src/secp256k1/src/ecmult_gen_impl.h
/* Setup blinding values for secp256k1_ecmult_gen. */
Setup blinding values for secp256k1_ecmult_gen.
Setup blinding values for secp256k1_ecmult_gen .
static void secp256k1_ecmult_gen_blind(secp256k1_ecmult_gen_context *ctx, const unsigned char *seed32) {
    secp256k1_scalar b;
    secp256k1_gej gb;
    secp256k1_fe s;
    unsigned char nonce32[32];
    secp256k1_rfc6979_hmac_sha256_t rng;
    int retry;
    unsigned char keydata[64] = {0};
    if (seed32 == NULL) {
        secp256k1_gej_set_ge(&ctx->initial, &secp256k1_ge_const_g);
        secp256k1_gej_neg(&ctx->initial, &ctx->initial);
        secp256k1_scalar_set_int(&ctx->blind, 1);
    }
    secp256k1_scalar_get_b32(nonce32, &ctx->blind);
    memcpy(keydata, nonce32, 32);
    if (seed32 != NULL) {
        memcpy(keydata + 32, seed32, 32);
    }
    secp256k1_rfc6979_hmac_sha256_initialize(&rng, keydata, seed32 ? 64 : 32);
    memset(keydata, 0, sizeof(keydata));
    do {
        secp256k1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
        retry = !secp256k1_fe_set_b32(&s, nonce32);
        retry |= secp256k1_fe_is_zero(&s);
    } while (retry); 
    secp256k1_gej_rescale(&ctx->initial, &s);
    secp256k1_fe_clear(&s);
    do {
        secp256k1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
        secp256k1_scalar_set_b32(&b, nonce32, &retry);
        retry |= secp256k1_scalar_is_zero(&b);
    } while (retry); 
    secp256k1_rfc6979_hmac_sha256_finalize(&rng);
    memset(nonce32, 0, 32);
    secp256k1_ecmult_gen(ctx, &gb, &b);
    secp256k1_scalar_negate(&b, &b);
    ctx->blind = b;
    ctx->initial = gb;
    secp256k1_scalar_clear(&b);
    secp256k1_gej_clear(&gb);
}
static void secp256k1_ecmult_gen_blind ( secp256k1_ecmult_gen_context * ctx , const unsigned char * seed32 ) { secp256k1_scalar b ; secp256k1_gej gb ; secp256k1_fe s ; unsigned char nonce32 [ 32 ] ; secp256k1_rfc6979_hmac_sha256_t rng ; int retry ; unsigned char keydata [ 64 ] = { 0 } ; if ( seed32 == NULL ) { secp256k1_gej_set_ge ( & ctx -> initial , & secp256k1_ge_const_g ) ; secp256k1_gej_neg ( & ctx -> initial , & ctx -> initial ) ; secp256k1_scalar_set_int ( & ctx -> blind , 1 ) ; } secp256k1_scalar_get_b32 ( nonce32 , & ctx -> blind ) ; memcpy ( keydata , nonce32 , 32 ) ; if ( seed32 != NULL ) { memcpy ( keydata + 32 , seed32 , 32 ) ; } secp256k1_rfc6979_hmac_sha256_initialize ( & rng , keydata , seed32 ? 64 : 32 ) ; memset ( keydata , 0 , sizeof ( keydata ) ) ; do { secp256k1_rfc6979_hmac_sha256_generate ( & rng , nonce32 , 32 ) ; retry = ! secp256k1_fe_set_b32 ( & s , nonce32 ) ; retry |= secp256k1_fe_is_zero ( & s ) ; } while ( retry ) ; secp256k1_gej_rescale ( & ctx -> initial , & s ) ; secp256k1_fe_clear ( & s ) ; do { secp256k1_rfc6979_hmac_sha256_generate ( & rng , nonce32 , 32 ) ; secp256k1_scalar_set_b32 ( & b , nonce32 , & retry ) ; retry |= secp256k1_scalar_is_zero ( & b ) ; } while ( retry ) ; secp256k1_rfc6979_hmac_sha256_finalize ( & rng ) ; memset ( nonce32 , 0 , 32 ) ; secp256k1_ecmult_gen ( ctx , & gb , & b ) ; secp256k1_scalar_negate ( & b , & b ) ; ctx -> blind = b ; ctx -> initial = gb ; secp256k1_scalar_clear ( & b ) ; secp256k1_gej_clear ( & gb ) ; }
Setup blinding values for secp256k1_ecmult_gen.
Setup blinding values for secp256k1_ecmult_gen .
/* When seed is NULL, reset the initial point and blinding value. */ /* The prior blinding value (if not reset) is chained forward by including it in the hash. */ /** Using a CSPRNG allows a failure free interface, avoids needing large amounts of random data,
     *   and guards against weak or adversarial seeds.  This is a simpler and safer interface than
     *   asking the caller for blinding values directly and expecting them to retry on failure.
     */ /* Retry for out of range results to achieve uniformity. */ /* This branch true is cryptographically unreachable. Requires sha256_hmac output > Fp. */ /* Randomize the projection to defend against multiplier sidechannels. */ /* A blinding value of 0 works, but would undermine the projection hardening. */ /* This branch true is cryptographically unreachable. Requires sha256_hmac output > order. */