CommitWatch RSS
BC
← All projectsBitcoin Core

libsecp256k1

High-assurance secp256k1 elliptic-curve library used throughout the Bitcoin ecosystem.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

176 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

48security candidates5second-pass queue11AI analyses
50commits · 30 days
69commits · 60 days
94commits · 180 days
176commits · 365 days
Backfill bands
Aug 5 → Feb 682 seen1 candidatesComplete
Feb 6 → Jun 625 seen2 candidatesComplete
Jun 6 → Jul 619 seen1 candidatesComplete
Jul 6 → Aug 548 seen1 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
39Strong · 80–100
76Adequate · 60–79
58Thin · 40–59
3Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Sebastian Falbesoner39154065
Hennadii Stepanov4561064
Tim Ruffing2260055
furszy1341087
josibake942066
Lőrinc1331077
kevkevinpal620064
John Moffett421069
copilot-swe-agent[bot]320074
Jonas Nick710053
merge-script210091
gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf211078
Analysis record

Published AI watches

Last scanned 42 minutes ago

Informational 17 AI analysisMessage 83 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

ellswift: check test operation results

This commit fixes test code for the EllSwift module so that it actually checks whether encoding, decoding, and public-key loading operations succeed before using their outputs. Previously the tests silently ignored failure return values, w…

Missing return-value checks in cryptographic test codePotential silent test failures in EllSwift encode/decode roundtrip testsPotential silent test failures in public-key load operations
564afb0bby Lőrinc+10−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

tests: add constant time tests

This commit only adds new test code. It extends the project's constant-time test suite to also exercise the silent payments module, ensuring that secret key material is not accidentally leaked through timing side channels during those oper…

Adds constant-time (side-channel) test coverage for the silent payments moduleUses memory-secret marking macros (SECP256K1_CHECKMEM_UNDEFINE/DEFINE) to detect secret-dependent branchesNo functional or cryptographic code changes
936907b0by josibake+78−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 41 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

silentpayments: sending

This commit adds a new feature to the secp256k1 cryptographic library: the sender-side logic for Bitcoin Silent Payments (BIP352). It lets a wallet create special one-time payment addresses for recipients without revealing which recipient …

New feature implementation for BIP352 Silent Payments sender sideExtensive input validation (ARG_CHECK) and test coverage for malformed keys and bad argumentsSensitive intermediate values (shared secrets, scalars) are explicitly cleared
b30ea3ebby josibake+719−14 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 100 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks)

This is a defensive code cleanup in a Bitcoin cryptography library. It introduces a helper function that wraps a common three-step pattern when multiplying by the generator point, ensuring that temporary sensitive Jacobian coordinate data …

New helper ensures intermediate Jacobian coordinates are always cleared after generator multiplicationCommit message states goal is to prevent accidental gej leaks of secret scalar informationRefactors existing call sites in ECDSA sign, Schnorr sign, pubkey creation, and blinding setup
a3296d5eby Sebastian Falbesoner+14−165 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

doc: correct API docs for ECDSA signing out-params (s/array/signature object/)

This commit only fixes wording in the API documentation comments. It changes the description of a function output parameter from 'pointer to an array' to 'pointer to a signature object' in two header files. No actual code behavior changed,…

40a0d874by Sebastian Falbesoner+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 73 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

musig: always clear out secret key in `secp256k1_musig_nonce_gen_counter`

This is a small defensive cleanup in Bitcoin Core's libsecp256k1 MuSig code. The function that generates a cryptographic nonce could, in rare error cases, leave a temporary copy of the user's secret key in memory instead of wiping it. The …

secret-key material left uncleared on an error pathuse of explicit memory clearing (`secp256k1_memclear_explicit`) added to failure pathMuSig nonce generation function
8479eafaby Sebastian Falbesoner+2−41 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 100 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

ellswift: fix overflow flag handling in secp256k1_ellswift_xdh

This commit fixes a bug in the ElligatorSwift-based ECDH key exchange function. The function was supposed to reject secret keys that are invalid (zero or greater than or equal to the curve order), but due to a one-character bug it only che…

Cryptographic secret-key validation bypassSilent modular reduction instead of rejection for out-of-range secretsInconsistency with documented/referenced ECDH overflow handling
307b49f1by gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 100 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

refactor: remove unnecessary `malloc` result casts

This commit is a straightforward code cleanup: it removes unnecessary type casts in front of memory allocation calls like malloc. In modern C, casting the result of malloc is not needed and is generally discouraged. The change does not alt…

97b3c478by Sebastian Falbesoner+17−173 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 91 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

ci, docker: Fix LLVM repository signature failure

This commit changes a CI Docker build script so that an older SHA-1-based PGP signature from the LLVM apt repository is still accepted. It is a build-infrastructure workaround, not a change to the secp256k1 cryptographic code, and it does …

Configuration relaxation of PGP signature policy in CI environmentUse of SHA-1 signature algorithm whitelisted by date extensionBuild-infrastructure-only change with no effect on shipped library
0ffb1749by Hennadii Stepanov+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

Add VERIFY_CHECKs that flags are 0 or 1

This commit adds safety checks and documentation to ensure that 'flag' values used in secret-handling code are exactly 0 or 1, not just any 'true' value. These flags control constant-time selection and memory wiping. If a caller passed a d…

constant-time masking invariant enforcementVERIFY_CHECK hardening for secret-dependent flag valuesdocumentation update clarifying 0/1 flag contract
ae00c552by John Moffett+30−811 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

test: introduce (mini) unit test framework

This commit is a pure test-infrastructure change. It introduces a small internal unit-test framework for the secp256k1 cryptographic library, replacing a long hand-written main() function with a registry of test cases and adding optional p…

48789dafby furszy+674−1436 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedrelease-process: Refactorby Tim Ruffing · 34f00ca9 · Jul 31, 2026 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Tim Ruffing

release-process: Refactor

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedrelease-process: Fix nitsby Tim Ruffing · 4a73b1ae · Jul 31, 2026 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Tim Ruffing

release-process: Fix nits

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedmusig: check infinity test setupby Lőrinc · b8de1bc3 · Jul 26, 2026 · 1 fileMessage 78 · AdequateTriage 0Details
Commit message · Lőrinc

musig: check infinity test setup

`pubnonce_summing_to_inf` initializes both sums to infinity before loading the nonce objects.
A load failure could therefore satisfy the expected infinity checks without validating the constructed pair.
Require both nonce-loading operations to succeed before testing their outputs.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedtests: compare full MuSig aggregate nonceby w0xlt · af1fdd12 · May 12, 2026 · 1 fileMessage 55 · ThinTriage 0Details
Commit message · w0xlt

tests: compare full MuSig aggregate nonce

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedremove secp256k1_eckey_pubkey_serialize functionby Sebastian Falbesoner · f5e815f4 · Nov 17, 2025 · 3 filesMessage 35 · OpaqueTriage 0Details
Commit message · Sebastian Falbesoner

remove secp256k1_eckey_pubkey_serialize function

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message