frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hash: add midstate initializer and use it for tagged hashes

Browse Source 
Introduce secp256k1_sha256_initialize_midstate() in the hash layer and use it at all tagged-hash midstate call sites across schnorrsig, musig, and ellswift.

Document the byte-counter contract at the declaration site in hash.h and add run_sha256_initialize_midstate_tests() to directly verify helper behavior against initialize_tagged.

Also switch the helper to take const uint32_t state[8] to reduce argument-order risk at call sites.
This commit is contained in:
w0xlt
2026-02-18 15:21:54 -08:00
parent 471e3a130d
commit f48b1bfa5d
7 changed files with 80 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
src/modules/musig/keyagg_impl.h
View File

@@ -62,17 +62,11 @@ static int secp256k1_keyagg_cache_load(const secp256k1_context* ctx, secp256k1_k
/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
* SHA256 to SHA256("KeyAgg list")||SHA256("KeyAgg list"). */
static void secp256k1_musig_keyagglist_sha256(secp256k1_sha256 *sha) {
secp256k1_sha256_initialize(sha);
sha->s[0] = 0xb399d5e0ul;
sha->s[1] = 0xc8fff302ul;
sha->s[2] = 0x6badac71ul;
sha->s[3] = 0x07c5b7f1ul;
sha->s[4] = 0x9701e2eful;
sha->s[5] = 0x2a72ecf8ul;
sha->s[6] = 0x201a4c7bul;
sha->s[7] = 0xab148a38ul;
sha->bytes = 64;
static const uint32_t midstate[8] = {
0xb399d5e0ul, 0xc8fff302ul, 0x6badac71ul, 0x07c5b7f1ul,
0x9701e2eful, 0x2a72ecf8ul, 0x201a4c7bul, 0xab148a38ul
};
secp256k1_sha256_initialize_midstate(sha, 64, midstate);
}
/* Computes pks_hash = tagged_hash(pk[0], ..., pk[np-1]) */
@@ -97,17 +91,11 @@ static int secp256k1_musig_compute_pks_hash(const secp256k1_context *ctx, unsign
/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
* SHA256 to SHA256("KeyAgg coefficient")||SHA256("KeyAgg coefficient"). */
static void secp256k1_musig_keyaggcoef_sha256(secp256k1_sha256 *sha) {
secp256k1_sha256_initialize(sha);
sha->s[0] = 0x6ef02c5aul;
sha->s[1] = 0x06a480deul;
sha->s[2] = 0x1f298665ul;
sha->s[3] = 0x1d1134f2ul;
sha->s[4] = 0x56a0b063ul;
sha->s[5] = 0x52da4147ul;
sha->s[6] = 0xf280d9d4ul;
sha->s[7] = 0x4484be15ul;
sha->bytes = 64;
static const uint32_t midstate[8] = {
0x6ef02c5aul, 0x06a480deul, 0x1f298665ul, 0x1d1134f2ul,
0x56a0b063ul, 0x52da4147ul, 0xf280d9d4ul, 0x4484be15ul
};
secp256k1_sha256_initialize_midstate(sha, 64, midstate);
}
/* Compute KeyAgg coefficient which is constant 1 for the second pubkey and

45
src/modules/musig/session_impl.h
View File

@@ -309,31 +309,21 @@ static void secp256k1_nonce_function_musig_helper(secp256k1_sha256 *sha, unsigne
/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
* SHA256 to SHA256("MuSig/aux")||SHA256("MuSig/aux"). */
static void secp256k1_nonce_function_musig_sha256_tagged_aux(secp256k1_sha256 *sha) {
secp256k1_sha256_initialize(sha);
sha->s[0] = 0xa19e884bul;
sha->s[1] = 0xf463fe7eul;
sha->s[2] = 0x2f18f9a2ul;
sha->s[3] = 0xbeb0f9fful;
sha->s[4] = 0x0f37e8b0ul;
sha->s[5] = 0x06ebd26ful;
sha->s[6] = 0xe3b243d2ul;
sha->s[7] = 0x522fb150ul;
sha->bytes = 64;
static const uint32_t midstate[8] = {
0xa19e884bul, 0xf463fe7eul, 0x2f18f9a2ul, 0xbeb0f9fful,
0x0f37e8b0ul, 0x06ebd26ful, 0xe3b243d2ul, 0x522fb150ul
};
secp256k1_sha256_initialize_midstate(sha, 64, midstate);
}
/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
* SHA256 to SHA256("MuSig/nonce")||SHA256("MuSig/nonce"). */
static void secp256k1_nonce_function_musig_sha256_tagged(secp256k1_sha256 *sha) {
secp256k1_sha256_initialize(sha);
sha->s[0] = 0x07101b64ul;
sha->s[1] = 0x18003414ul;
sha->s[2] = 0x0391bc43ul;
sha->s[3] = 0x0e6258eeul;
sha->s[4] = 0x29d26b72ul;
sha->s[5] = 0x8343937eul;
sha->s[6] = 0xb7a0a4fbul;
sha->s[7] = 0xff568a30ul;
sha->bytes = 64;
static const uint32_t midstate[8] = {
0x07101b64ul, 0x18003414ul, 0x0391bc43ul, 0x0e6258eeul,
0x29d26b72ul, 0x8343937eul, 0xb7a0a4fbul, 0xff568a30ul
};
secp256k1_sha256_initialize_midstate(sha, 64, midstate);
}
static void secp256k1_nonce_function_musig(secp256k1_scalar *k, const unsigned char *session_secrand, const unsigned char *msg32, const unsigned char *seckey32, const unsigned char *pk33, const unsigned char *agg_pk32, const unsigned char *extra_input32) {
@@ -543,16 +533,11 @@ int secp256k1_musig_nonce_agg(const secp256k1_context* ctx, secp256k1_musig_aggn
/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
* SHA256 to SHA256("MuSig/noncecoef")||SHA256("MuSig/noncecoef"). */
static void secp256k1_musig_compute_noncehash_sha256_tagged(secp256k1_sha256 *sha) {
secp256k1_sha256_initialize(sha);
sha->s[0] = 0x2c7d5a45ul;
sha->s[1] = 0x06bf7e53ul;
sha->s[2] = 0x89be68a6ul;
sha->s[3] = 0x971254c0ul;
sha->s[4] = 0x60ac12d2ul;
sha->s[5] = 0x72846dcdul;
sha->s[6] = 0x6c81212ful;
sha->s[7] = 0xde7a2500ul;
sha->bytes = 64;
static const uint32_t midstate[8] = {
0x2c7d5a45ul, 0x06bf7e53ul, 0x89be68a6ul, 0x971254c0ul,
0x60ac12d2ul, 0x72846dcdul, 0x6c81212ful, 0xde7a2500ul
};
secp256k1_sha256_initialize_midstate(sha, 64, midstate);
}
/* tagged_hash(aggnonce[0], aggnonce[1], agg_pk, msg) */