ctime_tests: treat auxiliary signing randomness as secret #1988

pull amartya1523 wants to merge 2 commits into bitcoin-core:master from amartya1523:ctime-aux-rand changing 1 files +11 −0

amartya1523 commented at 4:33 PM on November 3, 2026: none
While looking at #1962 I noticed a similar gap for the signing functions. The BIP340 aux_rand buffer is passed to schnorrsig_sign_custom in the constant-time tests but is never marked as undefined, and ecdsa_sign is only tested with ndata = NULL, so the RFC6979 path that mixes in extra entropy never runs with secret inputs.

Both values end up hashed together with the secret key to derive the nonce, and callers use them to add fresh randomness, so they shouldn't influence control flow or memory access either.
- The first commit marks aux_rand as undefined before both sign_custom calls (default BIP340 nonce function and the custom one).
- The second adds an ecdsa_sign call with a secret ndata.
This is test-only and doesn't overlap with #1969, which handles the ellswift auxrnd32 case from #1962.

ctime_tests: treat schnorrsig aux_rand as secret

BIP340 hashes the auxiliary randomness and XORs it into the secret key
before deriving the nonce, and its protection against side-channel
attacks relies on aux_rand being unknown to the attacker. The ctime
tests passed aux_rand to schnorrsig_sign_custom but left it marked as
defined, so a secret-dependent branch on it would go unnoticed.

Mark aux_rand as undefined before both sign_custom calls that use it,
covering the default BIP340 nonce function as well as a custom one.

680394c96b

ctime_tests: cover ecdsa_sign with extra entropy

The ECDSA signing test only passed NULL as ndata, so the RFC6979 path
that mixes 32 bytes of extra entropy into the nonce derivation was never
run with secret inputs. Callers can use ndata to add fresh randomness to
the nonce, and like the secret key it should not influence control flow
or memory access patterns.

Add a signing call with both the key and ndata marked as undefined.

484f48dcde

amartya1523 closed this on Nov 3, 2026

Contributors

amartya1523

Linked (view graph)

#1962 ellswift: constant-time tests don't cover `auxrnd32` in `secp256k1_ellswift_create`#1969 ellswift: declassify PRNG outputs before branching on them