You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Pieter Wuille 04e34d18c3 Split up signing and verification initialization 8 years ago
include Split up signing and verification initialization 8 years ago
src Split up signing and verification initialization 8 years ago
.gitignore build: add autogen. How was this missing? 9 years ago
.travis.yml travis: minimize the dependencies available for each build config 8 years ago
COPYING Add VERIFY_CHECK/DEBUG_CHECK and use CHECK macros more 8 years ago Nothing-up-my-sleeving blinding for a*G 8 years ago
TODO build: add autogen. How was this missing? 9 years ago Only use the libcrypto part of OpenSSL 8 years ago


Build Status

Optimized C library for EC operations on curve secp256k1.

This library is experimental, so use at your own risk.


  • Low-level field and group operations on secp256k1.
  • ECDSA signing/verification and key generation.
  • Adding/multiplying private/public keys.
  • Serialization/parsing of private keys, public keys, signatures.
  • Very efficient implementation.

Implementation details

  • General
    • Avoid dynamic memory usage almost everywhere.
  • Field operations
    • Optimized implementation of arithmetic modulo the curve's field size (2^256 - 0x1000003D1).
      • Using 5 52-bit limbs (including hand-optimized assembly for x86_64, by Diederik Huys).
      • Using 10 26-bit limbs.
      • Using GMP.
    • Field inverses and square roots using a sliding window over blocks of 1s (by Peter Dettman).
  • Group operations
    • Point addition formula specifically simplified for the curve equation (y^2 = x^3 + 7).
    • Use addition between points in Jacobian and affine coordinates where possible.
  • Point multiplication for verification (aP + bG).
    • Use wNAF notation for point multiplicands.
    • Use a much larger window for multiples of G, using precomputed multiples.
    • Use Shamir's trick to do the multiplication with the public key and the generator simultaneously.
    • Optionally use secp256k1's efficiently-computable endomorphism to split the multiplicands into 4 half-sized ones first.
  • Point multiplication for signing
    • Use a precomputed table of multiples of powers of 16 multiplied with the generator, so general multiplication becomes a series of additions.
    • Slice the precomputed table in memory per byte, so memory access to the table becomes uniform.
    • Not fully constant-time, but the precomputed tables add and eventually subtract points for which no known scalar (private key) is known, blinding non-constant time effects even from an attacker with control over the private key used.

Build steps

libsecp256k1 is built using autotools:

$ ./
$ ./configure
$ make
$ sudo make install  # optional