Quote from: Pieter Wuille on January 29, 2015, 03:15:54 AM

Hi colinistheman,

it's very good that people have concerns about the security of code, or the process used to assure it. I hope your concerns have been addressed by now.

Your post made me realize one thing though: you probably haven't seen gmaxwell's reddit post (http://www.reddit.com/r/Bitcoin/comments/2rrxq7/on_why_010s_release_notes_say_we_have_reason_to/). This explains the reason for the at the time somewhat cryptic "we have reason to believe it is better tested". I encourage you to read the details there, but in short: we found a very tricky (but most likely harmless) bug in OpenSSL itself while writing this library - because the tests did comparisons with OpenSSL and failed once. It's by no means a proof that libsecp256k1 is bug free (more review is always welcome), but it does show that its testing practices pay off.

We should probably change the language in the release notes, now that the OpenSSL bug it was referring to has been disclosed.

Quote from: doof on January 28, 2015, 05:57:30 AM

I've been looking at the code, and theres quite a few magic numbers in there Sad

Most of the constants are taken directly from the secp256k1 standard, or computed using algorithms explained in code. But more comments to explain where they come from would not be a bad idea. We'll add some.

Thank you for the answer, Peter.

My concerns have been addressed, but I am glad it got some people thinking on this thread. I feel like as long as we are alert to such things then they won't happen.

I will read gmaxwell's reddit post that you suggested as well. Thanks for that. Yes, you are correct, I had no idea what actual testing went into being able to make the statement "we have reason to believe it is better tested".

It is a good thing that we are not using OpenSSL if it contains a bug. Just wanted to be sure that the thing we're replacing it with does not contain different or worse bugs Wink

Thanks again.

Edit: I finished reading that reddit post from nullc. It was a good read, and while it answered the question of his reasoning for why he wrote "we have reason to believe it [libsecp256k1] is better tested", it raised another question in me:

nullc said "This error in OpenSSL could result in a number of cryptographic operations (for many different kinds of cryptosystems) yielding wrong results but due to good fortune the issue is not a concern for Bitcoin implementations."

If the squaring bug referenced is not a concern for Bitcoin implementations, then why was a new library required? It sounds like the bug affects things other than bitcoin, but bitcoin is safe from it.