42ae776d..56751a4c 56751a4c Merge BlockstreamResearch/secp256k1-zkp#331: Upstream PRs 1735, 1745, 1741, 1749, 1748, 1727, 1756, 1750, 1719, 1734, 1759, 1758 7111d365 modules, tests: Port bitcoin-core/secp256k1#1734 to zkp-specific code 7699fe9a modules: Port bitcoin-core/secp256k1#1735 to zkp-specific code f1e52fac Merge commits '88be4e8d b4756543 10dab907 58178851 de6af6ae baa26542 2b7337f6 a44a3393 f44c1ebd d543c0d9 43e7b115 7a2fff85 ' into temp-merge-1758 7a2fff85 Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0 43e7b115 Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image 8bc50b72 ci: Switch to macOS 15 Sequoia Intel-based image c09519f0 ci: Drop workaround for Valgrind older than 3.20.0 d543c0d9 Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework f44c1ebd Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors a44a3393 Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job 15d01480 ci: Drop default for `inputs.command` in `run-in-docker-action` 1decc49a ci: Use YAML anchor and aliases for repeated "CI script" steps dff1bc10 ci, refactor: Generalize use of `matrix.configuration.env_vars` 4b644da1 ci: Use YAML anchor and aliases for repeated "Print logs" steps a889cd93 ci: Bump `actions/checkout` version 574c2f30 ci: Use YAML anchor and aliases for repeated "Checkout" steps 53585f93 ci: Use clang-snapshot in "MSan" job 6894c964 Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan 2b7337f6 Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements f163c358 ci: Set `DEBIAN_FRONTEND=noninteractive` 70ae177c ci: Bump `docker/build-push-action` version b2a95a42 ci: Drop `tags` input for `docker/build-push-action` 122014ed ci: Add `scope` parameter to `cache-{to,from}` options 2f4546ce test: add --log option to display tests execution 95b9953e test: Add option to display all available tests 953f7b00 test: support running specific tests/modules targets 0302c1a3 test: add --help for command-line options 9ec3bfe2 test: adapt modules to the new test infrastructure 48789daf test: introduce (mini) unit test framework baa26542 Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once 4d90585f docs: Improve API docs of _context_set_illegal_callback 895f53d1 docs: Clarify that callback can be called more than once de6af6ae Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark 58178851 Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check ab560078 build: Fix warnings in x86_64 assembly check 10dab907 Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value dfe284ed bench: improve context creation in ECDH benchmark 7321bdf2 doc: clarify API doc of `secp256k1_ecdsa_recover` return value b4756543 Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication 9cce7038 refactor: move 'gettime_i64()' to tests_common.h 0c91c560 test: introduce group order byte-array constant for deduplication 88be4e8d Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign 399b582a Split memclear into two versions git-subtree-dir: Vendor/secp256k1-zkp git-subtree-split: 56751a4cf069b48ec8562b81dedff7e306679d59 * chore(deps): update subtree secp256k1-zkp to 56751a4c --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

ea174fe04 Merge bitcoin-core/secp256k1#1846: ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup 285cb788e ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup 7262adb4b Merge bitcoin-core/secp256k1#1841: gha: Bump deprecated GHA workflow dependencies c5cd9d6d9 gha: Bump deprecated GHA workflow dependencies 95b702de3 Merge bitcoin-core/secp256k1#1839: ecdsa: VERIFY_CHECK result of _fe_set_b32_limit 634215f3f Merge bitcoin-core/secp256k1#1837: tests: Fix function pointer initialization C89 error in ellswift tests 43fca0ff5 ecdsa: VERIFY_CHECK result of _fe_set_b32_limit b84635ed3 tests: Fix C89 function pointer initialization in ellswift tests ffc25a273 Merge bitcoin-core/secp256k1#1834: ecmult: Document and test ng=NULL in ecmult 3a403639d eckey: Call ecmult with NULL instead of zero scalar 7e68c0c88 ecmult: Document and test ng=NULL in ecmult 1aafe1513 Merge bitcoin-core/secp256k1#1777: Make SHA256 compression runtime pluggable b9cb1cbfd Merge bitcoin-core/secp256k1#1824: util: introduce and use `ARRAY_SIZE` macro 4d92a083b sha256: speed up writes using multi-block compression 0753f8b90 Add API to override SHA256 compression at runtime fdb6a91a5 Introduce hash context to support pluggable SHA256 compression c0a2aba08 Merge bitcoin-core/secp256k1#1811: bench: Update help functions in bench and bench_internal 10f546a2c Merge bitcoin-core/secp256k1#1832: testrand: Remove testrand_finish 8d0eda07e testrand: Remove testrand_finish 95e681584 Merge bitcoin-core/secp256k1#1825: hash: remove redundant `secp256k1_sha256_initialize` in tagged hash midstate functions f48b1bfa5 hash: add midstate initializer and use it for tagged hashes 3019186a6 Merge bitcoin-core/secp256k1#1829: ci: Fix leftover use of old ECMULTGENPRECISION 79e9f2523 ci: Fix leftover use of old ECMULTGENPRECISION dfe042feb Merge bitcoin-core/secp256k1#1828: Revert "ci, docker: Fix LLVM repository signature failure" 76e92cfee Revert "ci, docker: Fix LLVM repository signature failure" ac561601b Merge bitcoin-core/secp256k1#1760: cmake: Add dynamic test discovery to improve parallelism c7a7f732b Merge bitcoin-core/secp256k1#1821: ellswift: fix overflow flag handling in secp256k1_ellswift_xdh 921b9711e util: introduce and use `ARRAY_SIZE` macro b99a94c38 Add tests for bad scalar inputs in ellswift XDH 307b49f1b ellswift: fix overflow flag handling in secp256k1_ellswift_xdh 322d0a435 Merge bitcoin-core/secp256k1#1823: ci: Load Docker image by ID from builder step ed02466d3 ci: Load Docker image by ID from builder step c49c9be50 bench: Update help functions in bench and bench_internal 1d146ac3e Merge bitcoin-core/secp256k1#1819: tests: Improve secp256k1_scalar_check_overflow tests (Issue #1812) f47bbc07f test: add unit tests for secp256k1_scalar_check_overflow d071aa56d Merge bitcoin-core/secp256k1#1815: refactor: remove unnecessary `malloc` result casts 99ab4a105 Merge bitcoin-core/secp256k1#1817: ci: Disable Docker build summary generation c5da3bde9 Merge bitcoin-core/secp256k1#1818: ci: Enforce base-10 evaluation 97de5120c Merge bitcoin-core/secp256k1#1804: test: show both CMake and Autotools usage for ctime_tests 4fb7ccf5d ci: Enforce base-10 evaluation 3ae72e786 ci: Disable Docker build summary generation 97b3c4784 refactor: remove unnecessary `malloc` result casts 57315a698 Merge bitcoin-core/secp256k1#1813: Remove trailing spaces and introduce `-Wtrailing-whitespace=any` compiler flag 86cae58d2 build: Add `-Wleading-whitespace=spaces` compiler flag fb229e760 build: Add `-Wtrailing-whitespace=any` compiler flag 13e3bee50 refactor: Remove trailing whitespace 453949ab2 Merge bitcoin-core/secp256k1#1816: ci: Rotate Docker cache keys cd49c57e4 Merge bitcoin-core/secp256k1#1814: release process: mention the `[Unreleased]` link clearly 2ccff6eb7 ci: Add weekly schedule 2f18567d2 ci: Rotate Docker cache keys every 4 weeks 0ffb1749a ci, docker: Fix LLVM repository signature failure 0267b6551 release process: mention the `[Unreleased]` link clearly 1605b02f7 Merge bitcoin-core/secp256k1#1775: Add CMake build directory patterns to `.gitignore` 14e56970c Merge bitcoin-core/secp256k1#1794: ecmult: Use size_t for array indices c7a52400d Merge bitcoin-core/secp256k1#1809: release cleanup: bump version after 0.7.1 ae7eb729c release cleanup: bump version after 0.7.1 1a53f4961 Merge bitcoin-core/secp256k1#1808: Prepare for 0.7.1 20a209f11 release: prepare for 0.7.1 c4b6a81a6 changelog: update in preparation for the v0.7.1 release ebb35882d Merge bitcoin-core/secp256k1#1796: bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS c09215f7a bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS 1bc74a22f test: show both Autotools and CMake usage for ctime_tests 471e3a130 Merge bitcoin-core/secp256k1#1800: sage: verify Eisenstein integer connection for GLV constants 8354618e0 cmake: Set `LABELS` property for tests 29f26ec3c cmake: Integrate DiscoverTests and normalize test names 29ac4d849 sage: verify Eisenstein integer connection for GLV constants f95b263f2 cmake: Add DiscoverTests module 4ac651144 cmake, refactor: Deduplicate test-related code 4721e077b Merge bitcoin-core/secp256k1#1793: doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult bd5ced1fe doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult 47eb70959 ecmult: Use size_t for array indices in _odd_multiplies_table bb1d199de ecmult: Use size_t for array indices into tables 2d9137ce9 Merge bitcoin-core/secp256k1#1764: group: Avoid using infinity field directly in other modules f9a944ff2 Merge bitcoin-core/secp256k1#1790: doc: include arg -DSECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS=ON for cmake 0406cfc4d doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake 8d445730e Merge bitcoin-core/secp256k1#1783: Add VERIFY_CHECKs and documentation that flags must be 0 or 1 aa2a39c1a Merge bitcoin-core/secp256k1#1778: doc/bench: Added cmake build options to bench error messages 540fec8ae Merge bitcoin-core/secp256k1#1788: test: split monolithic ellswift test into independent cases d822b2902 test: split monolithic ellswift test into independent cases ae00c552d Add VERIFY_CHECKs that flags are 0 or 1 5c7518334 Merge bitcoin-core/secp256k1#1784: refactor: remove ret from secp256k1_ec_pubkey_serialize be5e4f02f Merge bitcoin-core/secp256k1#1779: Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3daab83a6 refactor: remove ret from secp256k1_ec_pubkey_serialize 8bcda186d test: Add non-NULL checks for "pointer of array" API functions 5a08c1bcd Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3b5b03f30 doc/bench: Added cmake build options to bench error messages e7f7083b5 Merge bitcoin-core/secp256k1#1774: refactor: split up internal pubkey serialization function into compressed/uncompressed variants 748c0fdd6 Add CMake build directory patterns to `.gitignore` 7eb86bdb0 autotools: Rename `build-aux` to `autotools-aux` b6c2a3cd7 Merge bitcoin-core/secp256k1#1761: ecmult_multi: reduce strauss memory usage by 30% f5e815f43 remove secp256k1_eckey_pubkey_serialize function 0d3659c54 use new `_eckey_pubkey_serialize{33,65}` functions in modules (ellswift,musig) adb76f82e use new `_eckey_pubkey_serialize{33,65}` functions in public API fc7458ca3 introduce `secp256k1_eckey_pubkey_serialize{33,65}` functions c8206b1ce Merge bitcoin-core/secp256k1#1771: ci: Use Python virtual environment in "x86_64-macos-native" job f252da7e6 ci: Use Python virtual environment in "x86_64-macos-native" job 115b135fe Merge bitcoin-core/secp256k1#1763: bench: Use `ALIGNMENT` macro instead of hardcoded value 2f73e5281 group: Avoid using infinity field directly in other modules 153eea20c bench: Use `ALIGNMENT` macro instead of hardcoded value 26166c4f5 ecmult_multi: reduce strauss memory usage by 30% 7a2fff85e Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0 43e7b115f Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image 8bc50b72f ci: Switch to macOS 15 Sequoia Intel-based image c09519f0e ci: Drop workaround for Valgrind older than 3.20.0 d543c0d91 Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework f44c1ebd9 Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors a44a33938 Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job 15d014804 ci: Drop default for `inputs.command` in `run-in-docker-action` 1decc49a1 ci: Use YAML anchor and aliases for repeated "CI script" steps dff1bc107 ci, refactor: Generalize use of `matrix.configuration.env_vars` 4b644da19 ci: Use YAML anchor and aliases for repeated "Print logs" steps a889cd93d ci: Bump `actions/checkout` version 574c2f308 ci: Use YAML anchor and aliases for repeated "Checkout" steps 53585f93b ci: Use clang-snapshot in "MSan" job 6894c964f Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan 2b7337f63 Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements f163c3589 ci: Set `DEBIAN_FRONTEND=noninteractive` 70ae177ca ci: Bump `docker/build-push-action` version b2a95a420 ci: Drop `tags` input for `docker/build-push-action` 122014edb ci: Add `scope` parameter to `cache-{to,from}` options 2f4546ce5 test: add --log option to display tests execution 95b9953ea test: Add option to display all available tests 953f7b008 test: support running specific tests/modules targets 0302c1a3d test: add --help for command-line options 9ec3bfe22 test: adapt modules to the new test infrastructure 48789dafc test: introduce (mini) unit test framework baa265429 Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once 4d90585fe docs: Improve API docs of _context_set_illegal_callback 895f53d1c docs: Clarify that callback can be called more than once de6af6ae3 Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark 581788515 Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check ab560078a build: Fix warnings in x86_64 assembly check 10dab907e Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value dfe284ed2 bench: improve context creation in ECDH benchmark 7321bdf27 doc: clarify API doc of `secp256k1_ecdsa_recover` return value b47565430 Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication 9cce70386 refactor: move 'gettime_i64()' to tests_common.h 0c91c5604 test: introduce group order byte-array constant for deduplication 88be4e8d8 Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign 399b582a5 Split memclear into two versions git-subtree-dir: src/secp256k1 git-subtree-split: ea174fe045e1832548cd3b7090958afe9573ad2b

0f4a7e6bf Merge bitcoin-core/secp256k1#1855: bench: add internal benchmark for `secp256k1_fe_normalize_var` 13db747f2 Merge bitcoin-core/secp256k1#1861: refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks) 9e017e506 refactor: rename `_ecmult_gen` -> `_ecmult_gen_gej` for consistency a3296d5e2 refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks) c63062380 Merge bitcoin-core/secp256k1#1852: Add exhaustive test for ECDH module 240578eef bench: add internal benchmark for `secp256k1_fe_normalize_var` 5698e66c6 Add exhaustive test for ECDH module a39093de1 Merge bitcoin-core/secp256k1#1851: doc: correct API docs for ECDSA signing out-params (s/array/signature object/) 8363a2d8d Merge bitcoin-core/secp256k1#1854: tests: compare full MuSig aggregate nonce af1fdd121 tests: compare full MuSig aggregate nonce 40a0d874a doc: correct API docs for ECDSA signing out-params (s/array/signature object/) b11340b3c Merge bitcoin-core/secp256k1#1849: musig: always clear out secret key in `secp256k1_musig_nonce_gen_counter` 8479eafa5 musig: always clear out secret key in `secp256k1_musig_nonce_gen_counter` c1a9e4fe6 Merge bitcoin-core/secp256k1#1848: ci: Bump GCC snapshot major version to 17 3cca6451a ci: Bump GCC snapshot major version to 17 ea174fe04 Merge bitcoin-core/secp256k1#1846: ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup 285cb788e ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup 7262adb4b Merge bitcoin-core/secp256k1#1841: gha: Bump deprecated GHA workflow dependencies c5cd9d6d9 gha: Bump deprecated GHA workflow dependencies 95b702de3 Merge bitcoin-core/secp256k1#1839: ecdsa: VERIFY_CHECK result of _fe_set_b32_limit 634215f3f Merge bitcoin-core/secp256k1#1837: tests: Fix function pointer initialization C89 error in ellswift tests 43fca0ff5 ecdsa: VERIFY_CHECK result of _fe_set_b32_limit b84635ed3 tests: Fix C89 function pointer initialization in ellswift tests ffc25a273 Merge bitcoin-core/secp256k1#1834: ecmult: Document and test ng=NULL in ecmult 3a403639d eckey: Call ecmult with NULL instead of zero scalar 7e68c0c88 ecmult: Document and test ng=NULL in ecmult 1aafe1513 Merge bitcoin-core/secp256k1#1777: Make SHA256 compression runtime pluggable b9cb1cbfd Merge bitcoin-core/secp256k1#1824: util: introduce and use `ARRAY_SIZE` macro 4d92a083b sha256: speed up writes using multi-block compression 0753f8b90 Add API to override SHA256 compression at runtime fdb6a91a5 Introduce hash context to support pluggable SHA256 compression c0a2aba08 Merge bitcoin-core/secp256k1#1811: bench: Update help functions in bench and bench_internal 10f546a2c Merge bitcoin-core/secp256k1#1832: testrand: Remove testrand_finish 8d0eda07e testrand: Remove testrand_finish 95e681584 Merge bitcoin-core/secp256k1#1825: hash: remove redundant `secp256k1_sha256_initialize` in tagged hash midstate functions f48b1bfa5 hash: add midstate initializer and use it for tagged hashes 3019186a6 Merge bitcoin-core/secp256k1#1829: ci: Fix leftover use of old ECMULTGENPRECISION 79e9f2523 ci: Fix leftover use of old ECMULTGENPRECISION dfe042feb Merge bitcoin-core/secp256k1#1828: Revert "ci, docker: Fix LLVM repository signature failure" 76e92cfee Revert "ci, docker: Fix LLVM repository signature failure" ac561601b Merge bitcoin-core/secp256k1#1760: cmake: Add dynamic test discovery to improve parallelism c7a7f732b Merge bitcoin-core/secp256k1#1821: ellswift: fix overflow flag handling in secp256k1_ellswift_xdh 921b9711e util: introduce and use `ARRAY_SIZE` macro b99a94c38 Add tests for bad scalar inputs in ellswift XDH 307b49f1b ellswift: fix overflow flag handling in secp256k1_ellswift_xdh 322d0a435 Merge bitcoin-core/secp256k1#1823: ci: Load Docker image by ID from builder step ed02466d3 ci: Load Docker image by ID from builder step c49c9be50 bench: Update help functions in bench and bench_internal 1d146ac3e Merge bitcoin-core/secp256k1#1819: tests: Improve secp256k1_scalar_check_overflow tests (Issue #1812) f47bbc07f test: add unit tests for secp256k1_scalar_check_overflow d071aa56d Merge bitcoin-core/secp256k1#1815: refactor: remove unnecessary `malloc` result casts 99ab4a105 Merge bitcoin-core/secp256k1#1817: ci: Disable Docker build summary generation c5da3bde9 Merge bitcoin-core/secp256k1#1818: ci: Enforce base-10 evaluation 97de5120c Merge bitcoin-core/secp256k1#1804: test: show both CMake and Autotools usage for ctime_tests 4fb7ccf5d ci: Enforce base-10 evaluation 3ae72e786 ci: Disable Docker build summary generation 97b3c4784 refactor: remove unnecessary `malloc` result casts 57315a698 Merge bitcoin-core/secp256k1#1813: Remove trailing spaces and introduce `-Wtrailing-whitespace=any` compiler flag 86cae58d2 build: Add `-Wleading-whitespace=spaces` compiler flag fb229e760 build: Add `-Wtrailing-whitespace=any` compiler flag 13e3bee50 refactor: Remove trailing whitespace 453949ab2 Merge bitcoin-core/secp256k1#1816: ci: Rotate Docker cache keys cd49c57e4 Merge bitcoin-core/secp256k1#1814: release process: mention the `[Unreleased]` link clearly 2ccff6eb7 ci: Add weekly schedule 2f18567d2 ci: Rotate Docker cache keys every 4 weeks 0ffb1749a ci, docker: Fix LLVM repository signature failure 0267b6551 release process: mention the `[Unreleased]` link clearly 1605b02f7 Merge bitcoin-core/secp256k1#1775: Add CMake build directory patterns to `.gitignore` 14e56970c Merge bitcoin-core/secp256k1#1794: ecmult: Use size_t for array indices c7a52400d Merge bitcoin-core/secp256k1#1809: release cleanup: bump version after 0.7.1 ae7eb729c release cleanup: bump version after 0.7.1 1a53f4961 Merge bitcoin-core/secp256k1#1808: Prepare for 0.7.1 20a209f11 release: prepare for 0.7.1 c4b6a81a6 changelog: update in preparation for the v0.7.1 release ebb35882d Merge bitcoin-core/secp256k1#1796: bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS c09215f7a bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS 1bc74a22f test: show both Autotools and CMake usage for ctime_tests 471e3a130 Merge bitcoin-core/secp256k1#1800: sage: verify Eisenstein integer connection for GLV constants 8354618e0 cmake: Set `LABELS` property for tests 29f26ec3c cmake: Integrate DiscoverTests and normalize test names 29ac4d849 sage: verify Eisenstein integer connection for GLV constants f95b263f2 cmake: Add DiscoverTests module 4ac651144 cmake, refactor: Deduplicate test-related code 4721e077b Merge bitcoin-core/secp256k1#1793: doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult bd5ced1fe doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult 47eb70959 ecmult: Use size_t for array indices in _odd_multiplies_table bb1d199de ecmult: Use size_t for array indices into tables 2d9137ce9 Merge bitcoin-core/secp256k1#1764: group: Avoid using infinity field directly in other modules f9a944ff2 Merge bitcoin-core/secp256k1#1790: doc: include arg -DSECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS=ON for cmake 0406cfc4d doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake 8d445730e Merge bitcoin-core/secp256k1#1783: Add VERIFY_CHECKs and documentation that flags must be 0 or 1 aa2a39c1a Merge bitcoin-core/secp256k1#1778: doc/bench: Added cmake build options to bench error messages 540fec8ae Merge bitcoin-core/secp256k1#1788: test: split monolithic ellswift test into independent cases d822b2902 test: split monolithic ellswift test into independent cases ae00c552d Add VERIFY_CHECKs that flags are 0 or 1 5c7518334 Merge bitcoin-core/secp256k1#1784: refactor: remove ret from secp256k1_ec_pubkey_serialize be5e4f02f Merge bitcoin-core/secp256k1#1779: Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3daab83a6 refactor: remove ret from secp256k1_ec_pubkey_serialize 8bcda186d test: Add non-NULL checks for "pointer of array" API functions 5a08c1bcd Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL 3b5b03f30 doc/bench: Added cmake build options to bench error messages e7f7083b5 Merge bitcoin-core/secp256k1#1774: refactor: split up internal pubkey serialization function into compressed/uncompressed variants 748c0fdd6 Add CMake build directory patterns to `.gitignore` 7eb86bdb0 autotools: Rename `build-aux` to `autotools-aux` b6c2a3cd7 Merge bitcoin-core/secp256k1#1761: ecmult_multi: reduce strauss memory usage by 30% f5e815f43 remove secp256k1_eckey_pubkey_serialize function 0d3659c54 use new `_eckey_pubkey_serialize{33,65}` functions in modules (ellswift,musig) adb76f82e use new `_eckey_pubkey_serialize{33,65}` functions in public API fc7458ca3 introduce `secp256k1_eckey_pubkey_serialize{33,65}` functions c8206b1ce Merge bitcoin-core/secp256k1#1771: ci: Use Python virtual environment in "x86_64-macos-native" job f252da7e6 ci: Use Python virtual environment in "x86_64-macos-native" job 115b135fe Merge bitcoin-core/secp256k1#1763: bench: Use `ALIGNMENT` macro instead of hardcoded value 2f73e5281 group: Avoid using infinity field directly in other modules 153eea20c bench: Use `ALIGNMENT` macro instead of hardcoded value 26166c4f5 ecmult_multi: reduce strauss memory usage by 30% 7a2fff85e Merge bitcoin-core/secp256k1#1758: ci: Drop workaround for Valgrind older than 3.20.0 43e7b115f Merge bitcoin-core/secp256k1#1759: ci: Switch to macOS 15 Sequoia Intel-based image 8bc50b72f ci: Switch to macOS 15 Sequoia Intel-based image c09519f0e ci: Drop workaround for Valgrind older than 3.20.0 d543c0d91 Merge bitcoin-core/secp256k1#1734: Introduce (mini) unit test framework f44c1ebd9 Merge bitcoin-core/secp256k1#1719: ci: DRY workflow using anchors a44a33938 Merge bitcoin-core/secp256k1#1750: ci: Use clang-snapshot in "MSan" job 15d014804 ci: Drop default for `inputs.command` in `run-in-docker-action` 1decc49a1 ci: Use YAML anchor and aliases for repeated "CI script" steps dff1bc107 ci, refactor: Generalize use of `matrix.configuration.env_vars` 4b644da19 ci: Use YAML anchor and aliases for repeated "Print logs" steps a889cd93d ci: Bump `actions/checkout` version 574c2f308 ci: Use YAML anchor and aliases for repeated "Checkout" steps 53585f93b ci: Use clang-snapshot in "MSan" job 6894c964f Fix Clang 21+ `-Wuninitialized-const-pointer` warning when using MSan 2b7337f63 Merge bitcoin-core/secp256k1#1756: ci: Fix image caching and apply other improvements f163c3589 ci: Set `DEBIAN_FRONTEND=noninteractive` 70ae177ca ci: Bump `docker/build-push-action` version b2a95a420 ci: Drop `tags` input for `docker/build-push-action` 122014edb ci: Add `scope` parameter to `cache-{to,from}` options 2f4546ce5 test: add --log option to display tests execution 95b9953ea test: Add option to display all available tests 953f7b008 test: support running specific tests/modules targets 0302c1a3d test: add --help for command-line options 9ec3bfe22 test: adapt modules to the new test infrastructure 48789dafc test: introduce (mini) unit test framework baa265429 Merge bitcoin-core/secp256k1#1727: docs: Clarify that callback can be called more than once 4d90585fe docs: Improve API docs of _context_set_illegal_callback 895f53d1c docs: Clarify that callback can be called more than once de6af6ae3 Merge bitcoin-core/secp256k1#1748: bench: improve context creation in ECDH benchmark 581788515 Merge bitcoin-core/secp256k1#1749: build: Fix warnings in x86_64 assembly check ab560078a build: Fix warnings in x86_64 assembly check 10dab907e Merge bitcoin-core/secp256k1#1741: doc: clarify API doc of `secp256k1_ecdsa_recover` return value dfe284ed2 bench: improve context creation in ECDH benchmark 7321bdf27 doc: clarify API doc of `secp256k1_ecdsa_recover` return value b47565430 Merge bitcoin-core/secp256k1#1745: test: introduce group order byte-array constant for deduplication 9cce70386 refactor: move 'gettime_i64()' to tests_common.h 0c91c5604 test: introduce group order byte-array constant for deduplication 88be4e8d8 Merge bitcoin-core/secp256k1#1735: musig: Invalidate secnonce in secp256k1_musig_partial_sign 399b582a5 Split memclear into two versions git-subtree-dir: src/secp256k1 git-subtree-split: 0f4a7e6bf9d971addb2b851df7cd2777fc62b212

real-or-random reviewed Sep 5, 2025

View reviewed changes

Comment thread src/modules/musig/session_impl.h Outdated

real-or-random added the tweak/refactor label Sep 5, 2025

jonasnick reviewed Sep 5, 2025

View reviewed changes

john-moffett force-pushed the musig-partial-clear-nonce branch from 10c46ec to fb40a68 Compare September 5, 2025 14:05

john-moffett force-pushed the musig-partial-clear-nonce branch from fb40a68 to 312ff27 Compare September 5, 2025 17:10

jonasnick reviewed Sep 5, 2025

View reviewed changes

Comment thread src/modules/musig/session_impl.h Outdated

john-moffett force-pushed the musig-partial-clear-nonce branch 2 times, most recently from 8b771f8 to 54bd42d Compare September 5, 2025 17:52

john-moffett marked this pull request as draft September 5, 2025 19:13

john-moffett force-pushed the musig-partial-clear-nonce branch from 54bd42d to 16f62f5 Compare September 6, 2025 13:46

jonasnick reviewed Sep 7, 2025

View reviewed changes

Comment thread src/modules/musig/tests_impl.h Outdated

john-moffett force-pushed the musig-partial-clear-nonce branch from 16f62f5 to d872a08 Compare September 7, 2025 14:10

john-moffett marked this pull request as ready for review September 7, 2025 14:11

jonasnick approved these changes Sep 7, 2025

View reviewed changes

real-or-random added the side-channel label Sep 8, 2025

john-moffett force-pushed the musig-partial-clear-nonce branch from 3c26af6 to 8165ac9 Compare September 8, 2025 16:24

john-moffett force-pushed the musig-partial-clear-nonce branch from 8165ac9 to 399b582 Compare September 8, 2025 16:26

real-or-random approved these changes Sep 9, 2025

View reviewed changes

jonasnick approved these changes Sep 11, 2025

View reviewed changes

real-or-random merged commit 88be4e8 into bitcoin-core:master Sep 12, 2025
119 checks passed

real-or-random mentioned this pull request Sep 12, 2025

Handle invalid inputs consistently with respect to constant-time #1621

Open

DarkWindman added a commit to mllwchrry/secp256k1-zkp that referenced this pull request Feb 24, 2026

modules, tests: Port bitcoin-core/secp256k1#1735 and bitcoin-core/sec…

4ff7ce9

…p256k1#1734 to zkp-specific code

DarkWindman added a commit to mllwchrry/secp256k1-zkp that referenced this pull request Feb 25, 2026

modules, tests: Port bitcoin-core/secp256k1#1735 and bitcoin-core/sec…

822d0d7

…p256k1#1734 to zkp-specific code

DarkWindman added a commit to mllwchrry/secp256k1-zkp that referenced this pull request Feb 25, 2026

modules, tests: Port bitcoin-core/secp256k1#1735 and bitcoin-core/sec…

78cc88d

…p256k1#1734 to zkp-specific code

DarkWindman added a commit to mllwchrry/secp256k1-zkp that referenced this pull request Feb 26, 2026

modules: Port bitcoin-core/secp256k1#1735 to zkp-specific code

30bed31

DarkWindman mentioned this pull request Feb 26, 2026

Upstream PRs 1735, 1745, 1741, 1749, 1748, 1727, 1756, 1750, 1719, 1734, 1759, 1758 BlockstreamResearch/secp256k1-zkp#331

Merged

DarkWindman added a commit to mllwchrry/secp256k1-zkp that referenced this pull request Feb 27, 2026

modules: Port bitcoin-core/secp256k1#1735 to zkp-specific code

7699fe9

Uh oh!

Conversation

john-moffett commented Sep 4, 2025

Uh oh!

real-or-random commented Sep 5, 2025

Uh oh!

Uh oh!

real-or-random commented Sep 5, 2025

Uh oh!

jonasnick left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

john-moffett commented Sep 5, 2025

Uh oh!

Uh oh!

jonasnick commented Sep 5, 2025

Uh oh!

Uh oh!

jonasnick left a comment

Choose a reason for hiding this comment

Uh oh!

real-or-random commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What could we do instead?

Uh oh!

jonasnick commented Sep 8, 2025

Uh oh!

john-moffett commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

john-moffett commented Sep 8, 2025

Uh oh!

real-or-random commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

real-or-random left a comment

Choose a reason for hiding this comment

Uh oh!

jonasnick commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jonasnick left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

theStack commented Sep 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jonasnick left a comment •

edited

Loading

real-or-random commented Sep 8, 2025 •

edited

Loading

john-moffett commented Sep 8, 2025 •

edited

Loading

real-or-random commented Sep 8, 2025 •

edited

Loading

jonasnick commented Sep 11, 2025 •

edited

Loading