No secp256k1_context_randomize after secp256k1_context_create?

[bitjson]

I noticed that addon.cc doesn't randomize the secp256k1_context after creating it. Is this an intentional trade-off? (And if so, is it described somewhere?)

If I understand correctly, context randomization is only important in scenarios where the attacker has the ability to carefully measure timing/electromagnetic emissions/power usage of the machine, and so isn't really a security concern for the vast majority of consumers of this library.

I probably don't understand it well enough, so I'd love to know – can someone explain (or link me to an explanation) of why it isn't necessary here?

For reference, here's the documentation for secp256k1_context_randomize:

/** Updates the context randomization to protect against side-channel leakage.
 *  Returns: 1: randomization successfully updated
 *           0: error
 *  Args:    ctx:       pointer to a context object (cannot be NULL)
 *  In:      seed32:    pointer to a 32-byte random seed (NULL resets to initial state)
 *
 * While secp256k1 code is written to be constant-time no matter what secret
 * values are, it's possible that a future compiler may output code which isn't,
 * and also that the CPU may not emit the same radio frequencies or draw the same
 * amount power for all values.
 *
 * This function provides a seed which is combined into the blinding value: that
 * blinding value is added before each multiplication (and removed afterwards) so
 * that it does not affect function results, but shields against attacks which
 * rely on any input-dependent behaviour.
 *
 * You should call this after secp256k1_context_create or
 * secp256k1_context_clone, and may call this repeatedly afterwards.
 */

What (if any) hypothetical attacks are possible given secp256k1-node doesn't call secp256k1_context_randomize when the context is created?

[fanatid]

Probably I did not added bindings in past, because there was not docs describing what function do or even did not knew that this function exists.
Looking on commit description where docs was added, looks like I'm not alone: bitcoin-core/secp256k1@70ff29b

@bitjson how you think, should we export this functions or call it silently after context creation?

[bitjson]

Ah, good to know. I don't think it's an urgent issue, but I think it would be wise to both randomize immediately after context creation, and expose a randomize method. (I think it's unlikely to be used except in some very unique hardware use cases.)

[bitjson]

There's a bit more of a description here too: bitcoin-core/secp256k1@d227579

[dcousens]

Probably could close... I suspect the side channels attacks in the remainder of the software stack will dramatically overshadow this.

[bitjson]

Ya, I decided I couldn't prove it was unnecessary, so I just included it as an option for consumers to choose based on their use case. You can see the explanation I wrote in bitcoin-ts here.

[fanatid]

I added secp256k1_context_randomize in version 4.0.0, but this should be called explicitly.
#160