secp256k1

commit e13dd1b4342d20bedee279f0c5d927dd3f198b10
parent 960b7568e31976e813f223068d74042b2d34dd84
Author: Jared Tobin <jared@jtobin.io>
Date:   Sat,  1 Aug 2026 12:14:02 -0230

lib: use ct eq test for negl. prob. branch

This is pedantic, since the branch has negligible probability. It's mostly
"good optics."

Diffstat:
M
lib/Crypto/Curve/Secp256k1.hs
 | 
4
+++-

1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/Crypto/Curve/Secp256k1.hs b/lib/Crypto/Curve/Secp256k1.hs
@@ -1044,7 +1044,9 @@ _sign_schnorr _mul _SECRET m a = do
       t       = xor bytes_d (hash_aux a)
       rand    = hash_nonce (t <> bytes_p <> m)
       k'      = S.to (unsafe_roll32 rand)
-  guard (not (S.eq_vartime k' 0)) -- negligible probability
+  -- negligible probability, but k' is secret, so compare without
+  -- short-circuiting and decide only on the result
+  guard (not (CT.decide (S.eq k' 0)))
   pt <- _mul (S.retr k')
   let Affine (C.retr -> x_r) (C.retr -> y_r) = affine pt
       k         = S.select k' (negate k') (W.odd y_r)