# Changelog
- 0.5.11 (2026-11-13)
* Bumps the ppad-sha256 dependency to 0.3.7, and uses its new
'hash_prefixed' to hash the message in place when signing and
verifying Schnorr signatures. The message was previously copied
three times per BIP340 tagged hash, six times in all when signing,
so peak memory use with large messages was several times the
message size.
- 0.5.10 (2026-11-07)
* Bumps the ppad-fixed dependency to 0.2.2, which fixes its parity
check on Montgomery values. 'parse_point' used that check when
lifting a 32-byte BIP340 public key, and so returned the point of
odd y, rather than even, about half the time. Schnorr verification
was unaffected, as it chooses the even-y point itself.
- 0.5.9 (2026-10-31)
* Bumps the ppad-fixed dependency to 0.2.1, which under the llvm
flag on x86_64 compiles ppad-fixed with LLVM's x86 cmov converter
off (-optlc=-x86-cmov-converter=false). This library is compiled
likewise, as ppad-fixed's constant-time arithmetic can be inlined
into it.
- 0.5.8 (2026-08-01)
* Addresses a number of minor issues found by an LLM scan:
* Fixes potential out-of-bounds reads that could occur if anyone
used the _no_hash-suffixed ECDSA internal entry points on invalid
digest inputs.
* Removes an entry point for the EC monoidal identity / point at
infinity to make it into both the ECDSA and Schnorr signature
machinery.
* Fixes a validation lapse in sign_ecdsa, which previously e.g.
accepted an invalid secret key of zero.
* Fixes other minor spec conformance and testing issues.
- 0.5.7 (2026-06-07)
* Improves the performance of all wNAF-based signing & verification
functions by about 1.5-2x, due to optimizations in 1) the
constant-time wNAF scalar multiplication function, and 2) upstream
modular field inversion (in ppad-fixed).
- 0.5.6 (2026-06-07)
* Improves the wall-clock performance of the constant-time, non-wNAF
scalar multiplication function by about 35%. ECDH also speeds up
proportionally as a direct result.
- 0.5.5 (2026-05-22)
* Adds no-hash ECDSA signature verification utilities that skip the
internal SHA256 step.
- 0.5.4 (2026-02-04)
* Nonce generation for ECDSA is now more secure due to recent
improvements in ppad-hmac-drbg. The DRBG state is now guaranteed
to live in only one location on the heap, and it is now wiped
explicitly after use.
* ECDSA signing now allocates about 1.5 orders of magnitude less than
it did previously.
- 0.5.3 (2026-01-10)
* Bumps the ppad-sha256 and ppad-hmac-drbg dependencies.
- 0.5.2 (2025-12-28)
* Adds an explicit 64-bit architecture constraint.
* Tests on GHC.10.3.
- 0.5.1 (2025-12-27)
* Improves the constant-time semantics in wNAF scalar multiplication,
replacing "indexing via a constant-time selected value" by performing
a full window scan and selecting via mask.
- 0.5.0 (2025-12-21)
* We get a significant upgrade to all functionality by pulling in the
ppad-fixed library for large unsigned and Montgomery-form integers.
Constant-time and allocation properties are made much more rigorous
across the board, as we no longer depend on 'Integer' whatsoever.
This version also improves performance radically throughout. A
summary of the speedups achieved:
sign_schnorr: ~7.1x speedup
verify_schnorr: ~4.5x speedup
sign_ecdsa: ~1.5x speedup
verify_ecdsa: ~4.5x speedup
- 0.4.0 (2025-06-21)
* Scalar multiplication, signing, verifying, and ECHD functions are now
all total, returning 'Nothing' when supplied with invalid inputs.
* Adds a group element check to 'mul_wnaf'.
- 0.3.0 (2025-03-14)
* Adds 'ecdh' for computing ECDH secrets, any given secret being the
SHA256 hash of the x-coordinate of the appropriate secp256k1 point.
- 0.2.2 (2025-02-16)
* Exports the secp256k1 "point at infinity" as _CURVE_ZERO.
- 0.2.1 (2024-12-18)
* Adds 'serialize_point' for compressed-format serialization of
secp256k1 points.
- 0.2.0 (2024-11-08)
* Adds wNAF ("w-ary non-adjacent form") scalar multiplication, as
well as fast 'sign' and 'verify' variants for Schnorr and ECDSA
(disambiguated by a trailing apostrophe) that make use of it.
Each wNAF-powered function requires a 'Context' consisting of
precomputed secp256k1 generator multiples; one can be gotten via
'precompute'.
Note that the non-wNAF-powered sign and verify functions have
incurred a slight performance decrease (on the order of tens to
hundreds of microseconds) as a result.
* Adds 'parse_sig' for parsing compact signatures.
* Adds a dependency on the 'primitive' library (already transitively required
via 'ppad-hmac-drbg').
- 0.1.0 (2024-10-19)
* Initial release, supporting public key derivation and Schnorr &
ECDSA signatures on secp256k1.