ellswift: declassify PRNG outputs before branching on them #1969

pull fametrano wants to merge 1 commits into bitcoin-core:master from fametrano:ellswift-declassify-prng changing 2 files +11 −0

fametrano commented at 1:31 PM on October 17, 2026: contributor

The header says secp256k1_ellswift_create is constant time in auxrnd32, but ctime_tests never marks auxrnd32 secret. Marking it secret makes the test fail under Valgrind and MSan, because secp256k1_ellswift_xswiftec_inv_var branches on the branch value and on u, which are PRNG outputs derived from auxrnd32.

This declassifies the branch pool and u32 right after they are drawn, as option 2 in the issue proposes. They are SHA256 outputs, so declassifying them does not reveal seckey32 or auxrnd32. ctime_tests now calls secp256k1_ellswift_create with both secret.

Fixes #1962.
Yudis-bit commented at 11:29 PM on October 17, 2026: contributor

Tested ACK 164b8c5 on Windows.
theStack added the label side-channel on Oct 18, 2026

in src/modules/ellswift/main_impl.h:357 in 164b8c5333

 351 | @@ -352,8 +352,12 @@ static void secp256k1_ellswift_xelligatorswift_var(const secp256k1_context *ctx,
 352 |          /* Take a 3-bit branch value from the branch pool (top bit is discarded). */
 353 |          --branches_left;
 354 |          branch = (branch_hash[branches_left >> 1] >> ((branches_left & 1) << 2)) & 7;
 355 | +        /* Declassify branch and u32 below, as xswiftec_inv_var branches on them. They are
 356 | +         * hash outputs, so they do not reveal the secret inputs written to hasher. */
 357 | +        secp256k1_declassify(ctx, &branch, sizeof(branch));

theStack commented at 6:40 AM on November 3, 2026:

nit: alternatively, could declassify the branch pool (branch_hash) right after its populated a few lines above, rather than the taken value in every iteration

fametrano commented at 8:06 AM on November 4, 2026:

Done in 1963611: branch_hash is now declassified once, right after it is filled, and the branch is rebased on master.

theStack approved
theStack commented at 6:44 AM on November 3, 2026: contributor

ACK 164b8c5333a3559dd49f843f59671d840b71558a

ellswift: declassify PRNG outputs before branching on them

The header says secp256k1_ellswift_create is constant time in seckey32
and auxrnd32, but secp256k1_ellswift_xswiftec_inv_var branches on the
branch value and on u, which are SHA256 outputs of both. ctime_tests
did not catch this because it never marked auxrnd32 secret.

Declassify the branch pool and u32 right after they are drawn. They
are hash outputs, so they do not reveal the secret inputs. Then mark
auxrnd32 secret in ctime_tests.

Fixes #1962.

196361112b

fametrano force-pushed on Nov 3, 2026

Contributors

Labels

Linked (view graph)

#1962 ellswift: constant-time tests don't cover `auxrnd32` in `secp256k1_ellswift_create`#1988 ctime_tests: treat auxiliary signing randomness as secret