bitcoin-core/secp256k1
FreeOptimized C library for EC operations on curve secp256k1
FreeFree tier
About bitcoin-core/secp256k1
High-performance, high-assurance C library for digital signatures and other cryptographic primitives on the secp256k1 elliptic curve. Developed primarily for Bitcoin, it offers ECDSA signing/verification, key generation, serialization, and optional modules for public key recovery, ECDH, Schnorr signatures (BIP-340), ElligatorSwift (BIP-324), and MuSig2 multi-signatures (BIP-327). The library is designed for security and efficiency, with constant-time operations, no runtime heap allocation, extensive testing, and portability to C89 compilers.
Key Features
ECDSA signing, verification, and key generation
Additive and multiplicative tweaking of secret/public keys
Serialization/parsing of secret keys, public keys, signatures
Constant-time signing and public key generation
Derandomized ECDSA via RFC6979
Optional public key recovery module
Optional ECDH key exchange module
Optional Schnorr signatures (BIP-340)
Optional ElligatorSwift key exchange (BIP-324)
Optional MuSig2 multi-signatures (BIP-327)
Pros & Cons
Pros
- High assurance with extensive testing and code review
- Constant-time operations prevent timing side-channel attacks
- No runtime dependencies, suitable for embedded systems
- Modular design with optional features
- Efficient implementation optimized for performance
- Portable across platforms with C89 compiler
Cons
- Primary focus on Bitcoin usage; other applications may be less tested
- Correct usage requires careful consideration of application context (as noted in README)
- Some experimental features (e.g., 10x26-bit limb implementation) not fully audited
- Limited to secp256k1 curve only
Best For
Digital signature generation and verification in Bitcoin and other cryptocurrenciesCryptographic key exchange (ECDH, ElligatorSwift)Multi-signature schemes (MuSig2)Embedded systems requiring cryptographic operationsSecurity-critical applications needing constant-time operations
FAQ
What is secp256k1?
It is a C library for elliptic curve operations specifically on the secp256k1 curve, used in Bitcoin and other cryptocurrencies.
What cryptographic primitives does it support?
It supports ECDSA, Schnorr signatures (BIP-340), ECDH, ElligatorSwift key exchange, and MuSig2 multi-signatures.
Is it suitable for embedded systems?
Yes, it has no runtime dependencies, no heap allocation, and is designed to be portable and efficient.
Does it have constant-time operations?
Yes, it provides constant-time signing and public key generation to prevent side-channel attacks.