secp256k1 group order.

secp256k1 field prime.

Division modulo secp256k1 group order, when argument is nonnegative.

Division modulo secp256k1 group order.

A Schnorr and ECDSA-flavoured alias for a secp256k1 point.

Derive a public key (i.e., a secp256k1 point) from the provided secret.

>>> import qualified System.Entropy as E
>>> sk <- fmap parse_int256 (E.getEntropy 32)
>>> derive_pub sk
"<secp256k1 point>"

The same as derive_pub, except uses a Context to optimise internal calculations.

>>> import qualified System.Entropy as E
>>> sk <- fmap parse_int256 (E.getEntropy 32)
>>> let !tex = precompute
>>> derive_pub' tex sk
"<secp256k1 point>"

secp256k1 generator point.

secp256k1 zero point, point at infinity, or monoidal identity.

Parse a positive 256-bit Integer, e.g. a Schnorr or ECDSA secret key.

>>> import qualified Data.ByteString as BS
>>> parse_int256 (BS.replicate 32 0xFF)
<2^256 - 1>

Parse compressed secp256k1 point (33 bytes), uncompressed point (65 bytes), or BIP0340-style point (32 bytes).

>>> parse_point <33-byte compressed point>
Just <Pub>
>>> parse_point <65-byte uncompressed point>
Just <Pub>
>>> parse_point <32-byte bip0340 public key>
Just <Pub>
>>> parse_point <anything else>
Nothing

Parse an ECDSA signature encoded in 64-byte "compact" form.

>>> parse_sig <64-byte compact signature>
"<ecdsa signature>"

Serialize a secp256k1 point in 33-byte compressed form.

>>> serialize_point pub
"<33-byte compressed point>"

Compute a shared secret, given a secret key and public secp256k1 point, via Elliptic Curve Diffie-Hellman (ECDH).

The shared secret is the SHA256 hash of the x-coordinate of the point obtained by scalar multiplication.

>>> let sec_alice = 0x03                   -- contrived
>>> let sec_bob   = 2 ^ 128 - 1            -- contrived
>>> let pub_alice = derive_pub sec_alice
>>> let pub_bob   = derive_pub sec_bob
>>> let secret_as_computed_by_alice = ecdh pub_bob sec_alice
>>> let secret_as_computed_by_bob   = ecdh pub_alice sec_bob
>>> secret_as_computed_by_alice == secret_as_computed_by_bob
True

Create a 64-byte Schnorr signature for the provided message, using the provided secret key.

BIP0340 recommends that 32 bytes of fresh auxiliary entropy be generated and added at signing time as additional protection against side-channel attacks (namely, to thwart so-called "fault injection" attacks). This entropy is supplemental to security, and the cryptographic security of the signature scheme itself does not rely on it, so it is not strictly required; 32 zero bytes can be used in its stead (and can be supplied via mempty).

>>> import qualified System.Entropy as E
>>> aux <- E.getEntropy 32
>>> sign_schnorr sec msg aux
"<64-byte schnorr signature>"

Verify a 64-byte Schnorr signature for the provided message with the supplied public key.

>>> verify_schnorr msg pub <valid signature>
True
>>> verify_schnorr msg pub <invalid signature>
False

An ECDSA signature.

Produce an ECDSA signature for the provided message, using the provided private key.

sign_ecdsa produces a "low-s" signature, as is commonly required in applications using secp256k1. If you need a generic ECDSA signature, use sign_ecdsa_unrestricted.

>>> sign_ecdsa sec msg
"<ecdsa signature>"

Produce an ECDSA signature for the provided message, using the provided private key.

sign_ecdsa_unrestricted produces an unrestricted ECDSA signature, which is less common in applications using secp256k1 due to the signature's inherent malleability. If you need a conventional "low-s" signature, use sign_ecdsa.

>>> sign_ecdsa_unrestricted sec msg
"<ecdsa signature>"

Verify a "low-s" ECDSA signature for the provided message and public key,

Fails to verify otherwise-valid "high-s" signatures. If you need to verify generic ECDSA signatures, use verify_ecdsa_unrestricted.

>>> verify_ecdsa msg pub valid_sig
True
>>> verify_ecdsa msg pub invalid_sig
False

Verify an unrestricted ECDSA signature for the provided message and public key.

>>> verify_ecdsa_unrestricted msg pub valid_sig
True
>>> verify_ecdsa_unrestricted msg pub invalid_sig
False

Precomputed multiples of the secp256k1 base or generator point.

Create a secp256k1 context by precomputing multiples of the curve's generator point.

This should be used once to create a Context to be reused repeatedly afterwards.

>>> let !tex = precompute
>>> sign_ecdsa' tex sec msg
>>> sign_schnorr' tex sec msg aux

The same as sign_schnorr, except uses a Context to optimise internal calculations.

You can expect about a 2x performance increase when using this function, compared to sign_schnorr.

>>> import qualified System.Entropy as E
>>> aux <- E.getEntropy 32
>>> let !tex = precompute
>>> sign_schnorr' tex sec msg aux
"<64-byte schnorr signature>"

The same as verify_schnorr, except uses a Context to optimise internal calculations.

You can expect about a 1.5x performance increase when using this function, compared to verify_schnorr.

>>> let !tex = precompute
>>> verify_schnorr' tex msg pub <valid signature>
True
>>> verify_schnorr' tex msg pub <invalid signature>
False

The same as sign_ecdsa, except uses a Context to optimise internal calculations.

You can expect about a 10x performance increase when using this function, compared to sign_ecdsa.

>>> let !tex = precompute
>>> sign_ecdsa' tex sec msg
"<ecdsa signature>"

The same as sign_ecdsa_unrestricted, except uses a Context to optimise internal calculations.

You can expect about a 10x performance increase when using this function, compared to sign_ecdsa_unrestricted.

>>> let !tex = precompute
>>> sign_ecdsa_unrestricted' tex sec msg
"<ecdsa signature>"

The same as verify_ecdsa, except uses a Context to optimise internal calculations.

You can expect about a 2x performance increase when using this function, compared to verify_ecdsa.

>>> let !tex = precompute
>>> verify_ecdsa' tex msg pub valid_sig
True
>>> verify_ecdsa' tex msg pub invalid_sig
False

The same as verify_ecdsa_unrestricted, except uses a Context to optimise internal calculations.

You can expect about a 2x performance increase when using this function, compared to verify_ecdsa_unrestricted.

>>> let !tex = precompute
>>> verify_ecdsa_unrestricted' tex msg pub valid_sig
True
>>> verify_ecdsa_unrestricted' tex msg pub invalid_sig
False