ellswift: declassify PRNG outputs before branching on them #1969

pull fametrano wants to merge 1 commits into bitcoin-core:master from fametrano:ellswift-declassify-prng changing 2 files +11 −0

fametrano commented at 1:31 PM on October 17, 2026: contributor

The header says secp256k1_ellswift_create is constant time in auxrnd32, but ctime_tests never marks auxrnd32 secret. Marking it secret makes the test fail under Valgrind and MSan, because secp256k1_ellswift_xswiftec_inv_var branches on the branch value and on u, which are PRNG outputs derived from auxrnd32.

This declassifies the branch value and u32 right after they are drawn, as option 2 in the issue proposes. They are SHA256 outputs, so declassifying them does not reveal seckey32 or auxrnd32. ctime_tests now calls secp256k1_ellswift_create with both secret.

Fixes #1962.

ellswift: declassify PRNG outputs before branching on them

The header says secp256k1_ellswift_create is constant time in seckey32
and auxrnd32, but secp256k1_ellswift_xswiftec_inv_var branches on the
branch value and on u, which are SHA256 outputs of both. ctime_tests
did not catch this because it never marked auxrnd32 secret.

Declassify the branch value and u32 right before they are used. They
are hash outputs, so they do not reveal the secret inputs. Then mark
auxrnd32 secret in ctime_tests.

Fixes #1962.

164b8c5333

Yudis-bit commented at 11:29 PM on October 17, 2026: contributor

Tested ACK 164b8c5 on Windows.
theStack added the label side-channel on Oct 18, 2026

Contributors

fametrano

Yudis-bit

Labels

side-channel

Linked (view graph)

#1962 ellswift: constant-time tests don't cover `auxrnd32` in `secp256k1_ellswift_create`