{ "number": 36409, "input_hash": "eb77dcec449ca616", "model": "ledger", "prompt_hash": null, "created": "2026-10-08T01:17:31+00:00", "result": { "summary": "Passes fresh randomness from GetRandHash() as BIP340 auxiliary data when creating Schnorr signatures in MutableTransactionSignatureCreator, replacing the static all-zero value. Adds a SignOptions::aux_rand option so callers can supply a fixed auxiliary value when deterministic signatures are required. Updates the BIP341 keypath unit test to test both fixed and randomized signing, and seeds the RNG in the script_sign fuzz target.", "problem": "Bitcoin Core signs Taproot inputs with all-zero auxiliary data instead of fresh randomness. This foregoes the defense-in-depth protection against side-channel and fault-injection attacks recommended by BIP340.", "card": "Bitcoin Core currently uses all-zero auxiliary data when creating Schnorr signatures for Taproot inputs, omitting BIP340-recommended defense-in-depth protections against fault-injection and side-channel attacks. This PR changes MutableTransactionSignatureCreator to supply fresh randomness via GetRandHash() by default, while introducing an aux_rand field in SignOptions to permit fixed auxiliary values when needed. It updates BIP341 keypath unit tests to verify both vector reproducibility with zero aux_rand and signature divergence under default options, and seeds the RNG in the script_sign fuzz target. Resolves issue #31883.", "evidence": [ "BIP340 specification explicitly recommends fresh randomness as auxiliary data for side-channel and fault-injection mitigation (cited in PR description and commit 1f274eae23).", "Linked issue #31883: 'SignatureCreator should supply auxiliary data argument for additional bip340 signature security'." ], "scope_notes": "Small patch touching transaction signing helper logic and tests.", "changed_since_previous": "Added SignOptions::aux_rand to allow callers to explicitly pass fixed auxiliary data instead of always forcing fresh randomness, enabling the BIP341 keypath test vector to continue verifying exact signature bytes alongside a test that consecutive default signatures differ.", "thread": { "last_event_at": "2026-10-03T23:23:30Z", "events": 3, "head_sha": "1f274eae23f415ab29e22d25a846844629c672ad", "schema_floor": 2, "schema": 2 }, "waiting_on": [ { "at": null, "id": "", "on": "nothing", "url": null, "what": "" } ], "risk": { "level": "medium", "touches": [ "wallet" ], "why": "A flaw in signature creation or RNG handling could produce invalid transaction signatures or degrade Schnorr signing robustness for wallet users." }, "discussion": { "author_status": "last statement processed 2026-10-03", "open_concerns": [], "resolved_concerns": [ "Yudis-bit: Add std::optional aux_rand to SignOptions so MutableTransactionSignatureCreator can test against BIP-341 vectors directly (accepted by Yudis-bit 2026-10-03)" ] }, "reviewability": { "state": "Ready", "label": "Ready", "reason": "Nothing known that would invalidate a review now." }, "agreement": { "state": "Strong", "summary": "Strong: substantive support, no open objection (Yudis-bit, Yudis-bit)", "reason": "Initial record. Yudis-bit suggested adding aux_rand to SignOptions to test MutableTransactionSignatureCreator against vectors; fametrano implemented it in 1f274eae23 and Yudis-bit ACKed. / Initial record. Yudis-bit endorsed the GetRandHash approach and suggested adding aux_rand to SignOptions, which fametrano implemented and Yudis-bit ACKed.", "evidence": [ "Yudis-bit: support \u2014 GetRandHash() is definitely the right choice here to keep signing fast and tests deterministic while providing side-channel mitigation", "Yudis-bit: ACK \u2014 keeps SignOptions::aux_rand optional while defaulting to GetRandHash(), reproduces BIP-341 witness with zero aux, confirms divergence under default options, and keeps script_sign fuzzing deterministic" ], "objections": [ { "reviewer": "Yudis-bit", "association": "NONE", "type": "suggestion", "kind": "interface", "harm": "", "request": "Add std::optional aux_rand to SignOptions so MutableTransactionSignatureCreator can test against BIP-341 vectors directly", "question": "", "text": "Add std::optional aux_rand to SignOptions so MutableTransactionSignatureCreator can test against BIP-341 vectors directly", "clears_with": "answer", "blocking": false, "status": "accepted", "status_note": "implemented in 1f274eae23 and accepted by reviewer", "cleared": true, "author_replied": true, "others_replied": false, "fix_pushed": true, "replies": [ "c:5972197429" ], "evidence": "2026-10-03: 'I'd definitely lean towards adding `std::optional aux_rand` there.'", "url": "https://github.com/bitcoin/bitcoin/pull/36409#issuecomment-5971122715", "id": "c:5971122715", "at": "2026-10-03", "status_at": "2026-10-03", "status_by": "Yudis-bit", "resolution_evidence": "2026-10-03: Yudis-bit: 'Cleanly addresses the test vector coupling by keeping `SignOptions::aux_rand` optional while defaulting to `GetRandHash()`.'", "pin": null, "from_schema": 2 } ], "support": [ { "reviewer": "Yudis-bit", "reason": "GetRandHash() is definitely the right choice here to keep signing fast and tests deterministic while providing side-channel mitigation", "substantive": true, "verdict": "", "id": "c:5971122715", "url": "https://github.com/bitcoin/bitcoin/pull/36409#issuecomment-5971122715", "at": "2026-10-03", "association": "NONE", "evidence": "both", "areas": [ "src/test/script_tests.cpp" ] }, { "reviewer": "Yudis-bit", "reason": "keeps SignOptions::aux_rand optional while defaulting to GetRandHash(), reproduces BIP-341 witness with zero aux, confirms divergence under default options, and keeps script_sign fuzzing deterministic", "substantive": true, "verdict": "ACK", "id": "c:5974564439", "url": "https://github.com/bitcoin/bitcoin/pull/36409#issuecomment-5974564439", "at": "2026-10-03", "association": "NONE", "evidence": "both", "areas": [ "bip341_keypath_test_vectors", "script_sign" ] } ], "participants": [ { "login": "Yudis-bit", "stance": "support", "note": "suggested adding aux_rand to SignOptions, tested and ACKed", "association": "NONE", "comments": 2, "first": "2026-10-03", "last": "2026-10-03" } ], "derivation": "substantive support, no open objection (Yudis-bit, Yudis-bit)", "model_state": null, "corrections": [], "notes": "Initial record. Yudis-bit suggested adding aux_rand to SignOptions to test MutableTransactionSignatureCreator against vectors; fametrano implemented it in 1f274eae23 and Yudis-bit ACKed. / Initial record. Yudis-bit endorsed the GetRandHash approach and suggested adding aux_rand to SignOptions, which fametrano implemented and Yudis-bit ACKed." }, "dependencies": { "depends_on": [], "enables": [] }, "categories": [ { "name": "build", "member": false, "evidence": "Changes signing and test code; keyword matches to build concepts are incidental.", "band": "Unranked", "reason_tag": "cleanup", "score": 0.0, "factors": { "bug_severity": 0, "leverage": 0, "performance": 0, "security_stability": 2, "user_value": 0 }, "rationale": "The PR does not touch the build system, CI configuration, or packaging." }, { "name": "tests", "member": false, "evidence": "Touches src/test/script_tests.cpp and src/test/fuzz/script_sign.cpp, but only to follow functional changes to BIP340 signing logic in src/script/sign.cpp.", "band": "Unranked", "reason_tag": "test coverage", "score": 0.0, "factors": { "bug_severity": 0, "leverage": 0, "performance": 0, "security_stability": 1, "user_value": 0 }, "rationale": "The PR modifies unit and fuzz tests purely to accommodate changes made to signing logic, rather than modifying test infrastructure or framework machinery." }, { "name": "tools", "member": false, "evidence": "Matches script-related keywords incidentally; does not touch CLI tools or contrib scripts.", "band": "Unranked", "reason_tag": "cleanup", "score": 0.0, "factors": { "bug_severity": 0, "leverage": 0, "performance": 0, "security_stability": 2, "user_value": 0 }, "rationale": "The PR modifies transaction signing in MutableTransactionSignatureCreator rather than standalone tools or scripts." }, { "name": "utils", "member": true, "evidence": "Updates Schnorr signature creation to use randomness (GetRandHash()) for BIP340 auxiliary data.", "band": "P2", "reason_tag": "fund safety", "score": 0.6, "factors": { "bug_severity": 0, "leverage": 0, "performance": 0, "security_stability": 2, "user_value": 0 }, "rationale": "Hardens cryptographic signing primitives with fresh randomness per BIP340 recommendations to protect against side-channel leakage and fault injection. It addresses open issue #31883, providing durable security hardening for key operations." } ], "confidence": "high", "uncertainties": [], "needs": [] }, "cost_usd": 0.0, "source": { "record": "2026-10-08T01:17:31+00:00", "code": "2026-10-04T01:20:32+00:00", "judgments": 4 } }