@qntx/nostr-native 0.0.0-stage → 0.12.1

package/vendor/secp256k1/include/secp256k1_silentpayments.h

@@ -0,0 +1,396 @@
+#ifndef SECP256K1_SILENTPAYMENTS_H
+#define SECP256K1_SILENTPAYMENTS_H
+
+#include <stdint.h>
+#include "secp256k1.h"
+#include "secp256k1_extrakeys.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** This module provides an implementation for Silent Payments, as specified in
+ *  BIP352. This particularly involves the creation of input tweak data by
+ *  summing up secret or public keys and the derivation of a shared secret using
+ *  Elliptic Curve Diffie-Hellman. Combined are either:
+ *    - spender's secret keys and recipient's public key (a * B, sender side)
+ *    - spender's public keys and recipient's secret key (A * b, recipient side)
+ *  With this result, the necessary key material for ultimately creating/scanning
+ *  or spending Silent Payments outputs can be determined.
+ *
+ *  Note that this module is _not_ a full implementation of BIP352, as it
+ *  inherently doesn't deal with higher-level concepts like addresses, output
+ *  script types or transactions. The intent is to provide a module for
+ *  abstracting away the elliptic-curve operations required for the protocol. For
+ *  any wallet software already using libsecp256k1, this API should provide all
+ *  the functions needed for a Silent Payments implementation without requiring
+ *  any further elliptic-curve operations from the wallet.
+ */
+
+/* Maximum number of Silent Payments recipients per group (i.e.
+ * recipients sharing the same scan public key) as per BIP-352 */
+#define SECP256K1_SILENTPAYMENTS_RECIPIENT_GROUP_LIMIT 2323
+
+/** The data from a single recipient address
+ *
+ *  This struct serves as an input argument to `silentpayments_sender_create_outputs`.
+ *
+ *  `index` must be set to the position (starting with 0) of this recipient in the
+ *  `recipients` array passed to `silentpayments_sender_create_outputs`. It is
+ *  used to map the returned generated outputs back to the original recipient.
+ *
+ *  Note:
+ *  The spend public key named `spend_pubkey` may have been optionally tweaked with
+ *  a label by the recipient. Whether `spend_pubkey` has actually been tagged with
+ *  a label is irrelevant for the sender. As a documentation convention in this API,
+ *  `unlabeled_spend_pubkey` is used to indicate when the unlabeled spend public key
+ *  must be used.
+ */
+typedef struct nostr_native_secp256k1_silentpayments_recipient {
+    nostr_native_secp256k1_pubkey scan_pubkey;
+    nostr_native_secp256k1_pubkey spend_pubkey;
+    size_t index;
+} nostr_native_secp256k1_silentpayments_recipient;
+
+/** Create Silent Payments outputs for recipient(s).
+ *
+ *  Given a list of n secret keys a_1...a_n (one for each Silent Payments
+ *  eligible input to spend), a serialized outpoint, and a list of recipients,
+ *  create the taproot outputs. Inputs with conditional branches or multiple
+ *  public keys are excluded from Silent Payments eligible inputs; see BIP352
+ *  for more information.
+ *
+ *  `outpoint_smallest36` refers to the smallest outpoint lexicographically
+ *  from the transaction inputs (both Silent Payments eligible and non-eligible
+ *  inputs). This value MUST be the smallest outpoint out of all of the
+ *  transaction inputs, otherwise the recipient will be unable to find the
+ *  payment. Determining the smallest outpoint from the list of transaction
+ *  inputs is the responsibility of the caller. It is strongly recommended
+ *  that implementations ensure they are doing this correctly by using the
+ *  test vectors from BIP352.
+ *
+ *  When creating more than one generated output, all of the generated outputs
+ *  MUST be included in the final transaction. Dropping any of the generated
+ *  outputs from the final transaction may make all or some of the outputs
+ *  unfindable by the recipient.
+ *
+ *  Returns: 1 if creation of outputs was successful.
+ *           0 on failure, i.e., when one of the following occurs:
+ *             - The size of any group (i.e. recipients sharing the same scan public key)
+ *               exceeds the protocol limit SECP256K1_SILENTPAYMENTS_RECIPIENT_GROUP_LIMIT.
+ *             - The sum of all input secret keys is 0.
+ *               (This occurs only with negligible probability if at least one of the
+ *               input secret keys is uniformly random and independent of all other keys.)
+ *             - An invalid output public key is created. (This can only happen for an
+ *               adversarially chosen recipient spend public key.)
+ *
+ *  Args:                ctx: pointer to a context object
+ *                            (not nostr_native_secp256k1_context_static).
+ *  Out:   generated_outputs: pointer to an array of pointers to xonly public keys,
+ *                            one per recipient.
+ *                            The outputs are ordered to match the original
+ *                            ordering of the recipient objects, i.e.,
+ *                            `generated_outputs[0]` is the generated output
+ *                            for the `nostr_native_secp256k1_silentpayments_recipient` object
+ *                            with index = 0.
+ *  In:           recipients: pointer to an array of pointers to Silent Payments
+ *                            recipients, where each recipient is a scan public
+ *                            key, a spend public key, and an index indicating
+ *                            its position in the original ordering. This function
+ *                            may reorder the pointers to the recipient objects
+ *                            within the array, i.e., after the call (including on
+ *                            failure), the index fields of the recipient objects
+ *                            may no longer correspond to the positions in the
+ *                            array. Multiple recipient objects with the same scan
+ *                            public key and/or same spend public key can be passed
+ *                            if they carry different indices.
+ *              n_recipients: the size of the recipients array.
+ *       outpoint_smallest36: serialized (36-byte) smallest outpoint
+ *                            (lexicographically) from the transaction inputs
+ *                  keypairs: pointer to an array of pointers to taproot
+ *                            keypair inputs (can be NULL if no secret keys
+ *                            of taproot inputs are used)
+ *                n_keypairs: the size of the keypairs array.
+ *                   seckeys: pointer to an array of pointers to 32-byte
+ *                            secret keys of non-taproot inputs (can be NULL
+ *                            if no secret keys of non-taproot inputs are
+ *                            used)
+ *                 n_seckeys: the size of the seckeys array.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int nostr_native_secp256k1_silentpayments_sender_create_outputs(
+    const nostr_native_secp256k1_context *ctx,
+    nostr_native_secp256k1_xonly_pubkey **generated_outputs,
+    const nostr_native_secp256k1_silentpayments_recipient **recipients,
+    size_t n_recipients,
+    const unsigned char *outpoint_smallest36,
+    const nostr_native_secp256k1_keypair * const *keypairs,
+    size_t n_keypairs,
+    const unsigned char * const *seckeys,
+    size_t n_seckeys
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5);
+
+/** Opaque data structure that holds a Silent Payments label.
+ *
+ *  Guaranteed to be 68 bytes in size. Serialized and parsed with
+ *  `nostr_native_secp256k1_silentpayments_recipient_label_serialize` and
+ *  `nostr_native_secp256k1_silentpayments_recipient_label_parse`.
+ */
+typedef struct nostr_native_secp256k1_silentpayments_label {
+    unsigned char data[68];
+} nostr_native_secp256k1_silentpayments_label;
+
+/** Parse a Silent Payments label.
+ *
+ *  Returns: 1 when the label could be parsed, 0 otherwise.
+ *  Args:    ctx: pointer to a context object
+ *  Out:   label: pointer to a label object
+ *  In:     in33: pointer to the 33-byte label to be parsed
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int nostr_native_secp256k1_silentpayments_recipient_label_parse(
+    const nostr_native_secp256k1_context *ctx,
+    nostr_native_secp256k1_silentpayments_label *label,
+    const unsigned char *in33
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Serialize a Silent Payments label
+ *
+ *  Returns: 1 always
+ *  Args:    ctx: pointer to a context object
+ *  Out:   out33: pointer to a 33-byte array to store the serialized label
+ *  In:    label: pointer to the label
+ */
+SECP256K1_API int nostr_native_secp256k1_silentpayments_recipient_label_serialize(
+    const nostr_native_secp256k1_context *ctx,
+    unsigned char *out33,
+    const nostr_native_secp256k1_silentpayments_label *label
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Create Silent Payments label tweak and label.
+ *
+ *  Given a recipient's 32 byte scan key and a label integer m, calculate the
+ *  corresponding label tweak and label:
+ *
+ *      label_tweak = hash(scan_key || m)
+ *            label = label_tweak * G
+ *
+ *  Returns: 1 if label tweak and label creation was successful.
+ *           0 if scan_key32 is invalid or the hash output label_tweak32 is
+ *             not a valid scalar (negligible probability per hash evaluation).
+ *
+ * WARNING: Creating a large number of labels may significantly degrade
+ * scanning performance in certain Silent Payments wallet implementations,
+ * such as light clients. The scanning function provided in this module,
+ * which is designed for full nodes, performs consistently even with hundreds
+ * of thousands of labels. Other implementations may not share this property
+ * or may be unable to use it due to lacking full transaction data.
+ *
+ * To maximize wallet interoperability, it is recommended to create only
+ * the change label (m = 0) and avoid distributing labeled addresses.
+ *
+ *  Args:                ctx: pointer to a context object
+ *                            (not nostr_native_secp256k1_context_static)
+ *  Out:               label: pointer to the resulting label
+ *             label_tweak32: pointer to the 32 byte label tweak
+ *  In:           scan_key32: pointer to the recipient's 32 byte scan key
+ *                         m: integer for the m-th label (0 is used for change outputs)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int nostr_native_secp256k1_silentpayments_recipient_label_create(
+    const nostr_native_secp256k1_context *ctx,
+    nostr_native_secp256k1_silentpayments_label *label,
+    unsigned char *label_tweak32,
+    const unsigned char *scan_key32,
+    uint32_t m
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Create Silent Payments labeled spend public key.
+ *
+ *  Given a recipient's spend public key and a label, calculate the
+ *  corresponding labeled spend public key:
+ *
+ *      labeled_spend_pubkey = unlabeled_spend_pubkey + label
+ *
+ *  The result is used by the recipient to create a Silent Payments address,
+ *  consisting of the serialized and concatenated scan public key and
+ *  (labeled) spend public key.
+ *
+ *  Returns: 1 if labeled spend public key creation was successful.
+ *           0 if spend pubkey and label sum to zero (negligible probability for
+ *             labels created according to BIP352).
+ *
+ *  Args:                    ctx: pointer to a context object
+ *  Out:    labeled_spend_pubkey: pointer to the resulting labeled spend public key
+ *  In:   unlabeled_spend_pubkey: pointer to the recipient's unlabeled spend public key
+ *                         label: pointer to the recipient's label
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int nostr_native_secp256k1_silentpayments_recipient_create_labeled_spend_pubkey(
+    const nostr_native_secp256k1_context *ctx,
+    nostr_native_secp256k1_pubkey *labeled_spend_pubkey,
+    const nostr_native_secp256k1_pubkey *unlabeled_spend_pubkey,
+    const nostr_native_secp256k1_silentpayments_label *label
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Opaque data structure that holds Silent Payments prevouts summary data.
+ *
+ *  The exact representation of data inside is implementation defined and not
+ *  guaranteed to be portable between different platforms or versions. It is
+ *  however guaranteed to be 101 bytes in size, and can be safely copied/moved.
+ *  This structure does not contain secret data. It can be created with
+ *  `nostr_native_secp256k1_silentpayments_recipient_prevouts_summary_create`.
+ */
+typedef struct nostr_native_secp256k1_silentpayments_prevouts_summary {
+    unsigned char data[101];
+} nostr_native_secp256k1_silentpayments_prevouts_summary;
+
+/** Compute Silent Payments prevouts summary from prevout public keys and transaction
+ *  inputs.
+ *
+ *  Given a list of n public keys A_1...A_n (one for each Silent Payments
+ *  eligible input to spend) and a serialized outpoint_smallest36, create a
+ *  `prevouts_summary` object. This object summarizes the prevout data from the
+ *  transaction inputs needed for scanning.
+ *
+ *  `outpoint_smallest36` refers to the smallest outpoint lexicographically
+ *  from the transaction inputs (both Silent Payments eligible and non-eligible
+ *  inputs). This value MUST be the smallest outpoint out of all of the
+ *  transaction inputs, otherwise the recipient will be unable to find the
+ *  payment.
+ *
+ *  The public keys have to be passed in via two different parameter pairs, one
+ *  for regular and one for x-only public keys, in order to avoid the need of
+ *  users converting to a common public key format before calling this function.
+ *  The resulting data can be used for scanning on the recipient side.
+ *
+ *  Returns: 1 if prevouts summary creation was successful.
+ *           0 if the transaction is not a Silent Payments transaction.
+ *
+ *  Args:                 ctx: pointer to a context object
+ *  Out:     prevouts_summary: pointer to prevouts_summary object containing the
+ *                             summed public key and input_hash.
+ *  In:   outpoint_smallest36: serialized smallest outpoint (lexicographically)
+ *                             from the transaction inputs
+ *              xonly_pubkeys: pointer to an array of pointers to taproot
+ *                             x-only public keys (can be NULL if no taproot
+ *                             inputs are used)
+ *            n_xonly_pubkeys: the size of the xonly_pubkeys array.
+ *                    pubkeys: pointer to an array of pointers to non-taproot
+ *                             public keys (can be NULL if no non-taproot
+ *                             inputs are used)
+ *                  n_pubkeys: the size of the pubkeys array.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int nostr_native_secp256k1_silentpayments_recipient_prevouts_summary_create(
+    const nostr_native_secp256k1_context *ctx,
+    nostr_native_secp256k1_silentpayments_prevouts_summary *prevouts_summary,
+    const unsigned char *outpoint_smallest36,
+    const nostr_native_secp256k1_xonly_pubkey * const *xonly_pubkeys,
+    size_t n_xonly_pubkeys,
+    const nostr_native_secp256k1_pubkey * const *pubkeys,
+    size_t n_pubkeys
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Type of callback function for label lookups
+ *
+ *  A function of this type will be used to retrieve the label tweak for a given
+ *  label during scanning. A typical implementation will perform a lookup in a
+ *  key-value store called the "label cache".
+ *
+ *  For creating the label cache data,
+ *  `nostr_native_secp256k1_silentpayments_recipient_label_create` and
+ *  `nostr_native_secp256k1_silentpayments_recipient_label_serialize` can be used.
+ *
+ *  Returns: pointer to the 32-byte label tweak if there is a match.
+ *           NULL pointer if there is no match.
+ *
+ *  In:         label: pointer to the serialized 33-byte label to check
+ *                     (computed during scanning)
+ *      label_context: pointer to the recipient's label cache.
+ */
+typedef const unsigned char* (*nostr_native_secp256k1_silentpayments_label_lookup)(const unsigned char* label33, const void* label_context);
+
+/** Found outputs struct
+ *
+ *  Struct for holding a found output along with data needed to spend it later.
+ *
+ *            output: the x-only public key for the taproot output
+ *             tweak: the 32-byte tweak needed to spend the output
+ *  found_with_label: boolean value to indicate if the output was sent to a
+ *                    labeled address. If true, label will be set to a valid value.
+ *             label: the label used. If found_with_label = false, this is set to
+ *                    an invalid value.
+ */
+typedef struct nostr_native_secp256k1_silentpayments_found_output {
+    nostr_native_secp256k1_xonly_pubkey output;
+    unsigned char tweak[32];
+    int found_with_label;
+    nostr_native_secp256k1_silentpayments_label label;
+} nostr_native_secp256k1_silentpayments_found_output;
+
+/** Scan for Silent Payments transaction outputs.
+ *
+ *  Given a prevouts_summary object, a recipient's 32 byte scan key and spend public key,
+ *  and the relevant transaction outputs, scan for outputs belonging to
+ *  the recipient and return the tweak(s) needed for spending the output(s). An
+ *  optional label_lookup callback function and label_context can be passed if
+ *  the recipient uses labels. This allows for checking if a label exists in
+ *  the recipients label cache and retrieving the label tweak during scanning.
+ *
+ *  If used, the `label_lookup` function must return a pointer to a 32-byte label
+ *  tweak if the label is found, or NULL otherwise. The returned pointer must remain
+ *  valid until the next call to `label_lookup` or until the function returns,
+ *  whichever comes first. It is not retained beyond that.
+ *
+ *  For creating the label cache, `nostr_native_secp256k1_silentpayments_recipient_label_create`
+ *  and `nostr_native_secp256k1_silentpayments_recipient_label_serialize` can be used.
+ *
+ *  Note:
+ *  Scanning is bounded by SECP256K1_SILENTPAYMENTS_RECIPIENT_GROUP_LIMIT and may
+ *  miss outputs if a transaction contains more outputs for a single scan public
+ *  key group than this limit.
+ *
+ *  Returns: 1 if output scanning was successful.
+ *           0 if the transaction is not a Silent Payments transaction,
+ *             or if the arguments are invalid.
+ *
+ *  Args:                   ctx: pointer to a context object
+ *  Out:          found_outputs: pointer to an array of pointers to found
+ *                               output objects. The found outputs array MUST
+ *                               have the same length as the tx_outputs array.
+ *              n_found_outputs: pointer to an integer indicating the final
+ *                               size of the found outputs array. This number
+ *                               represents the number of outputs found while
+ *                               scanning (0 if none are found). Can't be larger than
+ *                               SECP256K1_SILENTPAYMENTS_RECIPIENT_GROUP_LIMIT.
+ *  In:              tx_outputs: pointer to the transaction's x-only public key outputs,
+ *                               in their original transaction (vout) order
+ *                 n_tx_outputs: the size of the tx_outputs array.
+ *                   scan_key32: pointer to the recipient's 32 byte scan key. The scan
+ *                               key is valid if it passes nostr_native_secp256k1_ec_seckey_verify
+ *             prevouts_summary: pointer to the transaction prevouts summary data (see
+ *                               `nostr_native_secp256k1_silentpayments_recipient_prevouts_summary_create`).
+ *       unlabeled_spend_pubkey: pointer to the recipient's unlabeled spend public key
+ *                 label_lookup: pointer to a callback function for looking up
+ *                               a label value. This function takes a serialized 33-byte
+ *                               label as an argument and returns a pointer to the
+ *                               32-byte label tweak if the label exists, otherwise
+ *                               returns a NULL pointer (NULL if labels are not
+ *                               used)
+ *                label_context: pointer to a label context object (NULL if
+ *                               labels are not used or context is not needed)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int nostr_native_secp256k1_silentpayments_recipient_scan_outputs(
+    const nostr_native_secp256k1_context *ctx,
+    nostr_native_secp256k1_silentpayments_found_output **found_outputs,
+    uint32_t *n_found_outputs,
+    const nostr_native_secp256k1_xonly_pubkey * const *tx_outputs,
+    size_t n_tx_outputs,
+    const unsigned char *scan_key32,
+    const nostr_native_secp256k1_silentpayments_prevouts_summary *prevouts_summary,
+    const nostr_native_secp256k1_pubkey *unlabeled_spend_pubkey,
+    nostr_native_secp256k1_silentpayments_label_lookup label_lookup,
+    const void *label_context
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(7) SECP256K1_ARG_NONNULL(8);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SECP256K1_SILENTPAYMENTS_H */

package/vendor/secp256k1/src/assumptions.h

@@ -0,0 +1,87 @@
+/***********************************************************************
+ * Copyright (c) 2020 Pieter Wuille                                    *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_ASSUMPTIONS_H
+#define SECP256K1_ASSUMPTIONS_H
+
+#include <limits.h>
+
+#include "util.h"
+#if defined(SECP256K1_INT128_NATIVE)
+#include "int128_native.h"
+#endif
+
+/* This library, like most software, relies on a number of compiler implementation defined (but not undefined)
+   behaviours. Although the behaviours we require are essentially universal we test them specifically here to
+   reduce the odds of experiencing an unwelcome surprise.
+*/
+
+#if defined(__has_attribute)
+# if __has_attribute(__unavailable__)
+__attribute__((__unavailable__("Don't call this function. It only exists because STATIC_ASSERT cannot be used outside a function.")))
+# endif
+#endif
+static void nostr_native_secp256k1_assumption_checker(void) {
+    /* Bytes are 8 bits. */
+    STATIC_ASSERT(CHAR_BIT == 8);
+
+    /* No integer promotion for uint32_t. This ensures that we can multiply uintXX_t values where XX >= 32
+       without signed overflow, which would be undefined behaviour. */
+    STATIC_ASSERT(UINT_MAX <= UINT32_MAX);
+
+    /* Conversions from unsigned to signed outside of the bounds of the signed type are
+       implementation-defined. Verify that they function as reinterpreting the lower
+       bits of the input in two's complement notation. Do this for conversions:
+       - from uint(N)_t to int(N)_t with negative result
+       - from uint(2N)_t to int(N)_t with negative result
+       - from int(2N)_t to int(N)_t with negative result
+       - from int(2N)_t to int(N)_t with positive result */
+
+    /* To int8_t. */
+    STATIC_ASSERT(((int8_t)(uint8_t)0xAB == (int8_t)-(int8_t)0x55));
+    STATIC_ASSERT((int8_t)(uint16_t)0xABCD == (int8_t)-(int8_t)0x33);
+    STATIC_ASSERT((int8_t)(int16_t)(uint16_t)0xCDEF == (int8_t)(uint8_t)0xEF);
+    STATIC_ASSERT((int8_t)(int16_t)(uint16_t)0x9234 == (int8_t)(uint8_t)0x34);
+
+    /* To int16_t. */
+    STATIC_ASSERT((int16_t)(uint16_t)0xBCDE == (int16_t)-(int16_t)0x4322);
+    STATIC_ASSERT((int16_t)(uint32_t)0xA1B2C3D4 == (int16_t)-(int16_t)0x3C2C);
+    STATIC_ASSERT((int16_t)(int32_t)(uint32_t)0xC1D2E3F4 == (int16_t)(uint16_t)0xE3F4);
+    STATIC_ASSERT((int16_t)(int32_t)(uint32_t)0x92345678 == (int16_t)(uint16_t)0x5678);
+
+    /* To int32_t. */
+    STATIC_ASSERT((int32_t)(uint32_t)0xB2C3D4E5 == (int32_t)-(int32_t)0x4D3C2B1B);
+    STATIC_ASSERT((int32_t)(uint64_t)0xA123B456C789D012ULL == (int32_t)-(int32_t)0x38762FEE);
+    STATIC_ASSERT((int32_t)(int64_t)(uint64_t)0xC1D2E3F4A5B6C7D8ULL == (int32_t)(uint32_t)0xA5B6C7D8);
+    STATIC_ASSERT((int32_t)(int64_t)(uint64_t)0xABCDEF0123456789ULL == (int32_t)(uint32_t)0x23456789);
+
+    /* To int64_t. */
+    STATIC_ASSERT((int64_t)(uint64_t)0xB123C456D789E012ULL == (int64_t)-(int64_t)0x4EDC3BA928761FEEULL);
+#if defined(SECP256K1_INT128_NATIVE)
+    STATIC_ASSERT((int64_t)(((uint128_t)0xA1234567B8901234ULL << 64) + 0xC5678901D2345678ULL) == (int64_t)-(int64_t)0x3A9876FE2DCBA988ULL);
+    STATIC_ASSERT(((int64_t)(int128_t)(((uint128_t)0xB1C2D3E4F5A6B7C8ULL << 64) + 0xD9E0F1A2B3C4D5E6ULL)) == (int64_t)(uint64_t)0xD9E0F1A2B3C4D5E6ULL);
+    STATIC_ASSERT(((int64_t)(int128_t)(((uint128_t)0xABCDEF0123456789ULL << 64) + 0x0123456789ABCDEFULL)) == (int64_t)(uint64_t)0x0123456789ABCDEFULL);
+
+    /* To int128_t. */
+    STATIC_ASSERT((int128_t)(((uint128_t)0xB1234567C8901234ULL << 64) + 0xD5678901E2345678ULL) == (int128_t)(-(int128_t)0x8E1648B3F50E80DCULL * 0x8E1648B3F50E80DDULL + 0x5EA688D5482F9464ULL));
+#endif
+
+    /* Right shift on negative signed values is implementation defined. Verify that it
+       acts as a right shift in two's complement with sign extension (i.e duplicating
+       the top bit into newly added bits). */
+    STATIC_ASSERT((((int8_t)0xE8) >> 2) == (int8_t)(uint8_t)0xFA);
+    STATIC_ASSERT((((int16_t)0xE9AC) >> 4) == (int16_t)(uint16_t)0xFE9A);
+    STATIC_ASSERT((((int32_t)0x937C918A) >> 9) == (int32_t)(uint32_t)0xFFC9BE48);
+    STATIC_ASSERT((((int64_t)0xA8B72231DF9CF4B9ULL) >> 19) == (int64_t)(uint64_t)0xFFFFF516E4463BF3ULL);
+#if defined(SECP256K1_INT128_NATIVE)
+    STATIC_ASSERT((((int128_t)(((uint128_t)0xCD833A65684A0DBCULL << 64) + 0xB349312F71EA7637ULL)) >> 39) == (int128_t)(((uint128_t)0xFFFFFFFFFF9B0674ULL << 64) + 0xCAD0941B79669262ULL));
+#endif
+
+    /* This function is not supposed to be called. */
+    VERIFY_CHECK(0);
+}
+
+#endif /* SECP256K1_ASSUMPTIONS_H */

package/vendor/secp256k1/src/checkmem.h

@@ -0,0 +1,117 @@
+/***********************************************************************
+ * Copyright (c) 2022 Pieter Wuille                                    *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+/* The code here is inspired by Kris Kwiatkowski's approach in
+ * https://github.com/kriskwiatkowski/pqc/blob/main/src/common/ct_check.h
+ * to provide a general interface for memory-checking mechanisms, primarily
+ * for constant-time checking.
+ */
+
+/* These macros are defined by this header file:
+ *
+ * - SECP256K1_CHECKMEM_ENABLED:
+ *   - 1 if memory-checking integration is available, 0 otherwise.
+ *     This is just a compile-time macro. Use the next macro to check it is actually
+ *     available at runtime.
+ * - SECP256K1_CHECKMEM_RUNNING():
+ *   - Acts like a function call, returning 1 if memory checking is available
+ *     at runtime.
+ * - SECP256K1_CHECKMEM_CHECK(p, len):
+ *   - Assert or otherwise fail in case the len-byte memory block pointed to by p is
+ *     not considered entirely defined.
+ * - SECP256K1_CHECKMEM_CHECK_VERIFY(p, len):
+ *   - Like SECP256K1_CHECKMEM_CHECK, but only works in VERIFY mode.
+ * - SECP256K1_CHECKMEM_UNDEFINE(p, len):
+ *   - marks the len-byte memory block pointed to by p as undefined data (secret data,
+ *     in the context of constant-time checking).
+ * - SECP256K1_CHECKMEM_DEFINE(p, len):
+ *   - marks the len-byte memory pointed to by p as defined data (public data, in the
+ *     context of constant-time checking).
+ * - SECP256K1_CHECKMEM_MSAN_DEFINE(p, len):
+ *   - Like SECP256K1_CHECKMEM_DEFINE, but applies only to memory_sanitizer.
+ *
+ */
+
+#ifndef SECP256K1_CHECKMEM_H
+#define SECP256K1_CHECKMEM_H
+
+/* Define a statement-like macro that ignores the arguments. */
+#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
+
+/* If compiling under msan, map the SECP256K1_CHECKMEM_* functionality to msan.
+ * Choose this preferentially, even when VALGRIND is defined, as msan-compiled
+ * binaries can't be run under valgrind anyway. */
+#if defined(__has_feature)
+#  if __has_feature(memory_sanitizer)
+#    include <sanitizer/msan_interface.h>
+#    define SECP256K1_CHECKMEM_ENABLED 1
+#    if defined(__clang__) && ((__clang_major__ == 21 && __clang_minor__ >= 1) || __clang_major__ >= 22)
+#      define SECP256K1_CHECKMEM_UNDEFINE(p, len) do { \
+         /* Work around https://github.com/llvm/llvm-project/issues/160094 */ \
+         _Pragma("clang diagnostic push") \
+         _Pragma("clang diagnostic ignored \"-Wuninitialized-const-pointer\"") \
+         __msan_allocated_memory((p), (len)); \
+         _Pragma("clang diagnostic pop") \
+         } while(0)
+#    else
+#      define SECP256K1_CHECKMEM_UNDEFINE(p, len) __msan_allocated_memory((p), (len))
+#    endif
+#    define SECP256K1_CHECKMEM_DEFINE(p, len) __msan_unpoison((p), (len))
+#    define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) __msan_unpoison((p), (len))
+#    define SECP256K1_CHECKMEM_CHECK(p, len) __msan_check_mem_is_initialized((p), (len))
+#    define SECP256K1_CHECKMEM_RUNNING() (1)
+#  endif
+#endif
+
+#if !defined SECP256K1_CHECKMEM_MSAN_DEFINE
+#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
+#endif
+
+/* If valgrind integration is desired (through the VALGRIND define), implement the
+ * SECP256K1_CHECKMEM_* macros using valgrind. */
+#if !defined SECP256K1_CHECKMEM_ENABLED
+#  if defined VALGRIND
+#    include <stddef.h>
+#  if defined(__clang__) && defined(__APPLE__)
+#    pragma clang diagnostic push
+#    pragma clang diagnostic ignored "-Wreserved-identifier"
+#  elif defined(__GNUC__) && (__GNUC__ >= 15)
+#    pragma GCC diagnostic push
+#    pragma GCC diagnostic ignored "-Wtrailing-whitespace"
+#  endif
+#    include <valgrind/memcheck.h>
+#  if defined(__clang__) && defined(__APPLE__)
+#    pragma clang diagnostic pop
+#  elif defined(__GNUC__) && (__GNUC__ >= 15)
+#    pragma GCC diagnostic pop
+#  endif
+#    define SECP256K1_CHECKMEM_ENABLED 1
+#    define SECP256K1_CHECKMEM_UNDEFINE(p, len) VALGRIND_MAKE_MEM_UNDEFINED((p), (len))
+#    define SECP256K1_CHECKMEM_DEFINE(p, len) VALGRIND_MAKE_MEM_DEFINED((p), (len))
+#    define SECP256K1_CHECKMEM_CHECK(p, len) VALGRIND_CHECK_MEM_IS_DEFINED((p), (len))
+     /* VALGRIND_MAKE_MEM_DEFINED returns 0 iff not running on memcheck.
+      * This is more precise than the RUNNING_ON_VALGRIND macro, which
+      * checks for valgrind in general instead of memcheck specifically. */
+#    define SECP256K1_CHECKMEM_RUNNING() (VALGRIND_MAKE_MEM_DEFINED(NULL, 0) != 0)
+#  endif
+#endif
+
+/* As a fall-back, map these macros to dummy statements. */
+#if !defined SECP256K1_CHECKMEM_ENABLED
+#  define SECP256K1_CHECKMEM_ENABLED 0
+#  define SECP256K1_CHECKMEM_UNDEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
+#  define SECP256K1_CHECKMEM_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
+#  define SECP256K1_CHECKMEM_CHECK(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
+#  define SECP256K1_CHECKMEM_RUNNING() (0)
+#endif
+
+#if defined VERIFY
+#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_CHECK((p), (len))
+#else
+#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
+#endif
+
+#endif /* SECP256K1_CHECKMEM_H */

package/vendor/secp256k1/src/ecdsa.h

@@ -0,0 +1,21 @@
+/***********************************************************************
+ * Copyright (c) 2013, 2014 Pieter Wuille                              *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_ECDSA_H
+#define SECP256K1_ECDSA_H
+
+#include <stddef.h>
+
+#include "scalar.h"
+#include "group.h"
+#include "ecmult.h"
+
+static int nostr_native_secp256k1_ecdsa_sig_parse(nostr_native_secp256k1_scalar *r, nostr_native_secp256k1_scalar *s, const unsigned char *sig, size_t size);
+static int nostr_native_secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const nostr_native_secp256k1_scalar *r, const nostr_native_secp256k1_scalar *s);
+static int nostr_native_secp256k1_ecdsa_sig_verify(const nostr_native_secp256k1_scalar* r, const nostr_native_secp256k1_scalar* s, const nostr_native_secp256k1_ge *pubkey, const nostr_native_secp256k1_scalar *message);
+static int nostr_native_secp256k1_ecdsa_sig_sign(const nostr_native_secp256k1_ecmult_gen_context *ctx, nostr_native_secp256k1_scalar* r, nostr_native_secp256k1_scalar* s, const nostr_native_secp256k1_scalar *seckey, const nostr_native_secp256k1_scalar *message, const nostr_native_secp256k1_scalar *nonce, int *recid);
+
+#endif /* SECP256K1_ECDSA_H */