BIP324 tracking issue #27634

This issue will be updated to reflect the current state of BIP324 integration.

PRs ready for review:

• #29347

Overall plan:

• ElligatorSwift integration in Bitcoin Core (formerly 23432, 23561)
  • Dependency: Jacobi symbol support in libsecp256k1: bitcoin-core/secp256k1#979
  • Dependency: ElligatorSwift support in libsecp256k1: bitcoin-core/secp256k1#1129
  • Dependency: update libsecp256k1 subtree: currently part of 27479.
  • Main feature: #27479
• Cipher suite implementation (formerly 25361):
  • Dependency: support for not wasting ChaCha20 stream bytes: #26153
  • Dependency: support for RFC8439 variant of ChaCha20: #27985
  • Dependency: support for incremental Poly1305 computation: #27993
  • Main feature: #28008
  • Follow-up: #28267
  • Follow-up: #28263
• P2P v2 connection support (formerly 25361, 23233, 24545):
  • Dependency: P2P transport abstraction: #28165
  • Main feature: #28196
  • Follow up: #28433
  • Bugfix: #28489
  • Follow up: BIP change: #28525
  • Follow up: BIP change: #28577
  • Potential follow-up: decide how to report handshake/decoy bytes in per-message stats: #28331 (comment)
• P2P v2 signalling/integration (formerly 24545):
  • Main feature: #28331
  • Follow up test: #28588
  • Follow up: make all functional tests compatible with v2: #28805
  • Potential follow-up: integrated connect/add/reconnect logic: #28331 (review)
  • Potential follow-up: reuse CNode objects on reconnect: #28331 (review)
  • Potential follow-up: use V2Transport for everything, dropping abstract class: #28331 (review)
  • Enable V2 by default: #29347
• BIP324 functional tests:
  • Dependency: ElligatorSwift support in functional tests: #24005
  • Dependency: Field element support in functional tests: #26222
  • Dependency: Python cryptography #28374
  • Main feature: #24748
• P2P_V2 service flag support in DNS seeder:
  • Main feature: sipa/bitcoin-seeder#102

<details><summary>Older stuff:</summary>

• Prehistory:

  • CKey negation (no longer needed): #14047
  • ChaCha20 encryption: #15512
  • Poly1305 authentication: #15519
  • Old ChaCha20Poly1305@Bitcoin cipher: #15649
  • Preparing for multiple transport layers:
    • #16202
    • #16562
  • Fuzz tests for various components:
    • #17771
    • #19296
    • #22029
    • #22704
    • #23806
  • Miscellaneous fixes:
    • #22331
    • #23271
  • ChaCha20 performance: #24946

• Superseded:

  • #14032
  • #14046
  • #14049
  • #14050
  • #18242
  • #20962
  • #23233
  • #23322
  • #23432
  • #23441
  • #23900
  • #23561
  • #24545
  • #25361

</details>

Review comments from #28008 that could be incorporated into future changes:

• #28008#pullrequestreview-1554883653
• #28008 (review)
• #28008 (review)
• #28008 (review)
• #28008 (review)
• #28008 (review)

@sipa Want to add an item for mentioning BIP324 in https://github.com/bitcoin/bitcoin/blob/master/doc/bips.md?

@real-or-random Done in #28331.

Minor thing that was missed, can be included in some of the followups:

<details> <summary>s/TransportDeserializer/Transport class/</summary>

diff --git i/src/net.cpp w/src/net.cpp
index 6b2ef5f43d..5b0efc16aa 100644
--- i/src/net.cpp
+++ w/src/net.cpp
@@ -812,13 +812,13 @@ const uint256& V1Transport::GetMessageHash() const
 
 CNetMessage V1Transport::GetReceivedMessage(const std::chrono::microseconds time, bool& reject_message)
 {
     AssertLockNotHeld(m_recv_mutex);
     // Initialize out parameter
     reject_message = false;
-    // decompose a single CNetMessage from the TransportDeserializer
+    // decompose a single CNetMessage from the Transport class
     LOCK(m_recv_mutex);
     CNetMessage msg(std::move(vRecv));
 
     // store message type string, time, and sizes
     msg.m_type = hdr.GetCommand();
     msg.m_time = time;
@@ -3724,13 +3724,13 @@ void CNode::MarkReceivedMsgsForProcessing()
 {
     AssertLockNotHeld(m_msg_process_queue_mutex);
 
     size_t nSizeAdded = 0;
     for (const auto& msg : vRecvMsg) {
         // vRecvMsg contains only completed CNetMessage
-        // the single possible partially deserialized message are held by TransportDeserializer
+        // the single possible partially deserialized message are held by Transport class
         nSizeAdded += msg.m_raw_message_size;
     }
 
     LOCK(m_msg_process_queue_mutex);
     m_msg_process_queue.splice(m_msg_process_queue.end(), vRecvMsg);
     m_msg_process_queue_size += nSizeAdded;

</details>

There are a few minor follow-ups to consider still, but I believe this issue can be closed. Thanks everyone for getting us this far!