secp256k1: compile ecdsa_anti_exfil_host_commit only for testing
What the developer wrote
Authored by benma's agent
secp256k1: compile ecdsa_anti_exfil_host_commit only for testing
What changed, and why it matters
This commit hides a special testing-only function from the normal firmware build. The function itself is not a vulnerability; it is a build-hygiene change to make sure code meant only for unit tests is not compiled into the real device firmware. That reduces the attack surface slightly, but it does not fix any known bug.
No urgent action required. Treat as routine hardening. If reviewing the broader codebase, verify that other testing-only FFI bindings are similarly gated and that production builds do not enable the "testing" feature.
Security signals we found
Reduction of compiled-in attack surface by gating test-only code
No direct fix of memory corruption, cryptographic flaw, or authentication bypass
Change is build-configuration only, not functional logic
Evidence from the diff
The commit adds #[cfg(feature = “testing”)] guards around the Rust FFI declaration and wrapper for secp256k1_ecdsa_anti_exfil_host_commit. This ensures the symbol is only available when the “testing” feature is enabled. The change is defensive: it removes a host-commit helper from production builds where it is not intended to be used, but there is no evidence in the commit of a memory-safety bug, logic flaw, or exploitable weakness being patched.
Changed components
src/rust/bitbox-secp256k1/src/lib.rssecp256k1_ecdsa_anti_exfil_host_commit FFI bindingecdsa_anti_exfil_host_commit Rust wrapperInspect captured patch +2 / −0
diff --git a/src/rust/bitbox-secp256k1/src/lib.rs b/src/rust/bitbox-secp256k1/src/lib.rs
index 36b48ca..24ffc64 100644
--- a/src/rust/bitbox-secp256k1/src/lib.rs
+++ b/src/rust/bitbox-secp256k1/src/lib.rs
@@ -44,6 +44,7 @@ mod ffi {
opening: *const secp256k1_ecdsa_s2c_opening,
) -> c_int;
+ #[cfg(feature = "testing")]
pub fn secp256k1_ecdsa_anti_exfil_host_commit(
ctx: *const Context,
rand_commitment32: *mut c_uchar,
@@ -238,6 +239,7 @@ pub fn secp256k1_nonce_commit(
Ok(out)
}
+#[cfg(feature = "testing")]
pub fn ecdsa_anti_exfil_host_commit(secp: &Secp256k1<All>, rand32: &[u8]) -> Result<Vec<u8>, ()> {
let mut out = [0u8; 32];
match unsafe {
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.