From 52455af680bc3b5d9f1353455a17020cda43fe77 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 1 Sep 2026 19:55:31 +0200
Subject: [PATCH 1/5] pegin: randomize secp256k1 SIGN context in Secp256k1Ctx

---
 src/pegins.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pegins.cpp b/src/pegins.cpp
index b09677faec..f5471cd911 100644
--- a/src/pegins.cpp
+++ b/src/pegins.cpp
@@ -35,7 +35,7 @@ class Secp256k1Ctx
 public:
     Secp256k1Ctx() {
         assert(secp256k1_ctx_validation == nullptr);
-        secp256k1_ctx_validation = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
+        secp256k1_ctx_validation = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
         assert(secp256k1_ctx_validation != nullptr);
     }
 

From 0e7b1a69c768269fabe1c1db02697595a4e85158 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 1 Sep 2026 19:55:46 +0200
Subject: [PATCH 2/5] blind: randomize secp256k1 SIGN context in Blind_ECC_Init

Side-channel hardening: pass a fresh 32-byte GetStrongRandBytes seed to
secp256k1_context_randomize immediately after context creation, matching
the randomization of secp256k1_context_sign in key.cpp. No change to
consensus behavior or key/signature formats.
---
 src/blind.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/blind.cpp b/src/blind.cpp
index fc443d2977..67ffcb4059 100644
--- a/src/blind.cpp
+++ b/src/blind.cpp
@@ -22,6 +22,12 @@ class Blind_ECC_Init {
         secp256k1_context *ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
         assert(ctx != nullptr);
 
+        // Pass in a random blinding seed to the secp256k1 context (side-channel hardening,
+        // matching the randomization of secp256k1_context_sign in key.cpp).
+        unsigned char randseed[32];
+        GetStrongRandBytes(randseed);
+        assert(secp256k1_context_randomize(ctx, randseed) == 1);
+
         secp256k1_blind_context = ctx;
     }
 

From 7aca7070a96a2fbfdb7c90202ac1c2a4b0e6c36b Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 1 Sep 2026 20:07:02 +0200
Subject: [PATCH 3/5] wallet: randomize secp256k1 SIGN contexts in
 CSecp256k1Init

Side-channel hardening: blind each SIGN-capable secp256k1 context in the
wallet with a fresh 32-byte GetRandBytes seed via secp256k1_context_randomize,
mirroring key.cpp ECC_Start. Assert on null ctx and on a 0 randomize return.
No consensus impact.
---
 src/wallet/rpc/backup.cpp   | 6 ++++++
 src/wallet/rpc/elements.cpp | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/src/wallet/rpc/backup.cpp b/src/wallet/rpc/backup.cpp
index 67ffd6958f..548a4d0c07 100644
--- a/src/wallet/rpc/backup.cpp
+++ b/src/wallet/rpc/backup.cpp
@@ -12,6 +12,7 @@
 #include <key_io.h>
 #include <merkleblock.h>
 #include <rpc/util.h>
+#include <random.h>
 #include <script/descriptor.h>
 #include <script/script.h>
 #include <script/solver.h>
@@ -41,6 +42,11 @@ namespace {
     public:
         CSecp256k1Init() {
             secp256k1_ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
+            CHECK_NONFATAL(secp256k1_ctx != nullptr);
+            // Pass in a random blinding seed to the secp256k1 context (side-channel hardening).
+            unsigned char seed[32];
+            GetStrongRandBytes(seed);
+            CHECK_NONFATAL(secp256k1_context_randomize(secp256k1_ctx, seed));
         }
         ~CSecp256k1Init() {
             secp256k1_context_destroy(secp256k1_ctx);
diff --git a/src/wallet/rpc/elements.cpp b/src/wallet/rpc/elements.cpp
index 3ae240081a..5ad6f297a9 100644
--- a/src/wallet/rpc/elements.cpp
+++ b/src/wallet/rpc/elements.cpp
@@ -16,6 +16,7 @@
 #include <rpc/server.h>
 #include <rpc/server_util.h>
 #include <rpc/util.h>
+#include <random.h>
 #include <script/generic.hpp>
 #include <script/pegins.h>
 #include <secp256k1.h>
@@ -44,6 +45,11 @@ class CSecp256k1Init {
 public:
     CSecp256k1Init() {
         secp256k1_ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
+        CHECK_NONFATAL(secp256k1_ctx != nullptr);
+        // Pass in a random blinding seed to the secp256k1 context (side-channel hardening).
+        unsigned char seed[32];
+        GetStrongRandBytes(seed);
+        CHECK_NONFATAL(secp256k1_context_randomize(secp256k1_ctx, seed));
     }
     ~CSecp256k1Init() {
         secp256k1_context_destroy(secp256k1_ctx);

From 80e351ad3412fb39e3253c733d4f0fe88b1f05bf Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 1 Sep 2026 20:05:29 +0200
Subject: [PATCH 4/5] confidential_validation: randomize secp256k1 SIGN context
 in CSecp256k1Init

---
 src/confidential_validation.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/confidential_validation.cpp b/src/confidential_validation.cpp
index 915bbb48a7..e089bcea4b 100644
--- a/src/confidential_validation.cpp
+++ b/src/confidential_validation.cpp
@@ -4,6 +4,7 @@
 #include <issuance.h>
 #include <pegins.h>
 #include <script/sigcache.h>
+#include <random.h>
 #include <blind.h>
 
 namespace {
@@ -15,6 +16,11 @@ class CSecp256k1Init {
         assert(secp256k1_ctx_verify_amounts == nullptr);
         secp256k1_ctx_verify_amounts = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
         assert(secp256k1_ctx_verify_amounts != nullptr);
+        // Pass in a random blinding seed to the secp256k1 context (side-channel hardening).
+        unsigned char seed[32];
+        GetStrongRandBytes(seed);
+        assert(secp256k1_context_randomize(secp256k1_ctx_verify_amounts, seed));
+
     }
     ~CSecp256k1Init() {
         assert(secp256k1_ctx_verify_amounts != nullptr);

From 72a88d468017646ad822996c3d05edfe7c0a6724 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 1 Sep 2026 20:08:37 +0200
Subject: [PATCH 5/5] build: disable unused experimental secp256k1 zkp modules

Force BPPP, ECDSA_ADAPTOR, ECDSA_S2C, and SCHNORRSIG_HALFAGG OFF alongside
the existing MUSIG OFF in src/CMakeLists.txt. These experimental modules
default to ON in libsecp256k1's CMake but have zero references in the Elements
tree; building them is dead code that enlarges the binary and attack surface.
Genuinely used modules (ECDH, RECOVERY, EXTRAKEYS, SCHNORRSIG, ELLSWIFT,
GENERATOR, RANGEPROOF, SURJECTIONPROOF, WHITELIST) remain enabled.
---
 src/CMakeLists.txt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 4c4a4d59cc..c6361c358a 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -31,7 +31,12 @@ set(SECP256K1_ENABLE_MODULE_WHITELIST ON CACHE BOOL "" FORCE)
 set(SECP256K1_DISABLE_SHARED ON CACHE BOOL "" FORCE)
 set(SECP256K1_ENABLE_MODULE_ECDH ON CACHE BOOL "" FORCE)
 set(SECP256K1_ENABLE_MODULE_RECOVERY ON CACHE BOOL "" FORCE)
+# Disable unused on-by-default features from secp256k1-zkp
 set(SECP256K1_ENABLE_MODULE_MUSIG OFF CACHE BOOL "" FORCE)
+set(SECP256K1_ENABLE_MODULE_BPPP OFF CACHE BOOL "" FORCE)
+set(SECP256K1_ENABLE_MODULE_ECDSA_ADAPTOR OFF CACHE BOOL "" FORCE)
+set(SECP256K1_ENABLE_MODULE_ECDSA_S2C OFF CACHE BOOL "" FORCE)
+set(SECP256K1_ENABLE_MODULE_SCHNORRSIG_HALFAGG OFF CACHE BOOL "" FORCE)
 set(SECP256K1_BUILD_BENCHMARK OFF CACHE BOOL "" FORCE)
 set(SECP256K1_BUILD_TESTS ${BUILD_TESTS} CACHE BOOL "" FORCE)
 set(SECP256K1_BUILD_EXHAUSTIVE_TESTS ${BUILD_TESTS} CACHE BOOL "" FORCE)