#36409 sign: use fresh randomness as BIP340 auxiliary data
| Reviewability | Reviews | Agreement | Size | ||||
|---|---|---|---|---|---|---|---|
| #36409 sign: use fresh randomness as BIP340 auxiliary data | Ready | 1 | Strong | 6 + 11 tests | |||
|
|
|
|
| |||
Reviewability: ReadyStalePaused Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs. Size: lines added or modified outside tests, then in tests; greener = smaller. | |||||||
Goal
Passes fresh randomness from GetRandHash() as BIP340 auxiliary data when creating Schnorr signatures in MutableTransactionSignatureCreator, replacing the static all-zero value. Adds a SignOptions::aux_rand option so callers can supply a fixed auxiliary value when deterministic signatures are required. Updates the BIP341 keypath unit test to test both fixed and randomized signing, and seeds the RNG in the script_sign fuzz target.
Problem: Bitcoin Core signs Taproot inputs with all-zero auxiliary data instead of fresh randomness. This foregoes the defense-in-depth protection against side-channel and fault-injection attacks recommended by BIP340.
Evidence of importance:
- BIP340 specification explicitly recommends fresh randomness as auxiliary data for side-channel and fault-injection mitigation (cited in PR description and commit 1f274eae23).
- Linked issue #31883: 'SignatureCreator should supply auxiliary data argument for additional bip340 signature security'.
Scope: Small patch touching transaction signing helper logic and tests.
Risk of a mistake: medium (wallet). A flaw in signature creation or RNG handling could produce invalid transaction signatures or degrade Schnorr signing robustness for wallet users.
Changed since the previous assessment: Added SignOptions::aux_rand to allow callers to explicitly pass fixed auxiliary data instead of always forcing fresh randomness, enabling the BIP341 keypath test vector to continue verifying exact signature bytes alongside a test that consecutive default signatures differ.
Reviewability
Ready
Nothing known that would invalidate a review now.
Waiting on (from the thread read):
- nothing
Agreement
Strong
substantive support, no open objection (Yudis-bit, Yudis-bit)
Thread notes: Initial record. Yudis-bit suggested adding aux_rand to SignOptions to test MutableTransactionSignatureCreator against vectors; fametrano implemented it in 1f274eae23 and Yudis-bit ACKed. / Initial record. Yudis-bit endorsed the GetRandHash approach and suggested adding aux_rand to SignOptions, which fametrano implemented and Yudis-bit ACKed.
Objections, suggestions, and questions:
| Reviewer | Type | Harm, request, or question | Status | Must be | Author replied | Quote |
|---|---|---|---|---|---|---|
| Yudis-bit (none) | suggestion, interface | Add std::optional<uint256> aux_rand to SignOptions so MutableTransactionSignatureCreator can test against BIP-341 vectors directly | accepted · fix pushed · implemented in 1f274eae23 and accepted by reviewer | answered | yes | 2026-10-03: 'I'd definitely lean towards adding `std::optional<uint256> aux_rand` there.' Status from: 2026-10-03: Yudis-bit: 'Cleanly addresses the test vector coupling by keeping `SignOptions::aux_rand` optional while defaulting to `GetRandHash()`.' |
Support:
- Yudis-bit (none) (2026-10-03) [both: src/test/script_tests.cpp]: GetRandHash() is definitely the right choice here to keep signing fast and tests deterministic while providing side-channel mitigation
- Yudis-bit (none) (ACK, 2026-10-03) [both: bip341_keypath_test_vectors, script_sign]: keeps SignOptions::aux_rand optional while defaulting to GetRandHash(), reproduces BIP-341 witness with zero aux, confirms divergence under default options, and keeps script_sign fuzzing deterministic
Participants:
- Yudis-bit (none, support, 2 statements 2026-10-03 to 2026-10-03): suggested adding aux_rand to SignOptions, tested and ACKed
Files
13 lines under test/bench/ci.
- src/test/script_tests.cpp +9/-2
- src/script/sign.cpp +4/-2
- src/script/sign.h +2/-0
- src/test/fuzz/script_sign.cpp +2/-0
Card
The short text the ranking pass compares across PRs.
Bitcoin Core currently uses all-zero auxiliary data when creating Schnorr signatures for Taproot inputs, omitting BIP340-recommended defense-in-depth protections against fault-injection and side-channel attacks. This PR changes MutableTransactionSignatureCreator to supply fresh randomness via GetRandHash() by default, while introducing an aux_rand field in SignOptions to permit fixed auxiliary values when needed. It updates BIP341 keypath unit tests to verify both vector reproducibility with zero aux_rand and signature divergence under default options, and seeds the RNG in the script_sign fuzz target. Resolves issue #31883.
Data
thread read through 2026-10-03 (3 statements), head 1f274eae23
labels: none
Categories
Utilities (logging, arguments, libraries)
P2 · fund safety (ranking pass: Defense-in-depth hardening ranks just below measured perf wins and user-visible config bugs within P2.)
Hardens cryptographic signing primitives with fresh randomness per BIP340 recommendations to protect against side-channel leakage and fault injection. It addresses open issue #31883, providing durable security hardening for key operations.
Membership: Updates Schnorr signature creation to use randomness (GetRandHash()) for BIP340 auxiliary data.
Factors: security/stability 2, bug 0, performance 0, user value 0, leverage 0