READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

44,567 bytes · SHA-256 b20af3448985fa64… · View upstream ↗

1#ifndef SECP256K1_H
2#define SECP256K1_H
3
4#ifdef __cplusplus
5extern "C" {
6#endif
7
8#include <stddef.h>
9#include <stdint.h>
10
11/** Unless explicitly stated all pointer arguments must not be NULL.
12 *
13 * The following rules specify the order of arguments in API calls:
14 *
15 * 1. Context pointers go first, followed by output arguments, combined
16 *    output/input arguments, and finally input-only arguments.
17 * 2. Array lengths always immediately follow the argument whose length
18 *    they describe, even if this violates rule 1.
19 * 3. Within the OUT/OUTIN/IN groups, pointers to data that is typically generated
20 *    later go first. This means: signatures, public nonces, secret nonces,
21 *    messages, public keys, secret keys, tweaks.
22 * 4. Arguments that are not data pointers go last, from more complex to less
23 *    complex: function pointers, algorithm names, messages, void pointers,
24 *    counts, flags, booleans.
25 * 5. Opaque data pointers follow the function pointer they are to be passed to.
26 */
27
28/** Opaque data structure that holds context information
29 *
30 *  The primary purpose of context objects is to store randomization data for
31 *  enhanced protection against side-channel leakage. This protection is only
32 *  effective if the context is randomized after its creation. See
33 *  secp256k1_context_create for creation of contexts and
34 *  secp256k1_context_randomize for randomization.
35 *
36 *  A secondary purpose of context objects is to store pointers to callback
37 *  functions that the library will call when certain error states arise. See
38 *  secp256k1_context_set_error_callback as well as
39 *  secp256k1_context_set_illegal_callback for details. Future library versions
40 *  may use context objects for additional purposes.
41 *
42 *  A constructed context can safely be used from multiple threads
43 *  simultaneously, but API calls that take a non-const pointer to a context
44 *  need exclusive access to it. In particular this is the case for
45 *  secp256k1_context_destroy, secp256k1_context_preallocated_destroy,
46 *  and secp256k1_context_randomize.
47 *
48 *  Regarding randomization, either do it once at creation time (in which case
49 *  you do not need any locking for the other calls), or use a read-write lock.
50 */
51typedef struct secp256k1_context_struct secp256k1_context;
52
53/** Opaque data structure that holds a parsed and valid public key.
54 *
55 *  The exact representation of data inside is implementation defined and not
56 *  guaranteed to be portable between different platforms or versions. It is
57 *  however guaranteed to be 64 bytes in size, and can be safely copied/moved.
58 *  If you need to convert to a format suitable for storage or transmission,
59 *  use secp256k1_ec_pubkey_serialize and secp256k1_ec_pubkey_parse. To
60 *  compare keys, use secp256k1_ec_pubkey_cmp.
61 */
62typedef struct secp256k1_pubkey {
63    unsigned char data[64];
64} secp256k1_pubkey;
65
66/** Opaque data structure that holds a parsed ECDSA signature.
67 *
68 *  The exact representation of data inside is implementation defined and not
69 *  guaranteed to be portable between different platforms or versions. It is
70 *  however guaranteed to be 64 bytes in size, and can be safely copied/moved.
71 *  If you need to convert to a format suitable for storage, transmission, or
72 *  comparison, use the secp256k1_ecdsa_signature_serialize_* and
73 *  secp256k1_ecdsa_signature_parse_* functions.
74 */
75typedef struct secp256k1_ecdsa_signature {
76    unsigned char data[64];
77} secp256k1_ecdsa_signature;
78
79/** A pointer to a function to deterministically generate a nonce.
80 *
81 * Returns: 1 if a nonce was successfully generated. 0 will cause signing to fail.
82 * Out:     nonce32:   pointer to a 32-byte array to be filled by the function.
83 * In:      msg32:     the 32-byte message hash being verified (will not be NULL)
84 *          key32:     pointer to a 32-byte secret key (will not be NULL)
85 *          algo16:    pointer to a 16-byte array describing the signature
86 *                     algorithm (will be NULL for ECDSA for compatibility).
87 *          data:      Arbitrary data pointer that is passed through.
88 *          attempt:   how many iterations we have tried to find a nonce.
89 *                     This will almost always be 0, but different attempt values
90 *                     are required to result in a different nonce.
91 *
92 * Except for test cases, this function should compute some cryptographic hash of
93 * the message, the algorithm, the key and the attempt.
94 */
95typedef int (*secp256k1_nonce_function)(
96    unsigned char *nonce32,
97    const unsigned char *msg32,
98    const unsigned char *key32,
99    const unsigned char *algo16,
100    void *data,
101    unsigned int attempt
102);
103
104/*  When this header is used at build-time the SECP256K1_BUILD define needs to be set
105 *  to correctly setup export attributes and nullness checks.  This is normally done
106 *  by secp256k1.c but to guard against this header being included before secp256k1.c
107 *  has had a chance to set the define (e.g. via test harnesses that just includes
108 *  secp256k1.c) we set SECP256K1_NO_BUILD when this header is processed without the
109 *  BUILD define so this condition can be caught.
110 */
111#ifndef SECP256K1_BUILD
112# define SECP256K1_NO_BUILD
113#endif
114
115/* Symbol visibility. */
116#if !defined(SECP256K1_API) && defined(SECP256K1_NO_API_VISIBILITY_ATTRIBUTES)
117     /* The user has requested that we don't specify visibility attributes in
118      * the public API.
119      *
120      * Since all our non-API declarations use the static qualifier, this means
121      * that the user can use -fvisibility=<value> to set the visibility of the
122      * API symbols. For instance, -fvisibility=hidden can be useful *even for
123      * the API symbols*, e.g., when building a static library which is linked
124      * into a shared library, and the latter should not re-export the
125      * libsecp256k1 API.
126      *
127      * While visibility is a concept that applies only to shared libraries,
128      * setting visibility will still make a difference when building a static
129      * library: the visibility settings will be stored in the static library,
130      * solely for the potential case that the static library will be linked into
131      * a shared library. In that case, the stored visibility settings will
132      * resurface and be honored for the shared library. */
133#    define SECP256K1_API extern
134#endif
135#if !defined(SECP256K1_API)
136#    if defined(SECP256K1_BUILD)
137         /* On Windows, assume a shared library only if explicitly requested.
138          *   1. If using Libtool, it defines DLL_EXPORT automatically.
139          *   2. In other cases, SECP256K1_DLL_EXPORT must be defined. */
140#        if defined(_WIN32) && (defined(SECP256K1_DLL_EXPORT) || defined(DLL_EXPORT))
141             /* GCC for Windows (e.g., MinGW) accepts the __declspec syntax for
142              * MSVC compatibility. A __declspec declaration implies (but is not
143              * exactly equivalent to) __attribute__ ((visibility("default"))),
144              * and so we actually want __declspec even on GCC, see "Microsoft
145              * Windows Function Attributes" in the GCC manual and the
146              * recommendations in https://gcc.gnu.org/wiki/Visibility . */
147#            define SECP256K1_API extern __declspec(dllexport)
148         /* Avoid __attribute__ ((visibility("default"))) on Windows to get rid
149          * of warnings when compiling with -flto due to a bug in GCC, see
150          * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116478 . */
151#        elif !defined(_WIN32) && defined (__GNUC__) && (__GNUC__ >= 4)
152#            define SECP256K1_API extern __attribute__ ((visibility("default")))
153#        else
154#            define SECP256K1_API extern
155#        endif
156#    else
157         /* On Windows, SECP256K1_STATIC must be defined when consuming
158          * libsecp256k1 as a static library. Note that SECP256K1_STATIC is a
159          * "consumer-only" macro, and it has no meaning when building
160          * libsecp256k1. */
161#        if defined(_WIN32) && !defined(SECP256K1_STATIC)
162#            define SECP256K1_API extern __declspec(dllimport)
163#        else
164#            define SECP256K1_API extern
165#        endif
166#    endif
167#endif
168
169/* Warning attributes
170 * NONNULL is not used if SECP256K1_BUILD is set to avoid the compiler optimizing out
171 * some paranoid null checks. */
172# if defined(__GNUC__)
173#  define SECP256K1_WARN_UNUSED_RESULT __attribute__ ((__warn_unused_result__))
174# else
175#  define SECP256K1_WARN_UNUSED_RESULT
176# endif
177# if !defined(SECP256K1_BUILD) && defined(__GNUC__)
178#  define SECP256K1_ARG_NONNULL(_x)  __attribute__ ((__nonnull__(_x)))
179# else
180#  define SECP256K1_ARG_NONNULL(_x)
181# endif
182
183/* Attribute for marking functions, types, and variables as deprecated */
184#if !defined(SECP256K1_BUILD) && defined(__has_attribute)
185# if __has_attribute(__deprecated__)
186#  define SECP256K1_DEPRECATED(_msg) __attribute__ ((__deprecated__(_msg)))
187# else
188#  define SECP256K1_DEPRECATED(_msg)
189# endif
190#else
191# define SECP256K1_DEPRECATED(_msg)
192#endif
193
194/* All flags' lower 8 bits indicate what they're for. Do not use directly. */
195#define SECP256K1_FLAGS_TYPE_MASK ((1 << 8) - 1)
196#define SECP256K1_FLAGS_TYPE_CONTEXT (1 << 0)
197#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
198/* The higher bits contain the actual data. Do not use directly. */
199#define SECP256K1_FLAGS_BIT_CONTEXT_VERIFY (1 << 8)
200#define SECP256K1_FLAGS_BIT_CONTEXT_SIGN (1 << 9)
201#define SECP256K1_FLAGS_BIT_CONTEXT_DECLASSIFY (1 << 10)
202#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
203
204/** Context flags to pass to secp256k1_context_create, secp256k1_context_preallocated_size, and
205 *  secp256k1_context_preallocated_create. */
206#define SECP256K1_CONTEXT_NONE (SECP256K1_FLAGS_TYPE_CONTEXT)
207
208/** Deprecated context flags. These flags are treated equivalent to SECP256K1_CONTEXT_NONE. */
209#define SECP256K1_CONTEXT_VERIFY (SECP256K1_FLAGS_TYPE_CONTEXT | SECP256K1_FLAGS_BIT_CONTEXT_VERIFY)
210#define SECP256K1_CONTEXT_SIGN (SECP256K1_FLAGS_TYPE_CONTEXT | SECP256K1_FLAGS_BIT_CONTEXT_SIGN)
211
212/* Testing flag. Do not use. */
213#define SECP256K1_CONTEXT_DECLASSIFY (SECP256K1_FLAGS_TYPE_CONTEXT | SECP256K1_FLAGS_BIT_CONTEXT_DECLASSIFY)
214
215/** Flag to pass to secp256k1_ec_pubkey_serialize. */
216#define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
217#define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
218
219/** Prefix byte used to tag various encoded curvepoints for specific purposes */
220#define SECP256K1_TAG_PUBKEY_EVEN 0x02
221#define SECP256K1_TAG_PUBKEY_ODD 0x03
222#define SECP256K1_TAG_PUBKEY_UNCOMPRESSED 0x04
223#define SECP256K1_TAG_PUBKEY_HYBRID_EVEN 0x06
224#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
225
226/** A built-in constant secp256k1 context object with static storage duration, to be
227 *  used in conjunction with secp256k1_selftest.
228 *
229 *  This context object offers *only limited functionality* , i.e., it cannot be used
230 *  for API functions that perform computations involving secret keys, e.g., signing
231 *  and public key generation. If this restriction applies to a specific API function,
232 *  it is mentioned in its documentation. See secp256k1_context_create if you need a
233 *  full context object that supports all functionality offered by the library.
234 *
235 *  It is highly recommended to call secp256k1_selftest before using this context.
236 */
237SECP256K1_API const secp256k1_context * const secp256k1_context_static;
238
239/** Perform basic self tests (to be used in conjunction with secp256k1_context_static)
240 *
241 *  This function performs self tests that detect some serious usage errors and
242 *  similar conditions, e.g., when the library is compiled for the wrong endianness.
243 *  This is a last resort measure to be used in production. The performed tests are
244 *  very rudimentary and are not intended as a replacement for running the test
245 *  binaries.
246 *
247 *  It is highly recommended to call this before using secp256k1_context_static.
248 *  It is not necessary to call this function before using a context created with
249 *  secp256k1_context_create (or secp256k1_context_preallocated_create), which will
250 *  take care of performing the self tests.

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.