From 41784dbe55c394a3ac8447d3edfc0f0363d5b420 Mon Sep 17 00:00:00 2001 From: Nicolas Iooss Date: Mon, 29 Jun 2026 10:03:01 +0200 Subject: [PATCH 1/2] Clear scalar variables computed from scalar in secp256k1_ecmult_const Function secp256k1_ecdh performs an ECDH computation and clears some intermediate values from the stack before returning. This function calls secp256k1_ecmult_const, which does not clear anything. Clear the scalar variables computed from the scalar operand in secp256k1_ecmult_const. --- src/ecmult_const_impl.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/ecmult_const_impl.h b/src/ecmult_const_impl.h index 1d24aeaf36..ea824ec48d 100644 --- a/src/ecmult_const_impl.h +++ b/src/ecmult_const_impl.h @@ -263,6 +263,11 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons /* Map the result back to the secp256k1 curve from the isomorphic curve. */ secp256k1_fe_mul(&r->z, &r->z, &global_z); + + /* Clear local variables computed from scalar q */ + secp256k1_scalar_clear(&s); + secp256k1_scalar_clear(&v1); + secp256k1_scalar_clear(&v2); } static int secp256k1_ecmult_const_xonly(secp256k1_fe* r, const secp256k1_fe *n, const secp256k1_fe *d, const secp256k1_scalar *q, int known_on_curve) { From 3523d434fecd7a9f23057066d14b4373da0bd582 Mon Sep 17 00:00:00 2001 From: Nicolas Iooss Date: Mon, 29 Jun 2026 17:38:52 +0200 Subject: [PATCH 2/2] Clear more temporary variables in secp256k1_ecmult_const Some temporary variables in secp256k1_ecmult_const depends on few bits of the scalar. Clear them as well. --- src/ecmult_const_impl.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/ecmult_const_impl.h b/src/ecmult_const_impl.h index ea824ec48d..f717999b65 100644 --- a/src/ecmult_const_impl.h +++ b/src/ecmult_const_impl.h @@ -98,6 +98,7 @@ static void secp256k1_ecmult_const_odd_multiples_table_globalz(secp256k1_ge *pre } \ secp256k1_fe_negate(&neg_y, &(r)->y, 1); \ secp256k1_fe_cmov(&(r)->y, &neg_y, negative); \ + secp256k1_fe_clear(&neg_y); \ } while(0) /* For K as defined in the comment of secp256k1_ecmult_const, we have several precomputed @@ -247,6 +248,7 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons int j; ECMULT_CONST_TABLE_GET_GE(&t, pre_a, bits1); + secp256k1_memclear_explicit(&bits1, sizeof(bits1)); if (group == ECMULT_CONST_GROUPS - 1) { /* Directly set r in the first iteration. */ secp256k1_gej_set_ge(r, &t); @@ -258,7 +260,9 @@ static void secp256k1_ecmult_const(secp256k1_gej *r, const secp256k1_ge *a, cons secp256k1_gej_add_ge(r, r, &t); } ECMULT_CONST_TABLE_GET_GE(&t, pre_a_lam, bits2); + secp256k1_memclear_explicit(&bits2, sizeof(bits2)); secp256k1_gej_add_ge(r, r, &t); + secp256k1_ge_clear(&t); } /* Map the result back to the secp256k1 curve from the isomorphic curve. */