Merge 71797beec5 into merged_master (Bitcoin PR bitcoin/bitcoin#22448)

2026-08-13 12:33:42 +02:00 · 2023-04-05 13:40:55 +02:00 · 2023-04-05 13:40:55 +02:00 · 09333e2aca
commit 09333e2aca
parent d7c38ee168 71797beec5
25 changed files with 1135 additions and 1972 deletions
--- a/src/key.cpp
+++ b/src/key.cpp
@ -284,7 +284,7 @@ bool CKey::SignSchnorr(const uint256& hash, Span<unsigned char> sig, const uint2
        uint256 tweak = XOnlyPubKey(pubkey_bytes).ComputeTapTweakHash(merkle_root->IsNull() ? nullptr : merkle_root);
        if (!secp256k1_keypair_xonly_tweak_add(GetVerifyContext(), &keypair, tweak.data())) return false;
    }
-    bool ret = secp256k1_schnorrsig_sign32(secp256k1_context_sign, sig.data(), hash.data(), &keypair, aux ? (unsigned char*)aux->data() : nullptr);
+    bool ret = secp256k1_schnorrsig_sign(secp256k1_context_sign, sig.data(), hash.data(), &keypair, aux ? (unsigned char*)aux->data() : nullptr);
    memory_cleanse(&keypair, sizeof(keypair));
    return ret;
 }
--- a/src/pubkey.cpp
+++ b/src/pubkey.cpp
@ -191,7 +191,7 @@ bool XOnlyPubKey::VerifySchnorr(const Span<const unsigned char> msg, Span<const
    assert(sigbytes.size() == 64);
    secp256k1_xonly_pubkey pubkey;
    if (!secp256k1_xonly_pubkey_parse(secp256k1_context_verify, &pubkey, m_keydata.data())) return false;
-    return secp256k1_schnorrsig_verify(secp256k1_context_verify, sigbytes.data(), msg.data(), msg.size(), &pubkey);
+    return secp256k1_schnorrsig_verify(secp256k1_context_verify, sigbytes.data(), msg.begin(), 32, &pubkey);
 }

 // ELEMENTS: this is preserved from an old version of the Taproot code for use in OP_TWEAKVERIFY
--- a/src/secp256k1/.cirrus.yml
+++ b/src/secp256k1/.cirrus.yml
@ -4,32 +4,25 @@ env:
  # Specific warnings can be disabled with -Wno-error=foo.
  # -pedantic-errors is not equivalent to -Werror=pedantic and thus not implied by -Werror according to the GCC manual.
  WERROR_CFLAGS: -Werror -pedantic-errors
-  MAKEFLAGS: -j4
+  MAKEFLAGS: -j2
  BUILD: check
  ### secp256k1 config
-  ECMULTWINDOW: auto
+  STATICPRECOMPUTATION: yes
  ECMULTGENPRECISION: auto
  ASM: no
  WIDEMUL: auto
  WITH_VALGRIND: yes
  EXTRAFLAGS:
  ### secp256k1 modules
+  EXPERIMENTAL: no
  ECDH: no
  RECOVERY: no
  SCHNORRSIG: no
-  ECDSA_S2C: no
-  GENERATOR: no
-  RANGEPROOF: no
-  WHITELIST: no
-  MUSIG: no
-  ECDSAADAPTOR: no
  ### test options
-  SECP256K1_TEST_ITERS:
+  TEST_ITERS:
  BENCH: yes
-  SECP256K1_BENCH_ITERS: 2
+  BENCH_ITERS: 2
  CTIMETEST: yes
-  # Compile and run the tests
-  EXAMPLES: yes

 cat_logs_snippet: &CAT_LOGS
  always:
@ -57,32 +50,28 @@ merge_base_script_snippet: &MERGE_BASE
    - git config --global user.name "ci"
    - git merge FETCH_HEAD  # Merge base to detect silent merge conflicts

-linux_container_snippet: &LINUX_CONTAINER
+task:
+  name: "x86_64: Linux (Debian stable)"
  container:
    dockerfile: ci/linux-debian.Dockerfile
    # Reduce number of CPUs to be able to do more builds in parallel.
    cpu: 1
-    # Gives us more CPUs for free if they're available.
-    greedy: true
    # More than enough for our scripts.
    memory: 1G
-
-task:
-  name: "x86_64: Linux (Debian stable)"
-  << : *LINUX_CONTAINER
  matrix: &ENV_MATRIX
    - env: {WIDEMUL:  int64,  RECOVERY: yes}
-    - env: {WIDEMUL:  int64,                 ECDH: yes, SCHNORRSIG: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes,  RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes}
+    - env: {WIDEMUL:  int64,                 ECDH: yes, EXPERIMENTAL: yes, SCHNORRSIG: yes}
    - env: {WIDEMUL: int128}
-    - env: {WIDEMUL: int128,  RECOVERY: yes,            SCHNORRSIG: yes}
-    - env: {WIDEMUL: int128,                 ECDH: yes, SCHNORRSIG: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes}
+    - env: {WIDEMUL: int128,  RECOVERY: yes,            EXPERIMENTAL: yes, SCHNORRSIG: yes}
+    - env: {WIDEMUL: int128,                 ECDH: yes, EXPERIMENTAL: yes, SCHNORRSIG: yes}
    - env: {WIDEMUL: int128,  ASM: x86_64}
-    - env: {                  RECOVERY: yes,            SCHNORRSIG: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes}
+    - env: {                  RECOVERY: yes,            EXPERIMENTAL: yes, SCHNORRSIG: yes}
+    - env: {                  STATICPRECOMPUTATION: no}
    - env: {BUILD: distcheck, WITH_VALGRIND: no, CTIMETEST: no, BENCH: no}
    - env: {CPPFLAGS: -DDETERMINISTIC}
    - env: {CFLAGS: -O0, CTIMETEST: no}
-    - env: { ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
-    - env: { ECMULTGENPRECISION: 8, ECMULTWINDOW: 4 }
+    - env: { ECMULTGENPRECISION: 2 }
+    - env: { ECMULTGENPRECISION: 8 }
  matrix:
    - env:
        CC: gcc
@ -95,19 +84,16 @@ task:

 task:
  name: "i686: Linux (Debian stable)"
-  << : *LINUX_CONTAINER
+  container:
+    dockerfile: ci/linux-debian.Dockerfile
+    cpu: 1
+    memory: 1G
  env:
    HOST: i686-linux-gnu
    ECDH: yes
    RECOVERY: yes
-    SCHNORRSIG: yes
    EXPERIMENTAL: yes
-    ECDSA_S2C: yes
-    RANGEPROOF: yes
-    WHITELIST: yes
-    GENERATOR: yes
-    MUSIG: yes
-    ECDSAADAPTOR: yes
+    SCHNORRSIG: yes
  matrix:
    - env:
        CC: i686-linux-gnu-gcc
@ -122,8 +108,6 @@ task:
  name: "x86_64: macOS Catalina"
  macos_instance:
    image: catalina-base
-  # tasks with valgrind enabled take about 90 minutes
-  timeout_in: 120m
  env:
    HOMEBREW_NO_AUTO_UPDATE: 1
    HOMEBREW_NO_INSTALL_CLEANUP: 1
@ -150,10 +134,8 @@ task:
  ##   - rm /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
  ##
  brew_valgrind_pre_script:
-    # Retry a few times because this tends to fail randomly.
-    - for i in {1..5}; do brew update && break || sleep 15; done
    - brew config
-    - brew tap LouisBrunner/valgrind
+    - brew tap --shallow LouisBrunner/valgrind
    # Fetch valgrind source but don't build it yet.
    - brew fetch --HEAD LouisBrunner/valgrind/valgrind
  brew_valgrind_cache:
@ -183,22 +165,19 @@ task:

 task:
  name: "s390x (big-endian): Linux (Debian stable, QEMU)"
-  << : *LINUX_CONTAINER
+  container:
+    dockerfile: ci/linux-debian.Dockerfile
+    cpu: 1
+    memory: 1G
  env:
    WRAPPER_CMD: qemu-s390x
-    SECP256K1_TEST_ITERS: 16
+    TEST_ITERS: 16
    HOST: s390x-linux-gnu
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
-    SCHNORRSIG: yes
    EXPERIMENTAL: yes
-    ECDSA_S2C: yes
-    RANGEPROOF: yes
-    WHITELIST: yes
-    GENERATOR: yes
-    MUSIG: yes
-    ECDSAADAPTOR: yes
+    SCHNORRSIG: yes
    CTIMETEST: no
  << : *MERGE_BASE
  test_script:
@ -209,19 +188,23 @@ task:

 task:
  name: "ARM32: Linux (Debian stable, QEMU)"
-  << : *LINUX_CONTAINER
+  container:
+    dockerfile: ci/linux-debian.Dockerfile
+    cpu: 1
+    memory: 1G
  env:
    WRAPPER_CMD: qemu-arm
-    SECP256K1_TEST_ITERS: 16
+    TEST_ITERS: 16
    HOST: arm-linux-gnueabihf
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
+    EXPERIMENTAL: yes
    SCHNORRSIG: yes
    CTIMETEST: no
  matrix:
    - env: {}
-    - env: {EXPERIMENTAL: yes, ASM: arm}
+    - env: {ASM: arm}
  << : *MERGE_BASE
  test_script:
    - ./ci/cirrus.sh
@ -229,14 +212,18 @@ task:

 task:
  name: "ARM64: Linux (Debian stable, QEMU)"
-  << : *LINUX_CONTAINER
+  container:
+    dockerfile: ci/linux-debian.Dockerfile
+    cpu: 1
+    memory: 1G
  env:
    WRAPPER_CMD: qemu-aarch64
-    SECP256K1_TEST_ITERS: 16
+    TEST_ITERS: 16
    HOST: aarch64-linux-gnu
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
+    EXPERIMENTAL: yes
    SCHNORRSIG: yes
    CTIMETEST: no
  << : *MERGE_BASE
@ -246,14 +233,18 @@ task:

 task:
  name: "ppc64le: Linux (Debian stable, QEMU)"
-  << : *LINUX_CONTAINER
+  container:
+    dockerfile: ci/linux-debian.Dockerfile
+    cpu: 1
+    memory: 1G
  env:
    WRAPPER_CMD: qemu-ppc64le
-    SECP256K1_TEST_ITERS: 16
+    TEST_ITERS: 16
    HOST: powerpc64le-linux-gnu
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
+    EXPERIMENTAL: yes
    SCHNORRSIG: yes
    CTIMETEST: no
  << : *MERGE_BASE
@ -263,14 +254,18 @@ task:

 task:
  name: "x86_64 (mingw32-w64): Windows (Debian stable, Wine)"
-  << : *LINUX_CONTAINER
+  container:
+    dockerfile: ci/linux-debian.Dockerfile
+    cpu: 1
+    memory: 1G
  env:
    WRAPPER_CMD: wine64-stable
-    SECP256K1_TEST_ITERS: 16
+    TEST_ITERS: 16
    HOST: x86_64-w64-mingw32
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
+    EXPERIMENTAL: yes
    SCHNORRSIG: yes
    CTIMETEST: no
  << : *MERGE_BASE
@ -280,45 +275,40 @@ task:

 # Sanitizers
 task:
-  timeout_in: 120m
-  << : *LINUX_CONTAINER
+  container:
+    dockerfile: ci/linux-debian.Dockerfile
+    cpu: 1
+    memory: 1G
  env:
    ECDH: yes
    RECOVERY: yes
-    SCHNORRSIG: yes
    EXPERIMENTAL: yes
-    ECDSA_S2C: yes
-    RANGEPROOF: yes
-    WHITELIST: yes
-    GENERATOR: yes
-    MUSIG: yes
-    ECDSAADAPTOR: yes
+    SCHNORRSIG: yes
    CTIMETEST: no
+    EXTRAFLAGS: "--disable-openssl-tests"
  matrix:
    - name: "Valgrind (memcheck)"
-      container:
-        cpu: 2
      env:
        # The `--error-exitcode` is required to make the test fail if valgrind found errors, otherwise it'll return 0 (https://www.valgrind.org/docs/manual/manual-core.html)
        WRAPPER_CMD: "valgrind --error-exitcode=42"
-        SECP256K1_TEST_ITERS: 2
+        TEST_ITERS: 16
    - name: "UBSan, ASan, LSan"
-      container:
-        memory: 2G
      env:
-        CFLAGS: "-fsanitize=undefined,address -g"
+        CFLAGS: "-fsanitize=undefined,address"
+        CFLAGS_FOR_BUILD: "-fsanitize=undefined,address"
        UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=1"
        ASAN_OPTIONS: "strict_string_checks=1:detect_stack_use_after_return=1:detect_leaks=1"
        LSAN_OPTIONS: "use_unaligned=1"
-        SECP256K1_TEST_ITERS: 32
+        TEST_ITERS: 32
  # Try to cover many configurations with just a tiny matrix.
  matrix:
    - env:
        ASM: auto
+        STATICPRECOMPUTATION: yes
    - env:
        ASM: no
+        STATICPRECOMPUTATION: no
        ECMULTGENPRECISION: 2
-        ECMULTWINDOW: 2
  matrix:
    - env:
        CC: clang
@ -332,13 +322,17 @@ task:

 task:
  name: "C++ -fpermissive"
-  << : *LINUX_CONTAINER
+  container:
+    dockerfile: ci/linux-debian.Dockerfile
+    cpu: 1
+    memory: 1G
  env:
    # ./configure correctly errors out when given CC=g++.
    # We hack around this by passing CC=g++ only to make.
    CC: gcc
-    MAKEFLAGS: -j4 CC=g++ CFLAGS=-fpermissive\ -g
+    MAKEFLAGS: -j2 CC=g++ CFLAGS=-fpermissive
    WERROR_CFLAGS:
+    EXPERIMENTAL: yes
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
@ -346,10 +340,3 @@ task:
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
-
-task:
-  name: "sage prover"
-  << : *LINUX_CONTAINER
-  test_script:
-    - cd sage
-    - sage prove_group_implementations.sage
--- a/src/secp256k1/Makefile.am
+++ b/src/secp256k1/Makefile.am
@ -1,5 +1,3 @@
-.PHONY: clean-precomp precomp
-
 ACLOCAL_AMFLAGS = -I build-aux/m4

 # AM_CFLAGS will be automatically prepended to CFLAGS by Automake when compiling some foo
@ -20,22 +18,16 @@ noinst_HEADERS += src/scalar_8x32_impl.h
 noinst_HEADERS += src/scalar_low_impl.h
 noinst_HEADERS += src/group.h
 noinst_HEADERS += src/group_impl.h
-noinst_HEADERS += src/eccommit.h
-noinst_HEADERS += src/eccommit_impl.h
 noinst_HEADERS += src/ecdsa.h
 noinst_HEADERS += src/ecdsa_impl.h
 noinst_HEADERS += src/eckey.h
 noinst_HEADERS += src/eckey_impl.h
 noinst_HEADERS += src/ecmult.h
 noinst_HEADERS += src/ecmult_impl.h
-noinst_HEADERS += src/ecmult_compute_table.h
-noinst_HEADERS += src/ecmult_compute_table_impl.h
 noinst_HEADERS += src/ecmult_const.h
 noinst_HEADERS += src/ecmult_const_impl.h
 noinst_HEADERS += src/ecmult_gen.h
 noinst_HEADERS += src/ecmult_gen_impl.h
-noinst_HEADERS += src/ecmult_gen_compute_table.h
-noinst_HEADERS += src/ecmult_gen_compute_table_impl.h
 noinst_HEADERS += src/field_10x26.h
 noinst_HEADERS += src/field_10x26_impl.h
 noinst_HEADERS += src/field_5x52.h
@ -46,8 +38,6 @@ noinst_HEADERS += src/modinv32.h
 noinst_HEADERS += src/modinv32_impl.h
 noinst_HEADERS += src/modinv64.h
 noinst_HEADERS += src/modinv64_impl.h
-noinst_HEADERS += src/precomputed_ecmult.h
-noinst_HEADERS += src/precomputed_ecmult_gen.h
 noinst_HEADERS += src/assumptions.h
 noinst_HEADERS += src/util.h
 noinst_HEADERS += src/scratch.h
@ -60,24 +50,17 @@ noinst_HEADERS += src/hash_impl.h
 noinst_HEADERS += src/field.h
 noinst_HEADERS += src/field_impl.h
 noinst_HEADERS += src/bench.h
-noinst_HEADERS += src/basic-config.h
 noinst_HEADERS += contrib/lax_der_parsing.h
 noinst_HEADERS += contrib/lax_der_parsing.c
 noinst_HEADERS += contrib/lax_der_privatekey_parsing.h
 noinst_HEADERS += contrib/lax_der_privatekey_parsing.c
-noinst_HEADERS += examples/random.h
-
-PRECOMPUTED_LIB = libsecp256k1_precomputed.la
-noinst_LTLIBRARIES = $(PRECOMPUTED_LIB)
-libsecp256k1_precomputed_la_SOURCES =  src/precomputed_ecmult.c src/precomputed_ecmult_gen.c
-libsecp256k1_precomputed_la_CPPFLAGS = $(SECP_INCLUDES)

 if USE_EXTERNAL_ASM
 COMMON_LIB = libsecp256k1_common.la
+noinst_LTLIBRARIES = $(COMMON_LIB)
 else
 COMMON_LIB =
 endif
-noinst_LTLIBRARIES += $(COMMON_LIB)

 pkgconfigdir = $(libdir)/pkgconfig
 pkgconfig_DATA = libsecp256k1.pc
@ -90,8 +73,7 @@ endif

 libsecp256k1_la_SOURCES = src/secp256k1.c
 libsecp256k1_la_CPPFLAGS = -I$(top_srcdir)/include -I$(top_srcdir)/src $(SECP_INCLUDES)
-libsecp256k1_la_LIBADD = $(SECP_LIBS) $(COMMON_LIB) $(PRECOMPUTED_LIB)
-libsecp256k1_la_LDFLAGS = -no-undefined -version-info $(LIB_VERSION_CURRENT):$(LIB_VERSION_REVISION):$(LIB_VERSION_AGE)
+libsecp256k1_la_LIBADD = $(SECP_LIBS) $(COMMON_LIB)

 if VALGRIND_ENABLED
 libsecp256k1_la_CPPFLAGS += -DVALGRIND
@ -99,14 +81,18 @@ endif

 noinst_PROGRAMS =
 if USE_BENCHMARK
-noinst_PROGRAMS += bench bench_internal bench_ecmult
-bench_SOURCES = src/bench.c
-bench_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
+noinst_PROGRAMS += bench_verify bench_sign bench_internal bench_ecmult
+bench_verify_SOURCES = src/bench_verify.c
+bench_verify_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
+# SECP_TEST_INCLUDES are only used here for CRYPTO_CPPFLAGS
+bench_verify_CPPFLAGS = $(SECP_TEST_INCLUDES)
+bench_sign_SOURCES = src/bench_sign.c
+bench_sign_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
 bench_internal_SOURCES = src/bench_internal.c
-bench_internal_LDADD = $(SECP_LIBS) $(COMMON_LIB) $(PRECOMPUTED_LIB)
+bench_internal_LDADD = $(SECP_LIBS) $(COMMON_LIB)
 bench_internal_CPPFLAGS = $(SECP_INCLUDES)
 bench_ecmult_SOURCES = src/bench_ecmult.c
-bench_ecmult_LDADD = $(SECP_LIBS) $(COMMON_LIB) $(PRECOMPUTED_LIB)
+bench_ecmult_LDADD = $(SECP_LIBS) $(COMMON_LIB)
 bench_ecmult_CPPFLAGS = $(SECP_INCLUDES)
 endif

@ -124,7 +110,7 @@ endif
 if !ENABLE_COVERAGE
 tests_CPPFLAGS += -DVERIFY
 endif
-tests_LDADD = $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB) $(PRECOMPUTED_LIB)
+tests_LDADD = $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
 tests_LDFLAGS = -static
 TESTS += tests
 endif
@ -132,128 +118,47 @@ endif
 if USE_EXHAUSTIVE_TESTS
 noinst_PROGRAMS += exhaustive_tests
 exhaustive_tests_SOURCES = src/tests_exhaustive.c
-exhaustive_tests_CPPFLAGS = $(SECP_INCLUDES)
+exhaustive_tests_CPPFLAGS = -I$(top_srcdir)/src $(SECP_INCLUDES)
 if !ENABLE_COVERAGE
 exhaustive_tests_CPPFLAGS += -DVERIFY
 endif
-# Note: do not include $(PRECOMPUTED_LIB) in exhaustive_tests (it uses runtime-generated tables).
 exhaustive_tests_LDADD = $(SECP_LIBS) $(COMMON_LIB)
 exhaustive_tests_LDFLAGS = -static
 TESTS += exhaustive_tests
 endif

-if USE_EXAMPLES
-noinst_PROGRAMS += ecdsa_example
-ecdsa_example_SOURCES = examples/ecdsa.c
-ecdsa_example_CPPFLAGS = -I$(top_srcdir)/include
-ecdsa_example_LDADD = libsecp256k1.la
-ecdsa_example_LDFLAGS = -static
-if BUILD_WINDOWS
-ecdsa_example_LDFLAGS += -lbcrypt
-endif
-TESTS += ecdsa_example
-if ENABLE_MODULE_ECDH
-noinst_PROGRAMS += ecdh_example
-ecdh_example_SOURCES = examples/ecdh.c
-ecdh_example_CPPFLAGS = -I$(top_srcdir)/include
-ecdh_example_LDADD = libsecp256k1.la
-ecdh_example_LDFLAGS = -static
-if BUILD_WINDOWS
-ecdh_example_LDFLAGS += -lbcrypt
-endif
-TESTS += ecdh_example
-endif
-if ENABLE_MODULE_SCHNORRSIG
-noinst_PROGRAMS += schnorr_example
-schnorr_example_SOURCES = examples/schnorr.c
-schnorr_example_CPPFLAGS = -I$(top_srcdir)/include
-schnorr_example_LDADD = libsecp256k1.la
-schnorr_example_LDFLAGS = -static
-if BUILD_WINDOWS
-schnorr_example_LDFLAGS += -lbcrypt
-endif
-TESTS += schnorr_example
-endif
-if ENABLE_MODULE_MUSIG
-noinst_PROGRAMS += musig_example
-musig_example_SOURCES = examples/musig.c
-musig_example_CPPFLAGS = -I$(top_srcdir)/include
-musig_example_LDADD = libsecp256k1.la
-musig_example_LDFLAGS = -static
-if BUILD_WINDOWS
-musig_example_LDFLAGS += -lbcrypt
-endif
-TESTS += musig_example
-endif
+if USE_ECMULT_STATIC_PRECOMPUTATION
+CPPFLAGS_FOR_BUILD +=-I$(top_srcdir) -I$(builddir)/src
+
+gen_context_OBJECTS = gen_context.o
+gen_context_BIN = gen_context$(BUILD_EXEEXT)
+gen_%.o: src/gen_%.c src/libsecp256k1-config.h
+	$(CC_FOR_BUILD) $(DEFS) $(CPPFLAGS_FOR_BUILD) $(SECP_CFLAGS_FOR_BUILD) $(CFLAGS_FOR_BUILD) -c $< -o $@
+
+$(gen_context_BIN): $(gen_context_OBJECTS)
+	$(CC_FOR_BUILD) $(SECP_CFLAGS_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $^ -o $@
+
+$(libsecp256k1_la_OBJECTS): src/ecmult_static_context.h
+$(tests_OBJECTS): src/ecmult_static_context.h
+$(bench_internal_OBJECTS): src/ecmult_static_context.h
+$(bench_ecmult_OBJECTS): src/ecmult_static_context.h
+
+src/ecmult_static_context.h: $(gen_context_BIN)
+	./$(gen_context_BIN)
+
+CLEANFILES = $(gen_context_BIN) src/ecmult_static_context.h
 endif

-### Precomputed tables
-EXTRA_PROGRAMS = precompute_ecmult precompute_ecmult_gen
-CLEANFILES = $(EXTRA_PROGRAMS)
-
-precompute_ecmult_SOURCES = src/precompute_ecmult.c
-precompute_ecmult_CPPFLAGS = $(SECP_INCLUDES)
-precompute_ecmult_LDADD = $(SECP_LIBS) $(COMMON_LIB)
-
-precompute_ecmult_gen_SOURCES = src/precompute_ecmult_gen.c
-precompute_ecmult_gen_CPPFLAGS = $(SECP_INCLUDES)
-precompute_ecmult_gen_LDADD = $(SECP_LIBS) $(COMMON_LIB)
-
-# See Automake manual, Section "Errors with distclean".
-# We don't list any dependencies for the prebuilt files here because
-# otherwise make's decision whether to rebuild them (even in the first
-# build by a normal user) depends on mtimes, and thus is very fragile.
-# This means that rebuilds of the prebuilt files always need to be
-# forced by deleting them, e.g., by invoking `make clean-precomp`.
-src/precomputed_ecmult.c:
-	$(MAKE) $(AM_MAKEFLAGS) precompute_ecmult$(EXEEXT)
-	./precompute_ecmult$(EXEEXT)
-src/precomputed_ecmult_gen.c:
-	$(MAKE) $(AM_MAKEFLAGS) precompute_ecmult_gen$(EXEEXT)
-	./precompute_ecmult_gen$(EXEEXT)
-
-PRECOMP = src/precomputed_ecmult_gen.c src/precomputed_ecmult.c
-precomp: $(PRECOMP)
-
-# Ensure the prebuilt files will be build first (only if they don't exist,
-# e.g., after `make maintainer-clean`).
-BUILT_SOURCES = $(PRECOMP)
-
-maintainer-clean-local: clean-precomp
-
-clean-precomp:
-	rm -f $(PRECOMP)
-
-EXTRA_DIST = autogen.sh SECURITY.md
+EXTRA_DIST = autogen.sh src/gen_context.c src/basic-config.h

 if ENABLE_MODULE_ECDH
 include src/modules/ecdh/Makefile.am.include
 endif

-if ENABLE_MODULE_MUSIG
-include src/modules/musig/Makefile.am.include
-endif
-
 if ENABLE_MODULE_RECOVERY
 include src/modules/recovery/Makefile.am.include
 endif

-if ENABLE_MODULE_GENERATOR
-include src/modules/generator/Makefile.am.include
-endif
-
-if ENABLE_MODULE_RANGEPROOF
-include src/modules/rangeproof/Makefile.am.include
-endif
-
-if ENABLE_MODULE_WHITELIST
-include src/modules/whitelist/Makefile.am.include
-endif
-
-if ENABLE_MODULE_SURJECTIONPROOF
-include src/modules/surjection/Makefile.am.include
-endif
-
 if ENABLE_MODULE_EXTRAKEYS
 include src/modules/extrakeys/Makefile.am.include
 endif
@ -261,11 +166,3 @@ endif
 if ENABLE_MODULE_SCHNORRSIG
 include src/modules/schnorrsig/Makefile.am.include
 endif
-
-if ENABLE_MODULE_ECDSA_S2C
-include src/modules/ecdsa_s2c/Makefile.am.include
-endif
-
-if ENABLE_MODULE_ECDSA_ADAPTOR
-include src/modules/ecdsa_adaptor/Makefile.am.include
-endif
--- a/src/secp256k1/README.md
+++ b/src/secp256k1/README.md
@ -17,8 +17,7 @@ Features:
 * Suitable for embedded systems.
 * Optional module for public key recovery.
 * Optional module for ECDH key exchange.
-* Optional module for Schnorr signatures according to [BIP-340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
-* Optional module for ECDSA adaptor signatures (experimental).
+* Optional module for Schnorr signatures according to [BIP-340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki) (experimental).

 Experimental features have not received enough scrutiny to satisfy the standard of quality of this library but are made available for testing and review by the community. The APIs of these features should not be considered stable.

@ -36,7 +35,6 @@ Implementation details
  * Optimized implementation of arithmetic modulo the curve's field size (2^256 - 0x1000003D1).
    * Using 5 52-bit limbs (including hand-optimized assembly for x86_64, by Diederik Huys).
    * Using 10 26-bit limbs (including hand-optimized assembly for 32-bit ARM, by Wladimir J. van der Laan).
-      * This is an experimental feature that has not received enough scrutiny to satisfy the standard of quality of this library but is made available for testing and review by the community.
 * Scalar operations
  * Optimized implementation without data-dependent branches of arithmetic modulo the curve's order.
    * Using 4 64-bit limbs (relying on __int128 support in the compiler).
@ -68,18 +66,17 @@ libsecp256k1 is built using autotools:
    $ ./autogen.sh
    $ ./configure
    $ make
-    $ make check  # run the test suite
+    $ make check
    $ sudo make install  # optional

-To compile optional modules (such as Schnorr signatures), you need to run `./configure` with additional flags (such as `--enable-module-schnorrsig`). Run `./configure --help` to see the full list of available flags.
-
-Usage examples
+Exhaustive tests
 -----------
-  Usage examples can be found in the [examples](examples) directory. To compile them you need to configure with `--enable-examples`.
-  * [ECDSA example](examples/ecdsa.c)
-  * [Schnorr signatures example](examples/schnorr.c)
-  * [Deriving a shared secret (ECDH) example](examples/ecdh.c)
-  To compile the Schnorr signature and ECDH examples, you also need to configure with `--enable-module-schnorrsig` and `--enable-module-ecdh`.
+
+    $ ./exhaustive_tests
+
+With valgrind, you might need to increase the max stack size:
+
+    $ valgrind --max-stackframe=2500000 ./exhaustive_tests

 Test coverage
 -----------
@ -103,18 +100,6 @@ To create a HTML report with coloured and annotated source code:
    $ mkdir -p coverage
    $ gcovr --exclude 'src/bench*' --html --html-details -o coverage/coverage.html

-Benchmark
------------
-If configured with `--enable-benchmark` (which is the default), binaries for benchmarking the libsecp256k1 functions will be present in the root directory after the build.
-
-To print the benchmark result to the command line:
-
-    $ ./bench_name
-
-To create a CSV file for the benchmark result :
-
-    $ ./bench_name | sed '2d;s/ \{1,\}//g' > bench_name.csv
-
 Reporting a vulnerability
 ------------

--- a/src/secp256k1/build-aux/m4/bitcoin_secp.m4
+++ b/src/secp256k1/build-aux/m4/bitcoin_secp.m4
@ -9,17 +9,77 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 AC_MSG_RESULT([$has_64bit_asm])
 ])

+dnl
+AC_DEFUN([SECP_OPENSSL_CHECK],[
+  has_libcrypto=no
+  m4_ifdef([PKG_CHECK_MODULES],[
+    PKG_CHECK_MODULES([CRYPTO], [libcrypto], [has_libcrypto=yes],[has_libcrypto=no])
+    if test x"$has_libcrypto" = x"yes"; then
+      TEMP_LIBS="$LIBS"
+      LIBS="$LIBS $CRYPTO_LIBS"
+      AC_CHECK_LIB(crypto, main,[AC_DEFINE(HAVE_LIBCRYPTO,1,[Define this symbol if libcrypto is installed])],[has_libcrypto=no])
+      LIBS="$TEMP_LIBS"
+    fi
+  ])
+  if test x$has_libcrypto = xno; then
+    AC_CHECK_HEADER(openssl/crypto.h,[
+      AC_CHECK_LIB(crypto, main,[
+        has_libcrypto=yes
+        CRYPTO_LIBS=-lcrypto
+        AC_DEFINE(HAVE_LIBCRYPTO,1,[Define this symbol if libcrypto is installed])
+      ])
+    ])
+    LIBS=
+  fi
+if test x"$has_libcrypto" = x"yes" && test x"$has_openssl_ec" = x; then
+  AC_MSG_CHECKING(for EC functions in libcrypto)
+  CPPFLAGS_TEMP="$CPPFLAGS"
+  CPPFLAGS="$CRYPTO_CPPFLAGS $CPPFLAGS"
+  AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+    #include <openssl/bn.h>
+    #include <openssl/ec.h>
+    #include <openssl/ecdsa.h>
+    #include <openssl/obj_mac.h>]],[[
+    # if OPENSSL_VERSION_NUMBER < 0x10100000L
+    void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) {(void)sig->r; (void)sig->s;}
+    # endif
+
+    unsigned int zero = 0;
+    const unsigned char *zero_ptr = (unsigned char*)&zero;
+    EC_KEY_free(EC_KEY_new_by_curve_name(NID_secp256k1));
+    EC_KEY *eckey = EC_KEY_new();
+    EC_GROUP *group = EC_GROUP_new_by_curve_name(NID_secp256k1);
+    EC_KEY_set_group(eckey, group);
+    ECDSA_sign(0, NULL, 0, NULL, &zero, eckey);
+    ECDSA_verify(0, NULL, 0, NULL, 0, eckey);
+    o2i_ECPublicKey(&eckey, &zero_ptr, 0);
+    d2i_ECPrivateKey(&eckey, &zero_ptr, 0);
+    EC_KEY_check_key(eckey);
+    EC_KEY_free(eckey);
+    EC_GROUP_free(group);
+    ECDSA_SIG *sig_openssl;
+    sig_openssl = ECDSA_SIG_new();
+    d2i_ECDSA_SIG(&sig_openssl, &zero_ptr, 0);
+    i2d_ECDSA_SIG(sig_openssl, NULL);
+    ECDSA_SIG_get0(sig_openssl, NULL, NULL);
+    ECDSA_SIG_free(sig_openssl);
+    const BIGNUM *bignum = BN_value_one();
+    BN_is_negative(bignum);
+    BN_num_bits(bignum);
+    if (sizeof(zero) >= BN_num_bytes(bignum)) {
+        BN_bn2bin(bignum, (unsigned char*)&zero);
+    }
+  ]])],[has_openssl_ec=yes],[has_openssl_ec=no])
+  AC_MSG_RESULT([$has_openssl_ec])
+  CPPFLAGS="$CPPFLAGS_TEMP"
+fi
+])
+
 AC_DEFUN([SECP_VALGRIND_CHECK],[
 if test x"$has_valgrind" != x"yes"; then
  CPPFLAGS_TEMP="$CPPFLAGS"
  CPPFLAGS="$VALGRIND_CPPFLAGS $CPPFLAGS"
-  AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
-    #include <valgrind/memcheck.h>
-  ]], [[
-    #if defined(NVALGRIND)
-    #  error "Valgrind does not support this platform."
-    #endif
-  ]])], [has_valgrind=yes; AC_DEFINE(HAVE_VALGRIND,1,[Define this symbol if valgrind is installed, and it supports the host platform])])
+  AC_CHECK_HEADER([valgrind/memcheck.h], [has_valgrind=yes; AC_DEFINE(HAVE_VALGRIND,1,[Define this symbol if valgrind is installed])])
 fi
 ])

@ -38,16 +98,3 @@ AC_DEFUN([SECP_TRY_APPEND_CFLAGS], [
  unset flag_works
  AC_SUBST($2)
 ])
-
-dnl SECP_SET_DEFAULT(VAR, default, default-dev-mode)
-dnl Set VAR to default or default-dev-mode, depending on whether dev mode is enabled
-AC_DEFUN([SECP_SET_DEFAULT], [
-  if test "${enable_dev_mode+set}" != set; then
-    AC_MSG_ERROR([[Set enable_dev_mode before calling SECP_SET_DEFAULT]])
-  fi
-  if test x"$enable_dev_mode" = x"yes"; then
-    $1="$3"
-  else
-    $1="$2"
-  fi
-])
--- a/src/secp256k1/ci/cirrus.sh
+++ b/src/secp256k1/ci/cirrus.sh
@ -15,14 +15,9 @@ valgrind --version || true
 ./configure \
    --enable-experimental="$EXPERIMENTAL" \
    --with-test-override-wide-multiply="$WIDEMUL" --with-asm="$ASM" \
-    --with-ecmult-window="$ECMULTWINDOW" \
-    --with-ecmult-gen-precision="$ECMULTGENPRECISION" \
+    --enable-ecmult-static-precomputation="$STATICPRECOMPUTATION" --with-ecmult-gen-precision="$ECMULTGENPRECISION" \
    --enable-module-ecdh="$ECDH" --enable-module-recovery="$RECOVERY" \
-    --enable-module-ecdsa-s2c="$ECDSA_S2C" \
-    --enable-module-rangeproof="$RANGEPROOF" --enable-module-whitelist="$WHITELIST" --enable-module-generator="$GENERATOR" \
-    --enable-module-schnorrsig="$SCHNORRSIG"  --enable-module-musig="$MUSIG" --enable-module-ecdsa-adaptor="$ECDSAADAPTOR" \
    --enable-module-schnorrsig="$SCHNORRSIG" \
-    --enable-examples="$EXAMPLES" \
    --with-valgrind="$WITH_VALGRIND" \
    --host="$HOST" $EXTRAFLAGS

@ -31,12 +26,16 @@ make

 # Print information about binaries so that we can see that the architecture is correct
 file *tests* || true
-file bench* || true
+file bench_* || true
 file .libs/* || true

 # This tells `make check` to wrap test invocations.
 export LOG_COMPILER="$WRAPPER_CMD"

+# This limits the iterations in the tests and benchmarks.
+export SECP256K1_TEST_ITERS="$TEST_ITERS"
+export SECP256K1_BENCH_ITERS="$BENCH_ITERS"
+
 make "$BUILD"

 if [ "$BENCH" = "yes" ]
@ -50,22 +49,23 @@ then
    {
        $EXEC ./bench_ecmult
        $EXEC ./bench_internal
-        $EXEC ./bench
+        $EXEC ./bench_sign
+        $EXEC ./bench_verify
    } >> bench.log 2>&1
+    if [ "$RECOVERY" = "yes" ]
+    then
+        $EXEC ./bench_recover >> bench.log 2>&1
+    fi
+    if [ "$ECDH" = "yes" ]
+    then
+        $EXEC ./bench_ecdh >> bench.log 2>&1
+    fi
+    if [ "$SCHNORRSIG" = "yes" ]
+    then
+        $EXEC ./bench_schnorrsig >> bench.log 2>&1
+    fi
 fi
-
 if [ "$CTIMETEST" = "yes" ]
 then
    ./libtool --mode=execute valgrind --error-exitcode=42 ./valgrind_ctime_test > valgrind_ctime_test.log 2>&1
 fi
-
-# Rebuild precomputed files (if not cross-compiling).
-if [ -z "$HOST" ]
-then
-    make clean-precomp
-    make precomp
-fi
-
-# Check that no repo files have been modified by the build.
-# (This fails for example if the precomp files need to be updated in the repo.)
-git diff --exit-code
--- a/src/secp256k1/ci/linux-debian.Dockerfile
+++ b/src/secp256k1/ci/linux-debian.Dockerfile
@ -14,13 +14,12 @@ RUN apt-get install --no-install-recommends --no-upgrade -y \
        make automake libtool pkg-config dpkg-dev valgrind qemu-user \
        gcc clang llvm libc6-dbg \
        g++ \
-        gcc-i686-linux-gnu libc6-dev-i386-cross libc6-dbg:i386 libubsan1:i386 libasan6:i386 \
+        gcc-i686-linux-gnu libc6-dev-i386-cross libc6-dbg:i386 libubsan1:i386 libasan5:i386 \
        gcc-s390x-linux-gnu libc6-dev-s390x-cross libc6-dbg:s390x \
        gcc-arm-linux-gnueabihf libc6-dev-armhf-cross libc6-dbg:armhf \
        gcc-aarch64-linux-gnu libc6-dev-arm64-cross libc6-dbg:arm64 \
        gcc-powerpc64le-linux-gnu libc6-dev-ppc64el-cross libc6-dbg:ppc64el \
-        wine gcc-mingw-w64-x86-64 \
-        sagemath
+        wine gcc-mingw-w64-x86-64

 # Run a dummy command in wine to make it set up configuration
 RUN wine64-stable xcopy || true
--- a/src/secp256k1/configure.ac
+++ b/src/secp256k1/configure.ac
@ -1,47 +1,39 @@
 AC_PREREQ([2.60])
-
-# The package (a.k.a. release) version is based on semantic versioning 2.0.0 of
-# the API. All changes in experimental modules are treated as
-# backwards-compatible and therefore at most increase the minor version.
-define(_PKG_VERSION_MAJOR, 0)
-define(_PKG_VERSION_MINOR, 1)
-define(_PKG_VERSION_BUILD, 0)
-define(_PKG_VERSION_IS_RELEASE, false)
-
-# The library version is based on libtool versioning of the ABI. The set of
-# rules for updating the version can be found here:
-# https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
-# All changes in experimental modules are treated as if they don't affect the
-# interface and therefore only increase the revision.
-define(_LIB_VERSION_CURRENT, 0)
-define(_LIB_VERSION_REVISION, 0)
-define(_LIB_VERSION_AGE, 0)
-
-AC_INIT([libsecp256k1],m4_join([.], _PKG_VERSION_MAJOR, _PKG_VERSION_MINOR, _PKG_VERSION_BUILD)m4_if(_PKG_VERSION_IS_RELEASE, [true], [], [-pre]),[https://github.com/bitcoin-core/secp256k1/issues],[libsecp256k1],[https://github.com/bitcoin-core/secp256k1])
-
+AC_INIT([libsecp256k1],[0.1])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_MACRO_DIR([build-aux/m4])
 AC_CANONICAL_HOST
 AH_TOP([#ifndef LIBSECP256K1_CONFIG_H])
 AH_TOP([#define LIBSECP256K1_CONFIG_H])
 AH_BOTTOM([#endif /*LIBSECP256K1_CONFIG_H*/])
+AM_INIT_AUTOMAKE([foreign subdir-objects])

-# Require Automake 1.11.2 for AM_PROG_AR
-AM_INIT_AUTOMAKE([1.11.2 foreign subdir-objects])
+LT_INIT

 # Make the compilation flags quiet unless V=1 is used.
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])

-AC_PROG_CC
+PKG_PROG_PKG_CONFIG
+
+AC_PATH_TOOL(AR, ar)
+AC_PATH_TOOL(RANLIB, ranlib)
+AC_PATH_TOOL(STRIP, strip)
+
+# Save definition of AC_PROG_CC because AM_PROG_CC_C_O in automake<=1.13 will
+# redefine AC_PROG_CC to exit with an error, which avoids the user calling it
+# accidently and screwing up the effect of AM_PROG_CC_C_O. However, we'll need
+# AC_PROG_CC later on in AX_PROG_CC_FOR_BUILD, where its usage is fine, and
+# we'll carefully make sure not to call AC_PROG_CC anywhere else.
+m4_copy([AC_PROG_CC], [saved_AC_PROG_CC])
+AM_PROG_CC_C_O
+# Restore AC_PROG_CC
+m4_rename_force([saved_AC_PROG_CC], [AC_PROG_CC])
+
+AC_PROG_CC_C89
 if test x"$ac_cv_prog_cc_c89" = x"no"; then
  AC_MSG_ERROR([c89 compiler support required])
 fi
 AM_PROG_AS
-AM_PROG_AR
-
-LT_INIT([win32-dll])
-
-build_windows=no

 case $host_os in
  *darwin*)
@ -51,8 +43,14 @@ case $host_os in
         # These Homebrew packages may be keg-only, meaning that they won't be found
         # in expected paths because they may conflict with system files. Ask
         # Homebrew where each one is located, then adjust paths accordingly.
-         if $BREW list --versions valgrind >/dev/null; then
-           valgrind_prefix=$($BREW --prefix valgrind 2>/dev/null)
+         openssl_prefix=`$BREW --prefix openssl 2>/dev/null`
+         valgrind_prefix=`$BREW --prefix valgrind 2>/dev/null`
+         if test x$openssl_prefix != x; then
+           PKG_CONFIG_PATH="$openssl_prefix/lib/pkgconfig:$PKG_CONFIG_PATH"
+           export PKG_CONFIG_PATH
+           CRYPTO_CPPFLAGS="-I$openssl_prefix/include"
+         fi
+         if test x$valgrind_prefix != x; then
           VALGRIND_CPPFLAGS="-I$valgrind_prefix/include"
         fi
       else
@ -66,9 +64,6 @@ case $host_os in
       fi
     fi
   ;;
-   cygwin*|mingw*)
-     build_windows=yes
-   ;;
 esac

 # Try if some desirable compiler flags are supported and append them to SECP_CFLAGS.
@ -111,108 +106,77 @@ SECP_TRY_APPEND_DEFAULT_CFLAGS(SECP_CFLAGS)
 ### Define config arguments
 ###

-# In dev mode, we enable all binaries and modules by default but individual options can still be overridden explicitly.
-# Check for dev mode first because SECP_SET_DEFAULT needs enable_dev_mode set.
-AC_ARG_ENABLE(dev_mode, [], [],
-    [enable_dev_mode=no])
-
 AC_ARG_ENABLE(benchmark,
-    AS_HELP_STRING([--enable-benchmark],[compile benchmark [default=yes]]), [],
-    [SECP_SET_DEFAULT([enable_benchmark], [yes], [yes])])
+    AS_HELP_STRING([--enable-benchmark],[compile benchmark [default=yes]]),
+    [use_benchmark=$enableval],
+    [use_benchmark=yes])

 AC_ARG_ENABLE(coverage,
-    AS_HELP_STRING([--enable-coverage],[enable compiler flags to support kcov coverage analysis [default=no]]), [],
-    [SECP_SET_DEFAULT([enable_coverage], [no], [no])])
+    AS_HELP_STRING([--enable-coverage],[enable compiler flags to support kcov coverage analysis [default=no]]),
+    [enable_coverage=$enableval],
+    [enable_coverage=no])

 AC_ARG_ENABLE(tests,
-    AS_HELP_STRING([--enable-tests],[compile tests [default=yes]]), [],
-    [SECP_SET_DEFAULT([enable_tests], [yes], [yes])])
+    AS_HELP_STRING([--enable-tests],[compile tests [default=yes]]),
+    [use_tests=$enableval],
+    [use_tests=yes])
+
+AC_ARG_ENABLE(openssl_tests,
+    AS_HELP_STRING([--enable-openssl-tests],[enable OpenSSL tests [default=auto]]),
+    [enable_openssl_tests=$enableval],
+    [enable_openssl_tests=auto])

 AC_ARG_ENABLE(experimental,
-    AS_HELP_STRING([--enable-experimental],[allow experimental configure options [default=no]]), [],
-    [SECP_SET_DEFAULT([enable_experimental], [no], [yes])])
+    AS_HELP_STRING([--enable-experimental],[allow experimental configure options [default=no]]),
+    [use_experimental=$enableval],
+    [use_experimental=no])

 AC_ARG_ENABLE(exhaustive_tests,
-    AS_HELP_STRING([--enable-exhaustive-tests],[compile exhaustive tests [default=yes]]), [],
-    [SECP_SET_DEFAULT([enable_exhaustive_tests], [yes], [yes])])
+    AS_HELP_STRING([--enable-exhaustive-tests],[compile exhaustive tests [default=yes]]),
+    [use_exhaustive_tests=$enableval],
+    [use_exhaustive_tests=yes])

-AC_ARG_ENABLE(examples,
-    AS_HELP_STRING([--enable-examples],[compile the examples [default=no]]), [],
-    [SECP_SET_DEFAULT([enable_examples], [no], [yes])])
+AC_ARG_ENABLE(ecmult_static_precomputation,
+    AS_HELP_STRING([--enable-ecmult-static-precomputation],[enable precomputed ecmult table for signing [default=auto]]),
+    [use_ecmult_static_precomputation=$enableval],
+    [use_ecmult_static_precomputation=auto])

 AC_ARG_ENABLE(module_ecdh,
-    AS_HELP_STRING([--enable-module-ecdh],[enable ECDH module [default=no]]), [],
-    [SECP_SET_DEFAULT([enable_module_ecdh], [no], [yes])])
-
-AC_ARG_ENABLE(module_musig,
-    AS_HELP_STRING([--enable-module-musig],[enable MuSig module (experimental)]),
-    [],
-    [SECP_SET_DEFAULT([enable_module_musig], [no], [yes])])
+    AS_HELP_STRING([--enable-module-ecdh],[enable ECDH shared secret computation]),
+    [enable_module_ecdh=$enableval],
+    [enable_module_ecdh=no])

 AC_ARG_ENABLE(module_recovery,
-    AS_HELP_STRING([--enable-module-recovery],[enable ECDSA pubkey recovery module [default=no]]), [],
-    [SECP_SET_DEFAULT([enable_module_recovery], [no], [yes])])
-
-AC_ARG_ENABLE(module_generator,
-    AS_HELP_STRING([--enable-module-generator],[enable NUMS generator module [default=no]]),
-    [],
-    [SECP_SET_DEFAULT([enable_module_generator], [no], [yes])])
-
-AC_ARG_ENABLE(module_rangeproof,
-    AS_HELP_STRING([--enable-module-rangeproof],[enable Pedersen / zero-knowledge range proofs module [default=no]]),
-    [],
-    [SECP_SET_DEFAULT([enable_module_rangeproof], [no], [yes])])
-
-AC_ARG_ENABLE(module_whitelist,
-    AS_HELP_STRING([--enable-module-whitelist],[enable key whitelisting module [default=no]]),
-    [],
-    [SECP_SET_DEFAULT([enable_module_whitelist], [no], [yes])])
+    AS_HELP_STRING([--enable-module-recovery],[enable ECDSA pubkey recovery module [default=no]]),
+    [enable_module_recovery=$enableval],
+    [enable_module_recovery=no])

 AC_ARG_ENABLE(module_extrakeys,
-    AS_HELP_STRING([--enable-module-extrakeys],[enable extrakeys module [default=no]]), [],
-    [SECP_SET_DEFAULT([enable_module_extrakeys], [no], [yes])])
+    AS_HELP_STRING([--enable-module-extrakeys],[enable extrakeys module (experimental)]),
+    [enable_module_extrakeys=$enableval],
+    [enable_module_extrakeys=no])

 AC_ARG_ENABLE(module_schnorrsig,
-    AS_HELP_STRING([--enable-module-schnorrsig],[enable schnorrsig module [default=no]]), [],
-    [SECP_SET_DEFAULT([enable_module_schnorrsig], [no], [yes])])
-
-AC_ARG_ENABLE(module_ecdsa_s2c,
-    AS_HELP_STRING([--enable-module-ecdsa-s2c],[enable ECDSA sign-to-contract module [default=no]]),
-    [],
-    [SECP_SET_DEFAULT([enable_module_ecdsa_s2c], [no], [yes])])
-
-AC_ARG_ENABLE(module_ecdsa-adaptor,
-    AS_HELP_STRING([--enable-module-ecdsa-adaptor],[enable ECDSA adaptor module [default=no]]),
-    [],
-    [SECP_SET_DEFAULT([enable_module_ecdsa_adaptor], [no], [yes])])
+    AS_HELP_STRING([--enable-module-schnorrsig],[enable schnorrsig module (experimental)]),
+    [enable_module_schnorrsig=$enableval],
+    [enable_module_schnorrsig=no])

 AC_ARG_ENABLE(external_default_callbacks,
-    AS_HELP_STRING([--enable-external-default-callbacks],[enable external default callback functions [default=no]]), [],
-    [SECP_SET_DEFAULT([enable_external_default_callbacks], [no], [no])])
-
-AC_ARG_ENABLE(module_surjectionproof,
-    AS_HELP_STRING([--enable-module-surjectionproof],[enable surjection proof module [default=no]]),
-    [],
-    [SECP_SET_DEFAULT([enable_module_surjectionproof], [no], [yes])])
-
-AC_ARG_ENABLE(reduced_surjection_proof_size,
-    AS_HELP_STRING([--enable-reduced-surjection-proof-size],[use reduced surjection proof size (disabling parsing and verification) [default=no]]),
-    [],
-    [SECP_SET_DEFAULT([use_reduced_surjection_proof_size], [no], [no])])
+    AS_HELP_STRING([--enable-external-default-callbacks],[enable external default callback functions [default=no]]),
+    [use_external_default_callbacks=$enableval],
+    [use_external_default_callbacks=no])

 # Test-only override of the (autodetected by the C code) "widemul" setting.
 # Legal values are int64 (for [u]int64_t), int128 (for [unsigned] __int128), and auto (the default).
 AC_ARG_WITH([test-override-wide-multiply], [] ,[set_widemul=$withval], [set_widemul=auto])

 AC_ARG_WITH([asm], [AS_HELP_STRING([--with-asm=x86_64|arm|no|auto],
-[assembly optimizations to use (experimental: arm) [default=auto]])],[req_asm=$withval], [req_asm=auto])
+[assembly optimizations to use (experimental: arm) [default=auto]])],[req_asm=$withval], [req_asm=auto])

 AC_ARG_WITH([ecmult-window], [AS_HELP_STRING([--with-ecmult-window=SIZE|auto],
 [window size for ecmult precomputation for verification, specified as integer in range [2..24].]
 [Larger values result in possibly better performance at the cost of an exponentially larger precomputed table.]
 [The table will store 2^(SIZE-1) * 64 bytes of data but can be larger in memory due to platform-specific padding and alignment.]
-[A window size larger than 15 will require you delete the prebuilt precomputed_ecmult.c file so that it can be rebuilt.]
-[For very large window sizes, use "make -j 1" to reduce memory use during compilation.]
 ["auto" is a reasonable setting for desktop machines (currently 15). [default=auto]]
 )],
 [req_ecmult_window=$withval], [req_ecmult_window=auto])
@ -258,20 +222,9 @@ else
    # We still add it here because passing it twice is not an issue, and handling
    # this case would just add unnecessary complexity (see #896).
    SECP_CFLAGS="-O2 $SECP_CFLAGS"
+    SECP_CFLAGS_FOR_BUILD="-O2 $SECP_CFLAGS_FOR_BUILD"
 fi

-AC_MSG_CHECKING([for __builtin_popcount])
-AC_LINK_IFELSE([AC_LANG_SOURCE([[void myfunc() {__builtin_popcount(0);}]])],
-    [ AC_MSG_RESULT([yes]);AC_DEFINE(HAVE_BUILTIN_POPCOUNT,1,[Define this symbol if __builtin_popcount is available]) ],
-    [ AC_MSG_RESULT([no])
-    ])
-
-AC_MSG_CHECKING([for  __builtin_clzll])
-AC_LINK_IFELSE([AC_LANG_SOURCE([[void myfunc() { __builtin_clzll(1);}]])],
-    [ AC_MSG_RESULT([yes]);AC_DEFINE(HAVE_BUILTIN_CLZLL,1,[Define this symbol if  __builtin_clzll is available]) ],
-    [ AC_MSG_RESULT([no])
-    ])
-
 if test x"$req_asm" = x"auto"; then
  SECP_64BIT_ASM_CHECK
  if test x"$has_64bit_asm" = x"yes"; then
@ -300,14 +253,14 @@ else
 fi

 # Select assembly optimization
-enable_external_asm=no
+use_external_asm=no

 case $set_asm in
 x86_64)
  AC_DEFINE(USE_ASM_X86_64, 1, [Define this symbol to enable x86_64 assembly optimizations])
  ;;
 arm)
-  enable_external_asm=yes
+  use_external_asm=yes
  ;;
 no)
  ;;
@ -316,7 +269,7 @@ no)
  ;;
 esac

-if test x"$enable_external_asm" = x"yes"; then
+if test x"$use_external_asm" = x"yes"; then
  AC_DEFINE(USE_EXTERNAL_ASM, 1, [Define this symbol if an external (non-inline) assembly implementation is used])
 fi

@ -374,6 +327,32 @@ case $set_ecmult_gen_precision in
  ;;
 esac

+if test x"$use_tests" = x"yes"; then
+  SECP_OPENSSL_CHECK
+  if test x"$enable_openssl_tests" != x"no" && test x"$has_openssl_ec" = x"yes"; then
+      enable_openssl_tests=yes
+      AC_DEFINE(ENABLE_OPENSSL_TESTS, 1, [Define this symbol if OpenSSL EC functions are available])
+      SECP_TEST_INCLUDES="$SSL_CFLAGS $CRYPTO_CFLAGS $CRYPTO_CPPFLAGS"
+      SECP_TEST_LIBS="$CRYPTO_LIBS"
+
+      case $host in
+      *mingw*)
+        SECP_TEST_LIBS="$SECP_TEST_LIBS -lgdi32"
+        ;;
+      esac
+  else
+    if test x"$enable_openssl_tests" = x"yes"; then
+      AC_MSG_ERROR([OpenSSL tests requested but OpenSSL with EC support is not available])
+    fi
+    enable_openssl_tests=no
+  fi
+else
+  if test x"$enable_openssl_tests" = x"yes"; then
+    AC_MSG_ERROR([OpenSSL tests requested but tests are not enabled])
+  fi
+  enable_openssl_tests=no
+fi
+
 if test x"$enable_valgrind" = x"yes"; then
  SECP_INCLUDES="$SECP_INCLUDES $VALGRIND_CPPFLAGS"
 fi
@ -381,6 +360,77 @@ fi
 # Add -Werror and similar flags passed from the outside (for testing, e.g., in CI)
 SECP_CFLAGS="$SECP_CFLAGS $WERROR_CFLAGS"

+# Handle static precomputation (after everything which modifies CFLAGS and friends)
+if test x"$use_ecmult_static_precomputation" != x"no"; then
+  if test x"$cross_compiling" = x"no"; then
+    set_precomp=yes
+    if test x"${CC_FOR_BUILD+x}${CFLAGS_FOR_BUILD+x}${CPPFLAGS_FOR_BUILD+x}${LDFLAGS_FOR_BUILD+x}" != x; then
+      AC_MSG_WARN([CC_FOR_BUILD, CFLAGS_FOR_BUILD, CPPFLAGS_FOR_BUILD, and/or LDFLAGS_FOR_BUILD is set but ignored because we are not cross-compiling.])
+    fi
+    # If we're not cross-compiling, simply use the same compiler for building the static precompation code.
+    CC_FOR_BUILD="$CC"
+    CPPFLAGS_FOR_BUILD="$CPPFLAGS"
+    SECP_CFLAGS_FOR_BUILD="$SECP_CFLAGS"
+    CFLAGS_FOR_BUILD="$CFLAGS"
+    LDFLAGS_FOR_BUILD="$LDFLAGS"
+  else
+    AX_PROG_CC_FOR_BUILD
+
+    # Temporarily switch to an environment for the native compiler
+    save_cross_compiling=$cross_compiling
+    cross_compiling=no
+    SAVE_CC="$CC"
+    CC="$CC_FOR_BUILD"
+    SAVE_CPPFLAGS="$CPPFLAGS"
+    CPPFLAGS="$CPPFLAGS_FOR_BUILD"
+    SAVE_CFLAGS="$CFLAGS"
+    CFLAGS="$CFLAGS_FOR_BUILD"
+    SAVE_LDFLAGS="$LDFLAGS"
+    LDFLAGS="$LDFLAGS_FOR_BUILD"
+
+    SECP_TRY_APPEND_DEFAULT_CFLAGS(SECP_CFLAGS_FOR_BUILD)
+
+    AC_MSG_CHECKING([for working native compiler: ${CC_FOR_BUILD}])
+    AC_RUN_IFELSE(
+      [AC_LANG_PROGRAM([], [])],
+      [working_native_cc=yes],
+      [working_native_cc=no],[:])
+
+    # Restore the environment
+    cross_compiling=$save_cross_compiling
+    CC="$SAVE_CC"
+    CPPFLAGS="$SAVE_CPPFLAGS"
+    CFLAGS="$SAVE_CFLAGS"
+    LDFLAGS="$SAVE_LDFLAGS"
+
+    if test x"$working_native_cc" = x"no"; then
+      AC_MSG_RESULT([no])
+      set_precomp=no
+      m4_define([please_set_for_build], [Please set CC_FOR_BUILD, CPPFLAGS_FOR_BUILD, CFLAGS_FOR_BUILD, and/or LDFLAGS_FOR_BUILD.])
+      if test x"$use_ecmult_static_precomputation" = x"yes";  then
+        AC_MSG_ERROR([native compiler ${CC_FOR_BUILD} does not produce working binaries. please_set_for_build])
+      else
+        AC_MSG_WARN([Disabling statically generated ecmult table because the native compiler ${CC_FOR_BUILD} does not produce working binaries. please_set_for_build])
+      fi
+    else
+      AC_MSG_RESULT([yes])
+      set_precomp=yes
+    fi
+  fi
+
+  AC_SUBST(CC_FOR_BUILD)
+  AC_SUBST(CPPFLAGS_FOR_BUILD)
+  AC_SUBST(SECP_CFLAGS_FOR_BUILD)
+  AC_SUBST(CFLAGS_FOR_BUILD)
+  AC_SUBST(LDFLAGS_FOR_BUILD)
+else
+  set_precomp=no
+fi
+
+if test x"$set_precomp" = x"yes"; then
+  AC_DEFINE(USE_ECMULT_STATIC_PRECOMPUTATION, 1, [Define this symbol to use a statically generated ecmult table])
+fi
+
 ###
 ### Handle module options
 ###
@ -389,32 +439,10 @@ if test x"$enable_module_ecdh" = x"yes"; then
  AC_DEFINE(ENABLE_MODULE_ECDH, 1, [Define this symbol to enable the ECDH module])
 fi

-if test x"$enable_module_musig" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_MUSIG, 1, [Define this symbol to enable the MuSig module])
-  enable_module_schnorrsig=yes
-fi
-
 if test x"$enable_module_recovery" = x"yes"; then
  AC_DEFINE(ENABLE_MODULE_RECOVERY, 1, [Define this symbol to enable the ECDSA pubkey recovery module])
 fi

-if test x"$enable_module_generator" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_GENERATOR, 1, [Define this symbol to enable the NUMS generator module])
-fi
-
-if test x"$enable_module_rangeproof" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_RANGEPROOF, 1, [Define this symbol to enable the Pedersen / zero knowledge range proof module])
-fi
-
-if test x"$enable_module_whitelist" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_WHITELIST, 1, [Define this symbol to enable the key whitelisting module])
-fi
-
-if test x"$enable_module_surjectionproof" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_SURJECTIONPROOF, 1, [Define this symbol to enable the surjection proof module])
-fi
-# Test if extrakeys is set _after_ the MuSig module to allow the MuSig
-# module to set enable_module_schnorrsig=yes
 if test x"$enable_module_schnorrsig" = x"yes"; then
  AC_DEFINE(ENABLE_MODULE_SCHNORRSIG, 1, [Define this symbol to enable the schnorrsig module])
  enable_module_extrakeys=yes
@ -426,22 +454,10 @@ if test x"$enable_module_extrakeys" = x"yes"; then
  AC_DEFINE(ENABLE_MODULE_EXTRAKEYS, 1, [Define this symbol to enable the extrakeys module])
 fi

-if test x"$enable_module_ecdsa_s2c" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_ECDSA_S2C, 1, [Define this symbol to enable the ECDSA sign-to-contract module])
-fi
-
-if test x"$enable_external_default_callbacks" = x"yes"; then
+if test x"$use_external_default_callbacks" = x"yes"; then
  AC_DEFINE(USE_EXTERNAL_DEFAULT_CALLBACKS, 1, [Define this symbol if an external implementation of the default callbacks is used])
 fi

-if test x"$use_reduced_surjection_proof_size" = x"yes"; then
-  AC_DEFINE(USE_REDUCED_SURJECTION_PROOF_SIZE, 1, [Define this symbol to reduce SECP256K1_SURJECTIONPROOF_MAX_N_INPUTS to 16, disabling parsing and verification])
-fi
-
-if test x"$enable_module_ecdsa_adaptor" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_ECDSA_ADAPTOR, 1, [Define this symbol to enable the ECDSA adaptor module])
-fi
-
 ###
 ### Check for --enable-experimental if necessary
 ###
@ -450,61 +466,19 @@ if test x"$enable_experimental" = x"yes"; then
  AC_MSG_NOTICE([******])
  AC_MSG_NOTICE([WARNING: experimental build])
  AC_MSG_NOTICE([Experimental features do not have stable APIs or properties, and may not be safe for production use.])
-  AC_MSG_NOTICE([Building NUMS generator module: $enable_module_generator])
-  AC_MSG_NOTICE([Building range proof module: $enable_module_rangeproof])
-  AC_MSG_NOTICE([Building key whitelisting module: $enable_module_whitelist])
-  AC_MSG_NOTICE([Building surjection proof module: $enable_module_surjectionproof])
-  AC_MSG_NOTICE([Building MuSig module: $enable_module_musig])
-  AC_MSG_NOTICE([Building ECDSA sign-to-contract module: $enable_module_ecdsa_s2c])
-  AC_MSG_NOTICE([Building ECDSA adaptor signatures module: $enable_module_ecdsa_adaptor])
+  AC_MSG_NOTICE([Building extrakeys module: $enable_module_extrakeys])
+  AC_MSG_NOTICE([Building schnorrsig module: $enable_module_schnorrsig])
  AC_MSG_NOTICE([******])
-
-
-  if test x"$enable_module_schnorrsig" != x"yes"; then
-    if test x"$enable_module_musig" = x"yes"; then
-      AC_MSG_ERROR([MuSig module requires the schnorrsig module. Use --enable-module-schnorrsig to allow.])
-    fi
-  fi
-
-  if test x"$enable_module_generator" != x"yes"; then
-    if test x"$enable_module_rangeproof" = x"yes"; then
-      AC_MSG_ERROR([Rangeproof module requires the generator module. Use --enable-module-generator to allow.])
-    fi
-  fi
-
-  if test x"$enable_module_rangeproof" != x"yes"; then
-    if test x"$enable_module_whitelist" = x"yes"; then
-      AC_MSG_ERROR([Whitelist module requires the rangeproof module. Use --enable-module-rangeproof to allow.])
-    fi
-    if test x"$enable_module_surjectionproof" = x"yes"; then
-      AC_MSG_ERROR([Surjection proof module requires the rangeproof module. Use --enable-module-rangeproof to allow.])
-    fi
-  fi
 else
-  if test x"$enable_module_musig" = x"yes"; then
-    AC_MSG_ERROR([MuSig module is experimental. Use --enable-experimental to allow.])
+  if test x"$enable_module_extrakeys" = x"yes"; then
+    AC_MSG_ERROR([extrakeys module is experimental. Use --enable-experimental to allow.])
  fi
-  if test x"$enable_module_ecdsa_s2c" = x"yes"; then
-    AC_MSG_ERROR([ECDSA sign-to-contract module module is experimental. Use --enable-experimental to allow.])
-  fi
-  if test x"$enable_module_ecdsa_adaptor" = x"yes"; then
-    AC_MSG_ERROR([ecdsa adaptor signatures module is experimental. Use --enable-experimental to allow.])
+  if test x"$enable_module_schnorrsig" = x"yes"; then
+    AC_MSG_ERROR([schnorrsig module is experimental. Use --enable-experimental to allow.])
  fi
  if test x"$set_asm" = x"arm"; then
    AC_MSG_ERROR([ARM assembly optimization is experimental. Use --enable-experimental to allow.])
  fi
-  if test x"$enable_module_generator" = x"yes"; then
-    AC_MSG_ERROR([NUMS generator module is experimental. Use --enable-experimental to allow.])
-  fi
-  if test x"$enable_module_rangeproof" = x"yes"; then
-    AC_MSG_ERROR([Range proof module is experimental. Use --enable-experimental to allow.])
-  fi
-  if test x"$enable_module_whitelist" = x"yes"; then
-    AC_MSG_ERROR([Key whitelisting module is experimental. Use --enable-experimental to allow.])
-  fi
-  if test x"$enable_module_surjectionproof" = x"yes"; then
-    AC_MSG_ERROR([Surjection proof module is experimental. Use --enable-experimental to allow.])
-  fi
 fi

 ###
@ -519,45 +493,36 @@ AC_SUBST(SECP_TEST_LIBS)
 AC_SUBST(SECP_TEST_INCLUDES)
 AC_SUBST(SECP_CFLAGS)
 AM_CONDITIONAL([ENABLE_COVERAGE], [test x"$enable_coverage" = x"yes"])
-AM_CONDITIONAL([USE_TESTS], [test x"$enable_tests" != x"no"])
-AM_CONDITIONAL([USE_EXHAUSTIVE_TESTS], [test x"$enable_exhaustive_tests" != x"no"])
-AM_CONDITIONAL([USE_EXAMPLES], [test x"$enable_examples" != x"no"])
-AM_CONDITIONAL([USE_BENCHMARK], [test x"$enable_benchmark" = x"yes"])
+AM_CONDITIONAL([USE_TESTS], [test x"$use_tests" != x"no"])
+AM_CONDITIONAL([USE_EXHAUSTIVE_TESTS], [test x"$use_exhaustive_tests" != x"no"])
+AM_CONDITIONAL([USE_BENCHMARK], [test x"$use_benchmark" = x"yes"])
+AM_CONDITIONAL([USE_ECMULT_STATIC_PRECOMPUTATION], [test x"$set_precomp" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_ECDH], [test x"$enable_module_ecdh" = x"yes"])
-AM_CONDITIONAL([ENABLE_MODULE_MUSIG], [test x"$enable_module_musig" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_RECOVERY], [test x"$enable_module_recovery" = x"yes"])
-AM_CONDITIONAL([ENABLE_MODULE_GENERATOR], [test x"$enable_module_generator" = x"yes"])
-AM_CONDITIONAL([ENABLE_MODULE_RANGEPROOF], [test x"$enable_module_rangeproof" = x"yes"])
-AM_CONDITIONAL([ENABLE_MODULE_WHITELIST], [test x"$enable_module_whitelist" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_EXTRAKEYS], [test x"$enable_module_extrakeys" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG], [test x"$enable_module_schnorrsig" = x"yes"])
-AM_CONDITIONAL([ENABLE_MODULE_ECDSA_S2C], [test x"$enable_module_ecdsa_s2c" = x"yes"])
-AM_CONDITIONAL([ENABLE_MODULE_ECDSA_ADAPTOR], [test x"$enable_module_ecdsa_adaptor" = x"yes"])
-AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$enable_external_asm" = x"yes"])
+AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$use_external_asm" = x"yes"])
 AM_CONDITIONAL([USE_ASM_ARM], [test x"$set_asm" = x"arm"])
-AM_CONDITIONAL([ENABLE_MODULE_SURJECTIONPROOF], [test x"$enable_module_surjectionproof" = x"yes"])
-AM_CONDITIONAL([USE_REDUCED_SURJECTION_PROOF_SIZE], [test x"$use_reduced_surjection_proof_size" = x"yes"])
-AM_CONDITIONAL([BUILD_WINDOWS], [test "$build_windows" = "yes"])
-AC_SUBST(LIB_VERSION_CURRENT, _LIB_VERSION_CURRENT)
-AC_SUBST(LIB_VERSION_REVISION, _LIB_VERSION_REVISION)
-AC_SUBST(LIB_VERSION_AGE, _LIB_VERSION_AGE)
+
+# Make sure nothing new is exported so that we don't break the cache.
+PKGCONFIG_PATH_TEMP="$PKG_CONFIG_PATH"
+unset PKG_CONFIG_PATH
+PKG_CONFIG_PATH="$PKGCONFIG_PATH_TEMP"

 AC_OUTPUT

 echo
 echo "Build Options:"
-echo "  with external callbacks = $enable_external_default_callbacks"
-echo "  with benchmarks         = $enable_benchmark"
-echo "  with tests              = $enable_tests"
+echo "  with ecmult precomp     = $set_precomp"
+echo "  with external callbacks = $use_external_default_callbacks"
+echo "  with benchmarks         = $use_benchmark"
+echo "  with tests              = $use_tests"
+echo "  with openssl tests      = $enable_openssl_tests"
 echo "  with coverage           = $enable_coverage"
-echo "  with examples           = $enable_examples"
 echo "  module ecdh             = $enable_module_ecdh"
 echo "  module recovery         = $enable_module_recovery"
 echo "  module extrakeys        = $enable_module_extrakeys"
 echo "  module schnorrsig       = $enable_module_schnorrsig"
-echo "  module musig            = $enable_module_musig"
-echo "  module ecdsa-s2c        = $enable_module_ecdsa_s2c"
-echo "  module ecdsa-adaptor    = $enable_module_ecdsa_adaptor"
 echo
 echo "  asm                     = $set_asm"
 echo "  ecmult window size      = $set_ecmult_window"
@ -573,3 +538,11 @@ echo "  CPPFLAGS                = $CPPFLAGS"
 echo "  SECP_CFLAGS             = $SECP_CFLAGS"
 echo "  CFLAGS                  = $CFLAGS"
 echo "  LDFLAGS                 = $LDFLAGS"
+echo
+if test x"$set_precomp" = x"yes"; then
+echo "  CC_FOR_BUILD            = $CC_FOR_BUILD"
+echo "  CPPFLAGS_FOR_BUILD      = $CPPFLAGS_FOR_BUILD"
+echo "  SECP_CFLAGS_FOR_BUILD   = $SECP_CFLAGS_FOR_BUILD"
+echo "  CFLAGS_FOR_BUILD        = $CFLAGS_FOR_BUILD"
+echo "  LDFLAGS_FOR_BUILD       = $LDFLAGS_FOR_BUILD"
+fi
--- a/src/secp256k1/include/secp256k1.h
+++ b/src/secp256k1/include/secp256k1.h
@ -831,6 +831,31 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_tagged_sha256(
    size_t msglen
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5);

+/** Compute a tagged hash as defined in BIP-340.
+ *
+ *  This is useful for creating a message hash and achieving domain separation
+ *  through an application-specific tag. This function returns
+ *  SHA256(SHA256(tag)||SHA256(tag)||msg). Therefore, tagged hash
+ *  implementations optimized for a specific tag can precompute the SHA256 state
+ *  after hashing the tag hashes.
+ *
+ *  Returns 0 if the arguments are invalid and 1 otherwise.
+ *  Args:    ctx: pointer to a context object
+ *  Out:  hash32: pointer to a 32-byte array to store the resulting hash
+ *  In:      tag: pointer to an array containing the tag
+ *        taglen: length of the tag array
+ *           msg: pointer to an array containing the message
+ *        msglen: length of the message array
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_tagged_sha256(
+    const secp256k1_context* ctx,
+    unsigned char *hash32,
+    const unsigned char *tag,
+    size_t taglen,
+    const unsigned char *msg,
+    size_t msglen
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5);
+
 #ifdef __cplusplus
 }
 #endif
--- a/src/secp256k1/include/secp256k1_schnorrsig.h
+++ b/src/secp256k1/include/secp256k1_schnorrsig.h
@ -106,34 +106,22 @@ typedef struct {
 *  signatures from being valid in multiple contexts by accident.
 *
 *  Returns 1 on success, 0 on failure.
- *  Args:    ctx: pointer to a context object, initialized for signing.
- *  Out:   sig64: pointer to a 64-byte array to store the serialized signature.
- *  In:    msg32: the 32-byte message being signed.
- *       keypair: pointer to an initialized keypair.
+ *  Args:    ctx: pointer to a context object, initialized for signing (cannot be NULL)
+ *  Out:   sig64: pointer to a 64-byte array to store the serialized signature (cannot be NULL)
+ *  In:    msg32: the 32-byte message being signed (cannot be NULL)
+ *       keypair: pointer to an initialized keypair (cannot be NULL)
 *    aux_rand32: 32 bytes of fresh randomness. While recommended to provide
- *                this, it is only supplemental to security and can be NULL. A
- *                NULL argument is treated the same as an all-zero one. See
+ *                this, it is only supplemental to security and can be NULL. See
 *                BIP-340 "Default Signing" for a full explanation of this
 *                argument and for guidance if randomness is expensive.
 */
-SECP256K1_API int secp256k1_schnorrsig_sign32(
-    const secp256k1_context* ctx,
-    unsigned char *sig64,
-    const unsigned char *msg32,
-    const secp256k1_keypair *keypair,
-    const unsigned char *aux_rand32
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
-
-/** Same as secp256k1_schnorrsig_sign32, but DEPRECATED. Will be removed in
- *  future versions. */
 SECP256K1_API int secp256k1_schnorrsig_sign(
    const secp256k1_context* ctx,
    unsigned char *sig64,
    const unsigned char *msg32,
    const secp256k1_keypair *keypair,
-    const unsigned char *aux_rand32
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
-  SECP256K1_DEPRECATED("Use secp256k1_schnorrsig_sign32 instead");
+    unsigned char *aux_rand32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);

 /** Create a Schnorr signature with a more flexible API.
 *
@ -162,7 +150,7 @@ SECP256K1_API int secp256k1_schnorrsig_sign_custom(
 *  Returns: 1: correct signature
 *           0: incorrect signature
 *  Args:    ctx: a secp256k1 context object, initialized for verification.
- *  In:    sig64: pointer to the 64-byte signature to verify.
+ *  In:    sig64: pointer to the 64-byte signature to verify (cannot be NULL)
 *           msg: the message being verified. Can only be NULL if msglen is 0.
 *        msglen: length of the message
 *        pubkey: pointer to an x-only public key to verify with (cannot be NULL)
--- a/src/secp256k1/src/bench_ecmult.c
+++ b/src/secp256k1/src/bench_ecmult.c
@ -124,46 +124,46 @@ static void bench_ecmult_const_teardown(void* arg, int iters) {
    bench_ecmult_teardown_helper(data, &data->offset1, &data->offset2, NULL, iters);
 }

-static void bench_ecmult_1p(void* arg, int iters) {
+static void bench_ecmult_1(void* arg, int iters) {
    bench_data* data = (bench_data*)arg;
    int i;

    for (i = 0; i < iters; ++i) {
-        secp256k1_ecmult(&data->output[i], &data->pubkeys_gej[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], NULL);
+        secp256k1_ecmult(&data->ctx->ecmult_ctx, &data->output[i], &data->pubkeys_gej[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], NULL);
    }
 }

-static void bench_ecmult_1p_teardown(void* arg, int iters) {
+static void bench_ecmult_1_teardown(void* arg, int iters) {
    bench_data* data = (bench_data*)arg;
    bench_ecmult_teardown_helper(data, &data->offset1, &data->offset2, NULL, iters);
 }

-static void bench_ecmult_0p_g(void* arg, int iters) {
+static void bench_ecmult_1g(void* arg, int iters) {
    bench_data* data = (bench_data*)arg;
    secp256k1_scalar zero;
    int i;

    secp256k1_scalar_set_int(&zero, 0);
    for (i = 0; i < iters; ++i) {
-        secp256k1_ecmult(&data->output[i], NULL, &zero, &data->scalars[(data->offset1+i) % POINTS]);
+        secp256k1_ecmult(&data->ctx->ecmult_ctx, &data->output[i], NULL, &zero, &data->scalars[(data->offset1+i) % POINTS]);
    }
 }

-static void bench_ecmult_0p_g_teardown(void* arg, int iters) {
+static void bench_ecmult_1g_teardown(void* arg, int iters) {
    bench_data* data = (bench_data*)arg;
    bench_ecmult_teardown_helper(data, NULL, NULL, &data->offset1, iters);
 }

-static void bench_ecmult_1p_g(void* arg, int iters) {
+static void bench_ecmult_2g(void* arg, int iters) {
    bench_data* data = (bench_data*)arg;
    int i;

    for (i = 0; i < iters/2; ++i) {
-        secp256k1_ecmult(&data->output[i], &data->pubkeys_gej[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], &data->scalars[(data->offset1+i) % POINTS]);
+        secp256k1_ecmult(&data->ctx->ecmult_ctx, &data->output[i], &data->pubkeys_gej[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], &data->scalars[(data->offset1+i) % POINTS]);
    }
 }

-static void bench_ecmult_1p_g_teardown(void* arg, int iters) {
+static void bench_ecmult_2g_teardown(void* arg, int iters) {
    bench_data* data = (bench_data*)arg;
    bench_ecmult_teardown_helper(data, &data->offset1, &data->offset2, &data->offset1, iters/2);
 }
@ -175,14 +175,14 @@ static void run_ecmult_bench(bench_data* data, int iters) {
    sprintf(str, "ecmult_const");
    run_benchmark(str, bench_ecmult_const, bench_ecmult_setup, bench_ecmult_const_teardown, data, 10, iters);
    /* ecmult with non generator point */
-    sprintf(str, "ecmult_1p");
-    run_benchmark(str, bench_ecmult_1p, bench_ecmult_setup, bench_ecmult_1p_teardown, data, 10, iters);
+    sprintf(str, "ecmult 1");
+    run_benchmark(str, bench_ecmult_1, bench_ecmult_setup, bench_ecmult_1_teardown, data, 10, iters);
    /* ecmult with generator point */
-    sprintf(str, "ecmult_0p_g");
-    run_benchmark(str, bench_ecmult_0p_g, bench_ecmult_setup, bench_ecmult_0p_g_teardown, data, 10, iters);
+    sprintf(str, "ecmult 1g");
+    run_benchmark(str, bench_ecmult_1g, bench_ecmult_setup, bench_ecmult_1g_teardown, data, 10, iters);
    /* ecmult with generator and non-generator point. The reported time is per point. */
-    sprintf(str, "ecmult_1p_g");
-    run_benchmark(str, bench_ecmult_1p_g, bench_ecmult_setup, bench_ecmult_1p_g_teardown, data, 10, 2*iters);
+    sprintf(str, "ecmult 2g");
+    run_benchmark(str, bench_ecmult_2g, bench_ecmult_setup, bench_ecmult_2g_teardown, data, 10, 2*iters);
 }

 static int bench_ecmult_multi_callback(secp256k1_scalar* sc, secp256k1_ge* ge, size_t idx, void* arg) {
@ -207,7 +207,7 @@ static void bench_ecmult_multi(void* arg, int iters) {
    iters = iters / data->count;

    for (iter = 0; iter < iters; ++iter) {
-        data->ecmult_multi(&data->ctx->error_callback, data->scratch, &data->output[iter], data->includes_g ? &data->scalars[data->offset1] : NULL, bench_ecmult_multi_callback, arg, count - includes_g);
+        data->ecmult_multi(&data->ctx->error_callback, &data->ctx->ecmult_ctx, data->scratch, &data->output[iter], data->includes_g ? &data->scalars[data->offset1] : NULL, bench_ecmult_multi_callback, arg, count - includes_g);
        data->offset1 = (data->offset1 + count) % POINTS;
        data->offset2 = (data->offset2 + count - 1) % POINTS;
    }
@ -266,15 +266,11 @@ static void run_ecmult_multi_bench(bench_data* data, size_t count, int includes_
            secp256k1_scalar_add(&total, &total, &tmp);
        }
        secp256k1_scalar_negate(&total, &total);
-        secp256k1_ecmult(&data->expected_output[iter], NULL, &zero, &total);
+        secp256k1_ecmult(&data->ctx->ecmult_ctx, &data->expected_output[iter], NULL, &zero, &total);
    }

    /* Run the benchmark. */
-    if (includes_g) {
-        sprintf(str, "ecmult_multi_%ip_g", (int)count - 1);
-    } else {
-        sprintf(str, "ecmult_multi_%ip", (int)count);
-    }
+    sprintf(str, includes_g ? "ecmult_multi %ig" : "ecmult_multi %i", (int)count);
    run_benchmark(str, bench_ecmult_multi, bench_ecmult_multi_setup, bench_ecmult_multi_teardown, data, 10, count * iters);
 }

@ -292,7 +288,7 @@ int main(int argc, char **argv) {
           || have_flag(argc, argv, "--help")
           || have_flag(argc, argv, "help")) {
            help(argv);
-            return 0;
+            return 1;
        } else if(have_flag(argc, argv, "pippenger_wnaf")) {
            printf("Using pippenger_wnaf:\n");
            data.ecmult_multi = secp256k1_ecmult_pippenger_batch_single;
@ -337,7 +333,6 @@ int main(int argc, char **argv) {
    secp256k1_ge_set_all_gej_var(data.pubkeys, data.pubkeys_gej, POINTS);


-    print_output_table_header_row();
    /* Initialize offset1 and offset2 */
    hash_into_offset(&data, 0);
    run_ecmult_bench(&data, iters);
--- a/src/secp256k1/src/bench_sign.c
+++ b/src/secp256k1/src/bench_sign.c
@ -0,0 +1,58 @@
+/***********************************************************************
+ * Copyright (c) 2014 Pieter Wuille                                    *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#include "../include/secp256k1.h"
+#include "util.h"
+#include "bench.h"
+
+typedef struct {
+    secp256k1_context* ctx;
+    unsigned char msg[32];
+    unsigned char key[32];
+} bench_sign_data;
+
+static void bench_sign_setup(void* arg) {
+    int i;
+    bench_sign_data *data = (bench_sign_data*)arg;
+
+    for (i = 0; i < 32; i++) {
+        data->msg[i] = i + 1;
+    }
+    for (i = 0; i < 32; i++) {
+        data->key[i] = i + 65;
+    }
+}
+
+static void bench_sign_run(void* arg, int iters) {
+    int i;
+    bench_sign_data *data = (bench_sign_data*)arg;
+
+    unsigned char sig[74];
+    for (i = 0; i < iters; i++) {
+        size_t siglen = 74;
+        int j;
+        secp256k1_ecdsa_signature signature;
+        CHECK(secp256k1_ecdsa_sign(data->ctx, &signature, data->msg, data->key, NULL, NULL));
+        CHECK(secp256k1_ecdsa_signature_serialize_der(data->ctx, sig, &siglen, &signature));
+        for (j = 0; j < 32; j++) {
+            data->msg[j] = sig[j];
+            data->key[j] = sig[j + 32];
+        }
+    }
+}
+
+int main(void) {
+    bench_sign_data data;
+
+    int iters = get_iters(20000);
+
+    data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
+
+    run_benchmark("ecdsa_sign", bench_sign_run, bench_sign_setup, NULL, &data, 10, iters);
+
+    secp256k1_context_destroy(data.ctx);
+    return 0;
+}
--- a/src/secp256k1/src/bench_verify.c
+++ b/src/secp256k1/src/bench_verify.c
@ -0,0 +1,115 @@
+/***********************************************************************
+ * Copyright (c) 2014 Pieter Wuille                                    *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#include <stdio.h>
+#include <string.h>
+
+#include "../include/secp256k1.h"
+#include "util.h"
+#include "bench.h"
+
+#ifdef ENABLE_OPENSSL_TESTS
+#include <openssl/bn.h>
+#include <openssl/ecdsa.h>
+#include <openssl/obj_mac.h>
+#endif
+
+
+typedef struct {
+    secp256k1_context *ctx;
+    unsigned char msg[32];
+    unsigned char key[32];
+    unsigned char sig[72];
+    size_t siglen;
+    unsigned char pubkey[33];
+    size_t pubkeylen;
+#ifdef ENABLE_OPENSSL_TESTS
+    EC_GROUP* ec_group;
+#endif
+} bench_verify_data;
+
+static void bench_verify(void* arg, int iters) {
+    int i;
+    bench_verify_data* data = (bench_verify_data*)arg;
+
+    for (i = 0; i < iters; i++) {
+        secp256k1_pubkey pubkey;
+        secp256k1_ecdsa_signature sig;
+        data->sig[data->siglen - 1] ^= (i & 0xFF);
+        data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
+        data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
+        CHECK(secp256k1_ec_pubkey_parse(data->ctx, &pubkey, data->pubkey, data->pubkeylen) == 1);
+        CHECK(secp256k1_ecdsa_signature_parse_der(data->ctx, &sig, data->sig, data->siglen) == 1);
+        CHECK(secp256k1_ecdsa_verify(data->ctx, &sig, data->msg, &pubkey) == (i == 0));
+        data->sig[data->siglen - 1] ^= (i & 0xFF);
+        data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
+        data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
+    }
+}
+
+#ifdef ENABLE_OPENSSL_TESTS
+static void bench_verify_openssl(void* arg, int iters) {
+    int i;
+    bench_verify_data* data = (bench_verify_data*)arg;
+
+    for (i = 0; i < iters; i++) {
+        data->sig[data->siglen - 1] ^= (i & 0xFF);
+        data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
+        data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
+        {
+            EC_KEY *pkey = EC_KEY_new();
+            const unsigned char *pubkey = &data->pubkey[0];
+            int result;
+
+            CHECK(pkey != NULL);
+            result = EC_KEY_set_group(pkey, data->ec_group);
+            CHECK(result);
+            result = (o2i_ECPublicKey(&pkey, &pubkey, data->pubkeylen)) != NULL;
+            CHECK(result);
+            result = ECDSA_verify(0, &data->msg[0], sizeof(data->msg), &data->sig[0], data->siglen, pkey) == (i == 0);
+            CHECK(result);
+            EC_KEY_free(pkey);
+        }
+        data->sig[data->siglen - 1] ^= (i & 0xFF);
+        data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
+        data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
+    }
+}
+#endif
+
+int main(void) {
+    int i;
+    secp256k1_pubkey pubkey;
+    secp256k1_ecdsa_signature sig;
+    bench_verify_data data;
+
+    int iters = get_iters(20000);
+
+    data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
+
+    for (i = 0; i < 32; i++) {
+        data.msg[i] = 1 + i;
+    }
+    for (i = 0; i < 32; i++) {
+        data.key[i] = 33 + i;
+    }
+    data.siglen = 72;
+    CHECK(secp256k1_ecdsa_sign(data.ctx, &sig, data.msg, data.key, NULL, NULL));
+    CHECK(secp256k1_ecdsa_signature_serialize_der(data.ctx, data.sig, &data.siglen, &sig));
+    CHECK(secp256k1_ec_pubkey_create(data.ctx, &pubkey, data.key));
+    data.pubkeylen = 33;
+    CHECK(secp256k1_ec_pubkey_serialize(data.ctx, data.pubkey, &data.pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
+
+    run_benchmark("ecdsa_verify", bench_verify, NULL, NULL, &data, 10, iters);
+#ifdef ENABLE_OPENSSL_TESTS
+    data.ec_group = EC_GROUP_new_by_curve_name(NID_secp256k1);
+    run_benchmark("ecdsa_verify_openssl", bench_verify_openssl, NULL, NULL, &data, 10, iters);
+    EC_GROUP_free(data.ec_group);
+#endif
+
+    secp256k1_context_destroy(data.ctx);
+    return 0;
+}
--- a/src/secp256k1/src/ecmult.h
+++ b/src/secp256k1/src/ecmult.h
@ -11,26 +11,20 @@
 #include "scalar.h"
 #include "scratch.h"

-/* Noone will ever need more than a window size of 24. The code might
- * be correct for larger values of ECMULT_WINDOW_SIZE but this is not
- * tested.
- *
- * The following limitations are known, and there are probably more:
- * If WINDOW_G > 27 and size_t has 32 bits, then the code is incorrect
- * because the size of the memory object that we allocate (in bytes)
- * will not fit in a size_t.
- * If WINDOW_G > 31 and int has 32 bits, then the code is incorrect
- * because certain expressions will overflow.
- */
-#if ECMULT_WINDOW_SIZE < 2 || ECMULT_WINDOW_SIZE > 24
-#  error Set ECMULT_WINDOW_SIZE to an integer in range [2..24].
-#endif
+typedef struct {
+    /* For accelerating the computation of a*P + b*G: */
+    secp256k1_ge_storage (*pre_g)[];    /* odd multiples of the generator */
+    secp256k1_ge_storage (*pre_g_128)[]; /* odd multiples of 2^128*generator */
+} secp256k1_ecmult_context;

-/** The number of entries a table with precomputed multiples needs to have. */
-#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
+static void secp256k1_ecmult_context_init(secp256k1_ecmult_context *ctx);
+static void secp256k1_ecmult_context_build(secp256k1_ecmult_context *ctx, void **prealloc);
+static void secp256k1_ecmult_context_finalize_memcpy(secp256k1_ecmult_context *dst, const secp256k1_ecmult_context *src);
+static void secp256k1_ecmult_context_clear(secp256k1_ecmult_context *ctx);
+static int secp256k1_ecmult_context_is_built(const secp256k1_ecmult_context *ctx);

 /** Double multiply: R = na*A + ng*G */
-static void secp256k1_ecmult(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng);
+static void secp256k1_ecmult(const secp256k1_ecmult_context *ctx, secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng);

 typedef int (secp256k1_ecmult_multi_callback)(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *data);

@ -45,6 +39,6 @@ typedef int (secp256k1_ecmult_multi_callback)(secp256k1_scalar *sc, secp256k1_ge
 *          0 if there is not enough scratch space for a single point or
 *          callback returns 0
 */
-static int secp256k1_ecmult_multi_var(const secp256k1_callback* error_callback, secp256k1_scratch *scratch, secp256k1_gej *r, const secp256k1_scalar *inp_g_sc, secp256k1_ecmult_multi_callback cb, void *cbdata, size_t n);
+static int secp256k1_ecmult_multi_var(const secp256k1_callback* error_callback, const secp256k1_ecmult_context *ctx, secp256k1_scratch *scratch, secp256k1_gej *r, const secp256k1_scalar *inp_g_sc, secp256k1_ecmult_multi_callback cb, void *cbdata, size_t n);

 #endif /* SECP256K1_ECMULT_H */
--- a/src/secp256k1/src/ecmult_gen.h
+++ b/src/secp256k1/src/ecmult_gen.h
@ -13,20 +13,33 @@
 #if ECMULT_GEN_PREC_BITS != 2 && ECMULT_GEN_PREC_BITS != 4 && ECMULT_GEN_PREC_BITS != 8
 #  error "Set ECMULT_GEN_PREC_BITS to 2, 4 or 8."
 #endif
-#define ECMULT_GEN_PREC_G(bits) (1 << bits)
-#define ECMULT_GEN_PREC_N(bits) (256 / bits)
+#define ECMULT_GEN_PREC_B ECMULT_GEN_PREC_BITS
+#define ECMULT_GEN_PREC_G (1 << ECMULT_GEN_PREC_B)
+#define ECMULT_GEN_PREC_N (256 / ECMULT_GEN_PREC_B)

 typedef struct {
-    /* Whether the context has been built. */
-    int built;
-
-    /* Blinding values used when computing (n-b)G + bG. */
-    secp256k1_scalar blind; /* -b */
-    secp256k1_gej initial;  /* bG */
+    /* For accelerating the computation of a*G:
+     * To harden against timing attacks, use the following mechanism:
+     * * Break up the multiplicand into groups of PREC_B bits, called n_0, n_1, n_2, ..., n_(PREC_N-1).
+     * * Compute sum(n_i * (PREC_G)^i * G + U_i, i=0 ... PREC_N-1), where:
+     *   * U_i = U * 2^i, for i=0 ... PREC_N-2
+     *   * U_i = U * (1-2^(PREC_N-1)), for i=PREC_N-1
+     *   where U is a point with no known corresponding scalar. Note that sum(U_i, i=0 ... PREC_N-1) = 0.
+     * For each i, and each of the PREC_G possible values of n_i, (n_i * (PREC_G)^i * G + U_i) is
+     * precomputed (call it prec(i, n_i)). The formula now becomes sum(prec(i, n_i), i=0 ... PREC_N-1).
+     * None of the resulting prec group elements have a known scalar, and neither do any of
+     * the intermediate sums while computing a*G.
+     */
+    secp256k1_ge_storage (*prec)[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G]; /* prec[j][i] = (PREC_G)^j * i * G + U_i */
+    secp256k1_scalar blind;
+    secp256k1_gej initial;
 } secp256k1_ecmult_gen_context;

-static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context* ctx);
+static void secp256k1_ecmult_gen_context_init(secp256k1_ecmult_gen_context* ctx);
+static void secp256k1_ecmult_gen_context_build(secp256k1_ecmult_gen_context* ctx, void **prealloc);
+static void secp256k1_ecmult_gen_context_finalize_memcpy(secp256k1_ecmult_gen_context *dst, const secp256k1_ecmult_gen_context* src);
 static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context* ctx);
+static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx);

 /** Multiply with the generator: R = a*G */
 static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context* ctx, secp256k1_gej *r, const secp256k1_scalar *a);
--- a/src/secp256k1/src/gen_context.c
+++ b/src/secp256k1/src/gen_context.c
@ -0,0 +1,95 @@
+/***********************************************************************
+ * Copyright (c) 2013, 2014, 2015 Thomas Daede, Cory Fields            *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+/* Autotools creates libsecp256k1-config.h, of which ECMULT_GEN_PREC_BITS is needed.
+   ifndef guard so downstream users can define their own if they do not use autotools. */
+#if !defined(ECMULT_GEN_PREC_BITS)
+#include "libsecp256k1-config.h"
+#endif
+
+/* We can't require the precomputed tables when creating them. */
+#undef USE_ECMULT_STATIC_PRECOMPUTATION
+
+/* In principle we could use ASM, but this yields only a minor speedup in
+   build time and it's very complicated. In particular when cross-compiling, we'd
+   need to build the ASM for the build and the host machine. */
+#undef USE_EXTERNAL_ASM
+#undef USE_ASM_X86_64
+
+#include "../include/secp256k1.h"
+#include "assumptions.h"
+#include "util.h"
+#include "field_impl.h"
+#include "scalar_impl.h"
+#include "group_impl.h"
+#include "ecmult_gen_impl.h"
+
+static void default_error_callback_fn(const char* str, void* data) {
+    (void)data;
+    fprintf(stderr, "[libsecp256k1] internal consistency check failed: %s\n", str);
+    abort();
+}
+
+static const secp256k1_callback default_error_callback = {
+    default_error_callback_fn,
+    NULL
+};
+
+int main(int argc, char **argv) {
+    secp256k1_ecmult_gen_context ctx;
+    void *prealloc, *base;
+    int inner;
+    int outer;
+    FILE* fp;
+
+    (void)argc;
+    (void)argv;
+
+    fp = fopen("src/ecmult_static_context.h","w");
+    if (fp == NULL) {
+        fprintf(stderr, "Could not open src/ecmult_static_context.h for writing!\n");
+        return -1;
+    }
+
+    fprintf(fp, "#ifndef SECP256K1_ECMULT_STATIC_CONTEXT_H\n");
+    fprintf(fp, "#define SECP256K1_ECMULT_STATIC_CONTEXT_H\n");
+    fprintf(fp, "#include \"src/group.h\"\n");
+    fprintf(fp, "#define SC SECP256K1_GE_STORAGE_CONST\n");
+    fprintf(fp, "#if ECMULT_GEN_PREC_N != %d || ECMULT_GEN_PREC_G != %d\n", ECMULT_GEN_PREC_N, ECMULT_GEN_PREC_G);
+    fprintf(fp, "   #error configuration mismatch, invalid ECMULT_GEN_PREC_N, ECMULT_GEN_PREC_G. Try deleting ecmult_static_context.h before the build.\n");
+    fprintf(fp, "#endif\n");
+    fprintf(fp, "static const secp256k1_ge_storage secp256k1_ecmult_static_context[ECMULT_GEN_PREC_N][ECMULT_GEN_PREC_G] = {\n");
+
+    base = checked_malloc(&default_error_callback, SECP256K1_ECMULT_GEN_CONTEXT_PREALLOCATED_SIZE);
+    prealloc = base;
+    secp256k1_ecmult_gen_context_init(&ctx);
+    secp256k1_ecmult_gen_context_build(&ctx, &prealloc);
+    for(outer = 0; outer != ECMULT_GEN_PREC_N; outer++) {
+        fprintf(fp,"{\n");
+        for(inner = 0; inner != ECMULT_GEN_PREC_G; inner++) {
+            fprintf(fp,"    SC(%uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu, %uu)", SECP256K1_GE_STORAGE_CONST_GET((*ctx.prec)[outer][inner]));
+            if (inner != ECMULT_GEN_PREC_G - 1) {
+                fprintf(fp,",\n");
+            } else {
+                fprintf(fp,"\n");
+            }
+        }
+        if (outer != ECMULT_GEN_PREC_N - 1) {
+            fprintf(fp,"},\n");
+        } else {
+            fprintf(fp,"}\n");
+        }
+    }
+    fprintf(fp,"};\n");
+    secp256k1_ecmult_gen_context_clear(&ctx);
+    free(base);
+
+    fprintf(fp, "#undef SC\n");
+    fprintf(fp, "#endif\n");
+    fclose(fp);
+
+    return 0;
+}
--- a/src/secp256k1/src/modules/ecdh/bench_impl.h
+++ b/src/secp256k1/src/modules/ecdh/bench_impl.h
@ -4,10 +4,12 @@
 * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
 ***********************************************************************/

-#ifndef SECP256K1_MODULE_ECDH_BENCH_H
-#define SECP256K1_MODULE_ECDH_BENCH_H
+#include <string.h>

+#include "../include/secp256k1.h"
 #include "../include/secp256k1_ecdh.h"
+#include "util.h"
+#include "bench.h"

 typedef struct {
    secp256k1_context *ctx;
@ -42,16 +44,16 @@ static void bench_ecdh(void* arg, int iters) {
    }
 }

-void run_ecdh_bench(int iters, int argc, char** argv) {
+int main(void) {
    bench_ecdh_data data;
-    int d = argc == 1;
+
+    int iters = get_iters(20000);

    /* create a context with no capabilities */
    data.ctx = secp256k1_context_create(SECP256K1_FLAGS_TYPE_CONTEXT);

-    if (d || have_flag(argc, argv, "ecdh")) run_benchmark("ecdh", bench_ecdh, bench_ecdh_setup, NULL, &data, 10, iters);
+    run_benchmark("ecdh", bench_ecdh, bench_ecdh_setup, NULL, &data, 10, iters);

    secp256k1_context_destroy(data.ctx);
+    return 0;
 }
-
-#endif /* SECP256K1_MODULE_ECDH_BENCH_H */
--- a/src/secp256k1/src/modules/extrakeys/main_impl.h
+++ b/src/secp256k1/src/modules/extrakeys/main_impl.h
@ -9,7 +9,6 @@

 #include "../../../include/secp256k1.h"
 #include "../../../include/secp256k1_extrakeys.h"
-#include "hsort_impl.h"

 static SECP256K1_INLINE int secp256k1_xonly_pubkey_load(const secp256k1_context* ctx, secp256k1_ge *ge, const secp256k1_xonly_pubkey *pubkey) {
    return secp256k1_pubkey_load(ctx, ge, (const secp256k1_pubkey *) pubkey);
@ -121,11 +120,12 @@ int secp256k1_xonly_pubkey_tweak_add(const secp256k1_context* ctx, secp256k1_pub
    VERIFY_CHECK(ctx != NULL);
    ARG_CHECK(output_pubkey != NULL);
    memset(output_pubkey, 0, sizeof(*output_pubkey));
+    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
    ARG_CHECK(internal_pubkey != NULL);
    ARG_CHECK(tweak32 != NULL);

    if (!secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
-        || !secp256k1_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
+        || !secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &pk, tweak32)) {
        return 0;
    }
    secp256k1_pubkey_save(output_pubkey, &pk);
@ -137,12 +137,13 @@ int secp256k1_xonly_pubkey_tweak_add_check(const secp256k1_context* ctx, const u
    unsigned char pk_expected32[32];

    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
    ARG_CHECK(internal_pubkey != NULL);
    ARG_CHECK(tweaked_pubkey32 != NULL);
    ARG_CHECK(tweak32 != NULL);

    if (!secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
-        || !secp256k1_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
+        || !secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &pk, tweak32)) {
        return 0;
    }
    secp256k1_fe_normalize_var(&pk.x);
@ -153,28 +154,6 @@ int secp256k1_xonly_pubkey_tweak_add_check(const secp256k1_context* ctx, const u
            && secp256k1_fe_is_odd(&pk.y) == tweaked_pk_parity;
 }

-/* This struct wraps a const context pointer to satisfy the secp256k1_hsort api
- * which expects a non-const cmp_data pointer. */
-typedef struct {
-    const secp256k1_context *ctx;
-} secp256k1_xonly_sort_cmp_data;
-
-static int secp256k1_xonly_sort_cmp(const void* pk1, const void* pk2, void *cmp_data) {
-    return secp256k1_xonly_pubkey_cmp(((secp256k1_xonly_sort_cmp_data*)cmp_data)->ctx,
-                                      *(secp256k1_xonly_pubkey **)pk1,
-                                      *(secp256k1_xonly_pubkey **)pk2);
-}
-
-int secp256k1_xonly_sort(const secp256k1_context* ctx, const secp256k1_xonly_pubkey **pubkeys, size_t n_pubkeys) {
-    secp256k1_xonly_sort_cmp_data cmp_data;
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(pubkeys != NULL);
-
-    cmp_data.ctx = ctx;
-    secp256k1_hsort(pubkeys, n_pubkeys, sizeof(*pubkeys), secp256k1_xonly_sort_cmp, &cmp_data);
-    return 1;
-}
-
 static void secp256k1_keypair_save(secp256k1_keypair *keypair, const secp256k1_scalar *sk, secp256k1_ge *pk) {
    secp256k1_scalar_get_b32(&keypair->data[0], sk);
    secp256k1_pubkey_save((secp256k1_pubkey *)&keypair->data[32], pk);
@ -281,6 +260,7 @@ int secp256k1_keypair_xonly_tweak_add(const secp256k1_context* ctx, secp256k1_ke
    int ret;

    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
    ARG_CHECK(keypair != NULL);
    ARG_CHECK(tweak32 != NULL);

@ -293,7 +273,7 @@ int secp256k1_keypair_xonly_tweak_add(const secp256k1_context* ctx, secp256k1_ke
    }

    ret &= secp256k1_ec_seckey_tweak_add_helper(&sk, tweak32);
-    ret &= secp256k1_ec_pubkey_tweak_add_helper(&pk, tweak32);
+    ret &= secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &pk, tweak32);

    secp256k1_declassify(ctx, &ret, sizeof(ret));
    if (ret) {
--- a/src/secp256k1/src/modules/recovery/bench_impl.h
+++ b/src/secp256k1/src/modules/recovery/bench_impl.h
@ -4,10 +4,10 @@
 * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
 ***********************************************************************/

-#ifndef SECP256K1_MODULE_RECOVERY_BENCH_H
-#define SECP256K1_MODULE_RECOVERY_BENCH_H
-
+#include "../include/secp256k1.h"
 #include "../include/secp256k1_recovery.h"
+#include "util.h"
+#include "bench.h"

 typedef struct {
    secp256k1_context *ctx;
@ -48,15 +48,15 @@ void bench_recover_setup(void* arg) {
    }
 }

-void run_recovery_bench(int iters, int argc, char** argv) {
+int main(void) {
    bench_recover_data data;
-    int d = argc == 1;
+
+    int iters = get_iters(20000);

    data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);

-    if (d || have_flag(argc, argv, "ecdsa") || have_flag(argc, argv, "recover") || have_flag(argc, argv, "ecdsa_recover")) run_benchmark("ecdsa_recover", bench_recover, bench_recover_setup, NULL, &data, 10, iters);
+    run_benchmark("ecdsa_recover", bench_recover, bench_recover_setup, NULL, &data, 10, iters);

    secp256k1_context_destroy(data.ctx);
+    return 0;
 }
-
-#endif /* SECP256K1_MODULE_RECOVERY_BENCH_H */
--- a/src/secp256k1/src/modules/schnorrsig/bench_impl.h
+++ b/src/secp256k1/src/modules/schnorrsig/bench_impl.h
@ -4,10 +4,14 @@
 * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
 ***********************************************************************/

-#ifndef SECP256K1_MODULE_SCHNORRSIG_BENCH_H
-#define SECP256K1_MODULE_SCHNORRSIG_BENCH_H
+#include <string.h>
+#include <stdlib.h>

-#include "../../../include/secp256k1_schnorrsig.h"
+
+#include "../include/secp256k1.h"
+#include "../include/secp256k1_schnorrsig.h"
+#include "util.h"
+#include "bench.h"

 #define MSGLEN 32

@ -45,10 +49,10 @@ void bench_schnorrsig_verify(void* arg, int iters) {
    }
 }

-void run_schnorrsig_bench(int iters, int argc, char** argv) {
+int main(void) {
    int i;
    bench_schnorrsig_data data;
-    int d = argc == 1;
+    int iters = get_iters(10000);

    data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
    data.keypairs = (const secp256k1_keypair **)malloc(iters * sizeof(secp256k1_keypair *));
@ -82,8 +86,8 @@ void run_schnorrsig_bench(int iters, int argc, char** argv) {
        CHECK(secp256k1_xonly_pubkey_serialize(data.ctx, pk_char, &pk) == 1);
    }

-    if (d || have_flag(argc, argv, "schnorrsig") || have_flag(argc, argv, "sign") || have_flag(argc, argv, "schnorrsig_sign")) run_benchmark("schnorrsig_sign", bench_schnorrsig_sign, NULL, NULL, (void *) &data, 10, iters);
-    if (d || have_flag(argc, argv, "schnorrsig") || have_flag(argc, argv, "verify") || have_flag(argc, argv, "schnorrsig_verify")) run_benchmark("schnorrsig_verify", bench_schnorrsig_verify, NULL, NULL, (void *) &data, 10, iters);
+    run_benchmark("schnorrsig_sign", bench_schnorrsig_sign, NULL, NULL, (void *) &data, 10, iters);
+    run_benchmark("schnorrsig_verify", bench_schnorrsig_verify, NULL, NULL, (void *) &data, 10, iters);

    for (i = 0; i < iters; i++) {
        free((void *)data.keypairs[i]);
@ -97,6 +101,5 @@ void run_schnorrsig_bench(int iters, int argc, char** argv) {
    free(data.sigs);

    secp256k1_context_destroy(data.ctx);
+    return 0;
 }
-
-#endif
--- a/src/secp256k1/src/modules/schnorrsig/main_impl.h
+++ b/src/secp256k1/src/modules/schnorrsig/main_impl.h
@ -65,17 +65,6 @@ static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *ms
        for (i = 0; i < 32; i++) {
            masked_key[i] ^= key32[i];
        }
-    } else {
-        /* Precomputed TaggedHash("BIP0340/aux", 0x0000...00); */
-        static const unsigned char ZERO_MASK[32] = {
-              84, 241, 105, 207, 201, 226, 229, 114,
-             116, 128,  68,  31, 144, 186,  37, 196,
-             136, 244,  97, 199,  11,  94, 165, 220,
-             170, 247, 175, 105, 39,  10, 165,  20
-        };
-        for (i = 0; i < 32; i++) {
-            masked_key[i] = key32[i] ^ ZERO_MASK[i];
-        }
    }

    /* Tag the hash with algo which is important to avoid nonce reuse across
@ -88,8 +77,12 @@ static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *ms
        secp256k1_sha256_initialize_tagged(&sha, algo, algolen);
    }

-    /* Hash masked-key||pk||msg using the tagged hash as per the spec */
-    secp256k1_sha256_write(&sha, masked_key, 32);
+    /* Hash (masked-)key||pk||msg using the tagged hash as per the spec */
+    if (data != NULL) {
+        secp256k1_sha256_write(&sha, masked_key, 32);
+    } else {
+        secp256k1_sha256_write(&sha, key32, 32);
+    }
    secp256k1_sha256_write(&sha, xonly_pk32, 32);
    secp256k1_sha256_write(&sha, msg, msglen);
    secp256k1_sha256_finalize(&sha, nonce32);
@ -129,7 +122,7 @@ static void secp256k1_schnorrsig_challenge(secp256k1_scalar* e, const unsigned c
    secp256k1_scalar_set_b32(e, buf, NULL);
 }

-static int secp256k1_schnorrsig_sign_internal(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_keypair *keypair, secp256k1_nonce_function_hardened noncefp, void *ndata) {
+int secp256k1_schnorrsig_sign_internal(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_keypair *keypair, secp256k1_nonce_function_hardened noncefp, void *ndata) {
    secp256k1_scalar sk;
    secp256k1_scalar e;
    secp256k1_scalar k;
@ -192,13 +185,8 @@ static int secp256k1_schnorrsig_sign_internal(const secp256k1_context* ctx, unsi
    return ret;
 }

-int secp256k1_schnorrsig_sign32(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *aux_rand32) {
-    /* We cast away const from the passed aux_rand32 argument since we know the default nonce function does not modify it. */
-    return secp256k1_schnorrsig_sign_internal(ctx, sig64, msg32, 32, keypair, secp256k1_nonce_function_bip340, (unsigned char*)aux_rand32);
-}
-
-int secp256k1_schnorrsig_sign(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *aux_rand32) {
-    return secp256k1_schnorrsig_sign32(ctx, sig64, msg32, keypair, aux_rand32);
+int secp256k1_schnorrsig_sign(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, unsigned char *aux_rand32) {
+    return secp256k1_schnorrsig_sign_internal(ctx, sig64, msg32, 32, keypair, secp256k1_nonce_function_bip340, aux_rand32);
 }

 int secp256k1_schnorrsig_sign_custom(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_keypair *keypair, secp256k1_schnorrsig_extraparams *extraparams) {
@ -228,6 +216,7 @@ int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const unsigned cha
    int overflow;

    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
    ARG_CHECK(sig64 != NULL);
    ARG_CHECK(msg != NULL || msglen == 0);
    ARG_CHECK(pubkey != NULL);
@ -252,7 +241,7 @@ int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const unsigned cha
    /* Compute rj =  s*G + (-e)*pkj */
    secp256k1_scalar_negate(&e, &e);
    secp256k1_gej_set_ge(&pkj, &pk);
-    secp256k1_ecmult(&rj, &pkj, &e, &s);
+    secp256k1_ecmult(&ctx->ecmult_ctx, &rj, &pkj, &e, &s);

    secp256k1_ge_set_gej_var(&r, &rj);
    if (secp256k1_ge_is_infinity(&r)) {
--- a/src/secp256k1/src/modules/schnorrsig/tests_impl.h
+++ b/src/secp256k1/src/modules/schnorrsig/tests_impl.h
@ -38,7 +38,7 @@ void run_nonce_function_bip340_tests(void) {
    size_t algolen = sizeof(algo);
    secp256k1_sha256 sha;
    secp256k1_sha256 sha_optimized;
-    unsigned char nonce[32], nonce_z[32];
+    unsigned char nonce[32];
    unsigned char msg[32];
    size_t msglen = sizeof(msg);
    unsigned char key[32];
@ -87,7 +87,7 @@ void run_nonce_function_bip340_tests(void) {
    CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, NULL, 0, NULL) == 0);
    CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
    /* Other algo is fine */
-    secp256k1_testrand_bytes_test(algo, algolen);
+    secp256k1_rfc6979_hmac_sha256_generate(&secp256k1_test_rng, algo, algolen);
    CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);

    for (i = 0; i < count; i++) {
@ -107,11 +107,8 @@ void run_nonce_function_bip340_tests(void) {
        CHECK(secp256k1_memcmp_var(nonce, nonce2, 32) != 0);
    }

-    /* NULL aux_rand argument is allowed, and identical to passing all zero aux_rand. */
-    memset(aux_rand, 0, 32);
-    CHECK(nonce_function_bip340(nonce_z, msg, msglen, key, pk, algo, algolen, &aux_rand) == 1);
+    /* NULL aux_rand argument is allowed. */
    CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
-    CHECK(secp256k1_memcmp_var(nonce_z, nonce, 32) == 0);
 }

 void test_schnorrsig_api(void) {
@ -132,19 +129,16 @@ void test_schnorrsig_api(void) {
    secp256k1_context *sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
    secp256k1_context *vrfy = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
    secp256k1_context *both = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
-    secp256k1_context *sttc = secp256k1_context_clone(secp256k1_context_no_precomp);
    int ecount;

    secp256k1_context_set_error_callback(none, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(vrfy, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(both, counting_illegal_callback_fn, &ecount);
-    secp256k1_context_set_error_callback(sttc, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(none, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(sign, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(vrfy, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(both, counting_illegal_callback_fn, &ecount);
-    secp256k1_context_set_illegal_callback(sttc, counting_illegal_callback_fn, &ecount);

    secp256k1_testrand256(sk1);
    secp256k1_testrand256(sk2);
@ -160,71 +154,66 @@ void test_schnorrsig_api(void) {

    /** main test body **/
    ecount = 0;
-    CHECK(secp256k1_schnorrsig_sign32(none, sig, msg, &keypairs[0], NULL) == 1);
-    CHECK(ecount == 0);
-    CHECK(secp256k1_schnorrsig_sign32(vrfy, sig, msg, &keypairs[0], NULL) == 1);
-    CHECK(ecount == 0);
-    CHECK(secp256k1_schnorrsig_sign32(sign, sig, msg, &keypairs[0], NULL) == 1);
-    CHECK(ecount == 0);
-    CHECK(secp256k1_schnorrsig_sign32(sign, NULL, msg, &keypairs[0], NULL) == 0);
+    CHECK(secp256k1_schnorrsig_sign(none, sig, msg, &keypairs[0], NULL) == 0);
    CHECK(ecount == 1);
-    CHECK(secp256k1_schnorrsig_sign32(sign, sig, NULL, &keypairs[0], NULL) == 0);
+    CHECK(secp256k1_schnorrsig_sign(vrfy, sig, msg, &keypairs[0], NULL) == 0);
    CHECK(ecount == 2);
-    CHECK(secp256k1_schnorrsig_sign32(sign, sig, msg, NULL, NULL) == 0);
+    CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL) == 1);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_sign(sign, NULL, msg, &keypairs[0], NULL) == 0);
    CHECK(ecount == 3);
-    CHECK(secp256k1_schnorrsig_sign32(sign, sig, msg, &invalid_keypair, NULL) == 0);
+    CHECK(secp256k1_schnorrsig_sign(sign, sig, NULL, &keypairs[0], NULL) == 0);
    CHECK(ecount == 4);
-    CHECK(secp256k1_schnorrsig_sign32(sttc, sig, msg, &keypairs[0], NULL) == 0);
+    CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, NULL, NULL) == 0);
    CHECK(ecount == 5);
-
-    ecount = 0;
-    CHECK(secp256k1_schnorrsig_sign_custom(none, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
-    CHECK(ecount == 0);
-    CHECK(secp256k1_schnorrsig_sign_custom(vrfy, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
-    CHECK(ecount == 0);
-    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
-    CHECK(ecount == 0);
-    CHECK(secp256k1_schnorrsig_sign_custom(sign, NULL, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, NULL, sizeof(msg), &keypairs[0], &extraparams) == 0);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, NULL, 0, &keypairs[0], &extraparams) == 1);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), NULL, &extraparams) == 0);
-    CHECK(ecount == 3);
-    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &invalid_keypair, &extraparams) == 0);
-    CHECK(ecount == 4);
-    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &keypairs[0], NULL) == 1);
-    CHECK(ecount == 4);
-    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &keypairs[0], &invalid_extraparams) == 0);
-    CHECK(ecount == 5);
-    CHECK(secp256k1_schnorrsig_sign_custom(sttc, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
+    CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &invalid_keypair, NULL) == 0);
    CHECK(ecount == 6);

    ecount = 0;
-    CHECK(secp256k1_schnorrsig_sign32(sign, sig, msg, &keypairs[0], NULL) == 1);
-    CHECK(secp256k1_schnorrsig_verify(none, sig, msg, sizeof(msg), &pk[0]) == 1);
-    CHECK(ecount == 0);
-    CHECK(secp256k1_schnorrsig_verify(sign, sig, msg, sizeof(msg), &pk[0]) == 1);
-    CHECK(ecount == 0);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, sizeof(msg), &pk[0]) == 1);
-    CHECK(ecount == 0);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, NULL, msg, sizeof(msg), &pk[0]) == 0);
+    CHECK(secp256k1_schnorrsig_sign_custom(none, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
    CHECK(ecount == 1);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, NULL, sizeof(msg), &pk[0]) == 0);
+    CHECK(secp256k1_schnorrsig_sign_custom(vrfy, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
    CHECK(ecount == 2);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, NULL, 0, &pk[0]) == 0);
+    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
    CHECK(ecount == 2);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, sizeof(msg), NULL) == 0);
+    CHECK(secp256k1_schnorrsig_sign_custom(sign, NULL, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
    CHECK(ecount == 3);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, sizeof(msg), &zero_pk) == 0);
+    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, NULL, sizeof(msg), &keypairs[0], &extraparams) == 0);
    CHECK(ecount == 4);
+    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, NULL, 0, &keypairs[0], &extraparams) == 1);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), NULL, &extraparams) == 0);
+    CHECK(ecount == 5);
+    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &invalid_keypair, &extraparams) == 0);
+    CHECK(ecount == 6);
+    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &keypairs[0], NULL) == 1);
+    CHECK(ecount == 6);
+    CHECK(secp256k1_schnorrsig_sign_custom(sign, sig, msg, sizeof(msg), &keypairs[0], &invalid_extraparams) == 0);
+    CHECK(ecount == 7);
+
+    ecount = 0;
+    CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL) == 1);
+    CHECK(secp256k1_schnorrsig_verify(none, sig, msg, sizeof(msg), &pk[0]) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_schnorrsig_verify(sign, sig, msg, sizeof(msg), &pk[0]) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, sizeof(msg), &pk[0]) == 1);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, NULL, msg, sizeof(msg), &pk[0]) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, NULL, sizeof(msg), &pk[0]) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, NULL, 0, &pk[0]) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, sizeof(msg), NULL) == 0);
+    CHECK(ecount == 5);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, sizeof(msg), &zero_pk) == 0);
+    CHECK(ecount == 6);

    secp256k1_context_destroy(none);
    secp256k1_context_destroy(sign);
    secp256k1_context_destroy(vrfy);
    secp256k1_context_destroy(both);
-    secp256k1_context_destroy(sttc);
 }

 /* Checks that hash initialized by secp256k1_schnorrsig_sha256_tagged has the
@ -241,13 +230,13 @@ void test_schnorrsig_sha256_tagged(void) {

 /* Helper function for schnorrsig_bip_vectors
 * Signs the message and checks that it's the same as expected_sig. */
-void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *expected_sig) {
+void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const unsigned char *pk_serialized, unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *expected_sig) {
    unsigned char sig[64];
    secp256k1_keypair keypair;
    secp256k1_xonly_pubkey pk, pk_expected;

    CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
-    CHECK(secp256k1_schnorrsig_sign32(ctx, sig, msg32, &keypair, aux_rand));
+    CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg32, &keypair, aux_rand));
    CHECK(secp256k1_memcmp_var(sig, expected_sig, 64) == 0);

    CHECK(secp256k1_xonly_pubkey_parse(ctx, &pk_expected, pk_serialized));
@ -740,11 +729,8 @@ void test_schnorrsig_sign(void) {
    secp256k1_testrand256(aux_rand);
    CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
    CHECK(secp256k1_keypair_xonly_pub(ctx, &pk, NULL, &keypair));
-    CHECK(secp256k1_schnorrsig_sign32(ctx, sig, msg, &keypair, NULL) == 1);
+    CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL) == 1);
    CHECK(secp256k1_schnorrsig_verify(ctx, sig, msg, sizeof(msg), &pk));
-    /* Check that deprecated alias gives the same result */
-    CHECK(secp256k1_schnorrsig_sign(ctx, sig2, msg, &keypair, NULL) == 1);
-    CHECK(secp256k1_memcmp_var(sig, sig2, sizeof(sig)) == 0);

    /* Test different nonce functions */
    CHECK(secp256k1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
@ -767,7 +753,7 @@ void test_schnorrsig_sign(void) {
    extraparams.noncefp = NULL;
    extraparams.ndata = aux_rand;
    CHECK(secp256k1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
-    CHECK(secp256k1_schnorrsig_sign32(ctx, sig2, msg, &keypair, extraparams.ndata) == 1);
+    CHECK(secp256k1_schnorrsig_sign(ctx, sig2, msg, &keypair, extraparams.ndata) == 1);
    CHECK(secp256k1_memcmp_var(sig, sig2, sizeof(sig)) == 0);
 }

@ -790,7 +776,7 @@ void test_schnorrsig_sign_verify(void) {

    for (i = 0; i < N_SIGS; i++) {
        secp256k1_testrand256(msg[i]);
-        CHECK(secp256k1_schnorrsig_sign32(ctx, sig[i], msg[i], &keypair, NULL));
+        CHECK(secp256k1_schnorrsig_sign(ctx, sig[i], msg[i], &keypair, NULL));
        CHECK(secp256k1_schnorrsig_verify(ctx, sig[i], msg[i], sizeof(msg[i]), &pk));
    }

@ -798,18 +784,18 @@ void test_schnorrsig_sign_verify(void) {
        /* Flip a few bits in the signature and in the message and check that
         * verify and verify_batch (TODO) fail */
        size_t sig_idx = secp256k1_testrand_int(N_SIGS);
-        size_t byte_idx = secp256k1_testrand_bits(5);
+        size_t byte_idx = secp256k1_testrand_int(32);
        unsigned char xorbyte = secp256k1_testrand_int(254)+1;
        sig[sig_idx][byte_idx] ^= xorbyte;
        CHECK(!secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
        sig[sig_idx][byte_idx] ^= xorbyte;

-        byte_idx = secp256k1_testrand_bits(5);
+        byte_idx = secp256k1_testrand_int(32);
        sig[sig_idx][32+byte_idx] ^= xorbyte;
        CHECK(!secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
        sig[sig_idx][32+byte_idx] ^= xorbyte;

-        byte_idx = secp256k1_testrand_bits(5);
+        byte_idx = secp256k1_testrand_int(32);
        msg[sig_idx][byte_idx] ^= xorbyte;
        CHECK(!secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
        msg[sig_idx][byte_idx] ^= xorbyte;
@ -819,13 +805,13 @@ void test_schnorrsig_sign_verify(void) {
    }

    /* Test overflowing s */
-    CHECK(secp256k1_schnorrsig_sign32(ctx, sig[0], msg[0], &keypair, NULL));
+    CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL));
    CHECK(secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], sizeof(msg[0]), &pk));
    memset(&sig[0][32], 0xFF, 32);
    CHECK(!secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], sizeof(msg[0]), &pk));

    /* Test negative s */
-    CHECK(secp256k1_schnorrsig_sign32(ctx, sig[0], msg[0], &keypair, NULL));
+    CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL));
    CHECK(secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], sizeof(msg[0]), &pk));
    secp256k1_scalar_set_b32(&s, &sig[0][32], NULL);
    secp256k1_scalar_negate(&s, &s);
@ -876,7 +862,7 @@ void test_schnorrsig_taproot(void) {

    /* Key spend */
    secp256k1_testrand256(msg);
-    CHECK(secp256k1_schnorrsig_sign32(ctx, sig, msg, &keypair, NULL) == 1);
+    CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL) == 1);
    /* Verify key spend */
    CHECK(secp256k1_xonly_pubkey_parse(ctx, &output_pk, output_pk_bytes) == 1);
    CHECK(secp256k1_schnorrsig_verify(ctx, sig, msg, sizeof(msg), &output_pk) == 1);
--- a/src/secp256k1/src/tests.c
+++ b/src/secp256k1/src/tests.c
--- a/src/secp256k1/src/valgrind_ctime_test.c
+++ b/src/secp256k1/src/valgrind_ctime_test.c
@ -6,7 +6,6 @@

 #include <valgrind/memcheck.h>
 #include <stdio.h>
-#include <string.h>

 #include "../include/secp256k1.h"
 #include "assumptions.h"
@ -28,18 +27,6 @@
 #include "../include/secp256k1_schnorrsig.h"
 #endif

-#ifdef ENABLE_MODULE_ECDSA_S2C
-#include "include/secp256k1_ecdsa_s2c.h"
-#endif
-
-#ifdef ENABLE_MODULE_ECDSA_ADAPTOR
-#include "include/secp256k1_ecdsa_adaptor.h"
-#endif
-
-#ifdef ENABLE_MODULE_MUSIG
-#include "include/secp256k1_musig.h"
-#endif
-
 void run_tests(secp256k1_context *ctx, unsigned char *key);

 int main(void) {
@ -179,137 +166,8 @@ void run_tests(secp256k1_context *ctx, unsigned char *key) {
    ret = secp256k1_keypair_create(ctx, &keypair, key);
    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
    CHECK(ret == 1);
-    ret = secp256k1_schnorrsig_sign32(ctx, sig, msg, &keypair, NULL);
+    ret = secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL);
    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
    CHECK(ret == 1);
 #endif
-
-#ifdef ENABLE_MODULE_ECDSA_S2C
-    {
-        unsigned char s2c_data[32] = {0};
-        unsigned char s2c_data_comm[32] = {0};
-        secp256k1_ecdsa_s2c_opening s2c_opening;
-
-        VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-        VALGRIND_MAKE_MEM_UNDEFINED(s2c_data, 32);
-        ret = secp256k1_ecdsa_s2c_sign(ctx, &signature, &s2c_opening, msg, key, s2c_data);
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-
-        VALGRIND_MAKE_MEM_UNDEFINED(s2c_data, 32);
-        ret = secp256k1_ecdsa_anti_exfil_host_commit(ctx, s2c_data_comm, s2c_data);
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-
-        VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-        VALGRIND_MAKE_MEM_UNDEFINED(s2c_data, 32);
-        ret = secp256k1_ecdsa_anti_exfil_signer_commit(ctx, &s2c_opening, msg, key, s2c_data);
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-    }
-#endif
-
-#ifdef ENABLE_MODULE_ECDSA_ADAPTOR
-    {
-        unsigned char adaptor_sig[162];
-        unsigned char deckey[32];
-        unsigned char expected_deckey[32];
-        secp256k1_pubkey enckey;
-
-        for (i = 0; i < 32; i++) {
-            deckey[i] = i + 2;
-        }
-
-        ret = secp256k1_ec_pubkey_create(ctx, &enckey, deckey);
-        CHECK(ret == 1);
-
-        VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-        ret = secp256k1_ecdsa_adaptor_encrypt(ctx, adaptor_sig, key, &enckey, msg, NULL, NULL);
-        VALGRIND_MAKE_MEM_DEFINED(adaptor_sig, sizeof(adaptor_sig));
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-
-        VALGRIND_MAKE_MEM_UNDEFINED(deckey, 32);
-        ret = secp256k1_ecdsa_adaptor_decrypt(ctx, &signature, deckey, adaptor_sig);
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-
-        VALGRIND_MAKE_MEM_UNDEFINED(&signature, 32);
-        ret = secp256k1_ecdsa_adaptor_recover(ctx, expected_deckey, &signature, adaptor_sig, &enckey);
-        VALGRIND_MAKE_MEM_DEFINED(expected_deckey, sizeof(expected_deckey));
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-
-        VALGRIND_MAKE_MEM_DEFINED(deckey, sizeof(deckey));
-        ret = secp256k1_memcmp_var(deckey, expected_deckey, sizeof(expected_deckey));
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 0);
-    }
-#endif
-
-#ifdef ENABLE_MODULE_MUSIG
-    {
-        secp256k1_xonly_pubkey pk;
-        const secp256k1_xonly_pubkey *pk_ptr[1];
-        secp256k1_xonly_pubkey agg_pk;
-        unsigned char session_id[32];
-        secp256k1_musig_secnonce secnonce;
-        secp256k1_musig_pubnonce pubnonce;
-        const secp256k1_musig_pubnonce *pubnonce_ptr[1];
-        secp256k1_musig_aggnonce aggnonce;
-        secp256k1_musig_keyagg_cache cache;
-        secp256k1_musig_session session;
-        secp256k1_musig_partial_sig partial_sig;
-        const secp256k1_musig_partial_sig *partial_sig_ptr[1];
-        unsigned char extra_input[32];
-        unsigned char sec_adaptor[32];
-        secp256k1_pubkey adaptor;
-        unsigned char pre_sig[64];
-        int nonce_parity;
-
-        pk_ptr[0] = &pk;
-        pubnonce_ptr[0] = &pubnonce;
-        VALGRIND_MAKE_MEM_DEFINED(key, 32);
-        memcpy(session_id, key, sizeof(session_id));
-        session_id[0] = session_id[0] + 1;
-        memcpy(extra_input, key, sizeof(extra_input));
-        extra_input[0] = extra_input[0] + 2;
-        memcpy(sec_adaptor, key, sizeof(sec_adaptor));
-        sec_adaptor[0] = extra_input[0] + 3;
-        partial_sig_ptr[0] = &partial_sig;
-
-        CHECK(secp256k1_keypair_create(ctx, &keypair, key));
-        CHECK(secp256k1_keypair_xonly_pub(ctx, &pk, NULL, &keypair));
-        CHECK(secp256k1_musig_pubkey_agg(ctx, NULL, &agg_pk, &cache, pk_ptr, 1));
-        CHECK(secp256k1_ec_pubkey_create(ctx, &adaptor, sec_adaptor));
-        VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-        VALGRIND_MAKE_MEM_UNDEFINED(session_id, sizeof(session_id));
-        VALGRIND_MAKE_MEM_UNDEFINED(extra_input, sizeof(extra_input));
-        VALGRIND_MAKE_MEM_UNDEFINED(sec_adaptor, sizeof(sec_adaptor));
-        ret = secp256k1_musig_nonce_gen(ctx, &secnonce, &pubnonce, session_id, key, msg, &cache, extra_input);
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-        CHECK(secp256k1_musig_nonce_agg(ctx, &aggnonce, pubnonce_ptr, 1));
-        CHECK(secp256k1_musig_nonce_process(ctx, &session, &aggnonce, msg, &cache, &adaptor) == 1);
-
-        ret = secp256k1_keypair_create(ctx, &keypair, key);
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-        ret = secp256k1_musig_partial_sign(ctx, &partial_sig, &secnonce, &keypair, &cache, &session);
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-
-        VALGRIND_MAKE_MEM_DEFINED(&partial_sig, sizeof(partial_sig));
-        CHECK(secp256k1_musig_partial_sig_agg(ctx, pre_sig, &session, partial_sig_ptr, 1));
-        VALGRIND_MAKE_MEM_DEFINED(pre_sig, sizeof(pre_sig));
-
-        CHECK(secp256k1_musig_nonce_parity(ctx, &nonce_parity, &session));
-        ret = secp256k1_musig_adapt(ctx, sig, pre_sig, sec_adaptor, nonce_parity);
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-        ret = secp256k1_musig_extract_adaptor(ctx, sec_adaptor, sig, pre_sig, nonce_parity);
-        VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-        CHECK(ret == 1);
-    }
-#endif
 }