@qntx/nostr-native 0.0.0-stage → 0.12.1

package/vendor/secp256k1/src/modules/extrakeys/main_impl.h

@@ -0,0 +1,292 @@
+/***********************************************************************
+ * Copyright (c) 2020 Jonas Nick                                       *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_EXTRAKEYS_MAIN_H
+#define SECP256K1_MODULE_EXTRAKEYS_MAIN_H
+
+#include "../../../include/secp256k1.h"
+#include "../../../include/secp256k1_extrakeys.h"
+#include "../../util.h"
+
+static SECP256K1_INLINE int nostr_native_secp256k1_xonly_pubkey_load(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_ge *ge, const nostr_native_secp256k1_xonly_pubkey *pubkey) {
+    return nostr_native_secp256k1_pubkey_load(ctx, ge, (const nostr_native_secp256k1_pubkey *) pubkey);
+}
+
+static SECP256K1_INLINE void nostr_native_secp256k1_xonly_pubkey_save(nostr_native_secp256k1_xonly_pubkey *pubkey, nostr_native_secp256k1_ge *ge) {
+#ifdef VERIFY
+    /* ensure that the group element's Y coordinate is even, as per definition of x-only public keys */
+    nostr_native_secp256k1_fe y = ge->y;
+    nostr_native_secp256k1_fe_normalize_var(&y);
+    VERIFY_CHECK(!nostr_native_secp256k1_fe_is_odd(&y));
+#endif
+
+    nostr_native_secp256k1_pubkey_save((nostr_native_secp256k1_pubkey *) pubkey, ge);
+}
+
+int nostr_native_secp256k1_xonly_pubkey_parse(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_xonly_pubkey *pubkey, const unsigned char *input32) {
+    nostr_native_secp256k1_ge pk;
+    nostr_native_secp256k1_fe x;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(pubkey != NULL);
+    memset(pubkey, 0, sizeof(*pubkey));
+    ARG_CHECK(input32 != NULL);
+
+    if (!nostr_native_secp256k1_fe_set_b32_limit(&x, input32)) {
+        return 0;
+    }
+    if (!nostr_native_secp256k1_ge_set_xo_var(&pk, &x, 0)) {
+        return 0;
+    }
+    if (!nostr_native_secp256k1_ge_is_in_correct_subgroup(&pk)) {
+        return 0;
+    }
+    nostr_native_secp256k1_xonly_pubkey_save(pubkey, &pk);
+    return 1;
+}
+
+int nostr_native_secp256k1_xonly_pubkey_serialize(const nostr_native_secp256k1_context* ctx, unsigned char *output32, const nostr_native_secp256k1_xonly_pubkey *pubkey) {
+    nostr_native_secp256k1_ge pk;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(output32 != NULL);
+    memset(output32, 0, 32);
+    ARG_CHECK(pubkey != NULL);
+
+    if (!nostr_native_secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) {
+        return 0;
+    }
+    nostr_native_secp256k1_fe_get_b32(output32, &pk.x);
+    return 1;
+}
+
+int nostr_native_secp256k1_xonly_pubkey_cmp(const nostr_native_secp256k1_context* ctx, const nostr_native_secp256k1_xonly_pubkey* pk0, const nostr_native_secp256k1_xonly_pubkey* pk1) {
+    unsigned char out[2][32];
+    const nostr_native_secp256k1_xonly_pubkey* pk[2];
+    int i;
+
+    VERIFY_CHECK(ctx != NULL);
+    pk[0] = pk0; pk[1] = pk1;
+    for (i = 0; i < 2; i++) {
+        /* If the public key is NULL or invalid, xonly_pubkey_serialize will
+         * call the illegal_callback and return 0. In that case we will
+         * serialize the key as all zeros which is less than any valid public
+         * key. This results in consistent comparisons even if NULL or invalid
+         * pubkeys are involved and prevents edge cases such as sorting
+         * algorithms that use this function and do not terminate as a
+         * result. */
+        if (!nostr_native_secp256k1_xonly_pubkey_serialize(ctx, out[i], pk[i])) {
+            /* Note that xonly_pubkey_serialize should already set the output to
+             * zero in that case, but it's not guaranteed by the API, we can't
+             * test it and writing a VERIFY_CHECK is more complex than
+             * explicitly memsetting (again). */
+            memset(out[i], 0, sizeof(out[i]));
+        }
+    }
+    return nostr_native_secp256k1_memcmp_var(out[0], out[1], sizeof(out[1]));
+}
+
+/** Keeps a group element as is if it has an even Y and otherwise negates it.
+ *  y_parity is set to 0 in the former case and to 1 in the latter case.
+ *  Requires that the coordinates of r are normalized. */
+static int nostr_native_secp256k1_extrakeys_ge_even_y(nostr_native_secp256k1_ge *r) {
+    int y_parity = 0;
+    VERIFY_CHECK(!nostr_native_secp256k1_ge_is_infinity(r));
+
+    if (nostr_native_secp256k1_fe_is_odd(&r->y)) {
+        nostr_native_secp256k1_fe_negate(&r->y, &r->y, 1);
+        y_parity = 1;
+    }
+    return y_parity;
+}
+
+int nostr_native_secp256k1_xonly_pubkey_from_pubkey(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_xonly_pubkey *xonly_pubkey, int *pk_parity, const nostr_native_secp256k1_pubkey *pubkey) {
+    nostr_native_secp256k1_ge pk;
+    int tmp;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(xonly_pubkey != NULL);
+    ARG_CHECK(pubkey != NULL);
+
+    if (!nostr_native_secp256k1_pubkey_load(ctx, &pk, pubkey)) {
+        return 0;
+    }
+    tmp = nostr_native_secp256k1_extrakeys_ge_even_y(&pk);
+    if (pk_parity != NULL) {
+        *pk_parity = tmp;
+    }
+    nostr_native_secp256k1_xonly_pubkey_save(xonly_pubkey, &pk);
+    return 1;
+}
+
+int nostr_native_secp256k1_xonly_pubkey_tweak_add(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_pubkey *output_pubkey, const nostr_native_secp256k1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
+    nostr_native_secp256k1_ge pk;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(output_pubkey != NULL);
+    memset(output_pubkey, 0, sizeof(*output_pubkey));
+    ARG_CHECK(internal_pubkey != NULL);
+    ARG_CHECK(tweak32 != NULL);
+
+    if (!nostr_native_secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
+        || !nostr_native_secp256k1_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
+        return 0;
+    }
+    nostr_native_secp256k1_pubkey_save(output_pubkey, &pk);
+    return 1;
+}
+
+int nostr_native_secp256k1_xonly_pubkey_tweak_add_check(const nostr_native_secp256k1_context* ctx, const unsigned char *tweaked_pubkey32, int tweaked_pk_parity, const nostr_native_secp256k1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
+    nostr_native_secp256k1_ge pk;
+    unsigned char pk_expected32[32];
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(internal_pubkey != NULL);
+    ARG_CHECK(tweaked_pubkey32 != NULL);
+    ARG_CHECK(tweak32 != NULL);
+
+    if (!nostr_native_secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
+        || !nostr_native_secp256k1_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
+        return 0;
+    }
+    nostr_native_secp256k1_fe_normalize_var(&pk.x);
+    nostr_native_secp256k1_fe_normalize_var(&pk.y);
+    nostr_native_secp256k1_fe_get_b32(pk_expected32, &pk.x);
+
+    return nostr_native_secp256k1_memcmp_var(&pk_expected32, tweaked_pubkey32, 32) == 0
+            && nostr_native_secp256k1_fe_is_odd(&pk.y) == tweaked_pk_parity;
+}
+
+static void nostr_native_secp256k1_keypair_save(nostr_native_secp256k1_keypair *keypair, const nostr_native_secp256k1_scalar *sk, nostr_native_secp256k1_ge *pk) {
+    nostr_native_secp256k1_scalar_get_b32(&keypair->data[0], sk);
+    nostr_native_secp256k1_pubkey_save((nostr_native_secp256k1_pubkey *)&keypair->data[32], pk);
+}
+
+
+static int nostr_native_secp256k1_keypair_seckey_load(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_scalar *sk, const nostr_native_secp256k1_keypair *keypair) {
+    int ret;
+
+    ret = nostr_native_secp256k1_scalar_set_b32_seckey(sk, &keypair->data[0]);
+    /* We can declassify ret here because sk is only zero if a keypair function
+     * failed (which zeroes the keypair) and its return value is ignored. */
+    nostr_native_secp256k1_declassify(ctx, &ret, sizeof(ret));
+    ARG_CHECK(ret);
+    return ret;
+}
+
+/* Load a keypair into pk and sk (if non-NULL). This function declassifies pk
+ * and ARG_CHECKs that the keypair is not invalid. It always initializes sk and
+ * pk with dummy values. */
+static int nostr_native_secp256k1_keypair_load(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_scalar *sk, nostr_native_secp256k1_ge *pk, const nostr_native_secp256k1_keypair *keypair) {
+    int ret;
+    const nostr_native_secp256k1_pubkey *pubkey = (const nostr_native_secp256k1_pubkey *)&keypair->data[32];
+
+    /* Need to declassify the pubkey because pubkey_load ARG_CHECKs if it's
+     * invalid. */
+    nostr_native_secp256k1_declassify(ctx, pubkey, sizeof(*pubkey));
+    ret = nostr_native_secp256k1_pubkey_load(ctx, pk, pubkey);
+    if (sk != NULL) {
+        ret = ret && nostr_native_secp256k1_keypair_seckey_load(ctx, sk, keypair);
+    }
+    if (!ret) {
+        *pk = nostr_native_secp256k1_ge_const_g;
+        if (sk != NULL) {
+            *sk = nostr_native_secp256k1_scalar_one;
+        }
+    }
+    return ret;
+}
+
+int nostr_native_secp256k1_keypair_create(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_keypair *keypair, const unsigned char *seckey32) {
+    nostr_native_secp256k1_scalar sk;
+    nostr_native_secp256k1_ge pk;
+    int ret = 0;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(keypair != NULL);
+    memset(keypair, 0, sizeof(*keypair));
+    ARG_CHECK(nostr_native_secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(seckey32 != NULL);
+
+    ret = nostr_native_secp256k1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &sk, &pk, seckey32);
+    nostr_native_secp256k1_keypair_save(keypair, &sk, &pk);
+    nostr_native_secp256k1_memczero(keypair, sizeof(*keypair), !ret);
+
+    nostr_native_secp256k1_scalar_clear(&sk);
+    return ret;
+}
+
+int nostr_native_secp256k1_keypair_sec(const nostr_native_secp256k1_context* ctx, unsigned char *seckey, const nostr_native_secp256k1_keypair *keypair) {
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(seckey != NULL);
+    memset(seckey, 0, 32);
+    ARG_CHECK(keypair != NULL);
+
+    memcpy(seckey, &keypair->data[0], 32);
+    return 1;
+}
+
+int nostr_native_secp256k1_keypair_pub(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_pubkey *pubkey, const nostr_native_secp256k1_keypair *keypair) {
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(pubkey != NULL);
+    memset(pubkey, 0, sizeof(*pubkey));
+    ARG_CHECK(keypair != NULL);
+
+    memcpy(pubkey->data, &keypair->data[32], sizeof(*pubkey));
+    return 1;
+}
+
+int nostr_native_secp256k1_keypair_xonly_pub(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_xonly_pubkey *pubkey, int *pk_parity, const nostr_native_secp256k1_keypair *keypair) {
+    nostr_native_secp256k1_ge pk;
+    int tmp;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(pubkey != NULL);
+    memset(pubkey, 0, sizeof(*pubkey));
+    ARG_CHECK(keypair != NULL);
+
+    if (!nostr_native_secp256k1_keypair_load(ctx, NULL, &pk, keypair)) {
+        return 0;
+    }
+    tmp = nostr_native_secp256k1_extrakeys_ge_even_y(&pk);
+    if (pk_parity != NULL) {
+        *pk_parity = tmp;
+    }
+    nostr_native_secp256k1_xonly_pubkey_save(pubkey, &pk);
+
+    return 1;
+}
+
+int nostr_native_secp256k1_keypair_xonly_tweak_add(const nostr_native_secp256k1_context* ctx, nostr_native_secp256k1_keypair *keypair, const unsigned char *tweak32) {
+    nostr_native_secp256k1_ge pk;
+    nostr_native_secp256k1_scalar sk;
+    int y_parity;
+    int ret;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(keypair != NULL);
+    ARG_CHECK(tweak32 != NULL);
+
+    ret = nostr_native_secp256k1_keypair_load(ctx, &sk, &pk, keypair);
+    memset(keypair, 0, sizeof(*keypair));
+
+    y_parity = nostr_native_secp256k1_extrakeys_ge_even_y(&pk);
+    if (y_parity == 1) {
+        nostr_native_secp256k1_scalar_negate(&sk, &sk);
+    }
+
+    ret &= nostr_native_secp256k1_ec_seckey_tweak_add_helper(&sk, tweak32);
+    ret &= nostr_native_secp256k1_ec_pubkey_tweak_add_helper(&pk, tweak32);
+
+    nostr_native_secp256k1_declassify(ctx, &ret, sizeof(ret));
+    if (ret) {
+        nostr_native_secp256k1_keypair_save(keypair, &sk, &pk);
+    }
+
+    nostr_native_secp256k1_scalar_clear(&sk);
+    return ret;
+}
+
+#endif

package/vendor/secp256k1/src/modules/schnorrsig/main_impl.h

@@ -0,0 +1,256 @@
+/***********************************************************************
+ * Copyright (c) 2018-2020 Andrew Poelstra, Jonas Nick                 *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_SCHNORRSIG_MAIN_H
+#define SECP256K1_MODULE_SCHNORRSIG_MAIN_H
+
+#include "../../../include/secp256k1.h"
+#include "../../../include/secp256k1_schnorrsig.h"
+#include "../../hash.h"
+
+/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
+ * SHA256 to SHA256("BIP0340/nonce")||SHA256("BIP0340/nonce"). */
+static void nostr_native_secp256k1_nonce_function_bip340_sha256_tagged(nostr_native_secp256k1_sha256 *sha) {
+    static const uint32_t midstate[8] = {
+        0x46615b35ul, 0xf4bfbff7ul, 0x9f8dc671ul, 0x83627ab3ul,
+        0x60217180ul, 0x57358661ul, 0x21a29e54ul, 0x68b07b4cul
+    };
+    nostr_native_secp256k1_sha256_initialize_midstate(sha, 64, midstate);
+}
+
+/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
+ * SHA256 to SHA256("BIP0340/aux")||SHA256("BIP0340/aux"). */
+static void nostr_native_secp256k1_nonce_function_bip340_sha256_tagged_aux(nostr_native_secp256k1_sha256 *sha) {
+    static const uint32_t midstate[8] = {
+        0x24dd3219ul, 0x4eba7e70ul, 0xca0fabb9ul, 0x0fa3166dul,
+        0x3afbe4b1ul, 0x4c44df97ul, 0x4aac2739ul, 0x249e850aul
+    };
+    nostr_native_secp256k1_sha256_initialize_midstate(sha, 64, midstate);
+}
+
+/* algo argument for nonce_function_bip340 to derive the nonce exactly as stated in BIP-340
+ * by using the correct tagged hash function. */
+static const unsigned char bip340_algo[] = {'B', 'I', 'P', '0', '3', '4', '0', '/', 'n', 'o', 'n', 'c', 'e'};
+
+static const unsigned char schnorrsig_extraparams_magic[4] = SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC;
+
+static int nonce_function_bip340_impl(const nostr_native_secp256k1_hash_ctx *hash_ctx, unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) {
+    nostr_native_secp256k1_sha256 sha;
+    unsigned char masked_key[32];
+    int i;
+
+    if (algo == NULL) {
+        return 0;
+    }
+
+    if (data != NULL) {
+        nostr_native_secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha);
+        nostr_native_secp256k1_sha256_write(hash_ctx, &sha, data, 32);
+        nostr_native_secp256k1_sha256_finalize(hash_ctx, &sha, masked_key);
+        for (i = 0; i < 32; i++) {
+            masked_key[i] ^= key32[i];
+        }
+    } else {
+        /* Precomputed TaggedHash("BIP0340/aux", 0x0000...00); */
+        static const unsigned char ZERO_MASK[32] = {
+              84, 241, 105, 207, 201, 226, 229, 114,
+             116, 128,  68,  31, 144, 186,  37, 196,
+             136, 244,  97, 199,  11,  94, 165, 220,
+             170, 247, 175, 105, 39,  10, 165,  20
+        };
+        for (i = 0; i < 32; i++) {
+            masked_key[i] = key32[i] ^ ZERO_MASK[i];
+        }
+    }
+
+    /* Tag the hash with algo which is important to avoid nonce reuse across
+     * algorithms. If this nonce function is used in BIP-340 signing as defined
+     * in the spec, an optimized tagging implementation is used. */
+    if (algolen == sizeof(bip340_algo)
+            && nostr_native_secp256k1_memcmp_var(algo, bip340_algo, algolen) == 0) {
+        nostr_native_secp256k1_nonce_function_bip340_sha256_tagged(&sha);
+    } else {
+        nostr_native_secp256k1_sha256_initialize_tagged(hash_ctx, &sha, algo, algolen);
+    }
+
+    /* Hash masked-key||pk||msg using the tagged hash as per the spec */
+    nostr_native_secp256k1_sha256_write(hash_ctx, &sha, masked_key, 32);
+    nostr_native_secp256k1_sha256_write(hash_ctx, &sha, xonly_pk32, 32);
+    nostr_native_secp256k1_sha256_write(hash_ctx, &sha, msg, msglen);
+    nostr_native_secp256k1_sha256_finalize(hash_ctx, &sha, nonce32);
+    nostr_native_secp256k1_sha256_clear(&sha);
+    nostr_native_secp256k1_memclear_explicit(masked_key, sizeof(masked_key));
+
+    return 1;
+}
+
+static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) {
+    return nonce_function_bip340_impl(nostr_native_secp256k1_get_hash_context(nostr_native_secp256k1_context_static), nonce32, msg, msglen, key32, xonly_pk32, algo, algolen, data);
+}
+
+const nostr_native_secp256k1_nonce_function_hardened nostr_native_secp256k1_nonce_function_bip340 = nonce_function_bip340;
+
+/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
+ * SHA256 to SHA256("BIP0340/challenge")||SHA256("BIP0340/challenge"). */
+static void nostr_native_secp256k1_schnorrsig_sha256_tagged(nostr_native_secp256k1_sha256 *sha) {
+    static const uint32_t midstate[8] = {
+        0x9cecba11ul, 0x23925381ul, 0x11679112ul, 0xd1627e0ful,
+        0x97c87550ul, 0x003cc765ul, 0x90f61164ul, 0x33e9b66aul
+    };
+    nostr_native_secp256k1_sha256_initialize_midstate(sha, 64, midstate);
+}
+
+static void nostr_native_secp256k1_schnorrsig_challenge(const nostr_native_secp256k1_hash_ctx *hash_ctx, nostr_native_secp256k1_scalar* e, const unsigned char *r32, const unsigned char *msg, size_t msglen, const unsigned char *pubkey32)
+{
+    unsigned char buf[32];
+    nostr_native_secp256k1_sha256 sha;
+
+    /* tagged hash(r.x, pk.x, msg) */
+    nostr_native_secp256k1_schnorrsig_sha256_tagged(&sha);
+    nostr_native_secp256k1_sha256_write(hash_ctx, &sha, r32, 32);
+    nostr_native_secp256k1_sha256_write(hash_ctx, &sha, pubkey32, 32);
+    nostr_native_secp256k1_sha256_write(hash_ctx, &sha, msg, msglen);
+    nostr_native_secp256k1_sha256_finalize(hash_ctx, &sha, buf);
+    /* Set scalar e to the challenge hash modulo the curve order as per
+     * BIP340. */
+    nostr_native_secp256k1_scalar_set_b32(e, buf, NULL);
+}
+
+static int nostr_native_secp256k1_schnorrsig_sign_internal(const nostr_native_secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const nostr_native_secp256k1_keypair *keypair, nostr_native_secp256k1_nonce_function_hardened noncefp, void *ndata) {
+    nostr_native_secp256k1_scalar sk;
+    nostr_native_secp256k1_scalar e;
+    nostr_native_secp256k1_scalar k;
+    nostr_native_secp256k1_ge pk;
+    nostr_native_secp256k1_ge r;
+    unsigned char nonce32[32] = { 0 };
+    unsigned char pk_buf[32];
+    unsigned char seckey[32];
+    int ret = 1;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(nostr_native_secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(sig64 != NULL);
+    ARG_CHECK(msg != NULL || msglen == 0);
+    ARG_CHECK(keypair != NULL);
+
+    ret &= nostr_native_secp256k1_keypair_load(ctx, &sk, &pk, keypair);
+    /* Because we are signing for a x-only pubkey, the secret key is negated
+     * before signing if the point corresponding to the secret key does not
+     * have an even Y. */
+    if (nostr_native_secp256k1_fe_is_odd(&pk.y)) {
+        nostr_native_secp256k1_scalar_negate(&sk, &sk);
+    }
+
+    nostr_native_secp256k1_scalar_get_b32(seckey, &sk);
+    nostr_native_secp256k1_fe_get_b32(pk_buf, &pk.x);
+
+    /* Compute nonce */
+    if (noncefp == NULL || noncefp == nostr_native_secp256k1_nonce_function_bip340) {
+        /* Use context-aware nonce function by default */
+        ret &= nonce_function_bip340_impl(nostr_native_secp256k1_get_hash_context(ctx), nonce32, msg, msglen, seckey, pk_buf, bip340_algo, sizeof(bip340_algo), ndata);
+    } else {
+        ret &= !!noncefp(nonce32, msg, msglen, seckey, pk_buf, bip340_algo, sizeof(bip340_algo), ndata);
+    }
+
+    nostr_native_secp256k1_scalar_set_b32(&k, nonce32, NULL);
+    ret &= !nostr_native_secp256k1_scalar_is_zero(&k);
+    nostr_native_secp256k1_scalar_cmov(&k, &nostr_native_secp256k1_scalar_one, !ret);
+
+    nostr_native_secp256k1_ecmult_gen_ge(&ctx->ecmult_gen_ctx, &r, &k);
+
+    /* We declassify r to allow using it as a branch point. This is fine
+     * because r is not a secret. */
+    nostr_native_secp256k1_declassify(ctx, &r, sizeof(r));
+    nostr_native_secp256k1_fe_normalize_var(&r.y);
+    if (nostr_native_secp256k1_fe_is_odd(&r.y)) {
+        nostr_native_secp256k1_scalar_negate(&k, &k);
+    }
+    nostr_native_secp256k1_fe_normalize_var(&r.x);
+    nostr_native_secp256k1_fe_get_b32(&sig64[0], &r.x);
+
+    nostr_native_secp256k1_schnorrsig_challenge(nostr_native_secp256k1_get_hash_context(ctx), &e, &sig64[0], msg, msglen, pk_buf);
+    nostr_native_secp256k1_scalar_mul(&e, &e, &sk);
+    nostr_native_secp256k1_scalar_add(&e, &e, &k);
+    nostr_native_secp256k1_scalar_get_b32(&sig64[32], &e);
+
+    nostr_native_secp256k1_memczero(sig64, 64, !ret);
+    nostr_native_secp256k1_scalar_clear(&k);
+    nostr_native_secp256k1_scalar_clear(&sk);
+    nostr_native_secp256k1_memclear_explicit(seckey, sizeof(seckey));
+    nostr_native_secp256k1_memclear_explicit(nonce32, sizeof(nonce32));
+
+    return ret;
+}
+
+int nostr_native_secp256k1_schnorrsig_sign32(const nostr_native_secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const nostr_native_secp256k1_keypair *keypair, const unsigned char *aux_rand32) {
+    /* We cast away const from the passed aux_rand32 argument since we know the default nonce function does not modify it. */
+    return nostr_native_secp256k1_schnorrsig_sign_internal(ctx, sig64, msg32, 32, keypair, nostr_native_secp256k1_nonce_function_bip340, (unsigned char*)aux_rand32);
+}
+
+int nostr_native_secp256k1_schnorrsig_sign_custom(const nostr_native_secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const nostr_native_secp256k1_keypair *keypair, nostr_native_secp256k1_schnorrsig_extraparams *extraparams) {
+    nostr_native_secp256k1_nonce_function_hardened noncefp = NULL;
+    void *ndata = NULL;
+    VERIFY_CHECK(ctx != NULL);
+
+    if (extraparams != NULL) {
+        ARG_CHECK(nostr_native_secp256k1_memcmp_var(extraparams->magic,
+                                       schnorrsig_extraparams_magic,
+                                       sizeof(extraparams->magic)) == 0);
+        noncefp = extraparams->noncefp;
+        ndata = extraparams->ndata;
+    }
+    return nostr_native_secp256k1_schnorrsig_sign_internal(ctx, sig64, msg, msglen, keypair, noncefp, ndata);
+}
+
+int nostr_native_secp256k1_schnorrsig_verify(const nostr_native_secp256k1_context* ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const nostr_native_secp256k1_xonly_pubkey *pubkey) {
+    nostr_native_secp256k1_scalar s;
+    nostr_native_secp256k1_scalar e;
+    nostr_native_secp256k1_gej rj;
+    nostr_native_secp256k1_ge pk;
+    nostr_native_secp256k1_gej pkj;
+    nostr_native_secp256k1_fe rx;
+    nostr_native_secp256k1_ge r;
+    unsigned char buf[32];
+    int overflow;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(sig64 != NULL);
+    ARG_CHECK(msg != NULL || msglen == 0);
+    ARG_CHECK(pubkey != NULL);
+
+    if (!nostr_native_secp256k1_fe_set_b32_limit(&rx, &sig64[0])) {
+        return 0;
+    }
+
+    nostr_native_secp256k1_scalar_set_b32(&s, &sig64[32], &overflow);
+    if (overflow) {
+        return 0;
+    }
+
+    if (!nostr_native_secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) {
+        return 0;
+    }
+
+    /* Compute e. */
+    nostr_native_secp256k1_fe_get_b32(buf, &pk.x);
+    nostr_native_secp256k1_schnorrsig_challenge(nostr_native_secp256k1_get_hash_context(ctx), &e, &sig64[0], msg, msglen, buf);
+
+    /* Compute rj =  s*G + (-e)*pkj */
+    nostr_native_secp256k1_scalar_negate(&e, &e);
+    nostr_native_secp256k1_gej_set_ge(&pkj, &pk);
+    nostr_native_secp256k1_ecmult(&rj, &pkj, &e, &s);
+
+    nostr_native_secp256k1_ge_set_gej_var(&r, &rj);
+    if (nostr_native_secp256k1_ge_is_infinity(&r)) {
+        return 0;
+    }
+
+    nostr_native_secp256k1_fe_normalize_var(&r.y);
+    return !nostr_native_secp256k1_fe_is_odd(&r.y) &&
+           nostr_native_secp256k1_fe_equal(&rx, &r.x);
+}
+
+#endif