ppad-secp256k1 0.5.10 → 0.5.11

raw patch · 3 files changed

+23/−9 lines, 3 filesdep ~ppad-sha256PVP: major bump suggested

API removals or changes: PVP suggests a major version bump

Dependency ranges changed: ppad-sha256

API changes (from Hackage documentation)

Files

• CHANGELOG +8/−0
• lib/Crypto/Curve/Secp256k1.hs +13/−7
• ppad-secp256k1.cabal +2/−2

@@ -1,5 +1,13 @@ # Changelog +- 0.5.11 (2026-11-13)+  * Bumps the ppad-sha256 dependency to 0.3.7, and uses its new+    'hash_prefixed' to hash the message in place when signing and+    verifying Schnorr signatures. The message was previously copied+    three times per BIP340 tagged hash, six times in all when signing,+    so peak memory use with large messages was several times the+    message size.+ - 0.5.10 (2026-11-07)   * Bumps the ppad-fixed dependency to 0.2.2, which fixes its parity     check on Montgomery values. 'parse_point' used that check when

@@ -1049,7 +1049,7 @@       bytes_d = unroll32 (S.retr d)       bytes_p = unroll32 x_p       t       = xor bytes_d (hash_aux a)-      rand    = hash_nonce (t <> bytes_p <> m)+      rand    = hash_nonce (t <> bytes_p) m       k'      = S.to (unsafe_roll32 rand)   -- negligible probability, but k' is secret, so compare without   -- short-circuiting and decide only on the result@@ -1058,7 +1058,7 @@   let Affine (C.retr -> x_r) (C.retr -> y_r) = affine pt       k         = S.select k' (negate k') (W.odd y_r)       bytes_r   = unroll32 x_r-      rand'     = hash_challenge (bytes_r <> bytes_p <> m)+      rand'     = hash_challenge (bytes_r <> bytes_p) m       e         = S.to (unsafe_roll32 rand')       bytes_ked = unroll32 (S.retr (k + e * d))       sig       = bytes_r <> bytes_ked@@ -1120,7 +1120,7 @@       guard (W.lt_vartime r _CURVE_P && W.lt_vartime s _CURVE_Q)       let Affine (C.retr -> x_P) _ = affine capP           e = modQ . unsafe_roll32 $-            hash_challenge (unroll32 r <> unroll32 x_P <> m)+            hash_challenge (unroll32 r <> unroll32 x_P) m       -- mul_wnaf rejects a zero scalar, mul_vartime does not; agree on       -- the identity so both multiplication functions behave alike       pt0 <- if   W.eq_vartime s 0@@ -1143,14 +1143,20 @@ {-# INLINE hash_aux #-}  -- hardcoded tag of BIP0340/nonce-hash_nonce :: BS.ByteString -> BS.ByteString-hash_nonce x = SHA256.hash $+--+-- x is 64 bytes, so the prefix is block-aligned and the message is+-- hashed in place, rather than copied+hash_nonce :: BS.ByteString -> BS.ByteString -> BS.ByteString+hash_nonce x = SHA256.hash_prefixed $   "\aIw4\167\155\203\&5[\155\140}\ETXO\DC2\FS\244\&4\215>\247-\218\EM\135\NULa\251R\191\235/\aIw4\167\155\203\&5[\155\140}\ETXO\DC2\FS\244\&4\215>\247-\218\EM\135\NULa\251R\191\235/" <> x {-# INLINE hash_nonce #-}  -- hardcoded tag of BIP0340/challenge-hash_challenge :: BS.ByteString -> BS.ByteString-hash_challenge x = SHA256.hash $+--+-- x is 64 bytes, so the prefix is block-aligned and the message is+-- hashed in place, rather than copied+hash_challenge :: BS.ByteString -> BS.ByteString -> BS.ByteString+hash_challenge x = SHA256.hash_prefixed $   "{\181-z\159\239X2>\177\191z@}\179\130\210\243\242\216\ESC\177\"OI\254Q\143mH\211|{\181-z\159\239X2>\177\191z@}\179\130\210\243\242\216\ESC\177\"OI\254Q\143mH\211|" <> x {-# INLINE hash_challenge #-} 

@@ -1,6 +1,6 @@ cabal-version:      3.0 name:               ppad-secp256k1-version:            0.5.10+version:            0.5.11 synopsis:           Schnorr signatures, ECDSA, and ECDH on the elliptic curve                     secp256k1 license:            MIT@@ -43,7 +43,7 @@       base >= 4.9 && < 5     , bytestring >= 0.9 && < 0.13     , ppad-hmac-drbg >= 0.3.1 && < 0.4-    , ppad-sha256 >= 0.3.2 && < 0.4+    , ppad-sha256 >= 0.3.7 && < 0.4     , ppad-fixed >= 0.2.2 && < 0.3     , primitive >= 0.8 && < 0.10