packages:

- libgmp-dev

- valgrind

- libtool-bin

- FIELD=auto BIGNUM=auto SCALAR=auto ENDOMORPHISM=no STATICPRECOMPUTATION=yes ECMULTGENPRECISION=auto ASM=no BUILD=check EXTRAFLAGS= HOST= ECDH=no RECOVERY=no SCHNORRSIG=no EXPERIMENTAL=no CTIMETEST=yes BENCH=yes SECP256K1_BENCH_ITERS=2

- SCALAR=32bit FIELD=32bit ECDH=yes EXPERIMENTAL=yes SCHNORRSIG=yes

- FIELD=64bit RECOVERY=yes EXPERIMENTAL=yes SCHNORRSIG=yes

- FIELD=64bit ENDOMORPHISM=yes ECDH=yes EXPERIMENTAL=yes SCHNORRSIG=yes

- BIGNUM=no ENDOMORPHISM=yes RECOVERY=yes EXPERIMENTAL=yes SCHNORRSIG=yes

- BUILD=distcheck CTIMETEST= BENCH=

- ECMULTGENPRECISION=2

- ECMULTGENPRECISION=8

- valgrind

- libtool-bin

- libc6-dbg:i386

- valgrind

- libtool-bin

- libc6-dbg:i386

- valgrind

- libtool-bin

- libc6-dbg:i386

- valgrind

- libtool-bin

- libc6-dbg:i386

- compiler: gcc

env:

- BIGNUM=no ENDOMORPHISM=yes ASM=x86_64 EXPERIMENTAL=yes ECDH=yes RECOVERY=yes

- VALGRIND=yes EXTRAFLAGS="--disable-openssl-tests CPPFLAGS=-DVALGRIND" BUILD=

- compiler: gcc

env: # The same as above but without endomorphism.

- BIGNUM=no ENDOMORPHISM=no ASM=x86_64 EXPERIMENTAL=yes ECDH=yes RECOVERY=yes

- VALGRIND=yes EXTRAFLAGS="--disable-openssl-tests CPPFLAGS=-DVALGRIND" BUILD=

- ./configure --enable-experimental=$EXPERIMENTAL --enable-endomorphism=$ENDOMORPHISM --with-field=$FIELD --with-bignum=$BIGNUM --with-asm=$ASM --with-scalar=$SCALAR --enable-ecmult-static-precomputation=$STATICPRECOMPUTATION --with-ecmult-gen-precision=$ECMULTGENPRECISION --enable-module-ecdh=$ECDH --enable-module-recovery=$RECOVERY --enable-module-schnorrsig=$SCHNORRSIG $EXTRAFLAGS $USE_HOST

- if [ -n "$BUILD" ]; then make -j2 $BUILD; fi

- # travis_wait extends the 10 minutes without output allowed (https://docs.travis-ci.com/user/common-build-problems/#build-times-out-because-no-output-was-received)

- # the `--error-exitcode` is required to make the test fail if valgrind found errors, otherwise it'll return 0 (http://valgrind.org/docs/manual/manual-core.html)

- if [ -n "$VALGRIND" ]; then

make -j2 &&

travis_wait 30 valgrind --error-exitcode=42 ./tests 16 &&

travis_wait 30 valgrind --error-exitcode=42 ./exhaustive_tests;

fi

- if [ -n "$BENCH" ]; then

if [ -n "$VALGRIND" ]; then EXEC='libtool --mode=execute valgrind --error-exitcode=42'; else EXEC= ; fi &&

$EXEC ./bench_ecmult &>> bench.log && $EXEC ./bench_internal &>> bench.log && $EXEC ./bench_sign &>> bench.log && $EXEC ./bench_verify &>> bench.log &&

if [ "$RECOVERY" == "yes" ]; then $EXEC ./bench_recover &>> bench.log; fi &&

if [ "$ECDH" == "yes" ]; then $EXEC ./bench_ecdh &>> bench.log; fi;

fi

- if [ -n "$CTIMETEST" ]; then

libtool --mode=execute valgrind ./valgrind_ctime_test &> valgrind_ctime_test.log;

fi

after_script:

- cat ./tests.log

- cat ./exhaustive_tests.log

- cat ./valgrind_ctime_test.log

- cat ./bench.log

include_HEADERS += include/secp256k1_preallocated.h

libsecp256k1_la_LIBADD = $(SECP_LIBS) $(COMMON_LIB)

if VALGRIND_ENABLED

libsecp256k1_la_CPPFLAGS += -DVALGRIND

endif

bench_verify_CPPFLAGS = -DSECP256K1_BUILD $(SECP_TEST_INCLUDES)

if VALGRIND_ENABLED

tests_CPPFLAGS += -DVALGRIND

noinst_PROGRAMS += valgrind_ctime_test

valgrind_ctime_test_SOURCES = src/valgrind_ctime_test.c

valgrind_ctime_test_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)

endif

CPPFLAGS_FOR_BUILD +=-I$(top_srcdir) -I$(builddir)/src

gen_%.o: src/gen_%.c src/libsecp256k1-config.h

CLEANFILES = $(gen_context_BIN) src/ecmult_static_context.h

EXTRA_DIST = autogen.sh src/gen_context.c src/basic-config.h

if ENABLE_MODULE_EXTRAKEYS

include src/modules/extrakeys/Makefile.am.include

endif

if ENABLE_MODULE_SCHNORRSIG

include src/modules/schnorrsig/Makefile.am.include

endif

Optimized C library for ECDSA signatures and secret/public key operations on curve secp256k1.

This library is intended to be the highest quality publicly available library for cryptography on the secp256k1 curve. However, the primary focus of its development has been for usage in the Bitcoin system and usage unlike Bitcoin's may be less well tested, verified, or suffer from a less well thought out interface. Correct usage requires some care and consideration that the library is fit for your application's purpose.

* Additive and multiplicative tweaking of secret/public keys.

* Serialization/parsing of secret keys, public keys, signatures.

* Constant time, constant memory access signing and public key generation.

* Derandomized ECDSA (via RFC6979 or with a caller provided function.)

* Suitable for embedded systems.

* Optional module for public key recovery.

* Optional module for ECDH key exchange (experimental).

Experimental features have not received enough scrutiny to satisfy the standard of quality of this library but are made available for testing and review by the community. The APIs of these features should not be considered stable.

* No use of floating types.

* Using 10 26-bit limbs (including hand-optimized assembly for 32-bit ARM, by Wladimir J. van der Laan).

* Intended to be completely free of timing sidechannels for secret-key operations (on reasonable hardware/toolchains)

* Access the table with branch-free conditional moves so memory access is uniform.

* No data-dependent branches

* Optional runtime blinding which attempts to frustrate differential power analysis.

* The precomputed tables add and eventually subtract points for which no known scalar (secret key) is known, preventing even an attacker with control over the secret key used to control the data internally.

$ make check

Exhaustive tests

$ ./exhaustive_tests

With valgrind, you might need to increase the max stack size:

$ valgrind --max-stackframe=2500000 ./exhaustive_tests

Test coverage

This library aims to have full coverage of the reachable lines and branches.

To create a test coverage report, configure with `--enable-coverage` (use of GCC is necessary):

$ ./configure --enable-coverage

Run the tests:

$ make check

To create a report, `gcovr` is recommended, as it includes branch coverage reporting:

$ gcovr --exclude 'src/bench*' --print-summary

To create a HTML report with coloured and annotated source code:

$ gcovr --exclude 'src/bench*' --html --html-details -o coverage.html

Reporting a vulnerability

See [SECURITY.md](SECURITY.md)

To report security issues send an email to [email protected] (not for support).

The following keys may be used to communicate sensitive information to developers:

| Name | Fingerprint |

|------|-------------|

| Pieter Wuille | 133E AC17 9436 F14A 5CF1 B794 860F EB80 4E66 9320 |

| Andrew Poelstra | 699A 63EF C17A D3A9 A34C FFC0 7AD0 A91C 40BD 0091 |

| Tim Ruffing | 09E0 3F87 1092 E40E 106E 902B 33BC 86AB 80FF 5516 |

You can import a key by running the following command with that individual’s fingerprint: `gpg --recv-keys "<fingerprint>"` Ensure that you put quotes around fingerprints containing spaces.