efad3506a8 Merge #906: Use modified divsteps with initial delta=1/2 for constant-time
cc2c09e3a7 Merge #918: Clean up configuration in gen_context
07067967ee add ECMULT_GEN_PREC_BITS to basic_config.h
a3aa2628c7 gen_context: Don't include basic-config.h
be0609fd54 Add unit tests for edge cases with delta=1/2 variant of divsteps
cd393ce228 Optimization: only do 59 hddivsteps per iteration instead of 62
277b224b6a Use modified divsteps with initial delta=1/2 for constant-time
376ca366db Fix typo in explanation
1e5d50fa93 Merge #889: fix uninitialized read in tests
c083cc6e52 Merge #903: Make argument of fe_normalizes_to_zero{_var} const
6e898534ff Merge #907: changed import to use brackets <> for openssl
4504472269 changed import to use brackets <> for openssl as they are not local to the project
26de4dfeb1 Merge #831: Safegcd inverses, drop Jacobi symbols, remove libgmp
23c3fb629b Make argument of fe_normalizes_to_zero{_var} const
24ad04fc06 Make scalar_inverse{,_var} benchmark scale with SECP256K1_BENCH_ITERS
ebc1af700f Optimization: track f,g limb count and pass to new variable-time update_fg_var
b306935ac1 Optimization: use formulas instead of lookup tables for cancelling g bits
9164a1b658 Optimization: special-case zero modulus limbs in modinv64
1f233b3fa0 Remove num/gmp support
20448b8d09 Remove unused Jacobi symbol support
5437e7bdfb Remove unused scalar_sqr
aa9cc52180 Improve field/scalar inverse tests
1e0e885c8a Make field/scalar code use the new modinv modules for inverses
436281afdc Move secp256k1_fe_inverse{_var} to per-impl files
aa404d53be Move secp256k1_scalar_{inverse{_var},is_even} to per-impl files
08d54964e5 Improve bounds checks in modinv modules
151aac00d3 Add tests for modinv modules
d8a92fcc4c Add extensive comments on the safegcd algorithm and implementation
8e415acba2 Add safegcd based modular inverse modules
de0a643c3d Add secp256k1_ctz{32,64}_var functions
4c3ba88c3a Merge #901: ci: Switch all Linux builds to Debian and more improvements
9361f360bb ci: Select number of parallel make jobs depending on CI environment
28eccdf806 ci: Split output of logs into multiple sections
c7f754fe4d ci: Run PRs on merge result instead of on the source branch
b994a8be3c ci: Print information about binaries using "file"
f24e122d13 ci: Switch all Linux builds to Debian
ebdba03cb5 Merge #891: build: Add workaround for automake 1.13 and older
3a8b47bc6d Merge #894: ctime_test: move context randomization test to the end
7d3497cdc4 ctime_test: move context randomization test to the end
99a1cfec17 print warnings for conditional-uninitialized
3d2cf6c5bd initialize variable in tests
f329bba244 build: Add workaround for automake 1.13 and older
24d1656c32 Merge #882: Use bit ops instead of int mult for constant-time logic in gej_add_ge
e491d06b98 Use bit ops instead of int mult for constant-time logic in gej_add_ge
f8c0b57e6b Merge #864: Add support for Cirrus CI
cc2a5451dc ci: Refactor Nix shell files
2480e55c8f ci: Remove support for Travis CI
2b359f1c1d ci: Enable simple cache for brewing valgrind on macOS
8c02e465c5 ci: Add support for Cirrus CI
659d0d4798 Merge #880: Add parens around ROUND_TO_ALIGN's parameter.
b6f649889a Add parens around ROUND_TO_ALIGN's parameter. This makes the macro robust against a hypothetical ROUND_TO_ALIGN(foo ? sizeA : size B) invocation.
a4abaab793 Merge #877: Add missing secp256k1_ge_set_gej_var decl.
5671e5f3fd Merge #874: Remove underscores from header defs.
db726782fa Merge #878: Remove unused secp256k1_fe_inv_all_var
b732701faa Merge #875: Avoid casting (void**) values.
75d2ae149e Remove unused secp256k1_fe_inv_all_var
482e4a9cfc Add missing secp256k1_ge_set_gej_var decl.
2730618604 Avoid casting (void**) values. Replaced with an expression that only casts (void*) values.
fb390c5299 Remove underscores from header defs. This makes them consistent with other files and avoids reserved identifiers.
f2d9aeae6d Merge #862: Autoconf improvements
328aaef22a Merge #845: Extract the secret key from a keypair
3c15130709 Improve CC_FOR_BUILD detection
47802a4762 Restructure and tidy configure.ac
252c19dfc6 Ask brew for valgrind include path
8c727b9087 Merge #860: fixed trivial typo
b7bc3a4aaa fixed typo
33cb3c2b1f Add secret key extraction from keypair to constant time tests
36d9dc1e8e Add seckey extraction from keypair to the extrakeys tests
fc96aa73f5 Add a function to extract the secretkey from a keypair
98dac87839 Merge #858: Fix insecure links
07aa4c70ff Fix insecure links
b61f9da54e Merge #857: docs: fix simple typo, dependecy -> dependency
18aadf9d28 docs: fix simple typo, dependecy -> dependency
2d9e7175c6 Merge #852: Add sage script for generating scalar_split_lambda constants
dc6e5c3a5c Merge #854: Rename msg32 to msghash32 in ecdsa_sign/verify and add explanation
6e85d675aa Rename tweak to tweak32 in public API
f587f04e35 Rename msg32 to msghash32 in ecdsa_sign/verify and add explanation
329a2e0a3f sage: Add script for generating scalar_split_lambda constants
8f0c6f1545 Merge #851: make test count iteration configurable by environment variable
f4fa8d226a forbid a test iteration of 0 or less
f554dfc708 sage: Reorganize files
3a106966aa Merge #849: Convert Sage code to Python 3 (as used by Sage >= 9)
13c88efed0 Convert Sage code to Python 3 (as used by Sage >= 9)
0ce4554881 make test count iteration configurable by environment variable
9e5939d284 Merge #835: Don't use reserved identifiers memczero and benchmark_verify_t
d0a83f7328 Merge #839: Prevent arithmetic on NULL pointer if the scratch space is too small
903b16aa6c Merge #840: Return NULL early in context_preallocated_create if flags invalid
1f4dd03838 Typedef (u)int128_t only when they're not provided by the compiler
ebfa2058e9 Return NULL early in context_preallocated_create if flags invalid
29a299e373 Run the undefined behaviour sanitizer on Travis
7506e064d7 Prevent arithmetic on NULL pointer if the scratch space is too small
e89278f211 Don't use reserved identifiers memczero and benchmark_verify_t
git-subtree-dir: src/secp256k1
git-subtree-split: efad3506a8937162e8010f5839fdf3771dfcf516
2bfb82b Merge pull request #35106aeea5 Turn secp256k1_ec_pubkey_serialize outlen to in/out
970164d Merge pull request #3486466625 Improvements for coordinate decompression
e2100ad Merge pull request #3478e48787 Change secp256k1_ec_pubkey_combine's count argument to size_t.
c69dea0 Clear output in more cases for pubkey_combine, adds tests.
269d422 Comment copyediting.
b4d17da Merge pull request #3444709265 Merge pull request #34526abce7 Adds 32 static test vectors for scalar mul, sqr, inv.
5b71a3f Better error case handling for pubkey_create & pubkey_serialize, more tests.
3b7bc69 Merge pull request #343eed87af Change contrib/laxder from headers-only to files compilable as standalone C
d7eb1ae Merge pull request #3427914a6e Make lax_der_privatekey_parsing.h not depend on internal code
73f64ff Merge pull request #3399234391 Overhaul flags handling
1a36898 Make flags more explicit, add runtime checks.
1a3e03a Merge pull request #34096be204 Add additional tests for eckey and arg-checks.
bb5aa4d Make the tweak function zeroize-output-on-fail behavior consistent.
4a243da Move secp256k1_ec_privkey_import/export to contrib.
1b3efc1 Move secp256k1_ecdsa_sig_recover into the recovery module.
e3cd679 Eliminate all side-effects from VERIFY_CHECK() usage.
b30fc85 Avoid nonce_function_rfc6979 algo16 argument emulation.
70d4640 Make secp256k1_ec_pubkey_create skip processing invalid secret keys.
6c476a8 Minor comment improvements.
131afe5 Merge pull request #3340c6ab2f Introduce explicit lower-S normalization
fea19e7 Add contrib/lax_der_parsing.h
3bb9c44 Rewrite ECDSA signature parsing code
fa57f1b Use secp256k1_rand_int and secp256k1_rand_bits more
49b3749 Add new tests for the extra testrand functions
f684d7d Faster secp256k1_rand_int implementation
251b1a6 Improve testrand: add extra random functions
31994c8 Merge pull request #338f79aa88 Bugfix: swap arguments to noncefp
c98df26 Merge pull request #31967f7da4 Extensive interface and operations tests for secp256k1_ec_pubkey_parse.
ee2cb40 Add ARG_CHECKs to secp256k1_ec_pubkey_parse/secp256k1_ec_pubkey_serialize
7450ef1 Merge pull request #32868a3c76 Merge pull request #32998135ee Merge pull request #33237100d7 improve ECDH header-doc
b13d749 Fix couple of typos in API comments
7c823e3 travis: fixup module configs
cc3141a Merge pull request #325ee58fae Merge pull request #326213aa67 Do not force benchmarks to be statically linked.
338fc8b Add API exports to secp256k1_nonce_function_default and secp256k1_nonce_function_rfc6979.
52fd03f Merge pull request #3209f6993f Remove some dead code.
357f8cd Merge pull request #314118cd82 Use explicit symbol visibility.
4e64608 Include public module headers when compiling modules.
1f41437 Merge pull request #316fe0d463 Merge pull request #317cfe0ed9 Fix miscellaneous style nits that irritate overactive static analysis.
2b199de Use the explicit NULL macro for pointer comparisons.
9e90516 Merge pull request #294dd891e0 Get rid of _t as it is POSIX reserved
201819b Merge pull request #313912f203 Eliminate a few unbraced statements that crept into the code.
eeab823 Merge pull request #299486b9bb Use a flags bitfield for compressed option to secp256k1_ec_pubkey_serialize and secp256k1_ec_privkey_export
05732c5 Callback data: Accept pointers to either const or non-const data
1973c73 Bugfix: Reinitialise buffer lengths that have been used as outputs
788038d Use size_t for lengths (at least in external API)
c9d7c2a secp256k1_context_set_{error,illegal}_callback: Restore default handler by passing NULL as function argument
9aac008 secp256k1_context_destroy: Allow NULL argument as a no-op
64b730b secp256k1_context_create: Use unsigned type for flags bitfield
cb04ab5 Merge pull request #309a551669 Merge pull request #29581e45ff Update group_impl.h
85e3a2c Merge pull request #112b2eb63b Merge pull request #293dc0ce9f [API BREAK] Change argument order to out/outin/in
6d947ca Merge pull request #298c822693 Merge pull request #3016d04350 Merge pull request #3037ab311c Merge pull request #3045fb3229 Fixes a bug where bench_sign would fail due to passing in too small a buffer.
263dcbc remove unused assignment
b183b41 bugfix: "ARG_CHECK(ctx != NULL)" makes no sense
6da1446 build: fix parallel build
5eb4356 Merge pull request #291c996d53 Print success
9f443be Move pubkey recovery code to separate module
d49abbd Separate ECDSA recovery tests
439d34a Separate recoverable and normal signatures
a7b046e Merge pull request #289f66907f Improve/reformat API documentation secp256k1.h
2f77487 Add context building benchmarks
cc623d5 Merge pull request #287de7e398 small typo fix
9d96e36 Merge pull request #280432e1ce Merge pull request #28314727fd Use correct name in gitignore
356b0e9 Actually test static precomputation in Travis
ff3a5df Merge pull request #2842587208 Merge pull request #212a5a66c7 Add support for custom EC-Schnorr-SHA256 signatures
d84a378 Merge pull request #25272ae443 Improve perf. of cmov-based table lookup
92e53fc Implement endomorphism optimization for secp256k1_ecmult_const
ed35d43 Make `secp256k1_scalar_add_bit` conditional; make `secp256k1_scalar_split_lambda_var` constant time
91c0ce9 Add benchmarks for ECDH and const-time multiplication
0739bbb Add ECDH module which works by hashing the output of ecmult_const
4401500 Add constant-time multiply `secp256k1_ecmult_const` for ECDH
e4ce393 build: fix hard-coded usage of "gen_context"
b8e39ac build: don't use BUILT_SOURCES for the static context header
baa75da tests: add a couple tests
ae4f0c6 Merge pull request #278995c548 Introduce callback functions for dealing with errors.
c333074 Merge pull request #28218c329c Remove the internal secp256k1_ecdsa_sig_t type
74a2acd Add a secp256k1_ecdsa_signature_t type
23cfa91 Introduce secp256k1_pubkey_t type
4c63780 Merge pull request #2693e6f1e2 Change rfc6979 implementation to be a generic PRNG
ed5334a Update configure.ac to make it build on OpenBSD
1b68366 Merge pull request #274a83bb48 Make ecmult static precomputation default
166b32f Merge pull request #276c37812f Add gen_context src/ecmult_static_context.h to CLEANFILES to fix distclean.
125c15d Merge pull request #27576f6769 Fix build with static ecmult altroot and make dist.
5133f78 Merge pull request #254b0a60e6 Merge pull request #258733c1e6 Add travis build to test the static context.
fbecc38 Add ability to use a statically generated ecmult context.
4fb174d Merge pull request #263
4ab8990 Merge pull request #270bdf0e0c Merge pull request #27131d0c1f Merge pull request #273eb2c8ff Add missing casts to SECP256K1_FE_CONST_INNER
55399c2 Further performance improvements to _ecmult_wnaf
99fd963 Add secp256k1_ec_pubkey_compress(), with test similar to the related decompress() function.
145cc6e Improve performance of _ecmult_wnaf
36b305a Verify the result of GMP modular inverse using non-GMP code
0cbc860 Merge pull request #26606ff7fe Merge pull request #2675a43124 Save 1 _fe_negate since s1 == -s2
a5d796e Update code comments
3f3964e Add specific VERIFY tests for _fe_cmov
7d054cd Refactor to save a _fe_negate
b28d02a Refactor to remove a local var
55e7fc3 Perf. improvement in _gej_add_ge
a0601cd Fix VERIFY calculations in _fe_cmov methods
17f7148 Merge pull request #2617657420 Add tests for adding P+Q with P.x!=Q.x and P.y=-Q.y
8c5d5f7 tests: Add failing unit test for #257 (bad addition formula)
5de4c5d gej_add_ge: fix degenerate case when computing P + (-lambda)P
bcf2fcf gej_add_ge: rearrange algebra
e2a07c7 Fix compilation with C++
873a453 Merge pull request #25091eb0da Merge pull request #247210ffed Use separate in and out pointers in `secp256k1_ec_pubkey_decompress`
a1d5ae1 Tiny optimization
729badf Merge pull request #2102d5a186 Apply effective-affine trick to precomp
4f9791a Effective affine addition in EC multiplication
2b4cf41 Use pkg-config always when possible, with failover to manual checks for libcrypto
git-subtree-dir: src/secp256k1
git-subtree-split: 2bfb82b10e
1897b8e Merge pull request #229efc571c Add simple testcases for signing with rfc6979 extra entropy.
1573a10 Add ability to pass extra entropy to rfc6979
3087bc4 Merge pull request #228d9b9f11 Merge pull request #2180065a8f Eliminate multiple-returns from secp256k1.c.
354ffa3 Make secp256k1_ec_pubkey_create reject oversized secrets.
27bc131 Silence some warnings from pedantic static analysis tools, improve compatibility with C++.
3b7ea63 Merge pull request #221f789c5b Merge pull request #2154bc273b Merge pull request #222137a8ec Merge pull request #2167c3771d Disable overlength-strings warnings.
8956111 use 128-bit hex seed
02efd06 Use RFC6979 for test PRNGs
ae55e85 Use faster byteswapping and avoid alignment-increasing casts.
443cd4b Get rid of hex format and some binary conversions
0bada0e Merge #214: Improve signing API documentation & specification
8030d7c Improve signing API documentation & specification
7b2fc1c Merge #213: Removed gotos, which are hard to trace and maintain.
11690d3 Removed gotos, which are hard to trace and maintain.
122a1ec Merge pull request #205035406d Merge pull request #2062d4cd53 Merge pull request #16134b898d Additional comments for the testing PRNG and a seeding fix.
6efd6e7 Some comments explaining some of the constants in the code.
ffccfd2 x86_64 assembly optimization for scalar_4x64
67cbdf0 Merge pull request #207039723d Benchmarks for all internal operations
6cc8425 Include a comment on secp256k1_ecdsa_sign explaining low-s.
f88343f Merge pull request #203d61e899 Add group operation counts
2473f17 Merge pull request #202b5bbce6 Some readme updates, e.g. removal of the GMP field.
f0d851e Merge pull request #201a0ea884 Merge pull request #200f735446 Convert the rest of the codebase to C89.
bf2e1ac Convert tests to C89. (also fixes a use of bare "inline" in field)
fc8285f Merge pull request #199fff412e Merge pull request #1974be8d6f Centralize the definition of uint128_t and use it uniformly.
d9543c9 Switch scalar code to C89.
fcc48c4 Remove the non-storage cmov
55422b6 Switch ecmult_gen to use storage types
41f8455 Use group element storage type in EC multiplications
e68d720 Add group element storage type
ff889f7 Field storage type
7137be8 Merge pull request #1960768bd5 Get rid of variable-length hex string conversions
e84e761 Merge pull request #195792bcdb Covert several more files to C89.
45cdf44 Merge pull request #19317db09e Merge pull request #194402878a fix ifdef/ifndef
25b35c7 Convert field code to strict C89 (+ long long, +__int128)
3627437 C89 nits and dead code removal.
a9f350d Merge pull request #1914732d26 Convert the field/group/ecdsa constant initialization to static consts
19f3e76 Remove unused secp256k1_fe_inner_{start, stop} functions
f1ebfe3 Convert the scalar constant initialization to static consts
git-subtree-dir: src/secp256k1
git-subtree-split: 1897b8e90b
Pieter Wuille