ecdh/ellswift/schnorrsig: return early for invalid inputs (consistent handling w.r.t. constant-time) #1919

pull theStack wants to merge 3 commits into bitcoin-core:master from theStack:ctime-only_for_valid_inputs changing 5 files +41 −16

theStack commented at 1:37 AM on August 20, 2026: contributor
This PR partly addresses issue #1621, handling invalid inputs consistently w.r.t. constant-time, by applying the suggested "functions are constant-time only for valid inputs" approach (number 2. in the issue), for the following modules and API functions:
- ecdh: secp256k1_ecdh
- ellswift: secp256k1_ellswift_create and secp256k1_ellswift_xdh
- schnorrsig: secp256k1_schnorrsig_sign{32,_custom}
As stated in #1621, this leads to more readable and maintainable code, getting rid of constructs like return (!!ret) & is_sec_valid; or intermediate ret &= ...; statements. Conditional assignments like secp256k1_scalar_cmov can be removed as well.

Tests are added for the newly introduced branches if there were none. There are still further instances to tackle (mostly the main module API functions in secp256k1.c, and potential cleanups like e.g. removing the dummy assignments in _keypair_load), happy to add these here or in another PR, mostly chasing Conecpt ACKs for now if this is we want to handle constant-time behavior for current and future modules.

ecdh: return early for invalid inputs

Applies the suggested "function is constant-time only for valid inputs"
suggestion in issue #1621 ("Handle invalid inputs consistently w.r.t.
constant-time") for the API function `secp256k1_ecdh`.

While being at it, also introduce a check for the pubkey object
validity for consistency with other modules. Strictly speaking this is
a behaviour change, but it should be fine as it only improves things
for the user (from potentially arbitrary behaviour to defined one) and
as developers we don't have to reason anymore about code-paths with
how the remainder of the function behaves if the pubkey wasn't loaded
successfully.

170a3395e5

ellswift: return early for invalid inputs

Applies the suggested "function is constant-time only for valid inputs"
suggestion in issue #1621 ("Handle invalid inputs consistently w.r.t.
constant-time") for the API functions `secp256k1_ellswift_create` and
`secp256k1_ellswift_xdh`.

2a2c1985c1

schnorrsig: return early for invalid inputs

Applies the suggested "function is constant-time only for valid inputs"
suggestion in issue #1621 ("Handle invalid inputs consistently w.r.t.
constant-time") for the API functions `secp256k1_schnorrsig_sign32` and
`secp256k1_schnorrsig_sign_custom` (both calling
the non-public `secp256k1_schnorrsig_internal` function).

c45197378b

theStack renamed this:
~~ecdh/ellswift/schnorrsig: return early for invalid inputs (consistant handling w.r.t. constant-time)~~
ecdh/ellswift/schnorrsig: return early for invalid inputs (consistent handling w.r.t. constant-time)
on Aug 20, 2026
theStack added the label tweak/refactor on Aug 20, 2026
theStack added the label side-channel on Aug 20, 2026

Contributors

theStack

Labels

side-channel tweak/refactor

Linked (view graph)

#1621 Handle invalid inputs consistently with respect to constant-time