test: cover schnorrsig_sign_custom in constant-time tests #1893

pull Yudis-bit wants to merge 2 commits into bitcoin-core:master from Yudis-bit:yudis/ctime-cover-schnorrsig-sign-custom changing 1 files +64 −0

Yudis-bit commented at 5:18 PM on July 17, 2026: none
Description

src/ctime_tests.c covers secp256k1_schnorrsig_sign32 and secp256k1_schnorrsig_sign_custom entry points under Valgrind/CHECKMEM.

sign_custom accepts optional extraparams (including a custom nonce function) and variable-length messages before calling the shared internal signer. Functional tests cover it, but previously it was not tested under the constant-time CHECKMEM harness.

This PR adds coverage for:
- secp256k1_schnorrsig_sign_custom(..., NULL) (default nonce path, NULL extraparams).
- Default BIP340 nonce with non-NULL extraparams.ndata (auxiliary randomness).
- The actual custom callback dispatch path via a distinct custom callback function (nonce_function_custom) delegating to secp256k1_nonce_function_bip340.
- Variable-length message handling (sizeof(msg) - 1) in the custom callback case.
- Secret-tainted key, keypair, message, and auxiliary data under CHECKMEM.
Coverage gap (why)

Planted local-only synthetic mutations (e.g. secret-dependent branch in custom nonce callback, secret-dependent branch on non-NULL auxiliary data) were not detected by the existing ctime suite, but were detected after these test additions. A constant-work control mutation remained clean.

This is a test-coverage improvement. No production cryptographic code is modified. This PR does not claim a real production vulnerability in unmodified libsecp256k1.

Change
- src/ctime_tests.c only
- No mutation code
- No new dependencies
Build / test
```
cmake -B build \
  -DSECP256K1_VALGRIND=ON \
  -DSECP256K1_BUILD_CTIME_TESTS=ON \
  -DSECP256K1_ENABLE_MODULE_SCHNORRSIG=ON \
  -DSECP256K1_ENABLE_MODULE_EXTRAKEYS=ON \
  -DSECP256K1_ENABLE_MODULE_ECDH=ON \
  -DSECP256K1_ENABLE_MODULE_RECOVERY=ON \
  -DSECP256K1_ENABLE_MODULE_ELLSWIFT=ON \
  -DSECP256K1_ENABLE_MODULE_MUSIG=ON
cmake --build build --target ctime_tests
valgrind --error-exitcode=42 ./build/bin/ctime_tests
```
Clean upstream + this test: pass (repeated).
Synthetic mutations were local-only and are not included in this branch.

test: cover schnorrsig_sign_custom in constant-time tests

Call secp256k1_schnorrsig_sign_custom with CHECKMEM-undefined secrets
so the public sign_custom entry point is exercised under Valgrind, not
only schnorrsig_sign32.

c64c477b09

Yudis-bit force-pushed on Jul 17, 2026
Yudis-bit marked this as ready for review on Jul 18, 2026

in src/ctime_tests.c:193 in c64c477b09

 188 | @@ -189,6 +189,17 @@ static void run_tests(secp256k1_context *ctx, unsigned char *key) {
 189 |      ret = secp256k1_schnorrsig_sign32(ctx, sig, msg, &keypair, NULL);
 190 |      SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
 191 |      CHECK(ret == 1);
 192 | +
 193 | +    /* Also cover the public sign_custom entry point (default nonce path). */

real-or-random commented at 7:37 AM on July 22, 2026:

nit: Let's remove this comment. This is typical LLM comment: it makes sense in the context of LLM conversation but it doesn't add anything for a reader that looks at the file without this context.

real-or-random commented at 7:38 AM on July 22, 2026: contributor

Good catch.

It would be nice to test also the "custom nonce" path (with a simple custom function).
real-or-random added the label assurance on Jul 22, 2026
real-or-random added the label side-channel on Jul 22, 2026
real-or-random added the label tweak/refactor on Jul 22, 2026

test: cover custom Schnorr nonce callback in ctime tests

Exercise schnorrsig_sign_custom with non-NULL auxiliary data and
with a distinct custom nonce callback under CHECKMEM.

The callback delegates to the BIP340 nonce function so the custom
dispatch path is tested without introducing an unsafe test nonce.
Use a variable-length message for the custom callback case.

81e434f1af

Yudis-bit commented at 2:00 PM on July 22, 2026: none
Addressed the review:
- removed the redundant comment;
- added a distinct custom nonce callback (nonce_function_custom) that delegates to secp256k1_nonce_function_bip340;
- exercised the custom callback path with CHECKMEM-undefined secret inputs;
- added non-NULL auxiliary-data coverage (extraparams.ndata);
- used a variable-length message (sizeof(msg) - 1) for the custom path.
Validation:
- ctime_tests build: pass
- Valgrind/CHECKMEM clean run: pass (0 errors)
- CTest test suites (207 tests): pass (100% passed)
- Local-only secret-branch mutations (custom callback branch and non-NULL aux data branch) were detected by Valgrind (exit code 42) and removed before push

Contributors

Yudis-bit

real-or-random

Labels

assurance side-channel tweak/refactor

test: cover schnorrsig_sign_custom in constant-time tests #1893

Description

Coverage gap (why)

Change

Build / test