musig2-0.2.1: CHANGELOG

# Changelog

## 0.2.1 (2026-11-12)

* BIP-0327 conformance fixes:
  - Fix `aggPartials` producing invalid signatures when an x-only tweak is
    applied to an aggregated public key with odd y (it used `g * gacc` instead
    of `g` in the final `e * g * tacc` term)
  - Fix the session nonce coefficient and final nonce when either half of the
    aggregated nonce is the point at infinity: no longer substitute `G` for an
    infinite `R1`, and encode infinity as 33 zero bytes when hashing
  - `sign` rejects a signer whose public key is not in the session's public keys
    (`SecretKeyPublicKeyMismatch`)
  - `applyTweak` accepts the valid tweak value `0`
  - `partialSigVerify` returns `Right False` for a zero partial signature instead
    of an error
  - `aggNonces` and `partialSigVerify` reject individual public nonces that
    contain the point at infinity (`InvalidPointFormat`)
* Dependencies:
  - Require `ppad-secp256k1 >= 0.5.10`, which fixes x-only point parsing and
    several `ppad-fixed` arithmetic bugs
  - Drop the unused `ppad-hmac-drbg` and `base16-bytestring` library dependencies
  - Tested with GHC 9.8.4, 9.10.3, 9.12.4 and 9.14.1
* Tests, benchmarks and CI:
  - Run the official BIP-0327 test vectors from the upstream JSON files
    (pinned and checksummed) instead of hand-copied subsets, with exact-output
    assertions; vectors the API cannot express yet are listed explicitly
  - Add regression tests for the fixed bugs, using the reference implementation
    for cases the official vectors do not cover
  - Fix the benchmark suite build and build it in CI
  - Run Linux CI jobs on `ubuntu-24.04` so LLVM jobs can install `llvm-15`

## 0.2.0 (2026-04-10)

* Security hardening and API changes:
  - Bind `SecNonce` values to the originating signer public key and reject nonce/key mismatches during signing
  - Replace panic-based validation in signing, verification, context creation, tweaking, and nonce generation with structured `MuSig2Error` results
  - Eliminate all remaining `error` calls from library code (`publicNonce`, `getSigningNonce`, `isEvenPub`)
  - Make `SecNonce` opaque and require checked construction via `mkSecNonce` or the nonce generation APIs
  - Remove `Eq` and `Ord` instances from `SecNonce` to discourage storing nonces in collections
  - Move `secNonceScalars` out of public API into `Internal` module to prevent leaking secret nonce scalars
  - Strip secret scalar values from `MuSig2Error` constructors to prevent leaking secrets through error logging
  - Reject out-of-range partial signatures during `aggPartials` instead of reducing them modulo the curve order
  - Update nonce generation and session construction APIs to return checked `Either` results
  - Add security considerations documentation (nonce reuse, non-constant-time arithmetic, no zeroization)
  - Refresh tests, benchmarks, and documentation to cover the new checked API and regression cases

## 0.1.3 (2026-01-04)

* Performance improvements:
  - Cache `KeyAggContext` in `SessionContext` to avoid redundant EC operations
  - Replace lazy `foldl` with strict `foldl'` to prevent space leaks
  - Add strictness annotations to `SessionContext` fields
  - Replace O(n) list indexing with O(log n) `Seq.lookup` in `partialSigVerify`
  - Optimize `integerToBytes32` to eliminate intermediate list allocation
  - Fix `NFData` instances in benchmarks for accurate measurements

## 0.1.2 (2025-12-30)

* Fix Hackage build failure by implementing `modQ` locally to support `ppad-secp256k1` 0.5.0+.

## 0.1.1 (2025-12-22)

* Bump `ppad-secp256k1` to 0.5.0. More efficient and faster EC operations.

## 0.1.0 (2025-09-20)

* Initial release, full BIP-0327 support except [Deterministic and Stateless Signing for a Single Signer](https://github.com/bitcoin/bips/blob/master/bip-0327.mediawiki#user-content-Deterministic_and_Stateless_Signing_for_a_Single_Signer)