HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
bitcoin-core
secp256k1
C2016–2024
bitcoin-core / secp256k1

secp256k1

Optimized C library for EC operations on curve secp256k1

Finance & CommerceLibraries & SDKs
Explore on GitHubRead Hacker News discussions
7Distinct people
10Mentions
0Explicit recommenders
2.5KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Optimized C library for EC operations on curve secp256k1

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year10 dated mentions

Observed mentions: 2016-08-11 06:04:02 UTC to 2024-07-18 17:14:19 UTC.

0122016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments20162017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2024

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC110
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC101
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC202
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC211
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC101
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC202

What Hacker News says

10 sources
yegle·Feb 9, 2023
Just yesterday I was trying to generate a vanity pub key for Nostr. I was using https://github.com/kdmukai/nostr_vanity_npub which uses the python-nostr library which in turn uses https://github.com/bitcoin-core/secp256k1. The test (single thread with -j1 flag) has some interesting result. Time taken to calculate 1 million keys: i7 8650U=2m5s, Oracle Cloud A1 VM=3m30s, Ryzen ThreadRipper Pro 3945WX=3m30s, GCE VM Xeon 2.2Ghz=6m. So in this particular use case, an 8th gen Intel mobile CPU is the winner. Would you want to use 8650U based on this test result? Probably not.
In Apple’s 2½ year old iPhone 12 is 6% faster than the new Samsung Galaxy S23 Ultra
nullc·Oct 11, 2021
The binary GCD has inferior performance to other approaches for big numbers because those min() comparisons require that you had to update the entire numbers at each step. I submitted a writeup on the safegcd algorithm used by libsecp256k1 a while back, but it got the HN zomg-bitcoin-related quick flagging: https://github.com/bitcoin-core/secp256k1/blob/master/doc/sa... Safegcd-like functions requires somewhat more iterations but most of the iterations need to only operate on the least significant bits of the numbers, which makes them faster in practice. For safegcd-ish functions proving a hard upper bound on the number of require iterations is non-trivial. But it's useful to prove the bound in order to make constant time versions. Here is a writeup on our techniques for proving the upper bounds: https://github.com/sipa/safegcd-bounds#b
Read the rest
ounds-on-divsteps-it...
In Binary GCD
nullc·Oct 3, 2019
Thanks for the clarification! Even a "we tested this specific function, and didn't find an issue" would usually be helpful. The situation I've faced as an implementer is that people show up asking about a paper (e.g. https://github.com/bitcoin-core/secp256k1/issues/238 ) I read the paper, it discusses a risk vector we were aware of and believe we avoided and I find myself somewhat surprised at the list of vulnerable implementations. This makes me worry that I didn't actually understand the issue-- maybe the countermeasures we had weren't really good enough-- and uncomfortable giving the really strong "not vulnerable" that the requester was looking for. This is especially the case because the results in papers like yours aren't against toy implementations, but in implementations that I know are written by extremely competent persons. The
Read the rest
end result is usually that I go and read the changes that fix the vulnerability, if possible-- sometimes they're made somewhat surreptitiously and hard to disentangle from the other changes--; and convince myself that it really was the issue I understood it to be... and rest back on my prior constant time testing results and our design countermeasures to be confident that no similar issue exists. > One could choose just random hobby ECDSA implementations and list them as likely vulnerable, these are just a few that are worthy of listing because of their popularity. Fair enough. I think actually searching to see how many other projects have copied the vulnerable code might be a better proxy than stars, since there is no particular reason to click the star button if you're using a piece of code. Often end users will pick up vulnerable code via a popular program that links or embed it, and the bulk of users never directly see the repo for the crypto library. For years searching for "python eddsa" yielded an extremely vulnerable first result (including setting K to H(private key), using double and add, non-constant time infinity handling, etc.) that by all appearances was some random hobby project but because it was the first google hit, it actually got used in a fair number of places.
In Side channel attacks against ECDSA/EdDSA signature generation in smart cards
jamoes·Jun 13, 2018
Looking at libgcrypt's patch [1], it looks like the mitigation technique they're using is to blind the private key and message hash with a random number before performing point addition, and then unblinding the result of the point addition. This unfortunately requires an extra 3 point multiplication operations, so it probably isn't a good solution where performance is critical. According to the article, the private key information is leaked through memory caches, so it looks like libgcrypt's solution just ensures that the data written to memory caches is random, rather than leaking the private key. Also according to the article, libsecp256k1 isn't vulnerable, and they still only do 2 point multiplications [2] (compared to libgcrypt's 5 point multiplications). So it is possible to mitigate this attack efficiently. [1] https://lists.gnupg.o
Read the rest
rg/pipermail/gnupg-announce/2018q2/0004... [2] https://github.com/bitcoin-core/secp256k1/blob/master/src/ec...
In ECDSA Key Extraction Side Channel in Multiple Crypto Libraries
nullc·Jul 20, 2017
We've identified ~some~ of OpenSSL's strange behaviors and documented them for the purpose of making a bug compatible implementation (https://github.com/bitcoin-core/secp256k1/tree/master/contri...), which required that: - All numbers are parsed as nonnegative integers, even though X.609-0207 section 8.3.3 specifies that integers are always encoded as two's complement. - Integers can have length 0, even though section 8.3.1 says they can't. - Integers with overly long padding are accepted, violation section 8.3.2. - 127-byte long length descriptors are accepted, even though section 8.1.3.5.c says that they are not. - Trailing garbage data inside or after the signature is ignored. - The length descriptor of the sequence is ignored. But some things were just too awful to implement, e.g. - Using overly long tag descriptors for the sequence o
Read the rest
r integers inside, violating section 8.1.2.2. - Encoding primitive integers as constructed values, violating section 8.3.1. This last is especially fun, in OpenSSL you can create a constructed value (like a struct) of constructed values of constructed values of strings.. and it will just concatenate up all the bytes in the last level primitive elements and treat the result as a number. ... but only if it's not more than 7 (IIRC) levels deep.
In Bitcoin Transaction Malleability

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.