secp256k1

commit ac4037e56cea6626e60fe1a0c448526247be9037
parent e13dd1b4342d20bedee279f0c5d927dd3f198b10
Author: Jared Tobin <jared@jtobin.io>
Date:   Sat,  1 Aug 2026 12:24:32 -0230

lib: correct the schnorr auxiliary entropy docstring

hash_aux hashes tag <> tag <> a, so an empty auxiliary input is not
the same as 32 zero bytes: both give valid signatures, but only the
latter reproduces BIP0340's zero-entropy vectors. The docstring
claimed the two were interchangeable.

Document the behaviour rather than change it. The auxiliary input is
supplemental by construction, so a short one weakens nothing, and
callers who followed the previous docs pass mempty today.

Diffstat:
M
lib/Crypto/Curve/Secp256k1.hs
 | 
4
+++-

1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/Crypto/Curve/Secp256k1.hs b/lib/Crypto/Curve/Secp256k1.hs
@@ -996,7 +996,9 @@ ecdh pub _SECRET = do
 --   injection" attacks). This entropy is /supplemental/ to security,
 --   and the cryptographic security of the signature scheme itself does
 --   not rely on it, so it is not strictly required; 32 zero bytes can
---   be used in its stead (and can be supplied via 'mempty').
+--   be used in its stead.
+--
+--   The auxiliary input is hashed, so any length input is accepted.
 --
 --   >>> import qualified System.Entropy as E
 --   >>> aux <- E.getEntropy 32