486b9bb Use a flags bitfield for compressed option to secp256k1_ec_pubkey_serialize and secp256k1_ec_privkey_export (Luke Dashjr)
05732c5 Callback data: Accept pointers to either const or non-const data (Luke Dashjr)
1973c73 Bugfix: Reinitialise buffer lengths that have been used as outputs (Luke Dashjr)
788038d Use size_t for lengths (at least in external API) (Luke Dashjr)
c9d7c2a secp256k1_context_set_{error,illegal}_callback: Restore default handler by passing NULL as function argument (Luke Dashjr)
9aac008 secp256k1_context_destroy: Allow NULL argument as a no-op (Luke Dashjr)
64b730b secp256k1_context_create: Use unsigned type for flags bitfield (Luke Dashjr)
9f443be Move pubkey recovery code to separate module (Pieter Wuille)
d49abbd Separate ECDSA recovery tests (Pieter Wuille)
439d34a Separate recoverable and normal signatures (Pieter Wuille)
72ae443 Improve perf. of cmov-based table lookup (Peter Dettman)
92e53fc Implement endomorphism optimization for secp256k1_ecmult_const (Andrew Poelstra)
ed35d43 Make `secp256k1_scalar_add_bit` conditional; make `secp256k1_scalar_split_lambda_var` constant time (Andrew Poelstra)
91c0ce9 Add benchmarks for ECDH and const-time multiplication (Andrew Poelstra)
0739bbb Add ECDH module which works by hashing the output of ecmult_const (Andrew Poelstra)
4401500 Add constant-time multiply `secp256k1_ecmult_const` for ECDH (Andrew Poelstra)
baa75da tests: add a couple tests (Andrew Poelstra)
This has the effect of making `secp256k1_scalar_mul_shift_var` constant
time in both input scalars. Keep the _var name because it is NOT constant
time in the shift amount.
As used in `secp256k1_scalar_split_lambda_var`, the shift is always
the constant 272, so this function becomes constant time, and it
loses the `_var` suffix.
Designed with clear separation of the wNAF conversion, precomputation
and exponentiation (since the precomp at least we will probably want
to separate in the API for users who reuse points a lot.
Future work:
- actually separate precomp in the API
- do multiexp rather than single exponentiation
