tests: correct scalar split bound vectors #1921

pull l0rinc wants to merge 1 commits into bitcoin-core:master from l0rinc:l0rinc/scalar-split-bound-vectors changing 1 files +47 −20

l0rinc commented at 6:13 AM on August 24, 2026: contributor

The 20 scalars used to exercise secp256k1_scalar_split_lambda near its 128-bit bounds do not match their documented construction. One 32-bit limb is shifted in every entry, so the resulting split components remain around 126 bits and miss the cases this table is intended to cover.

This regenerates the constants from (a*LAMBDA + (ORDER+b)/2) mod ORDER and checks every literal against that formula at runtime. The corrected existing input set reaches the maximum absolute values of both split components, so no additional inputs are needed.

Fixes #1920.

tests: correct scalar split bound vectors

The precomputed scalars do not match their documented construction because one 32-bit limb in every entry is shifted. The resulting splits stay well below the intended 128-bit boundaries.

Regenerate all 20 constants and check them against the formula at runtime so future transcription errors fail directly. The existing input set already reaches the maximum absolute values of both split components.

refs #1920

ef59c3c292

l0rinc commented at 6:16 AM on August 24, 2026: contributor

This isn't ready yet, meant to push it elsewhere
l0rinc closed this on Aug 24, 2026
real-or-random added the label invalid on Aug 24, 2026

Contributors

l0rinc

Labels

invalid

Linked (view graph)

#1920 scalars_near_split_bounds in tests.c don't match their documented construction