From ed59fbe8b7d60fed0fdcc62a2aa94249ab0e9d21 Mon Sep 17 00:00:00 2001
From: Jonas Nick <jonasd.nick@gmail.com>
Date: Thu, 20 Dec 2018 20:48:19 +0000
Subject: [PATCH 1/5] Add trivial ecmult_multi algorithm. It is selected when
 no scratch space is given and just multiplies and adds the points.

---
 src/ecmult.h      |  3 ++-
 src/ecmult_impl.h | 29 +++++++++++++++++++++++++++++
 src/tests.c       |  1 +
 3 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/src/ecmult.h b/src/ecmult.h
index ea1cd8a21..3d75a960f 100644
--- a/src/ecmult.h
+++ b/src/ecmult.h
@@ -37,7 +37,8 @@ typedef int (secp256k1_ecmult_multi_callback)(secp256k1_scalar *sc, secp256k1_ge
  * Chooses the right algorithm for a given number of points and scratch space
  * size. Resets and overwrites the given scratch space. If the points do not
  * fit in the scratch space the algorithm is repeatedly run with batches of
- * points.
+ * points. If no scratch space is given then a simple algorithm is used that
+ * simply multiplies the points with the corresponding scalars and adds them up.
  * Returns: 1 on success (including when inp_g_sc is NULL and n is 0)
  *          0 if there is not enough scratch space for a single point or
  *          callback returns 0
diff --git a/src/ecmult_impl.h b/src/ecmult_impl.h
index c00578bed..1f113b520 100644
--- a/src/ecmult_impl.h
+++ b/src/ecmult_impl.h
@@ -1083,6 +1083,32 @@ static size_t secp256k1_pippenger_max_points(secp256k1_scratch *scratch) {
     return res;
 }
 
+/* Computes ecmult_multi by simply multiplying and adding each point. Does not
+ * require a scratch space */
+static int secp256k1_ecmult_multi_var_simple(const secp256k1_ecmult_context *ctx, secp256k1_gej *r, const secp256k1_scalar *inp_g_sc, secp256k1_ecmult_multi_callback cb, void *cbdata, size_t n_points) {
+    size_t point_idx;
+    secp256k1_scalar szero;
+    secp256k1_gej tmpj;
+
+    secp256k1_scalar_set_int(&szero, 0);
+    /* r = inp_g_sc*G */
+    secp256k1_gej_set_infinity(r);
+    secp256k1_ecmult(ctx, r, &tmpj, &szero, inp_g_sc);
+    for (point_idx = 0; point_idx < n_points; point_idx++) {
+        secp256k1_ge point;
+        secp256k1_gej pointj;
+        secp256k1_scalar scalar;
+        if (!cb(&scalar, &point, point_idx, cbdata)) {
+            return 0;
+        }
+        /* r += scalar*point */
+        secp256k1_gej_set_ge(&pointj, &point);
+        secp256k1_ecmult(ctx, &tmpj, &pointj, &scalar, NULL);
+        secp256k1_gej_add_var(r, r, &tmpj, NULL);
+    }
+    return 1;
+}
+
 typedef int (*secp256k1_ecmult_multi_func)(const secp256k1_ecmult_context*, secp256k1_scratch*, secp256k1_gej*, const secp256k1_scalar*, secp256k1_ecmult_multi_callback cb, void*, size_t);
 static int secp256k1_ecmult_multi_var(const secp256k1_ecmult_context *ctx, secp256k1_scratch *scratch, secp256k1_gej *r, const secp256k1_scalar *inp_g_sc, secp256k1_ecmult_multi_callback cb, void *cbdata, size_t n) {
     size_t i;
@@ -1101,6 +1127,9 @@ static int secp256k1_ecmult_multi_var(const secp256k1_ecmult_context *ctx, secp2
         secp256k1_ecmult(ctx, r, r, &szero, inp_g_sc);
         return 1;
     }
+    if (scratch == NULL) {
+        return secp256k1_ecmult_multi_var_simple(ctx, r, inp_g_sc, cb, cbdata, n);
+    }
 
     max_points = secp256k1_pippenger_max_points(scratch);
     if (max_points == 0) {
diff --git a/src/tests.c b/src/tests.c
index 5c8dc8b17..492c7ca3d 100644
--- a/src/tests.c
+++ b/src/tests.c
@@ -2968,6 +2968,7 @@ void run_ecmult_multi_tests(void) {
     test_ecmult_multi_pippenger_max_points();
     scratch = secp256k1_scratch_create(&ctx->error_callback, 819200);
     test_ecmult_multi(scratch, secp256k1_ecmult_multi_var);
+    test_ecmult_multi(NULL, secp256k1_ecmult_multi_var);
     test_ecmult_multi(scratch, secp256k1_ecmult_pippenger_batch_single);
     test_ecmult_multi(scratch, secp256k1_ecmult_strauss_batch_single);
     secp256k1_scratch_destroy(scratch);

From 826080049148998af26ed0d227f9ee4c845ccc87 Mon Sep 17 00:00:00 2001
From: Andrew Poelstra <apoelstra@wpsoftware.net>
Date: Tue, 3 Apr 2018 22:06:07 +0000
Subject: [PATCH 2/5] add chacha20 function

---
 src/scalar.h           |   3 ++
 src/scalar_4x64_impl.h |  91 ++++++++++++++++++++++++++++++++++
 src/scalar_8x32_impl.h | 100 +++++++++++++++++++++++++++++++++++++
 src/scalar_low_impl.h  |   5 ++
 src/tests.c            | 110 +++++++++++++++++++++++++++++++++++++++++
 5 files changed, 309 insertions(+)

diff --git a/src/scalar.h b/src/scalar.h
index 1fc3a73ff..57389da3a 100644
--- a/src/scalar.h
+++ b/src/scalar.h
@@ -106,4 +106,7 @@ static void secp256k1_scalar_split_lambda(secp256k1_scalar *r1, secp256k1_scalar
 /** Multiply a and b (without taking the modulus!), divide by 2**shift, and round to the nearest integer. Shift must be at least 256. */
 static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift);
 
+/** Generate two scalars from a 32-byte seed and an integer using the chacha20 stream cipher */
+static void secp256k1_scalar_chacha20(secp256k1_scalar *r1, secp256k1_scalar *r2, const unsigned char *seed, uint64_t idx);
+
 #endif /* SECP256K1_SCALAR_H */
diff --git a/src/scalar_4x64_impl.h b/src/scalar_4x64_impl.h
index 97401968b..38390c495 100644
--- a/src/scalar_4x64_impl.h
+++ b/src/scalar_4x64_impl.h
@@ -8,6 +8,7 @@
 #define SECP256K1_SCALAR_REPR_IMPL_H
 
 #include "scalar.h"
+#include <string.h>
 
 /* Limbs of the secp256k1 order. */
 #define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
@@ -955,4 +956,94 @@ SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r,
     secp256k1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 6] >> ((shift - 1) & 0x3f)) & 1);
 }
 
+#define ROTL32(x,n) ((x) << (n) | (x) >> (32-(n)))
+#define QUARTERROUND(a,b,c,d) \
+  a += b; d = ROTL32(d ^ a, 16); \
+  c += d; b = ROTL32(b ^ c, 12); \
+  a += b; d = ROTL32(d ^ a, 8); \
+  c += d; b = ROTL32(b ^ c, 7);
+
+#ifdef WORDS_BIGENDIAN
+#define LE32(p) ((((p) & 0xFF) << 24) | (((p) & 0xFF00) << 8) | (((p) & 0xFF0000) >> 8) | (((p) & 0xFF000000) >> 24))
+#define BE32(p) (p)
+#else
+#define BE32(p) ((((p) & 0xFF) << 24) | (((p) & 0xFF00) << 8) | (((p) & 0xFF0000) >> 8) | (((p) & 0xFF000000) >> 24))
+#define LE32(p) (p)
+#endif
+
+static void secp256k1_scalar_chacha20(secp256k1_scalar *r1, secp256k1_scalar *r2, const unsigned char *seed, uint64_t idx) {
+    size_t n;
+    size_t over_count = 0;
+    uint32_t seed32[8];
+    uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+    int over1, over2;
+
+    memcpy((void *) seed32, (const void *) seed, 32);
+    do {
+        x0 = 0x61707865;
+        x1 = 0x3320646e;
+        x2 = 0x79622d32;
+        x3 = 0x6b206574;
+        x4 = LE32(seed32[0]);
+        x5 = LE32(seed32[1]);
+        x6 = LE32(seed32[2]);
+        x7 = LE32(seed32[3]);
+        x8 = LE32(seed32[4]);
+        x9 = LE32(seed32[5]);
+        x10 = LE32(seed32[6]);
+        x11 = LE32(seed32[7]);
+        x12 = idx;
+        x13 = idx >> 32;
+        x14 = 0;
+        x15 = over_count;
+
+        n = 10;
+        while (n--) {
+            QUARTERROUND(x0, x4, x8,x12)
+            QUARTERROUND(x1, x5, x9,x13)
+            QUARTERROUND(x2, x6,x10,x14)
+            QUARTERROUND(x3, x7,x11,x15)
+            QUARTERROUND(x0, x5,x10,x15)
+            QUARTERROUND(x1, x6,x11,x12)
+            QUARTERROUND(x2, x7, x8,x13)
+            QUARTERROUND(x3, x4, x9,x14)
+        }
+
+        x0 += 0x61707865;
+        x1 += 0x3320646e;
+        x2 += 0x79622d32;
+        x3 += 0x6b206574;
+        x4 += LE32(seed32[0]);
+        x5 += LE32(seed32[1]);
+        x6 += LE32(seed32[2]);
+        x7 += LE32(seed32[3]);
+        x8 += LE32(seed32[4]);
+        x9 += LE32(seed32[5]);
+        x10 += LE32(seed32[6]);
+        x11 += LE32(seed32[7]);
+        x12 += idx;
+        x13 += idx >> 32;
+        x14 += 0;
+        x15 += over_count;
+
+        r1->d[3] = LE32((uint64_t) x0) << 32 | LE32(x1);
+        r1->d[2] = LE32((uint64_t) x2) << 32 | LE32(x3);
+        r1->d[1] = LE32((uint64_t) x4) << 32 | LE32(x5);
+        r1->d[0] = LE32((uint64_t) x6) << 32 | LE32(x7);
+        r2->d[3] = LE32((uint64_t) x8) << 32 | LE32(x9);
+        r2->d[2] = LE32((uint64_t) x10) << 32 | LE32(x11);
+        r2->d[1] = LE32((uint64_t) x12) << 32 | LE32(x13);
+        r2->d[0] = LE32((uint64_t) x14) << 32 | LE32(x15);
+
+        over1 = secp256k1_scalar_check_overflow(r1);
+        over2 = secp256k1_scalar_check_overflow(r2);
+        over_count++;
+   } while (over1 | over2);
+}
+
+#undef ROTL32
+#undef QUARTERROUND
+#undef BE32
+#undef LE32
+
 #endif /* SECP256K1_SCALAR_REPR_IMPL_H */
diff --git a/src/scalar_8x32_impl.h b/src/scalar_8x32_impl.h
index ad4d050df..11fac6c23 100644
--- a/src/scalar_8x32_impl.h
+++ b/src/scalar_8x32_impl.h
@@ -7,6 +7,8 @@
 #ifndef SECP256K1_SCALAR_REPR_IMPL_H
 #define SECP256K1_SCALAR_REPR_IMPL_H
 
+#include <string.h>
+
 /* Limbs of the secp256k1 order. */
 #define SECP256K1_N_0 ((uint32_t)0xD0364141UL)
 #define SECP256K1_N_1 ((uint32_t)0xBFD25E8CUL)
@@ -729,4 +731,102 @@ SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r,
     secp256k1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 5] >> ((shift - 1) & 0x1f)) & 1);
 }
 
+#define ROTL32(x,n) ((x) << (n) | (x) >> (32-(n)))
+#define QUARTERROUND(a,b,c,d) \
+  a += b; d = ROTL32(d ^ a, 16); \
+  c += d; b = ROTL32(b ^ c, 12); \
+  a += b; d = ROTL32(d ^ a, 8); \
+  c += d; b = ROTL32(b ^ c, 7);
+
+#ifdef WORDS_BIGENDIAN
+#define LE32(p) ((((p) & 0xFF) << 24) | (((p) & 0xFF00) << 8) | (((p) & 0xFF0000) >> 8) | (((p) & 0xFF000000) >> 24))
+#define BE32(p) (p)
+#else
+#define BE32(p) ((((p) & 0xFF) << 24) | (((p) & 0xFF00) << 8) | (((p) & 0xFF0000) >> 8) | (((p) & 0xFF000000) >> 24))
+#define LE32(p) (p)
+#endif
+
+static void secp256k1_scalar_chacha20(secp256k1_scalar *r1, secp256k1_scalar *r2, const unsigned char *seed, uint64_t idx) {
+    size_t n;
+    size_t over_count = 0;
+    uint32_t seed32[8];
+    uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+    int over1, over2;
+
+    memcpy((void *) seed32, (const void *) seed, 32);
+    do {
+        x0 = 0x61707865;
+        x1 = 0x3320646e;
+        x2 = 0x79622d32;
+        x3 = 0x6b206574;
+        x4 = LE32(seed32[0]);
+        x5 = LE32(seed32[1]);
+        x6 = LE32(seed32[2]);
+        x7 = LE32(seed32[3]);
+        x8 = LE32(seed32[4]);
+        x9 = LE32(seed32[5]);
+        x10 = LE32(seed32[6]);
+        x11 = LE32(seed32[7]);
+        x12 = idx;
+        x13 = idx >> 32;
+        x14 = 0;
+        x15 = over_count;
+
+        n = 10;
+        while (n--) {
+            QUARTERROUND(x0, x4, x8,x12)
+            QUARTERROUND(x1, x5, x9,x13)
+            QUARTERROUND(x2, x6,x10,x14)
+            QUARTERROUND(x3, x7,x11,x15)
+            QUARTERROUND(x0, x5,x10,x15)
+            QUARTERROUND(x1, x6,x11,x12)
+            QUARTERROUND(x2, x7, x8,x13)
+            QUARTERROUND(x3, x4, x9,x14)
+        }
+
+        x0 += 0x61707865;
+        x1 += 0x3320646e;
+        x2 += 0x79622d32;
+        x3 += 0x6b206574;
+        x4 += LE32(seed32[0]);
+        x5 += LE32(seed32[1]);
+        x6 += LE32(seed32[2]);
+        x7 += LE32(seed32[3]);
+        x8 += LE32(seed32[4]);
+        x9 += LE32(seed32[5]);
+        x10 += LE32(seed32[6]);
+        x11 += LE32(seed32[7]);
+        x12 += idx;
+        x13 += idx >> 32;
+        x14 += 0;
+        x15 += over_count;
+
+        r1->d[7] = LE32(x0);
+        r1->d[6] = LE32(x1);
+        r1->d[5] = LE32(x2);
+        r1->d[4] = LE32(x3);
+        r1->d[3] = LE32(x4);
+        r1->d[2] = LE32(x5);
+        r1->d[1] = LE32(x6);
+        r1->d[0] = LE32(x7);
+        r2->d[7] = LE32(x8);
+        r2->d[6] = LE32(x9);
+        r2->d[5] = LE32(x10);
+        r2->d[4] = LE32(x11);
+        r2->d[3] = LE32(x12);
+        r2->d[2] = LE32(x13);
+        r2->d[1] = LE32(x14);
+        r2->d[0] = LE32(x15);
+
+        over1 = secp256k1_scalar_check_overflow(r1);
+        over2 = secp256k1_scalar_check_overflow(r2);
+        over_count++;
+   } while (over1 | over2);
+}
+
+#undef ROTL32
+#undef QUARTERROUND
+#undef BE32
+#undef LE32
+
 #endif /* SECP256K1_SCALAR_REPR_IMPL_H */
diff --git a/src/scalar_low_impl.h b/src/scalar_low_impl.h
index 37af136e4..d6fdeadcc 100644
--- a/src/scalar_low_impl.h
+++ b/src/scalar_low_impl.h
@@ -112,4 +112,9 @@ SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar *a, const
     return *a == *b;
 }
 
+SECP256K1_INLINE static void secp256k1_scalar_chacha20(secp256k1_scalar *r1, secp256k1_scalar *r2, const unsigned char *seed, uint64_t n) {
+    *r1 = (seed[0] + n) % EXHAUSTIVE_TEST_ORDER;
+    *r2 = (seed[1] + n) % EXHAUSTIVE_TEST_ORDER;
+}
+
 #endif /* SECP256K1_SCALAR_REPR_IMPL_H */
diff --git a/src/tests.c b/src/tests.c
index 492c7ca3d..55dd7dcdf 100644
--- a/src/tests.c
+++ b/src/tests.c
@@ -1007,12 +1007,122 @@ void scalar_test(void) {
 
 }
 
+void scalar_chacha_tests(void) {
+    /* Test vectors 1 to 4 from https://tools.ietf.org/html/rfc8439#appendix-A
+     * Note that scalar_set_b32 and scalar_get_b32 represent integers
+     * underlying the scalar in big-endian format. */
+    unsigned char expected1[64] = {
+        0xad, 0xe0, 0xb8, 0x76, 0x90, 0x3d, 0xf1, 0xa0,
+        0xe5, 0x6a, 0x5d, 0x40, 0x28, 0xbd, 0x86, 0x53,
+        0xb8, 0x19, 0xd2, 0xbd, 0x1a, 0xed, 0x8d, 0xa0,
+        0xcc, 0xef, 0x36, 0xa8, 0xc7, 0x0d, 0x77, 0x8b,
+        0x7c, 0x59, 0x41, 0xda, 0x8d, 0x48, 0x57, 0x51,
+        0x3f, 0xe0, 0x24, 0x77, 0x37, 0x4a, 0xd8, 0xb8,
+        0xf4, 0xb8, 0x43, 0x6a, 0x1c, 0xa1, 0x18, 0x15,
+        0x69, 0xb6, 0x87, 0xc3, 0x86, 0x65, 0xee, 0xb2
+    };
+    unsigned char expected2[64] = {
+        0xbe, 0xe7, 0x07, 0x9f, 0x7a, 0x38, 0x51, 0x55,
+        0x7c, 0x97, 0xba, 0x98, 0x0d, 0x08, 0x2d, 0x73,
+        0xa0, 0x29, 0x0f, 0xcb, 0x69, 0x65, 0xe3, 0x48,
+        0x3e, 0x53, 0xc6, 0x12, 0xed, 0x7a, 0xee, 0x32,
+        0x76, 0x21, 0xb7, 0x29, 0x43, 0x4e, 0xe6, 0x9c,
+        0xb0, 0x33, 0x71, 0xd5, 0xd5, 0x39, 0xd8, 0x74,
+        0x28, 0x1f, 0xed, 0x31, 0x45, 0xfb, 0x0a, 0x51,
+        0x1f, 0x0a, 0xe1, 0xac, 0x6f, 0x4d, 0x79, 0x4b
+    };
+    unsigned char seed3[32] = {
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
+    };
+    unsigned char expected3[64] = {
+        0x24, 0x52, 0xeb, 0x3a, 0x92, 0x49, 0xf8, 0xec,
+        0x8d, 0x82, 0x9d, 0x9b, 0xdd, 0xd4, 0xce, 0xb1,
+        0xe8, 0x25, 0x20, 0x83, 0x60, 0x81, 0x8b, 0x01,
+        0xf3, 0x84, 0x22, 0xb8, 0x5a, 0xaa, 0x49, 0xc9,
+        0xbb, 0x00, 0xca, 0x8e, 0xda, 0x3b, 0xa7, 0xb4,
+        0xc4, 0xb5, 0x92, 0xd1, 0xfd, 0xf2, 0x73, 0x2f,
+        0x44, 0x36, 0x27, 0x4e, 0x25, 0x61, 0xb3, 0xc8,
+        0xeb, 0xdd, 0x4a, 0xa6, 0xa0, 0x13, 0x6c, 0x00
+    };
+    unsigned char seed4[32] = {
+        0x00, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+    };
+    unsigned char expected4[64] = {
+        0xfb, 0x4d, 0xd5, 0x72, 0x4b, 0xc4, 0x2e, 0xf1,
+        0xdf, 0x92, 0x26, 0x36, 0x32, 0x7f, 0x13, 0x94,
+        0xa7, 0x8d, 0xea, 0x8f, 0x5e, 0x26, 0x90, 0x39,
+        0xa1, 0xbe, 0xbb, 0xc1, 0xca, 0xf0, 0x9a, 0xae,
+        0xa2, 0x5a, 0xb2, 0x13, 0x48, 0xa6, 0xb4, 0x6c,
+        0x1b, 0x9d, 0x9b, 0xcb, 0x09, 0x2c, 0x5b, 0xe6,
+        0x54, 0x6c, 0xa6, 0x24, 0x1b, 0xec, 0x45, 0xd5,
+        0x87, 0xf4, 0x74, 0x73, 0x96, 0xf0, 0x99, 0x2e
+    };
+    unsigned char seed5[32] = {
+        0x32, 0x56, 0x56, 0xf4, 0x29, 0x02, 0xc2, 0xf8,
+        0xa3, 0x4b, 0x96, 0xf5, 0xa7, 0xf7, 0xe3, 0x6c,
+        0x92, 0xad, 0xa5, 0x18, 0x1c, 0xe3, 0x41, 0xae,
+        0xc3, 0xf3, 0x18, 0xd0, 0xfa, 0x5b, 0x72, 0x53
+    };
+    unsigned char expected5[64] = {
+        0xe7, 0x56, 0xd3, 0x28, 0xe9, 0xc6, 0x19, 0x5c,
+        0x6f, 0x17, 0x8e, 0x21, 0x8c, 0x1e, 0x72, 0x11,
+        0xe7, 0xbd, 0x17, 0x0d, 0xac, 0x14, 0xad, 0xe9,
+        0x3d, 0x9f, 0xb6, 0x92, 0xd6, 0x09, 0x20, 0xfb,
+        0x43, 0x8e, 0x3b, 0x6d, 0xe3, 0x33, 0xdc, 0xc7,
+        0x6c, 0x07, 0x6f, 0xbb, 0x1f, 0xb4, 0xc8, 0xb5,
+        0xe3, 0x6c, 0xe5, 0x12, 0xd9, 0xd7, 0x64, 0x0c,
+        0xf5, 0xa7, 0x0d, 0xab, 0x79, 0x03, 0xf1, 0x81
+    };
+
+    secp256k1_scalar exp_r1, exp_r2;
+    secp256k1_scalar r1, r2;
+    unsigned char seed0[32] = { 0 };
+
+    secp256k1_scalar_chacha20(&r1, &r2, seed0, 0);
+    secp256k1_scalar_set_b32(&exp_r1, &expected1[0], NULL);
+    secp256k1_scalar_set_b32(&exp_r2, &expected1[32], NULL);
+    CHECK(secp256k1_scalar_eq(&exp_r1, &r1));
+    CHECK(secp256k1_scalar_eq(&exp_r2, &r2));
+
+    secp256k1_scalar_chacha20(&r1, &r2, seed0, 1);
+    secp256k1_scalar_set_b32(&exp_r1, &expected2[0], NULL);
+    secp256k1_scalar_set_b32(&exp_r2, &expected2[32], NULL);
+    CHECK(secp256k1_scalar_eq(&exp_r1, &r1));
+    CHECK(secp256k1_scalar_eq(&exp_r2, &r2));
+
+    secp256k1_scalar_chacha20(&r1, &r2, seed3, 1);
+    secp256k1_scalar_set_b32(&exp_r1, &expected3[0], NULL);
+    secp256k1_scalar_set_b32(&exp_r2, &expected3[32], NULL);
+    CHECK(secp256k1_scalar_eq(&exp_r1, &r1));
+    CHECK(secp256k1_scalar_eq(&exp_r2, &r2));
+
+    secp256k1_scalar_chacha20(&r1, &r2, seed4, 2);
+    secp256k1_scalar_set_b32(&exp_r1, &expected4[0], NULL);
+    secp256k1_scalar_set_b32(&exp_r2, &expected4[32], NULL);
+    CHECK(secp256k1_scalar_eq(&exp_r1, &r1));
+    CHECK(secp256k1_scalar_eq(&exp_r2, &r2));
+
+    secp256k1_scalar_chacha20(&r1, &r2, seed5, 0x6ff8602a7a78e2f2ULL);
+    secp256k1_scalar_set_b32(&exp_r1, &expected5[0], NULL);
+    secp256k1_scalar_set_b32(&exp_r2, &expected5[32], NULL);
+    CHECK(secp256k1_scalar_eq(&exp_r1, &r1));
+    CHECK(secp256k1_scalar_eq(&exp_r2, &r2));
+}
+
 void run_scalar_tests(void) {
     int i;
     for (i = 0; i < 128 * count; i++) {
         scalar_test();
     }
 
+    scalar_chacha_tests();
+
     {
         /* (-1)+1 should be zero. */
         secp256k1_scalar s, o;

From f0e4bb9283156b657097f32be33ef9416b6e4350 Mon Sep 17 00:00:00 2001
From: Andrew Poelstra <apoelstra@wpsoftware.net>
Date: Wed, 9 May 2018 15:37:35 +0000
Subject: [PATCH 3/5] Add schnorrsig module which implements BIP-schnorr [0]
 compatible signing, verification and batch verification.

[0] https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki
---
 .gitignore                                 |   2 +-
 Makefile.am                                |   4 +
 configure.ac                               |  14 +
 include/secp256k1_schnorrsig.h             | 118 ++++
 src/bench_schnorrsig.c                     | 128 ++++
 src/modules/schnorrsig/Makefile.am.include |   8 +
 src/modules/schnorrsig/main_impl.h         | 338 ++++++++++
 src/modules/schnorrsig/tests_impl.h        | 726 +++++++++++++++++++++
 src/secp256k1.c                            |  25 +
 src/tests.c                                |   9 +
 10 files changed, 1371 insertions(+), 1 deletion(-)
 create mode 100644 include/secp256k1_schnorrsig.h
 create mode 100644 src/bench_schnorrsig.c
 create mode 100644 src/modules/schnorrsig/Makefile.am.include
 create mode 100644 src/modules/schnorrsig/main_impl.h
 create mode 100644 src/modules/schnorrsig/tests_impl.h

diff --git a/.gitignore b/.gitignore
index 55d325aee..905be9873 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,9 @@
 bench_inv
 bench_ecdh
 bench_ecmult
+bench_schnorrsig
 bench_sign
 bench_verify
-bench_schnorr_verify
 bench_recover
 bench_internal
 tests
diff --git a/Makefile.am b/Makefile.am
index ec3c64ccf..caf30e25e 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -178,6 +178,10 @@ if ENABLE_MODULE_ECDH
 include src/modules/ecdh/Makefile.am.include
 endif
 
+if ENABLE_MODULE_SCHNORRSIG
+include src/modules/schnorrsig/Makefile.am.include
+endif
+
 if ENABLE_MODULE_RECOVERY
 include src/modules/recovery/Makefile.am.include
 endif
diff --git a/configure.ac b/configure.ac
index c4442eb25..44da65707 100644
--- a/configure.ac
+++ b/configure.ac
@@ -129,6 +129,11 @@ AC_ARG_ENABLE(module_ecdh,
     [enable_module_ecdh=$enableval],
     [enable_module_ecdh=no])
 
+AC_ARG_ENABLE(module_schnorrsig,
+    AS_HELP_STRING([--enable-module-schnorrsig],[enable schnorrsig module (experimental)]),
+    [enable_module_schnorrsig=$enableval],
+    [enable_module_schnorrsig=no])
+
 AC_ARG_ENABLE(module_recovery,
     AS_HELP_STRING([--enable-module-recovery],[enable ECDSA pubkey recovery module (default is no)]),
     [enable_module_recovery=$enableval],
@@ -463,6 +468,10 @@ if test x"$enable_module_ecdh" = x"yes"; then
   AC_DEFINE(ENABLE_MODULE_ECDH, 1, [Define this symbol to enable the ECDH module])
 fi
 
+if test x"$enable_module_schnorrsig" = x"yes"; then
+  AC_DEFINE(ENABLE_MODULE_SCHNORRSIG, 1, [Define this symbol to enable the schnorrsig module])
+fi
+
 if test x"$enable_module_recovery" = x"yes"; then
   AC_DEFINE(ENABLE_MODULE_RECOVERY, 1, [Define this symbol to enable the ECDSA pubkey recovery module])
 fi
@@ -510,6 +519,7 @@ if test x"$enable_experimental" = x"yes"; then
   AC_MSG_NOTICE([Building range proof module: $enable_module_rangeproof])
   AC_MSG_NOTICE([Building key whitelisting module: $enable_module_whitelist])
   AC_MSG_NOTICE([Building surjection proof module: $enable_module_surjectionproof])
+  AC_MSG_NOTICE([Building schnorrsig module: $enable_module_schnorrsig])
   AC_MSG_NOTICE([******])
 
   if test x"$enable_module_generator" != x"yes"; then
@@ -530,6 +540,9 @@ else
   if test x"$enable_module_ecdh" = x"yes"; then
     AC_MSG_ERROR([ECDH module is experimental. Use --enable-experimental to allow.])
   fi
+  if test x"$enable_module_schnorrsig" = x"yes"; then
+    AC_MSG_ERROR([schnorrsig module is experimental. Use --enable-experimental to allow.])
+  fi
   if test x"$set_asm" = x"arm"; then
     AC_MSG_ERROR([ARM assembly optimization is experimental. Use --enable-experimental to allow.])
   fi
@@ -560,6 +573,7 @@ AM_CONDITIONAL([USE_EXHAUSTIVE_TESTS], [test x"$use_exhaustive_tests" != x"no"])
 AM_CONDITIONAL([USE_BENCHMARK], [test x"$use_benchmark" = x"yes"])
 AM_CONDITIONAL([USE_ECMULT_STATIC_PRECOMPUTATION], [test x"$set_precomp" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_ECDH], [test x"$enable_module_ecdh" = x"yes"])
+AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG], [test x"$enable_module_schnorrsig" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_RECOVERY], [test x"$enable_module_recovery" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_GENERATOR], [test x"$enable_module_generator" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_RANGEPROOF], [test x"$enable_module_rangeproof" = x"yes"])
diff --git a/include/secp256k1_schnorrsig.h b/include/secp256k1_schnorrsig.h
new file mode 100644
index 000000000..e507c63f4
--- /dev/null
+++ b/include/secp256k1_schnorrsig.h
@@ -0,0 +1,118 @@
+#ifndef SECP256K1_SCHNORRSIG_H
+#define SECP256K1_SCHNORRSIG_H
+
+/** This module implements a variant of Schnorr signatures compliant with
+ * BIP-schnorr
+ * (https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki).
+ */
+
+/** Opaque data structure that holds a parsed Schnorr signature.
+ *
+ *  The exact representation of data inside is implementation defined and not
+ *  guaranteed to be portable between different platforms or versions. It is
+ *  however guaranteed to be 64 bytes in size, and can be safely copied/moved.
+ *  If you need to convert to a format suitable for storage, transmission, or
+ *  comparison, use the `secp256k1_schnorrsig_serialize` and
+ *  `secp256k1_schnorrsig_parse` functions.
+ */
+typedef struct {
+    unsigned char data[64];
+} secp256k1_schnorrsig;
+
+/** Serialize a Schnorr signature.
+ *
+ *  Returns: 1
+ *  Args:    ctx: a secp256k1 context object
+ *  Out:   out64: pointer to a 64-byte array to store the serialized signature
+ *  In:      sig: pointer to the signature
+ *
+ *  See secp256k1_schnorrsig_parse for details about the encoding.
+ */
+SECP256K1_API int secp256k1_schnorrsig_serialize(
+    const secp256k1_context* ctx,
+    unsigned char *out64,
+    const secp256k1_schnorrsig* sig
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Parse a Schnorr signature.
+ *
+ *  Returns: 1 when the signature could be parsed, 0 otherwise.
+ *  Args:    ctx: a secp256k1 context object
+ *  Out:     sig: pointer to a signature object
+ *  In:     in64: pointer to the 64-byte signature to be parsed
+ *
+ * The signature is serialized in the form R||s, where R is a 32-byte public
+ * key (x-coordinate only; the y-coordinate is considered to be the unique
+ * y-coordinate satisfying the curve equation that is a quadratic residue)
+ * and s is a 32-byte big-endian scalar.
+ *
+ * After the call, sig will always be initialized. If parsing failed or the
+ * encoded numbers are out of range, signature validation with it is
+ * guaranteed to fail for every message and public key.
+ */
+SECP256K1_API int secp256k1_schnorrsig_parse(
+    const secp256k1_context* ctx,
+    secp256k1_schnorrsig* sig,
+    const unsigned char *in64
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Create a Schnorr signature.
+ *
+ * Returns 1 on success, 0 on failure.
+ *  Args:    ctx: pointer to a context object, initialized for signing (cannot be NULL)
+ *  Out:     sig: pointer to the returned signature (cannot be NULL)
+ *       nonce_is_negated: a pointer to an integer indicates if signing algorithm negated the
+ *                nonce (can be NULL)
+ *  In:    msg32: the 32-byte message hash being signed (cannot be NULL)
+ *        seckey: pointer to a 32-byte secret key (cannot be NULL)
+ *       noncefp: pointer to a nonce generation function. If NULL, secp256k1_nonce_function_bipschnorr is used
+ *         ndata: pointer to arbitrary data used by the nonce generation function (can be NULL)
+ */
+SECP256K1_API int secp256k1_schnorrsig_sign(
+    const secp256k1_context* ctx,
+    secp256k1_schnorrsig *sig,
+    int *nonce_is_negated,
+    const unsigned char *msg32,
+    const unsigned char *seckey,
+    secp256k1_nonce_function noncefp,
+    void *ndata
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+/** Verify a Schnorr signature.
+ *
+ *  Returns: 1: correct signature
+ *           0: incorrect or unparseable signature
+ *  Args:    ctx: a secp256k1 context object, initialized for verification.
+ *  In:      sig: the signature being verified (cannot be NULL)
+ *         msg32: the 32-byte message hash being verified (cannot be NULL)
+ *        pubkey: pointer to a public key to verify with (cannot be NULL)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_verify(
+    const secp256k1_context* ctx,
+    const secp256k1_schnorrsig *sig,
+    const unsigned char *msg32,
+    const secp256k1_pubkey *pubkey
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Verifies a set of Schnorr signatures.
+ *
+ * Returns 1 if all succeeded, 0 otherwise. In particular, returns 1 if n_sigs is 0.
+ *
+ *  Args:    ctx: a secp256k1 context object, initialized for verification.
+ *       scratch: scratch space used for the multiexponentiation
+ *  In:      sig: array of signatures, or NULL if there are no signatures
+ *         msg32: array of messages, or NULL if there are no signatures
+ *            pk: array of public keys, or NULL if there are no signatures
+ *        n_sigs: number of signatures in above arrays. Must be smaller than
+ *                2^31 and smaller than half the maximum size_t value. Must be 0
+ *                if above arrays are NULL.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_verify_batch(
+    const secp256k1_context* ctx,
+    secp256k1_scratch_space *scratch,
+    const secp256k1_schnorrsig *const *sig,
+    const unsigned char *const *msg32,
+    const secp256k1_pubkey *const *pk,
+    size_t n_sigs
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2);
+#endif
diff --git a/src/bench_schnorrsig.c b/src/bench_schnorrsig.c
new file mode 100644
index 000000000..d24510921
--- /dev/null
+++ b/src/bench_schnorrsig.c
@@ -0,0 +1,128 @@
+/**********************************************************************
+ * Copyright (c) 2018 Andrew Poelstra                                 *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#include <string.h>
+#include <stdlib.h>
+
+#include "include/secp256k1.h"
+#include "include/secp256k1_schnorrsig.h"
+#include "util.h"
+#include "bench.h"
+
+#define MAX_SIGS	(32768)
+
+typedef struct {
+    secp256k1_context *ctx;
+    secp256k1_scratch_space *scratch;
+    size_t n;
+    const unsigned char **pk;
+    const secp256k1_schnorrsig **sigs;
+    const unsigned char **msgs;
+} bench_schnorrsig_data;
+
+void bench_schnorrsig_sign(void* arg) {
+    bench_schnorrsig_data *data = (bench_schnorrsig_data *)arg;
+    size_t i;
+    unsigned char sk[32] = "benchmarkexample secrettemplate";
+    unsigned char msg[32] = "benchmarkexamplemessagetemplate";
+    secp256k1_schnorrsig sig;
+
+    for (i = 0; i < 1000; i++) {
+        msg[0] = i;
+        msg[1] = i >> 8;
+        sk[0] = i;
+        sk[1] = i >> 8;
+        CHECK(secp256k1_schnorrsig_sign(data->ctx, &sig, NULL, msg, sk, NULL, NULL));
+    }
+}
+
+void bench_schnorrsig_verify(void* arg) {
+    bench_schnorrsig_data *data = (bench_schnorrsig_data *)arg;
+    size_t i;
+
+    for (i = 0; i < 1000; i++) {
+        secp256k1_pubkey pk;
+        CHECK(secp256k1_ec_pubkey_parse(data->ctx, &pk, data->pk[i], 33) == 1);
+        CHECK(secp256k1_schnorrsig_verify(data->ctx, data->sigs[i], data->msgs[i], &pk));
+    }
+}
+
+void bench_schnorrsig_verify_n(void* arg) {
+    bench_schnorrsig_data *data = (bench_schnorrsig_data *)arg;
+    size_t i, j;
+    const secp256k1_pubkey **pk = (const secp256k1_pubkey **)malloc(data->n * sizeof(*pk));
+
+    CHECK(pk != NULL);
+    for (j = 0; j < MAX_SIGS/data->n; j++) {
+        for (i = 0; i < data->n; i++) {
+            secp256k1_pubkey *pk_nonconst = (secp256k1_pubkey *)malloc(sizeof(*pk_nonconst));
+            CHECK(secp256k1_ec_pubkey_parse(data->ctx, pk_nonconst, data->pk[i], 33) == 1);
+            pk[i] = pk_nonconst;
+        }
+        CHECK(secp256k1_schnorrsig_verify_batch(data->ctx, data->scratch, data->sigs, data->msgs, pk, data->n));
+        for (i = 0; i < data->n; i++) {
+            free((void *)pk[i]);
+        }
+    }
+    free(pk);
+}
+
+int main(void) {
+    size_t i;
+    bench_schnorrsig_data data;
+
+    data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
+    data.scratch = secp256k1_scratch_space_create(data.ctx, 1024 * 1024 * 1024);
+    data.pk = (const unsigned char **)malloc(MAX_SIGS * sizeof(unsigned char *));
+    data.msgs = (const unsigned char **)malloc(MAX_SIGS * sizeof(unsigned char *));
+    data.sigs = (const secp256k1_schnorrsig **)malloc(MAX_SIGS * sizeof(secp256k1_schnorrsig *));
+
+    for (i = 0; i < MAX_SIGS; i++) {
+        unsigned char sk[32];
+        unsigned char *msg = (unsigned char *)malloc(32);
+        secp256k1_schnorrsig *sig = (secp256k1_schnorrsig *)malloc(sizeof(*sig));
+        unsigned char *pk_char = (unsigned char *)malloc(33);
+        secp256k1_pubkey pk;
+        size_t pk_len = 33;
+        msg[0] = sk[0] = i;
+        msg[1] = sk[1] = i >> 8;
+        msg[2] = sk[2] = i >> 16;
+        msg[3] = sk[3] = i >> 24;
+        memset(&msg[4], 'm', 28);
+        memset(&sk[4], 's', 28);
+
+        data.pk[i] = pk_char;
+        data.msgs[i] = msg;
+        data.sigs[i] = sig;
+
+        CHECK(secp256k1_ec_pubkey_create(data.ctx, &pk, sk));
+        CHECK(secp256k1_ec_pubkey_serialize(data.ctx, pk_char, &pk_len, &pk, SECP256K1_EC_COMPRESSED) == 1);
+        CHECK(secp256k1_schnorrsig_sign(data.ctx, sig, NULL, msg, sk, NULL, NULL));
+    }
+
+    run_benchmark("schnorrsig_sign", bench_schnorrsig_sign, NULL, NULL, (void *) &data, 10, 1000);
+    run_benchmark("schnorrsig_verify", bench_schnorrsig_verify, NULL, NULL, (void *) &data, 10, 1000);
+    for (i = 1; i <= MAX_SIGS; i *= 2) {
+        char name[64];
+        sprintf(name, "schnorrsig_batch_verify_%d", (int) i);
+
+        data.n = i;
+        run_benchmark(name, bench_schnorrsig_verify_n, NULL, NULL, (void *) &data, 3, MAX_SIGS);
+    }
+
+    for (i = 0; i < MAX_SIGS; i++) {
+        free((void *)data.pk[i]);
+        free((void *)data.msgs[i]);
+        free((void *)data.sigs[i]);
+    }
+    free(data.pk);
+    free(data.msgs);
+    free(data.sigs);
+
+    secp256k1_scratch_space_destroy(data.scratch);
+    secp256k1_context_destroy(data.ctx);
+    return 0;
+}
diff --git a/src/modules/schnorrsig/Makefile.am.include b/src/modules/schnorrsig/Makefile.am.include
new file mode 100644
index 000000000..a82bafe43
--- /dev/null
+++ b/src/modules/schnorrsig/Makefile.am.include
@@ -0,0 +1,8 @@
+include_HEADERS += include/secp256k1_schnorrsig.h
+noinst_HEADERS += src/modules/schnorrsig/main_impl.h
+noinst_HEADERS += src/modules/schnorrsig/tests_impl.h
+if USE_BENCHMARK
+noinst_PROGRAMS += bench_schnorrsig
+bench_schnorrsig_SOURCES = src/bench_schnorrsig.c
+bench_schnorrsig_LDADD = libsecp256k1.la $(SECP_LIBS) $(COMMON_LIB)
+endif
diff --git a/src/modules/schnorrsig/main_impl.h b/src/modules/schnorrsig/main_impl.h
new file mode 100644
index 000000000..bebb49fe9
--- /dev/null
+++ b/src/modules/schnorrsig/main_impl.h
@@ -0,0 +1,338 @@
+/**********************************************************************
+ * Copyright (c) 2018 Andrew Poelstra                                 *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef _SECP256K1_MODULE_SCHNORRSIG_MAIN_
+#define _SECP256K1_MODULE_SCHNORRSIG_MAIN_
+
+#include "include/secp256k1.h"
+#include "include/secp256k1_schnorrsig.h"
+#include "hash.h"
+
+int secp256k1_schnorrsig_serialize(const secp256k1_context* ctx, unsigned char *out64, const secp256k1_schnorrsig* sig) {
+    (void) ctx;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(out64 != NULL);
+    ARG_CHECK(sig != NULL);
+    memcpy(out64, sig->data, 64);
+    return 1;
+}
+
+int secp256k1_schnorrsig_parse(const secp256k1_context* ctx, secp256k1_schnorrsig* sig, const unsigned char *in64) {
+    (void) ctx;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(sig != NULL);
+    ARG_CHECK(in64 != NULL);
+    memcpy(sig->data, in64, 64);
+    return 1;
+}
+
+int secp256k1_schnorrsig_sign(const secp256k1_context* ctx, secp256k1_schnorrsig *sig, int *nonce_is_negated, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, void *ndata) {
+    secp256k1_scalar x;
+    secp256k1_scalar e;
+    secp256k1_scalar k;
+    secp256k1_gej pkj;
+    secp256k1_gej rj;
+    secp256k1_ge pk;
+    secp256k1_ge r;
+    secp256k1_sha256 sha;
+    int overflow;
+    unsigned char buf[33];
+    size_t buflen = sizeof(buf);
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(sig != NULL);
+    ARG_CHECK(msg32 != NULL);
+    ARG_CHECK(seckey != NULL);
+
+    if (noncefp == NULL) {
+        noncefp = secp256k1_nonce_function_bipschnorr;
+    }
+    secp256k1_scalar_set_b32(&x, seckey, &overflow);
+    /* Fail if the secret key is invalid. */
+    if (overflow || secp256k1_scalar_is_zero(&x)) {
+        memset(sig, 0, sizeof(*sig));
+        return 0;
+    }
+
+    secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pkj, &x);
+    secp256k1_ge_set_gej(&pk, &pkj);
+
+    if (!noncefp(buf, msg32, seckey, NULL, (void*)ndata, 0)) {
+        return 0;
+    }
+    secp256k1_scalar_set_b32(&k, buf, NULL);
+    if (secp256k1_scalar_is_zero(&k)) {
+        return 0;
+    }
+
+    secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &k);
+    secp256k1_ge_set_gej(&r, &rj);
+
+    if (nonce_is_negated != NULL) {
+        *nonce_is_negated = 0;
+    }
+    if (!secp256k1_fe_is_quad_var(&r.y)) {
+        secp256k1_scalar_negate(&k, &k);
+        if (nonce_is_negated != NULL) {
+            *nonce_is_negated = 1;
+        }
+    }
+    secp256k1_fe_normalize(&r.x);
+    secp256k1_fe_get_b32(&sig->data[0], &r.x);
+
+    secp256k1_sha256_initialize(&sha);
+    secp256k1_sha256_write(&sha, &sig->data[0], 32);
+    secp256k1_eckey_pubkey_serialize(&pk, buf, &buflen, 1);
+    secp256k1_sha256_write(&sha, buf, buflen);
+    secp256k1_sha256_write(&sha, msg32, 32);
+    secp256k1_sha256_finalize(&sha, buf);
+
+    secp256k1_scalar_set_b32(&e, buf, NULL);
+    secp256k1_scalar_mul(&e, &e, &x);
+    secp256k1_scalar_add(&e, &e, &k);
+
+    secp256k1_scalar_get_b32(&sig->data[32], &e);
+    secp256k1_scalar_clear(&k);
+    secp256k1_scalar_clear(&x);
+
+    return 1;
+}
+
+/* Helper function for verification and batch verification.
+ * Computes R = sG - eP. */
+static int secp256k1_schnorrsig_real_verify(const secp256k1_context* ctx, secp256k1_gej *rj, const secp256k1_scalar *s, const secp256k1_scalar *e, const secp256k1_pubkey *pk) {
+    secp256k1_scalar nege;
+    secp256k1_ge pkp;
+    secp256k1_gej pkj;
+
+    secp256k1_scalar_negate(&nege, e);
+
+    if (!secp256k1_pubkey_load(ctx, &pkp, pk)) {
+        return 0;
+    }
+    secp256k1_gej_set_ge(&pkj, &pkp);
+
+    /* rj =  s*G + (-e)*pkj */
+    secp256k1_ecmult(&ctx->ecmult_ctx, rj, &pkj, &nege, s);
+    return 1;
+}
+
+int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const secp256k1_schnorrsig *sig, const unsigned char *msg32, const secp256k1_pubkey *pk) {
+    secp256k1_scalar s;
+    secp256k1_scalar e;
+    secp256k1_gej rj;
+    secp256k1_fe rx;
+    secp256k1_sha256 sha;
+    unsigned char buf[33];
+    size_t buflen = sizeof(buf);
+    int overflow;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
+    ARG_CHECK(sig != NULL);
+    ARG_CHECK(msg32 != NULL);
+    ARG_CHECK(pk != NULL);
+
+    if (!secp256k1_fe_set_b32(&rx, &sig->data[0])) {
+        return 0;
+    }
+
+    secp256k1_scalar_set_b32(&s, &sig->data[32], &overflow);
+    if (overflow) {
+        return 0;
+    }
+
+    secp256k1_sha256_initialize(&sha);
+    secp256k1_sha256_write(&sha, &sig->data[0], 32);
+    secp256k1_ec_pubkey_serialize(ctx, buf, &buflen, pk, SECP256K1_EC_COMPRESSED);
+    secp256k1_sha256_write(&sha, buf, buflen);
+    secp256k1_sha256_write(&sha, msg32, 32);
+    secp256k1_sha256_finalize(&sha, buf);
+    secp256k1_scalar_set_b32(&e, buf, NULL);
+
+    if (!secp256k1_schnorrsig_real_verify(ctx, &rj, &s, &e, pk)
+        || !secp256k1_gej_has_quad_y_var(&rj) /* fails if rj is infinity */
+        || !secp256k1_gej_eq_x_var(&rx, &rj)) {
+        return 0;
+    }
+
+    return 1;
+}
+
+/* Data that is used by the batch verification ecmult callback */
+typedef struct {
+    const secp256k1_context *ctx;
+    /* Seed for the random number generator */
+    unsigned char chacha_seed[32];
+    /* Caches randomizers generated by the PRNG which returns two randomizers per call. Caching
+     * avoids having to call the PRNG twice as often. The very first randomizer will be set to 1 and
+     * the PRNG is called at every odd indexed schnorrsig to fill the cache. */
+    secp256k1_scalar randomizer_cache[2];
+    /* Signature, message, public key tuples to verify */
+    const secp256k1_schnorrsig *const *sig;
+    const unsigned char *const *msg32;
+    const secp256k1_pubkey *const *pk;
+    size_t n_sigs;
+} secp256k1_schnorrsig_verify_ecmult_context;
+
+/* Callback function which is called by ecmult_multi in order to convert the ecmult_context
+ * consisting of signature, message and public key tuples into scalars and points. */
+static int secp256k1_schnorrsig_verify_batch_ecmult_callback(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *data) {
+    secp256k1_schnorrsig_verify_ecmult_context *ecmult_context = (secp256k1_schnorrsig_verify_ecmult_context *) data;
+
+    if (idx % 4 == 2) {
+        /* Every idx corresponds to a (scalar,point)-tuple. So this callback is called with 4
+         * consecutive tuples before we need to call the RNG for new randomizers:
+         * (-randomizer_cache[0], R1)
+         * (-randomizer_cache[0]*e1, P1)
+         * (-randomizer_cache[1], R2)
+         * (-randomizer_cache[1]*e2, P2) */
+        secp256k1_scalar_chacha20(&ecmult_context->randomizer_cache[0], &ecmult_context->randomizer_cache[1], ecmult_context->chacha_seed, idx / 4);
+    }
+
+    /* R */
+    if (idx % 2 == 0) {
+        secp256k1_fe rx;
+        *sc = ecmult_context->randomizer_cache[(idx / 2) % 2];
+        if (!secp256k1_fe_set_b32(&rx, &ecmult_context->sig[idx / 2]->data[0])) {
+            return 0;
+        }
+        if (!secp256k1_ge_set_xquad(pt, &rx)) {
+            return 0;
+        }
+    /* eP */
+    } else {
+        unsigned char buf[33];
+        size_t buflen = sizeof(buf);
+        secp256k1_sha256 sha;
+        secp256k1_sha256_initialize(&sha);
+        secp256k1_sha256_write(&sha, &ecmult_context->sig[idx / 2]->data[0], 32);
+        secp256k1_ec_pubkey_serialize(ecmult_context->ctx, buf, &buflen, ecmult_context->pk[idx / 2], SECP256K1_EC_COMPRESSED);
+        secp256k1_sha256_write(&sha, buf, buflen);
+        secp256k1_sha256_write(&sha, ecmult_context->msg32[idx / 2], 32);
+        secp256k1_sha256_finalize(&sha, buf);
+
+        secp256k1_scalar_set_b32(sc, buf, NULL);
+        secp256k1_scalar_mul(sc, sc, &ecmult_context->randomizer_cache[(idx / 2) % 2]);
+
+        if (!secp256k1_pubkey_load(ecmult_context->ctx, pt, ecmult_context->pk[idx / 2])) {
+            return 0;
+        }
+    }
+    return 1;
+}
+
+/** Helper function for batch verification. Hashes signature verification data into the
+ *  randomization seed and initializes ecmult_context.
+ *
+ *  Returns 1 if the randomizer was successfully initialized.
+ *
+ *  Args:    ctx: a secp256k1 context object
+ *  Out: ecmult_context: context for batch_ecmult_callback
+ *  In/Out   sha: an initialized sha256 object which hashes the schnorrsig input in order to get a
+ *                seed for the randomizer PRNG
+ *  In:      sig: array of signatures, or NULL if there are no signatures
+ *         msg32: array of messages, or NULL if there are no signatures
+ *            pk: array of public keys, or NULL if there are no signatures
+ *        n_sigs: number of signatures in above arrays (must be 0 if they are NULL)
+ */
+int secp256k1_schnorrsig_verify_batch_init_randomizer(const secp256k1_context *ctx, secp256k1_schnorrsig_verify_ecmult_context *ecmult_context, secp256k1_sha256 *sha, const secp256k1_schnorrsig *const *sig, const unsigned char *const *msg32, const secp256k1_pubkey *const *pk, size_t n_sigs) {
+    size_t i;
+
+    if (n_sigs > 0) {
+        ARG_CHECK(sig != NULL);
+        ARG_CHECK(msg32 != NULL);
+        ARG_CHECK(pk != NULL);
+    }
+
+    for (i = 0; i < n_sigs; i++) {
+        unsigned char buf[33];
+        size_t buflen = sizeof(buf);
+        secp256k1_sha256_write(sha, sig[i]->data, 64);
+        secp256k1_sha256_write(sha, msg32[i], 32);
+        secp256k1_ec_pubkey_serialize(ctx, buf, &buflen, pk[i], SECP256K1_EC_COMPRESSED);
+        secp256k1_sha256_write(sha, buf, 32);
+    }
+    ecmult_context->ctx = ctx;
+    ecmult_context->sig = sig;
+    ecmult_context->msg32 = msg32;
+    ecmult_context->pk = pk;
+    ecmult_context->n_sigs = n_sigs;
+
+    return 1;
+}
+
+/** Helper function for batch verification. Sums the s part of all signatures multiplied by their
+ *  randomizer.
+ *
+ *  Returns 1 if s is successfully summed.
+ *
+ *  In/Out: s: the s part of the input sigs is added to this s argument
+ *  In:  chacha_seed: PRNG seed for computing randomizers
+ *        sig: array of signatures, or NULL if there are no signatures
+ *     n_sigs: number of signatures in above array (must be 0 if they are NULL)
+ */
+int secp256k1_schnorrsig_verify_batch_sum_s(secp256k1_scalar *s, unsigned char *chacha_seed, const secp256k1_schnorrsig *const *sig, size_t n_sigs) {
+    secp256k1_scalar randomizer_cache[2];
+    size_t i;
+
+    secp256k1_scalar_set_int(&randomizer_cache[0], 1);
+    for (i = 0; i < n_sigs; i++) {
+        int overflow;
+        secp256k1_scalar term;
+        if (i % 2 == 1) {
+            secp256k1_scalar_chacha20(&randomizer_cache[0], &randomizer_cache[1], chacha_seed, i / 2);
+        }
+
+        secp256k1_scalar_set_b32(&term, &sig[i]->data[32], &overflow);
+        if (overflow) {
+            return 0;
+        }
+        secp256k1_scalar_mul(&term, &term, &randomizer_cache[i % 2]);
+        secp256k1_scalar_add(s, s, &term);
+    }
+    return 1;
+}
+
+/* schnorrsig batch verification.
+ * Seeds a random number generator with the inputs and derives a random number ai for every
+ * signature i. Fails if y-coordinate of any R is not a quadratic residue or if
+ * 0 != -(s1 + a2*s2 + ... + au*su)G + R1 + a2*R2 + ... + au*Ru + e1*P1 + (a2*e2)P2 + ... + (au*eu)Pu. */
+int secp256k1_schnorrsig_verify_batch(const secp256k1_context *ctx, secp256k1_scratch *scratch, const secp256k1_schnorrsig *const *sig, const unsigned char *const *msg32, const secp256k1_pubkey *const *pk, size_t n_sigs) {
+    secp256k1_schnorrsig_verify_ecmult_context ecmult_context;
+    secp256k1_sha256 sha;
+    secp256k1_scalar s;
+    secp256k1_gej rj;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
+    ARG_CHECK(scratch != NULL);
+    /* Check that n_sigs is less than half of the maximum size_t value. This is necessary because
+     * the number of points given to ecmult_multi is 2*n_sigs. */
+    ARG_CHECK(n_sigs <= SIZE_MAX / 2);
+    /* Check that n_sigs is less than 2^31 to ensure the same behavior of this function on 32-bit
+     * and 64-bit platforms. */
+    ARG_CHECK(n_sigs < (size_t)(1 << 31));
+
+    secp256k1_sha256_initialize(&sha);
+    if (!secp256k1_schnorrsig_verify_batch_init_randomizer(ctx, &ecmult_context, &sha, sig, msg32, pk, n_sigs)) {
+        return 0;
+    }
+    secp256k1_sha256_finalize(&sha, ecmult_context.chacha_seed);
+    secp256k1_scalar_set_int(&ecmult_context.randomizer_cache[0], 1);
+
+    secp256k1_scalar_clear(&s);
+    if (!secp256k1_schnorrsig_verify_batch_sum_s(&s, ecmult_context.chacha_seed, sig, n_sigs)) {
+        return 0;
+    }
+    secp256k1_scalar_negate(&s, &s);
+
+    return secp256k1_ecmult_multi_var(&ctx->ecmult_ctx, scratch, &rj, &s, secp256k1_schnorrsig_verify_batch_ecmult_callback, (void *) &ecmult_context, 2 * n_sigs)
+            && secp256k1_gej_is_infinity(&rj);
+}
+
+#endif
diff --git a/src/modules/schnorrsig/tests_impl.h b/src/modules/schnorrsig/tests_impl.h
new file mode 100644
index 000000000..e067058aa
--- /dev/null
+++ b/src/modules/schnorrsig/tests_impl.h
@@ -0,0 +1,726 @@
+/**********************************************************************
+ * Copyright (c) 2018 Andrew Poelstra                                 *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef _SECP256K1_MODULE_SCHNORRSIG_TESTS_
+#define _SECP256K1_MODULE_SCHNORRSIG_TESTS_
+
+#include "secp256k1_schnorrsig.h"
+
+void test_schnorrsig_serialize(void) {
+    secp256k1_schnorrsig sig;
+    unsigned char in[64];
+    unsigned char out[64];
+
+    memset(in, 0x12, 64);
+    CHECK(secp256k1_schnorrsig_parse(ctx, &sig, in));
+    CHECK(secp256k1_schnorrsig_serialize(ctx, out, &sig));
+    CHECK(memcmp(in, out, 64) == 0);
+}
+
+void test_schnorrsig_api(secp256k1_scratch_space *scratch) {
+    unsigned char sk1[32];
+    unsigned char sk2[32];
+    unsigned char sk3[32];
+    unsigned char msg[32];
+    unsigned char sig64[64];
+    secp256k1_pubkey pk[3];
+    secp256k1_schnorrsig sig;
+    const secp256k1_schnorrsig *sigptr = &sig;
+    const unsigned char *msgptr = msg;
+    const secp256k1_pubkey *pkptr = &pk[0];
+    int nonce_is_negated;
+
+    /** setup **/
+    secp256k1_context *none = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
+    secp256k1_context *sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
+    secp256k1_context *vrfy = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
+    secp256k1_context *both = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
+    int ecount;
+
+    secp256k1_context_set_error_callback(none, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_error_callback(vrfy, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_error_callback(both, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_illegal_callback(none, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_illegal_callback(sign, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_illegal_callback(vrfy, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_illegal_callback(both, counting_illegal_callback_fn, &ecount);
+
+    secp256k1_rand256(sk1);
+    secp256k1_rand256(sk2);
+    secp256k1_rand256(sk3);
+    secp256k1_rand256(msg);
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk[0], sk1) == 1);
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk[1], sk2) == 1);
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk[2], sk3) == 1);
+
+    /** main test body **/
+    ecount = 0;
+    CHECK(secp256k1_schnorrsig_sign(none, &sig, &nonce_is_negated, msg, sk1, NULL, NULL) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_schnorrsig_sign(vrfy, &sig, &nonce_is_negated, msg, sk1, NULL, NULL) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_sign(sign, &sig, &nonce_is_negated, msg, sk1, NULL, NULL) == 1);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_sign(sign, NULL, &nonce_is_negated, msg, sk1, NULL, NULL) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_schnorrsig_sign(sign, &sig, NULL, msg, sk1, NULL, NULL) == 1);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_schnorrsig_sign(sign, &sig, &nonce_is_negated, NULL, sk1, NULL, NULL) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_schnorrsig_sign(sign, &sig, &nonce_is_negated, msg, NULL, NULL, NULL) == 0);
+    CHECK(ecount == 5);
+
+    ecount = 0;
+    CHECK(secp256k1_schnorrsig_serialize(none, sig64, &sig) == 1);
+    CHECK(ecount == 0);
+    CHECK(secp256k1_schnorrsig_serialize(none, NULL, &sig) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_schnorrsig_serialize(none, sig64, NULL) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_parse(none, &sig, sig64) == 1);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_parse(none, NULL, sig64) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_schnorrsig_parse(none, &sig, NULL) == 0);
+    CHECK(ecount == 4);
+
+    ecount = 0;
+    CHECK(secp256k1_schnorrsig_verify(none, &sig, msg, &pk[0]) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_schnorrsig_verify(sign, &sig, msg, &pk[0]) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, &sig, msg, &pk[0]) == 1);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, NULL, msg, &pk[0]) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, &sig, NULL, &pk[0]) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_schnorrsig_verify(vrfy, &sig, msg, NULL) == 0);
+    CHECK(ecount == 5);
+
+    ecount = 0;
+    CHECK(secp256k1_schnorrsig_verify_batch(none, scratch, &sigptr, &msgptr, &pkptr, 1) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_schnorrsig_verify_batch(sign, scratch, &sigptr, &msgptr, &pkptr, 1) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_verify_batch(vrfy, scratch, &sigptr, &msgptr, &pkptr, 1) == 1);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_verify_batch(vrfy, scratch, NULL, NULL, NULL, 0) == 1);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_schnorrsig_verify_batch(vrfy, scratch, NULL, &msgptr, &pkptr, 1) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_schnorrsig_verify_batch(vrfy, scratch, &sigptr, NULL, &pkptr, 1) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_schnorrsig_verify_batch(vrfy, scratch, &sigptr, &msgptr, NULL, 1) == 0);
+    CHECK(ecount == 5);
+    CHECK(secp256k1_schnorrsig_verify_batch(vrfy, scratch, &sigptr, &msgptr, &pkptr, (size_t)1 << (sizeof(size_t)*8-1)) == 0);
+    CHECK(ecount == 6);
+    CHECK(secp256k1_schnorrsig_verify_batch(vrfy, scratch, &sigptr, &msgptr, &pkptr, 1 << 31) == 0);
+    CHECK(ecount == 7);
+
+    secp256k1_context_destroy(none);
+    secp256k1_context_destroy(sign);
+    secp256k1_context_destroy(vrfy);
+    secp256k1_context_destroy(both);
+}
+
+/* Helper function for schnorrsig_bip_vectors
+ * Signs the message and checks that it's the same as expected_sig. */
+void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *msg, const unsigned char *expected_sig, const int expected_nonce_is_negated) {
+    secp256k1_schnorrsig sig;
+    unsigned char serialized_sig[64];
+    secp256k1_pubkey pk;
+    int nonce_is_negated;
+
+    CHECK(secp256k1_schnorrsig_sign(ctx, &sig, &nonce_is_negated, msg, sk, NULL, NULL));
+    CHECK(nonce_is_negated == expected_nonce_is_negated);
+    CHECK(secp256k1_schnorrsig_serialize(ctx, serialized_sig, &sig));
+    CHECK(memcmp(serialized_sig, expected_sig, 64) == 0);
+
+    CHECK(secp256k1_ec_pubkey_parse(ctx, &pk, pk_serialized, 33));
+    CHECK(secp256k1_schnorrsig_verify(ctx, &sig, msg, &pk));
+}
+
+/* Helper function for schnorrsig_bip_vectors
+ * Checks that both verify and verify_batch return the same value as expected. */
+void test_schnorrsig_bip_vectors_check_verify(secp256k1_scratch_space *scratch, const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig_serialized, int expected) {
+    const unsigned char *msg_arr[1];
+    const secp256k1_schnorrsig *sig_arr[1];
+    const secp256k1_pubkey *pk_arr[1];
+    secp256k1_pubkey pk;
+    secp256k1_schnorrsig sig;
+
+    CHECK(secp256k1_ec_pubkey_parse(ctx, &pk, pk_serialized, 33));
+    CHECK(secp256k1_schnorrsig_parse(ctx, &sig, sig_serialized));
+
+    sig_arr[0] = &sig;
+    msg_arr[0] = msg32;
+    pk_arr[0] = &pk;
+
+    CHECK(expected == secp256k1_schnorrsig_verify(ctx, &sig, msg32, &pk));
+    CHECK(expected == secp256k1_schnorrsig_verify_batch(ctx, scratch, sig_arr, msg_arr, pk_arr, 1));
+}
+
+/* Test vectors according to BIP-schnorr
+ * (https://github.com/sipa/bips/blob/7f6a73e53c8bbcf2d008ea0546f76433e22094a8/bip-schnorr/test-vectors.csv).
+ */
+void test_schnorrsig_bip_vectors(secp256k1_scratch_space *scratch) {
+    {
+        /* Test vector 1 */
+        const unsigned char sk1[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
+        };
+        const unsigned char pk1[33] = {
+            0x02, 0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB,
+            0xAC, 0x55, 0xA0, 0x62, 0x95, 0xCE, 0x87, 0x0B,
+            0x07, 0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE, 0x28,
+            0xD9, 0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17,
+            0x98
+        };
+        const unsigned char msg1[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        };
+        const unsigned char sig1[64] = {
+            0x78, 0x7A, 0x84, 0x8E, 0x71, 0x04, 0x3D, 0x28,
+            0x0C, 0x50, 0x47, 0x0E, 0x8E, 0x15, 0x32, 0xB2,
+            0xDD, 0x5D, 0x20, 0xEE, 0x91, 0x2A, 0x45, 0xDB,
+            0xDD, 0x2B, 0xD1, 0xDF, 0xBF, 0x18, 0x7E, 0xF6,
+            0x70, 0x31, 0xA9, 0x88, 0x31, 0x85, 0x9D, 0xC3,
+            0x4D, 0xFF, 0xEE, 0xDD, 0xA8, 0x68, 0x31, 0x84,
+            0x2C, 0xCD, 0x00, 0x79, 0xE1, 0xF9, 0x2A, 0xF1,
+            0x77, 0xF7, 0xF2, 0x2C, 0xC1, 0xDC, 0xED, 0x05
+        };
+        test_schnorrsig_bip_vectors_check_signing(sk1, pk1, msg1, sig1, 1);
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk1, msg1, sig1, 1);
+    }
+    {
+        /* Test vector 2 */
+        const unsigned char sk2[32] = {
+            0xB7, 0xE1, 0x51, 0x62, 0x8A, 0xED, 0x2A, 0x6A,
+            0xBF, 0x71, 0x58, 0x80, 0x9C, 0xF4, 0xF3, 0xC7,
+            0x62, 0xE7, 0x16, 0x0F, 0x38, 0xB4, 0xDA, 0x56,
+            0xA7, 0x84, 0xD9, 0x04, 0x51, 0x90, 0xCF, 0xEF
+        };
+        const unsigned char pk2[33] = {
+            0x02, 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C,
+            0x5F, 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41,
+            0xBE, 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE,
+            0xD8, 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6,
+            0x59
+        };
+        const unsigned char msg2[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
+        };
+        const unsigned char sig2[64] = {
+            0x2A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0x1E, 0x51, 0xA2, 0x2C, 0xCE, 0xC3, 0x55, 0x99,
+            0xB8, 0xF2, 0x66, 0x91, 0x22, 0x81, 0xF8, 0x36,
+            0x5F, 0xFC, 0x2D, 0x03, 0x5A, 0x23, 0x04, 0x34,
+            0xA1, 0xA6, 0x4D, 0xC5, 0x9F, 0x70, 0x13, 0xFD
+        };
+        test_schnorrsig_bip_vectors_check_signing(sk2, pk2, msg2, sig2, 0);
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk2, msg2, sig2, 1);
+    }
+    {
+        /* Test vector 3 */
+        const unsigned char sk3[32] = {
+            0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
+            0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
+            0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
+            0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x14, 0xE5, 0xC7
+        };
+        const unsigned char pk3[33] = {
+            0x03, 0xFA, 0xC2, 0x11, 0x4C, 0x2F, 0xBB, 0x09,
+            0x15, 0x27, 0xEB, 0x7C, 0x64, 0xEC, 0xB1, 0x1F,
+            0x80, 0x21, 0xCB, 0x45, 0xE8, 0xE7, 0x80, 0x9D,
+            0x3C, 0x09, 0x38, 0xE4, 0xB8, 0xC0, 0xE5, 0xF8,
+            0x4B
+        };
+        const unsigned char msg3[32] = {
+            0x5E, 0x2D, 0x58, 0xD8, 0xB3, 0xBC, 0xDF, 0x1A,
+            0xBA, 0xDE, 0xC7, 0x82, 0x90, 0x54, 0xF9, 0x0D,
+            0xDA, 0x98, 0x05, 0xAA, 0xB5, 0x6C, 0x77, 0x33,
+            0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C
+        };
+        const unsigned char sig3[64] = {
+            0x00, 0xDA, 0x9B, 0x08, 0x17, 0x2A, 0x9B, 0x6F,
+            0x04, 0x66, 0xA2, 0xDE, 0xFD, 0x81, 0x7F, 0x2D,
+            0x7A, 0xB4, 0x37, 0xE0, 0xD2, 0x53, 0xCB, 0x53,
+            0x95, 0xA9, 0x63, 0x86, 0x6B, 0x35, 0x74, 0xBE,
+            0x00, 0x88, 0x03, 0x71, 0xD0, 0x17, 0x66, 0x93,
+            0x5B, 0x92, 0xD2, 0xAB, 0x4C, 0xD5, 0xC8, 0xA2,
+            0xA5, 0x83, 0x7E, 0xC5, 0x7F, 0xED, 0x76, 0x60,
+            0x77, 0x3A, 0x05, 0xF0, 0xDE, 0x14, 0x23, 0x80
+        };
+        test_schnorrsig_bip_vectors_check_signing(sk3, pk3, msg3, sig3, 0);
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk3, msg3, sig3, 1);
+    }
+    {
+        /* Test vector 4 */
+        const unsigned char pk4[33] = {
+            0x03, 0xDE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77,
+            0x50, 0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF,
+            0x21, 0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76,
+            0x87, 0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A,
+            0x34
+        };
+        const unsigned char msg4[32] = {
+            0x4D, 0xF3, 0xC3, 0xF6, 0x8F, 0xCC, 0x83, 0xB2,
+            0x7E, 0x9D, 0x42, 0xC9, 0x04, 0x31, 0xA7, 0x24,
+            0x99, 0xF1, 0x78, 0x75, 0xC8, 0x1A, 0x59, 0x9B,
+            0x56, 0x6C, 0x98, 0x89, 0xB9, 0x69, 0x67, 0x03
+        };
+        const unsigned char sig4[64] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x3B, 0x78, 0xCE, 0x56, 0x3F,
+            0x89, 0xA0, 0xED, 0x94, 0x14, 0xF5, 0xAA, 0x28,
+            0xAD, 0x0D, 0x96, 0xD6, 0x79, 0x5F, 0x9C, 0x63,
+            0x02, 0xA8, 0xDC, 0x32, 0xE6, 0x4E, 0x86, 0xA3,
+            0x33, 0xF2, 0x0E, 0xF5, 0x6E, 0xAC, 0x9B, 0xA3,
+            0x0B, 0x72, 0x46, 0xD6, 0xD2, 0x5E, 0x22, 0xAD,
+            0xB8, 0xC6, 0xBE, 0x1A, 0xEB, 0x08, 0xD4, 0x9D
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk4, msg4, sig4, 1);
+    }
+    {
+        /* Test vector 5 */
+        const unsigned char pk5[33] = {
+            0x03, 0x1B, 0x84, 0xC5, 0x56, 0x7B, 0x12, 0x64,
+            0x40, 0x99, 0x5D, 0x3E, 0xD5, 0xAA, 0xBA, 0x05,
+            0x65, 0xD7, 0x1E, 0x18, 0x34, 0x60, 0x48, 0x19,
+            0xFF, 0x9C, 0x17, 0xF5, 0xE9, 0xD5, 0xDD, 0x07,
+            0x8F
+        };
+        const unsigned char msg5[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        };
+        const unsigned char sig5[64] = {
+            0x52, 0x81, 0x85, 0x79, 0xAC, 0xA5, 0x97, 0x67,
+            0xE3, 0x29, 0x1D, 0x91, 0xB7, 0x6B, 0x63, 0x7B,
+            0xEF, 0x06, 0x20, 0x83, 0x28, 0x49, 0x92, 0xF2,
+            0xD9, 0x5F, 0x56, 0x4C, 0xA6, 0xCB, 0x4E, 0x35,
+            0x30, 0xB1, 0xDA, 0x84, 0x9C, 0x8E, 0x83, 0x04,
+            0xAD, 0xC0, 0xCF, 0xE8, 0x70, 0x66, 0x03, 0x34,
+            0xB3, 0xCF, 0xC1, 0x8E, 0x82, 0x5E, 0xF1, 0xDB,
+            0x34, 0xCF, 0xAE, 0x3D, 0xFC, 0x5D, 0x81, 0x87
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk5, msg5, sig5, 1);
+    }
+    {
+        /* Test vector 6 */
+        const unsigned char pk6[33] = {
+            0x03, 0xFA, 0xC2, 0x11, 0x4C, 0x2F, 0xBB, 0x09,
+            0x15, 0x27, 0xEB, 0x7C, 0x64, 0xEC, 0xB1, 0x1F,
+            0x80, 0x21, 0xCB, 0x45, 0xE8, 0xE7, 0x80, 0x9D,
+            0x3C, 0x09, 0x38, 0xE4, 0xB8, 0xC0, 0xE5, 0xF8,
+            0x4B
+        };
+        const unsigned char msg6[32] = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+        };
+        const unsigned char sig6[64] = {
+            0x57, 0x0D, 0xD4, 0xCA, 0x83, 0xD4, 0xE6, 0x31,
+            0x7B, 0x8E, 0xE6, 0xBA, 0xE8, 0x34, 0x67, 0xA1,
+            0xBF, 0x41, 0x9D, 0x07, 0x67, 0x12, 0x2D, 0xE4,
+            0x09, 0x39, 0x44, 0x14, 0xB0, 0x50, 0x80, 0xDC,
+            0xE9, 0xEE, 0x5F, 0x23, 0x7C, 0xBD, 0x10, 0x8E,
+            0xAB, 0xAE, 0x1E, 0x37, 0x75, 0x9A, 0xE4, 0x7F,
+            0x8E, 0x42, 0x03, 0xDA, 0x35, 0x32, 0xEB, 0x28,
+            0xDB, 0x86, 0x0F, 0x33, 0xD6, 0x2D, 0x49, 0xBD
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk6, msg6, sig6, 1);
+    }
+    {
+        /* Test vector 7 */
+        const unsigned char pk7[33] = {
+            0x03, 0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77,
+            0x50, 0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF,
+            0x21, 0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76,
+            0x87, 0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A,
+            0x34
+        };
+        secp256k1_pubkey pk7_parsed;
+        /* No need to check the signature of the test vector as parsing the pubkey already fails */
+        CHECK(!secp256k1_ec_pubkey_parse(ctx, &pk7_parsed, pk7, 33));
+    }
+    {
+        /* Test vector 8 */
+        const unsigned char pk8[33] = {
+            0x02, 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C,
+            0x5F, 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41,
+            0xBE, 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE,
+            0xD8, 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6,
+            0x59
+        };
+        const unsigned char msg8[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
+        };
+        const unsigned char sig8[64] = {
+            0x2A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0xFA, 0x16, 0xAE, 0xE0, 0x66, 0x09, 0x28, 0x0A,
+            0x19, 0xB6, 0x7A, 0x24, 0xE1, 0x97, 0x7E, 0x46,
+            0x97, 0x71, 0x2B, 0x5F, 0xD2, 0x94, 0x39, 0x14,
+            0xEC, 0xD5, 0xF7, 0x30, 0x90, 0x1B, 0x4A, 0xB7
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk8, msg8, sig8, 0);
+    }
+    {
+        /* Test vector 9 */
+        const unsigned char pk9[33] = {
+            0x03, 0xFA, 0xC2, 0x11, 0x4C, 0x2F, 0xBB, 0x09,
+            0x15, 0x27, 0xEB, 0x7C, 0x64, 0xEC, 0xB1, 0x1F,
+            0x80, 0x21, 0xCB, 0x45, 0xE8, 0xE7, 0x80, 0x9D,
+            0x3C, 0x09, 0x38, 0xE4, 0xB8, 0xC0, 0xE5, 0xF8,
+            0x4B
+        };
+        const unsigned char msg9[32] = {
+            0x5E, 0x2D, 0x58, 0xD8, 0xB3, 0xBC, 0xDF, 0x1A,
+            0xBA, 0xDE, 0xC7, 0x82, 0x90, 0x54, 0xF9, 0x0D,
+            0xDA, 0x98, 0x05, 0xAA, 0xB5, 0x6C, 0x77, 0x33,
+            0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C
+        };
+        const unsigned char sig9[64] = {
+            0x00, 0xDA, 0x9B, 0x08, 0x17, 0x2A, 0x9B, 0x6F,
+            0x04, 0x66, 0xA2, 0xDE, 0xFD, 0x81, 0x7F, 0x2D,
+            0x7A, 0xB4, 0x37, 0xE0, 0xD2, 0x53, 0xCB, 0x53,
+            0x95, 0xA9, 0x63, 0x86, 0x6B, 0x35, 0x74, 0xBE,
+            0xD0, 0x92, 0xF9, 0xD8, 0x60, 0xF1, 0x77, 0x6A,
+            0x1F, 0x74, 0x12, 0xAD, 0x8A, 0x1E, 0xB5, 0x0D,
+            0xAC, 0xCC, 0x22, 0x2B, 0xC8, 0xC0, 0xE2, 0x6B,
+            0x20, 0x56, 0xDF, 0x2F, 0x27, 0x3E, 0xFD, 0xEC
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk9, msg9, sig9, 0);
+    }
+    {
+        /* Test vector 10 */
+        const unsigned char pk10[33] = {
+            0x02, 0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB,
+            0xAC, 0x55, 0xA0, 0x62, 0x95, 0xCE, 0x87, 0x0B,
+            0x07, 0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE, 0x28,
+            0xD9, 0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17,
+            0x98
+        };
+        const unsigned char msg10[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        };
+        const unsigned char sig10[64] = {
+            0x78, 0x7A, 0x84, 0x8E, 0x71, 0x04, 0x3D, 0x28,
+            0x0C, 0x50, 0x47, 0x0E, 0x8E, 0x15, 0x32, 0xB2,
+            0xDD, 0x5D, 0x20, 0xEE, 0x91, 0x2A, 0x45, 0xDB,
+            0xDD, 0x2B, 0xD1, 0xDF, 0xBF, 0x18, 0x7E, 0xF6,
+            0x8F, 0xCE, 0x56, 0x77, 0xCE, 0x7A, 0x62, 0x3C,
+            0xB2, 0x00, 0x11, 0x22, 0x57, 0x97, 0xCE, 0x7A,
+            0x8D, 0xE1, 0xDC, 0x6C, 0xCD, 0x4F, 0x75, 0x4A,
+            0x47, 0xDA, 0x6C, 0x60, 0x0E, 0x59, 0x54, 0x3C
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk10, msg10, sig10, 0);
+    }
+    {
+        /* Test vector 11 */
+        const unsigned char pk11[33] = {
+            0x03, 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C,
+            0x5F, 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41,
+            0xBE, 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE,
+            0xD8, 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6,
+            0x59
+        };
+        const unsigned char msg11[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
+        };
+        const unsigned char sig11[64] = {
+            0x2A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0x1E, 0x51, 0xA2, 0x2C, 0xCE, 0xC3, 0x55, 0x99,
+            0xB8, 0xF2, 0x66, 0x91, 0x22, 0x81, 0xF8, 0x36,
+            0x5F, 0xFC, 0x2D, 0x03, 0x5A, 0x23, 0x04, 0x34,
+            0xA1, 0xA6, 0x4D, 0xC5, 0x9F, 0x70, 0x13, 0xFD
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk11, msg11, sig11, 0);
+    }
+    {
+        /* Test vector 12 */
+        const unsigned char pk12[33] = {
+            0x02, 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C,
+            0x5F, 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41,
+            0xBE, 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE,
+            0xD8, 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6,
+            0x59
+        };
+        const unsigned char msg12[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
+        };
+        const unsigned char sig12[64] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x9E, 0x9D, 0x01, 0xAF, 0x98, 0x8B, 0x5C, 0xED,
+            0xCE, 0x47, 0x22, 0x1B, 0xFA, 0x9B, 0x22, 0x27,
+            0x21, 0xF3, 0xFA, 0x40, 0x89, 0x15, 0x44, 0x4A,
+            0x4B, 0x48, 0x90, 0x21, 0xDB, 0x55, 0x77, 0x5F
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk12, msg12, sig12, 0);
+    }
+    {
+        /* Test vector 13 */
+        const unsigned char pk13[33] = {
+            0x02, 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C,
+            0x5F, 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41,
+            0xBE, 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE,
+            0xD8, 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6,
+            0x59
+        };
+        const unsigned char msg13[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
+        };
+        const unsigned char sig13[64] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+            0xD3, 0x7D, 0xDF, 0x02, 0x54, 0x35, 0x18, 0x36,
+            0xD8, 0x4B, 0x1B, 0xD6, 0xA7, 0x95, 0xFD, 0x5D,
+            0x52, 0x30, 0x48, 0xF2, 0x98, 0xC4, 0x21, 0x4D,
+            0x18, 0x7F, 0xE4, 0x89, 0x29, 0x47, 0xF7, 0x28
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk13, msg13, sig13, 0);
+    }
+    {
+        /* Test vector 14 */
+        const unsigned char pk14[33] = {
+            0x02, 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C,
+            0x5F, 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41,
+            0xBE, 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE,
+            0xD8, 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6,
+            0x59
+        };
+        const unsigned char msg14[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x14, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
+        };
+        const unsigned char sig14[64] = {
+            0x4A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0x1E, 0x51, 0xA2, 0x2C, 0xCE, 0xC3, 0x55, 0x99,
+            0xB8, 0xF2, 0x66, 0x91, 0x22, 0x81, 0xF8, 0x36,
+            0x5F, 0xFC, 0x2D, 0x03, 0x5A, 0x23, 0x04, 0x34,
+            0xA1, 0xA6, 0x4D, 0xC5, 0x9F, 0x70, 0x13, 0xFD
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk14, msg14, sig14, 0);
+    }
+    {
+        /* Test vector 15 */
+        const unsigned char pk15[33] = {
+            0x02, 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C,
+            0x5F, 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41,
+            0xBE, 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE,
+            0xD8, 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6,
+            0x59
+        };
+        const unsigned char msg15[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
+        };
+        const unsigned char sig15[64] = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC, 0x2F,
+            0x1E, 0x51, 0xA2, 0x2C, 0xCE, 0xC3, 0x55, 0x99,
+            0xB8, 0xF2, 0x66, 0x91, 0x22, 0x81, 0xF8, 0x36,
+            0x5F, 0xFC, 0x2D, 0x03, 0x5A, 0x23, 0x04, 0x34,
+            0xA1, 0xA6, 0x4D, 0xC5, 0x9F, 0x70, 0x13, 0xFD
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk15, msg15, sig15, 0);
+    }
+    {
+        /* Test vector 16 */
+        const unsigned char pk16[33] = {
+            0x02, 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C,
+            0x5F, 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41,
+            0xBE, 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE,
+            0xD8, 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6,
+            0x59
+        };
+        const unsigned char msg16[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
+        };
+        const unsigned char sig16[64] = {
+            0x2A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,
+            0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,
+            0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41
+        };
+        test_schnorrsig_bip_vectors_check_verify(scratch, pk16, msg16, sig16, 0);
+    }
+}
+
+/* Nonce function that returns constant 0 */
+static int nonce_function_failing(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
+    (void) msg32;
+    (void) key32;
+    (void) algo16;
+    (void) data;
+    (void) counter;
+    (void) nonce32;
+    return 0;
+}
+
+/* Nonce function that sets nonce to 0 */
+static int nonce_function_0(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
+    (void) msg32;
+    (void) key32;
+    (void) algo16;
+    (void) data;
+    (void) counter;
+
+    memset(nonce32, 0, 32);
+    return 1;
+}
+
+void test_schnorrsig_sign(void) {
+    unsigned char sk[32];
+    const unsigned char msg[32] = "this is a msg for a schnorrsig..";
+    secp256k1_schnorrsig sig;
+
+    memset(sk, 23, sizeof(sk));
+    CHECK(secp256k1_schnorrsig_sign(ctx, &sig, NULL, msg, sk, NULL, NULL) == 1);
+
+    /* Overflowing secret key */
+    memset(sk, 0xFF, sizeof(sk));
+    CHECK(secp256k1_schnorrsig_sign(ctx, &sig, NULL, msg, sk, NULL, NULL) == 0);
+    memset(sk, 23, sizeof(sk));
+
+    CHECK(secp256k1_schnorrsig_sign(ctx, &sig, NULL, msg, sk, nonce_function_failing, NULL) == 0);
+    CHECK(secp256k1_schnorrsig_sign(ctx, &sig, NULL, msg, sk, nonce_function_0, NULL) == 0);
+}
+
+#define N_SIGS  200
+/* Creates N_SIGS valid signatures and verifies them with verify and verify_batch. Then flips some
+ * bits and checks that verification now fails. */
+void test_schnorrsig_sign_verify(secp256k1_scratch_space *scratch) {
+    const unsigned char sk[32] = "shhhhhhhh! this key is a secret.";
+    unsigned char msg[N_SIGS][32];
+    secp256k1_schnorrsig sig[N_SIGS];
+    size_t i;
+    const secp256k1_schnorrsig *sig_arr[N_SIGS];
+    const unsigned char *msg_arr[N_SIGS];
+    const secp256k1_pubkey *pk_arr[N_SIGS];
+    secp256k1_pubkey pk;
+
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk, sk));
+
+    CHECK(secp256k1_schnorrsig_verify_batch(ctx, scratch, NULL, NULL, NULL, 0));
+
+    for (i = 0; i < N_SIGS; i++) {
+        secp256k1_rand256(msg[i]);
+        CHECK(secp256k1_schnorrsig_sign(ctx, &sig[i], NULL, msg[i], sk, NULL, NULL));
+        CHECK(secp256k1_schnorrsig_verify(ctx, &sig[i], msg[i], &pk));
+        sig_arr[i] = &sig[i];
+        msg_arr[i] = msg[i];
+        pk_arr[i] = &pk;
+    }
+
+    CHECK(secp256k1_schnorrsig_verify_batch(ctx, scratch, sig_arr, msg_arr, pk_arr, 1));
+    CHECK(secp256k1_schnorrsig_verify_batch(ctx, scratch, sig_arr, msg_arr, pk_arr, 2));
+    CHECK(secp256k1_schnorrsig_verify_batch(ctx, scratch, sig_arr, msg_arr, pk_arr, 4));
+    CHECK(secp256k1_schnorrsig_verify_batch(ctx, scratch, sig_arr, msg_arr, pk_arr, N_SIGS));
+
+    {
+        /* Flip a few bits in the signature and in the message and check that
+         * verify and verify_batch fail */
+        size_t sig_idx = secp256k1_rand_int(4);
+        size_t byte_idx = secp256k1_rand_int(32);
+        unsigned char xorbyte = secp256k1_rand_int(254)+1;
+        sig[sig_idx].data[byte_idx] ^= xorbyte;
+        CHECK(!secp256k1_schnorrsig_verify(ctx, &sig[sig_idx], msg[sig_idx], &pk));
+        CHECK(!secp256k1_schnorrsig_verify_batch(ctx, scratch, sig_arr, msg_arr, pk_arr, 4));
+        sig[sig_idx].data[byte_idx] ^= xorbyte;
+
+        byte_idx = secp256k1_rand_int(32);
+        sig[sig_idx].data[32+byte_idx] ^= xorbyte;
+        CHECK(!secp256k1_schnorrsig_verify(ctx, &sig[sig_idx], msg[sig_idx], &pk));
+        CHECK(!secp256k1_schnorrsig_verify_batch(ctx, scratch, sig_arr, msg_arr, pk_arr, 4));
+        sig[sig_idx].data[32+byte_idx] ^= xorbyte;
+
+        byte_idx = secp256k1_rand_int(32);
+        msg[sig_idx][byte_idx] ^= xorbyte;
+        CHECK(!secp256k1_schnorrsig_verify(ctx, &sig[sig_idx], msg[sig_idx], &pk));
+        CHECK(!secp256k1_schnorrsig_verify_batch(ctx, scratch, sig_arr, msg_arr, pk_arr, 4));
+        msg[sig_idx][byte_idx] ^= xorbyte;
+
+        /* Check that above bitflips have been reversed correctly */
+        CHECK(secp256k1_schnorrsig_verify(ctx, &sig[sig_idx], msg[sig_idx], &pk));
+        CHECK(secp256k1_schnorrsig_verify_batch(ctx, scratch, sig_arr, msg_arr, pk_arr, 4));
+    }
+}
+#undef N_SIGS
+
+void run_schnorrsig_tests(void) {
+    secp256k1_scratch_space *scratch = secp256k1_scratch_space_create(ctx, 1024 * 1024);
+
+    test_schnorrsig_serialize();
+    test_schnorrsig_api(scratch);
+    test_schnorrsig_bip_vectors(scratch);
+    test_schnorrsig_sign();
+    test_schnorrsig_sign_verify(scratch);
+
+    secp256k1_scratch_space_destroy(scratch);
+}
+
+#endif
diff --git a/src/secp256k1.c b/src/secp256k1.c
index 9aedec5b2..95ad5a86f 100644
--- a/src/secp256k1.c
+++ b/src/secp256k1.c
@@ -343,6 +343,27 @@ static SECP256K1_INLINE void buffer_append(unsigned char *buf, unsigned int *off
     *offset += len;
 }
 
+/* This nonce function is described in BIP-schnorr
+ * (https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki) */
+static int secp256k1_nonce_function_bipschnorr(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
+    secp256k1_sha256 sha;
+    (void) data;
+    (void) counter;
+    VERIFY_CHECK(counter == 0);
+
+    /* Hash x||msg as per the spec */
+    secp256k1_sha256_initialize(&sha);
+    secp256k1_sha256_write(&sha, key32, 32);
+    secp256k1_sha256_write(&sha, msg32, 32);
+    /* Hash in algorithm, which is not in the spec, but may be critical to
+     * users depending on it to avoid nonce reuse across algorithms. */
+    if (algo16 != NULL) {
+        secp256k1_sha256_write(&sha, algo16, 16);
+    }
+    secp256k1_sha256_finalize(&sha, nonce32);
+    return 1;
+}
+
 static int nonce_function_rfc6979(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
    unsigned char keydata[112];
    unsigned int offset = 0;
@@ -614,6 +635,10 @@ int secp256k1_ec_pubkey_combine(const secp256k1_context* ctx, secp256k1_pubkey *
 # include "modules/ecdh/main_impl.h"
 #endif
 
+#ifdef ENABLE_MODULE_SCHNORRSIG
+# include "modules/schnorrsig/main_impl.h"
+#endif
+
 #ifdef ENABLE_MODULE_RECOVERY
 # include "modules/recovery/main_impl.h"
 #endif
diff --git a/src/tests.c b/src/tests.c
index 55dd7dcdf..60c451967 100644
--- a/src/tests.c
+++ b/src/tests.c
@@ -5119,6 +5119,10 @@ void run_ecdsa_openssl(void) {
 # include "modules/ecdh/tests_impl.h"
 #endif
 
+#ifdef ENABLE_MODULE_SCHNORRSIG
+# include "modules/schnorrsig/tests_impl.h"
+#endif
+
 #ifdef ENABLE_MODULE_RECOVERY
 # include "modules/recovery/tests_impl.h"
 #endif
@@ -5247,6 +5251,11 @@ int main(int argc, char **argv) {
     run_ecdh_tests();
 #endif
 
+#ifdef ENABLE_MODULE_SCHNORRSIG
+    /* Schnorrsig tests */
+    run_schnorrsig_tests();
+#endif
+
     /* ecdsa tests */
     run_random_pubkeys();
     run_ecdsa_der_parse();

From 77d5b4ac7dc2eaea96fdd75636bd2dc621e4104b Mon Sep 17 00:00:00 2001
From: Jonas Nick <jonasd.nick@gmail.com>
Date: Sat, 22 Dec 2018 22:12:35 +0000
Subject: [PATCH 4/5] Add MuSig module which allows creating n-of-n
 multisignatures and adaptor signatures.

---
 Makefile.am                           |   4 +
 configure.ac                          |  21 +
 include/secp256k1_musig.h             | 429 +++++++++++++++
 src/modules/musig/Makefile.am.include |   3 +
 src/modules/musig/main_impl.h         | 629 +++++++++++++++++++++
 src/modules/musig/tests_impl.h        | 757 ++++++++++++++++++++++++++
 src/secp256k1.c                       |   4 +
 src/tests.c                           |   8 +
 8 files changed, 1855 insertions(+)
 create mode 100644 include/secp256k1_musig.h
 create mode 100644 src/modules/musig/Makefile.am.include
 create mode 100644 src/modules/musig/main_impl.h
 create mode 100644 src/modules/musig/tests_impl.h

diff --git a/Makefile.am b/Makefile.am
index caf30e25e..86729cfc1 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -182,6 +182,10 @@ if ENABLE_MODULE_SCHNORRSIG
 include src/modules/schnorrsig/Makefile.am.include
 endif
 
+if ENABLE_MODULE_MUSIG
+include src/modules/musig/Makefile.am.include
+endif
+
 if ENABLE_MODULE_RECOVERY
 include src/modules/recovery/Makefile.am.include
 endif
diff --git a/configure.ac b/configure.ac
index 44da65707..204d11d1b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -134,6 +134,11 @@ AC_ARG_ENABLE(module_schnorrsig,
     [enable_module_schnorrsig=$enableval],
     [enable_module_schnorrsig=no])
 
+AC_ARG_ENABLE(module_musig,
+    AS_HELP_STRING([--enable-module-musig],[enable MuSig module (experimental)]),
+    [enable_module_musig=$enableval],
+    [enable_module_musig=no])
+
 AC_ARG_ENABLE(module_recovery,
     AS_HELP_STRING([--enable-module-recovery],[enable ECDSA pubkey recovery module (default is no)]),
     [enable_module_recovery=$enableval],
@@ -472,6 +477,10 @@ if test x"$enable_module_schnorrsig" = x"yes"; then
   AC_DEFINE(ENABLE_MODULE_SCHNORRSIG, 1, [Define this symbol to enable the schnorrsig module])
 fi
 
+if test x"$enable_module_musig" = x"yes"; then
+  AC_DEFINE(ENABLE_MODULE_MUSIG, 1, [Define this symbol to enable the MuSig module])
+fi
+
 if test x"$enable_module_recovery" = x"yes"; then
   AC_DEFINE(ENABLE_MODULE_RECOVERY, 1, [Define this symbol to enable the ECDSA pubkey recovery module])
 fi
@@ -520,8 +529,16 @@ if test x"$enable_experimental" = x"yes"; then
   AC_MSG_NOTICE([Building key whitelisting module: $enable_module_whitelist])
   AC_MSG_NOTICE([Building surjection proof module: $enable_module_surjectionproof])
   AC_MSG_NOTICE([Building schnorrsig module: $enable_module_schnorrsig])
+  AC_MSG_NOTICE([Building MuSig module: $enable_module_musig])
   AC_MSG_NOTICE([******])
 
+
+  if test x"$enable_module_schnorrsig" != x"yes"; then
+    if test x"$enable_module_musig" = x"yes"; then
+      AC_MSG_ERROR([MuSig module requires the schnorrsig module. Use --enable-module-schnorrsig to allow.])
+    fi
+  fi
+
   if test x"$enable_module_generator" != x"yes"; then
     if test x"$enable_module_rangeproof" = x"yes"; then
       AC_MSG_ERROR([Rangeproof module requires the generator module. Use --enable-module-generator to allow.])
@@ -543,6 +560,9 @@ else
   if test x"$enable_module_schnorrsig" = x"yes"; then
     AC_MSG_ERROR([schnorrsig module is experimental. Use --enable-experimental to allow.])
   fi
+  if test x"$enable_module_musig" = x"yes"; then
+    AC_MSG_ERROR([MuSig module is experimental. Use --enable-experimental to allow.])
+  fi
   if test x"$set_asm" = x"arm"; then
     AC_MSG_ERROR([ARM assembly optimization is experimental. Use --enable-experimental to allow.])
   fi
@@ -574,6 +594,7 @@ AM_CONDITIONAL([USE_BENCHMARK], [test x"$use_benchmark" = x"yes"])
 AM_CONDITIONAL([USE_ECMULT_STATIC_PRECOMPUTATION], [test x"$set_precomp" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_ECDH], [test x"$enable_module_ecdh" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG], [test x"$enable_module_schnorrsig" = x"yes"])
+AM_CONDITIONAL([ENABLE_MODULE_MUSIG], [test x"$enable_module_musig" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_RECOVERY], [test x"$enable_module_recovery" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_GENERATOR], [test x"$enable_module_generator" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_RANGEPROOF], [test x"$enable_module_rangeproof" = x"yes"])
diff --git a/include/secp256k1_musig.h b/include/secp256k1_musig.h
new file mode 100644
index 000000000..035adfe0e
--- /dev/null
+++ b/include/secp256k1_musig.h
@@ -0,0 +1,429 @@
+#ifndef SECP256K1_MUSIG_H
+#define SECP256K1_MUSIG_H
+
+#include <stdint.h>
+
+/** This module implements a Schnorr-based multi-signature scheme called MuSig
+ * (https://eprint.iacr.org/2018/068.pdf).
+ */
+
+/** Data structure containing data related to a signing session resulting in a single
+ * signature.
+ *
+ * This structure is not opaque, but it MUST NOT be copied or read or written to it
+ * directly. A signer who is online throughout the whole process and can keep this
+ * structure in memory can use the provided API functions for a safe standard
+ * workflow.
+ *
+ * A signer who goes offline and needs to import/export or save/load this structure
+ * **must** take measures prevent replay attacks wherein an old state is loaded and
+ * the signing protocol forked from that point. One straightforward way to accomplish
+ * this is to attach the output of a monotonic non-resettable counter (hardware
+ * support is needed for this). Increment the counter before each output and
+ * encrypt+sign the entire package. If a package is deserialized with an old counter
+ * state or bad signature it should be rejected.
+ *
+ * Observe that an independent counter is needed for each concurrent signing session
+ * such a device is involved in. To avoid fragility, it is therefore recommended that
+ * any offline signer be usable for only a single session at once.
+ *
+ * Given access to such a counter, its output should be used as (or mixed into) the
+ * session ID to ensure uniqueness.
+ *
+ * Fields:
+ *      combined_pk: MuSig-computed combined public key
+ *        n_signers: Number of signers
+ *          pk_hash: The 32-byte hash of the original public keys
+ *   combined_nonce: Summed combined public nonce (undefined if `nonce_is_set` is false)
+ *     nonce_is_set: Whether the above nonce has been set
+ * nonce_is_negated: If `nonce_is_set`, whether the above nonce was negated after
+ *                   summing the participants' nonces. Needed to ensure the nonce's y
+ *                   coordinate has a quadratic-residue y coordinate
+ *              msg: The 32-byte message (hash) to be signed
+ *       msg_is_set: Whether the above message has been set
+ *  has_secret_data: Whether this session object has a signers' secret data; if this
+ *                   is `false`, it may still be used for verification purposes.
+ *           seckey: If `has_secret_data`, the signer's secret key
+ *         secnonce: If `has_secret_data`, the signer's secret nonce
+ *            nonce: If `has_secret_data`, the signer's public nonce
+ * nonce_commitments_hash: If `has_secret_data` and `nonce_commitments_hash_is_set`,
+ *                   the hash of all signers' commitments
+ * nonce_commitments_hash_is_set: If `has_secret_data`, whether the
+ *                   nonce_commitments_hash has been set
+ */
+typedef struct {
+    secp256k1_pubkey combined_pk;
+    uint32_t n_signers;
+    unsigned char pk_hash[32];
+    secp256k1_pubkey combined_nonce;
+    int nonce_is_set;
+    int nonce_is_negated;
+    unsigned char msg[32];
+    int msg_is_set;
+    int has_secret_data;
+    unsigned char seckey[32];
+    unsigned char secnonce[32];
+    secp256k1_pubkey nonce;
+    unsigned char nonce_commitments_hash[32];
+    int nonce_commitments_hash_is_set;
+} secp256k1_musig_session;
+
+/** Data structure containing data on all signers in a single session.
+ *
+ * The workflow for this structure is as follows:
+ *
+ * 1. This structure is initialized with `musig_session_initialize` or
+ *    `musig_session_initialize_verifier`, which set the `index` field, and zero out
+ *    all other fields. The public session is initialized with the signers'
+ *    nonce_commitments.
+ *
+ * 2. In a non-public session the nonce_commitments are set with the function
+ *    `musig_get_public_nonce`, which also returns the signer's public nonce. This
+ *    ensures that the public nonce is not exposed until all commitments have been
+ *    received.
+ *
+ * 3. Each individual data struct should be updated with `musig_set_nonce` once a
+ *    nonce is available. This function takes a single signer data struct rather than
+ *    an array because it may fail in the case that the provided nonce does not match
+ *    the commitment. In this case, it is desirable to identify the exact party whose
+ *    nonce was inconsistent.
+ *
+ * Fields:
+ *   present: indicates whether the signer's nonce is set
+ *     index: index of the signer in the MuSig key aggregation
+ *     nonce: public nonce, must be a valid curvepoint if the signer is `present`
+ * nonce_commitment: commitment to the nonce, or all-bits zero if a commitment
+ *                   has not yet been set
+ */
+typedef struct {
+    int present;
+    uint32_t index;
+    secp256k1_pubkey nonce;
+    unsigned char nonce_commitment[32];
+} secp256k1_musig_session_signer_data;
+
+/** Opaque data structure that holds a MuSig partial signature.
+ *
+ *  The exact representation of data inside is implementation defined and not
+ *  guaranteed to be portable between different platforms or versions. It is however
+ *  guaranteed to be 32 bytes in size, and can be safely copied/moved. If you need
+ *  to convert to a format suitable for storage, transmission, or comparison, use the
+ *  `musig_partial_signature_serialize` and `musig_partial_signature_parse`
+ *  functions.
+ */
+typedef struct {
+    unsigned char data[32];
+} secp256k1_musig_partial_signature;
+
+/** Computes a combined public key and the hash of the given public keys
+ *
+ *  Returns: 1 if the public keys were successfully combined, 0 otherwise
+ *  Args:        ctx: pointer to a context object initialized for verification
+ *                    (cannot be NULL)
+ *           scratch: scratch space used to compute the combined pubkey by
+ *                    multiexponentiation. If NULL, an inefficient algorithm is used.
+ *  Out: combined_pk: the MuSig-combined public key (cannot be NULL)
+ *         pk_hash32: if non-NULL, filled with the 32-byte hash of all input public
+ *                    keys in order to be used in `musig_session_initialize`.
+ *   In:     pubkeys: input array of public keys to combine. The order is important;
+ *                    a different order will result in a different combined public
+ *                    key (cannot be NULL)
+ *         n_pubkeys: length of pubkeys array
+ */
+SECP256K1_API int secp256k1_musig_pubkey_combine(
+    const secp256k1_context* ctx,
+    secp256k1_scratch_space *scratch,
+    secp256k1_pubkey *combined_pk,
+    unsigned char *pk_hash32,
+    const secp256k1_pubkey *pubkeys,
+    size_t n_pubkeys
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5);
+
+/** Initializes a signing session for a signer
+ *
+ *  Returns: 1: session is successfully initialized
+ *           0: session could not be initialized: secret key or secret nonce overflow
+ *  Args:         ctx: pointer to a context object, initialized for signing (cannot
+ *                     be NULL)
+ *  Out:      session: the session structure to initialize (cannot be NULL)
+ *            signers: an array of signers' data to be initialized. Array length must
+ *                     equal to `n_signers` (cannot be NULL)
+ * nonce_commitment32: filled with a 32-byte commitment to the generated nonce
+ *                     (cannot be NULL)
+ *  In:  session_id32: a *unique* 32-byte ID to assign to this session (cannot be
+ *                     NULL). If a non-unique session_id32 was given then a partial
+ *                     signature will LEAK THE SECRET KEY.
+ *              msg32: the 32-byte message to be signed. Shouldn't be NULL unless you
+ *                     require sharing public nonces before the message is known
+ *                     because it reduces nonce misuse resistance. If NULL, must be
+ *                     set with `musig_session_set_msg` before signing and verifying.
+ *        combined_pk: the combined public key of all signers (cannot be NULL)
+ *          pk_hash32: the 32-byte hash of the signers' individual keys (cannot be
+ *                     NULL)
+ *          n_signers: length of signers array. Number of signers participating in
+ *                     the MuSig. Must be greater than 0 and at most 2^32 - 1.
+ *           my_index: index of this signer in the signers array
+ *             seckey: the signer's 32-byte secret key (cannot be NULL)
+ */
+SECP256K1_API int secp256k1_musig_session_initialize(
+    const secp256k1_context* ctx,
+    secp256k1_musig_session *session,
+    secp256k1_musig_session_signer_data *signers,
+    unsigned char *nonce_commitment32,
+    const unsigned char *session_id32,
+    const unsigned char *msg32,
+    const secp256k1_pubkey *combined_pk,
+    const unsigned char *pk_hash32,
+    size_t n_signers,
+    size_t my_index,
+    const unsigned char *seckey
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(7) SECP256K1_ARG_NONNULL(8) SECP256K1_ARG_NONNULL(11);
+
+/** Gets the signer's public nonce given a list of all signers' data with commitments
+ *
+ *  Returns: 1: public nonce is written in nonce
+ *           0: signer data is missing commitments or session isn't initialized
+ *              for signing
+ *  Args:        ctx: pointer to a context object (cannot be NULL)
+ *           session: the signing session to get the nonce from (cannot be NULL)
+ *           signers: an array of signers' data initialized with
+ *                    `musig_session_initialize`. Array length must equal to
+ *                    `n_commitments` (cannot be NULL)
+ *  Out:       nonce: the nonce (cannot be NULL)
+ *  In:  commitments: array of 32-byte nonce commitments (cannot be NULL)
+ *     n_commitments: the length of commitments and signers array. Must be the total
+ *                    number of signers participating in the MuSig.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_session_get_public_nonce(
+    const secp256k1_context* ctx,
+    secp256k1_musig_session *session,
+    secp256k1_musig_session_signer_data *signers,
+    secp256k1_pubkey *nonce,
+    const unsigned char *const *commitments,
+    size_t n_commitments
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+/** Initializes a verifier session that can be used for verifying nonce commitments
+ *  and partial signatures. It does not have secret key material and therefore can not
+ *  be used to create signatures.
+ *
+ *  Returns: 1 when session is successfully initialized, 0 otherwise
+ *  Args:        ctx: pointer to a context object (cannot be NULL)
+ *  Out:     session: the session structure to initialize (cannot be NULL)
+ *           signers: an array of signers' data to be initialized. Array length must
+ *                    equal to `n_signers`(cannot be NULL)
+ *  In:        msg32: the 32-byte message to be signed If NULL, must be set with
+ *                    `musig_session_set_msg` before using the session for verifying
+ *                    partial signatures.
+ *       combined_pk: the combined public key of all signers (cannot be NULL)
+ *         pk_hash32: the 32-byte hash of the signers' individual keys (cannot be NULL)
+ *       commitments: array of 32-byte nonce commitments. Array length must equal to
+ *                    `n_signers` (cannot be NULL)
+ *         n_signers: length of signers and commitments array. Number of signers
+ *                    participating in the MuSig. Must be greater than 0 and at most
+ *                    2^32 - 1.
+ */
+SECP256K1_API int secp256k1_musig_session_initialize_verifier(
+    const secp256k1_context* ctx,
+    secp256k1_musig_session *session,
+    secp256k1_musig_session_signer_data *signers,
+    const unsigned char *msg32,
+    const secp256k1_pubkey *combined_pk,
+    const unsigned char *pk_hash32,
+    const unsigned char *const *commitments,
+    size_t n_signers
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(7);
+
+/** Checks a signer's public nonce against a commitment to said nonce, and update
+ *  data structure if they match
+ *
+ *  Returns: 1: commitment was valid, data structure updated
+ *           0: commitment was invalid, nothing happened
+ *  Args:      ctx: pointer to a context object (cannot be NULL)
+ *          signer: pointer to the signer data to update (cannot be NULL). Must have
+ *                  been used with `musig_session_get_public_nonce` or initialized
+ *                  with `musig_session_initialize_verifier`.
+ *  In:     nonce: signer's alleged public nonce (cannot be NULL)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_set_nonce(
+    const secp256k1_context* ctx,
+    secp256k1_musig_session_signer_data *signer,
+    const secp256k1_pubkey *nonce
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Updates a session with the combined public nonce of all signers. The combined
+ * public nonce is the sum of every signer's public nonce.
+ *
+ *  Returns: 1: nonces are successfully combined
+ *           0: a signer's nonce is missing
+ *  Args:        ctx: pointer to a context object (cannot be NULL)
+ *           session: session to update with the combined public nonce (cannot be
+ *                    NULL)
+ *           signers: an array of signers' data, which must have had public nonces
+ *                    set with `musig_set_nonce`. Array length must equal to `n_signers`
+ *                    (cannot be NULL)
+ *         n_signers: the length of the signers array. Must be the total number of
+ *                    signers participating in the MuSig.
+ *  Out: nonce_is_negated: a pointer to an integer that indicates if the combined
+ *                    public nonce had to be negated.
+ *           adaptor: point to add to the combined public nonce. If NULL, nothing is
+ *                    added to the combined nonce.
+ */
+SECP256K1_API int secp256k1_musig_session_combine_nonces(
+    const secp256k1_context* ctx,
+    secp256k1_musig_session *session,
+    const secp256k1_musig_session_signer_data *signers,
+    size_t n_signers,
+    int *nonce_is_negated,
+    const secp256k1_pubkey *adaptor
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
+
+/** Sets the message of a session if previously unset
+ *
+ *  Returns 1 if the message was not set yet and is now successfully set
+ *          0 otherwise
+ *  Args:    ctx: pointer to a context object (cannot be NULL)
+ *       session: the session structure to update with the message (cannot be NULL)
+ *  In:    msg32: the 32-byte message to be signed (cannot be NULL)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_session_set_msg(
+    const secp256k1_context* ctx,
+    secp256k1_musig_session *session,
+    const unsigned char *msg32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Serialize a MuSig partial signature or adaptor signature
+ *
+ *  Returns: 1 when the signature could be serialized, 0 otherwise
+ *  Args:    ctx: a secp256k1 context object
+ *  Out:   out32: pointer to a 32-byte array to store the serialized signature
+ *  In:      sig: pointer to the signature
+ */
+SECP256K1_API int secp256k1_musig_partial_signature_serialize(
+    const secp256k1_context* ctx,
+    unsigned char *out32,
+    const secp256k1_musig_partial_signature* sig
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Parse and verify a MuSig partial signature.
+ *
+ *  Returns: 1 when the signature could be parsed, 0 otherwise.
+ *  Args:    ctx: a secp256k1 context object
+ *  Out:     sig: pointer to a signature object
+ *  In:     in32: pointer to the 32-byte signature to be parsed
+ *
+ *  After the call, sig will always be initialized. If parsing failed or the
+ *  encoded numbers are out of range, signature verification with it is
+ *  guaranteed to fail for every message and public key.
+ */
+SECP256K1_API int secp256k1_musig_partial_signature_parse(
+    const secp256k1_context* ctx,
+    secp256k1_musig_partial_signature* sig,
+    const unsigned char *in32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Produces a partial signature
+ *
+ *  Returns: 1: partial signature constructed
+ *           0: session in incorrect or inconsistent state
+ *  Args:         ctx: pointer to a context object (cannot be NULL)
+ *            session: active signing session for which the combined nonce has been
+ *                     computed (cannot be NULL)
+ *  Out:  partial_sig: partial signature (cannot be NULL)
+ */
+SECP256K1_API int secp256k1_musig_partial_sign(
+    const secp256k1_context* ctx,
+    const secp256k1_musig_session *session,
+    secp256k1_musig_partial_signature *partial_sig
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Checks that an individual partial signature verifies
+ *
+ *  This function is essential when using protocols with adaptor signatures.
+ *  However, it is not essential for regular MuSig's, in the sense that if any
+ *  partial signatures does not verify, the full signature will also not verify, so the
+ *  problem will be caught. But this function allows determining the specific party
+ *  who produced an invalid signature, so that signing can be restarted without them.
+ *
+ *  Returns: 1: partial signature verifies
+ *           0: invalid signature or bad data
+ *  Args:         ctx: pointer to a context object (cannot be NULL)
+ *            session: active session for which the combined nonce has been computed
+ *                     (cannot be NULL)
+ *             signer: data for the signer who produced this signature (cannot be NULL)
+ *  In:   partial_sig: signature to verify (cannot be NULL)
+ *             pubkey: public key of the signer who produced the signature (cannot be NULL)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_partial_sig_verify(
+    const secp256k1_context* ctx,
+    const secp256k1_musig_session *session,
+    const secp256k1_musig_session_signer_data *signer,
+    const secp256k1_musig_partial_signature *partial_sig,
+    const secp256k1_pubkey *pubkey
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+/** Combines partial signatures
+ *
+ *  Returns: 1: all partial signatures have values in range. Does NOT mean the
+ *              resulting signature verifies.
+ *           0: some partial signature had s/r out of range
+ *  Args:         ctx: pointer to a context object (cannot be NULL)
+ *            session: initialized session for which the combined nonce has been
+ *                     computed (cannot be NULL)
+ *  Out:          sig: complete signature (cannot be NULL)
+ *  In:  partial_sigs: array of partial signatures to combine (cannot be NULL)
+ *             n_sigs: number of signatures in the partial_sigs array
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_partial_sig_combine(
+    const secp256k1_context* ctx,
+    const secp256k1_musig_session *session,
+    secp256k1_schnorrsig *sig,
+    const secp256k1_musig_partial_signature *partial_sigs,
+    size_t n_sigs
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Converts a partial signature to an adaptor signature by adding a given secret
+ *  adaptor.
+ *
+ *  Returns: 1: signature and secret adaptor contained valid values
+ *           0: otherwise
+ *  Args:         ctx: pointer to a context object (cannot be NULL)
+ *  Out:  adaptor_sig: adaptor signature to produce (cannot be NULL)
+ *  In:   partial_sig: partial signature to tweak with secret adaptor (cannot be NULL)
+ *      sec_adaptor32: 32-byte secret adaptor to add to the partial signature (cannot
+ *                     be NULL)
+ *   nonce_is_negated: the `nonce_is_negated` output of `musig_session_combine_nonces`
+ */
+SECP256K1_API int secp256k1_musig_partial_sig_adapt(
+    const secp256k1_context* ctx,
+    secp256k1_musig_partial_signature *adaptor_sig,
+    const secp256k1_musig_partial_signature *partial_sig,
+    const unsigned char *sec_adaptor32,
+    int nonce_is_negated
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Extracts a secret adaptor from a MuSig, given all parties' partial
+ *  signatures. This function will not fail unless given grossly invalid data; if it
+ *  is merely given signatures that do not verify, the returned value will be
+ *  nonsense. It is therefore important that all data be verified at earlier steps of
+ *  any protocol that uses this function.
+ *
+ *  Returns: 1: signatures contained valid data such that an adaptor could be extracted
+ *           0: otherwise
+ *  Args:         ctx: pointer to a context object (cannot be NULL)
+ *  Out:sec_adaptor32: 32-byte secret adaptor (cannot be NULL)
+ *  In:           sig: complete 2-of-2 signature (cannot be NULL)
+ *       partial_sigs: array of partial signatures (cannot be NULL)
+ *     n_partial_sigs: number of elements in partial_sigs array
+ *   nonce_is_negated: the `nonce_is_negated` output of `musig_session_combine_nonces`
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_extract_secret_adaptor(
+    const secp256k1_context* ctx,
+    unsigned char *sec_adaptor32,
+    const secp256k1_schnorrsig *sig,
+    const secp256k1_musig_partial_signature *partial_sigs,
+    size_t n_partial_sigs,
+    int nonce_is_negated
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+#endif
diff --git a/src/modules/musig/Makefile.am.include b/src/modules/musig/Makefile.am.include
new file mode 100644
index 000000000..6099ab727
--- /dev/null
+++ b/src/modules/musig/Makefile.am.include
@@ -0,0 +1,3 @@
+include_HEADERS += include/secp256k1_musig.h
+noinst_HEADERS += src/modules/musig/main_impl.h
+noinst_HEADERS += src/modules/musig/tests_impl.h
diff --git a/src/modules/musig/main_impl.h b/src/modules/musig/main_impl.h
new file mode 100644
index 000000000..d6d9e17d1
--- /dev/null
+++ b/src/modules/musig/main_impl.h
@@ -0,0 +1,629 @@
+/**********************************************************************
+ * Copyright (c) 2018 Andrew Poelstra, Jonas Nick                     *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef _SECP256K1_MODULE_MUSIG_MAIN_
+#define _SECP256K1_MODULE_MUSIG_MAIN_
+
+#include "include/secp256k1.h"
+#include "include/secp256k1_musig.h"
+#include "hash.h"
+
+/* Computes ell = SHA256(pk[0], ..., pk[np-1]) */
+static int secp256k1_musig_compute_ell(const secp256k1_context *ctx, unsigned char *ell, const secp256k1_pubkey *pk, size_t np) {
+    secp256k1_sha256 sha;
+    size_t i;
+
+    secp256k1_sha256_initialize(&sha);
+    for (i = 0; i < np; i++) {
+        unsigned char ser[33];
+        size_t serlen = sizeof(ser);
+        if (!secp256k1_ec_pubkey_serialize(ctx, ser, &serlen, &pk[i], SECP256K1_EC_COMPRESSED)) {
+            return 0;
+        }
+        secp256k1_sha256_write(&sha, ser, serlen);
+    }
+    secp256k1_sha256_finalize(&sha, ell);
+    return 1;
+}
+
+/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
+ * SHA256 to SHA256("MuSig coefficient")||SHA256("MuSig coefficient"). */
+static void secp256k1_musig_sha256_init_tagged(secp256k1_sha256 *sha) {
+    secp256k1_sha256_initialize(sha);
+
+    sha->s[0] = 0x0fd0690cul;
+    sha->s[1] = 0xfefeae97ul;
+    sha->s[2] = 0x996eac7ful;
+    sha->s[3] = 0x5c30d864ul;
+    sha->s[4] = 0x8c4a0573ul;
+    sha->s[5] = 0xaca1a22ful;
+    sha->s[6] = 0x6f43b801ul;
+    sha->s[7] = 0x85ce27cdul;
+    sha->bytes = 64;
+}
+
+/* Compute r = SHA256(ell, idx). The four bytes of idx are serialized least significant byte first. */
+static void secp256k1_musig_coefficient(secp256k1_scalar *r, const unsigned char *ell, uint32_t idx) {
+    secp256k1_sha256 sha;
+    unsigned char buf[32];
+    size_t i;
+
+    secp256k1_musig_sha256_init_tagged(&sha);
+    secp256k1_sha256_write(&sha, ell, 32);
+    /* We're hashing the index of the signer instead of its public key as specified
+     * in the MuSig paper. This reduces the total amount of data that needs to be
+     * hashed.
+     * Additionally, it prevents creating identical musig_coefficients for identical
+     * public keys. A participant Bob could choose his public key to be the same as
+     * Alice's, then replay Alice's messages (nonce and partial signature) to create
+     * a valid partial signature. This is not a problem for MuSig per se, but could
+     * result in subtle issues with protocols building on threshold signatures.
+     * With the assumption that public keys are unique, hashing the index is
+     * equivalent to hashing the public key. Because the public key can be
+     * identified by the index given the ordered list of public keys (included in
+     * ell), the index is just a different encoding of the public key.*/
+    for (i = 0; i < sizeof(uint32_t); i++) {
+        unsigned char c = idx;
+        secp256k1_sha256_write(&sha, &c, 1);
+        idx >>= 8;
+    }
+    secp256k1_sha256_finalize(&sha, buf);
+    secp256k1_scalar_set_b32(r, buf, NULL);
+}
+
+typedef struct {
+    const secp256k1_context *ctx;
+    unsigned char ell[32];
+    const secp256k1_pubkey *pks;
+} secp256k1_musig_pubkey_combine_ecmult_data;
+
+/* Callback for batch EC multiplication to compute ell_0*P0 + ell_1*P1 + ...  */
+static int secp256k1_musig_pubkey_combine_callback(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *data) {
+    secp256k1_musig_pubkey_combine_ecmult_data *ctx = (secp256k1_musig_pubkey_combine_ecmult_data *) data;
+    secp256k1_musig_coefficient(sc, ctx->ell, idx);
+    return secp256k1_pubkey_load(ctx->ctx, pt, &ctx->pks[idx]);
+}
+
+
+static void secp256k1_musig_signers_init(secp256k1_musig_session_signer_data *signers, uint32_t n_signers) {
+    uint32_t i;
+    for (i = 0; i < n_signers; i++) {
+        memset(&signers[i], 0, sizeof(signers[i]));
+        signers[i].index = i;
+        signers[i].present = 0;
+    }
+}
+
+int secp256k1_musig_pubkey_combine(const secp256k1_context* ctx, secp256k1_scratch_space *scratch, secp256k1_pubkey *combined_pk, unsigned char *pk_hash32, const secp256k1_pubkey *pubkeys, size_t n_pubkeys) {
+    secp256k1_musig_pubkey_combine_ecmult_data ecmult_data;
+    secp256k1_gej pkj;
+    secp256k1_ge pkp;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(combined_pk != NULL);
+    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
+    ARG_CHECK(pubkeys != NULL);
+    ARG_CHECK(n_pubkeys > 0);
+
+    ecmult_data.ctx = ctx;
+    ecmult_data.pks = pubkeys;
+    if (!secp256k1_musig_compute_ell(ctx, ecmult_data.ell, pubkeys, n_pubkeys)) {
+        return 0;
+    }
+    if (!secp256k1_ecmult_multi_var(&ctx->ecmult_ctx, scratch, &pkj, NULL, secp256k1_musig_pubkey_combine_callback, (void *) &ecmult_data, n_pubkeys)) {
+        return 0;
+    }
+    secp256k1_ge_set_gej(&pkp, &pkj);
+    secp256k1_pubkey_save(combined_pk, &pkp);
+
+    if (pk_hash32 != NULL) {
+        memcpy(pk_hash32, ecmult_data.ell, 32);
+    }
+    return 1;
+}
+
+int secp256k1_musig_session_initialize(const secp256k1_context* ctx, secp256k1_musig_session *session, secp256k1_musig_session_signer_data *signers, unsigned char *nonce_commitment32, const unsigned char *session_id32, const unsigned char *msg32, const secp256k1_pubkey *combined_pk, const unsigned char *pk_hash32, size_t n_signers, size_t my_index, const unsigned char *seckey) {
+    unsigned char combined_ser[33];
+    size_t combined_ser_size = sizeof(combined_ser);
+    int overflow;
+    secp256k1_scalar secret;
+    secp256k1_scalar mu;
+    secp256k1_sha256 sha;
+    secp256k1_gej rj;
+    secp256k1_ge rp;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(session != NULL);
+    ARG_CHECK(signers != NULL);
+    ARG_CHECK(nonce_commitment32 != NULL);
+    ARG_CHECK(session_id32 != NULL);
+    ARG_CHECK(combined_pk != NULL);
+    ARG_CHECK(pk_hash32 != NULL);
+    ARG_CHECK(seckey != NULL);
+
+    memset(session, 0, sizeof(*session));
+
+    if (msg32 != NULL) {
+        memcpy(session->msg, msg32, 32);
+        session->msg_is_set = 1;
+    } else {
+        session->msg_is_set = 0;
+    }
+    memcpy(&session->combined_pk, combined_pk, sizeof(*combined_pk));
+    memcpy(session->pk_hash, pk_hash32, 32);
+    session->nonce_is_set = 0;
+    session->has_secret_data = 1;
+    if (n_signers == 0 || my_index >= n_signers) {
+        return 0;
+    }
+    if (n_signers > UINT32_MAX) {
+        return 0;
+    }
+    session->n_signers = (uint32_t) n_signers;
+    secp256k1_musig_signers_init(signers, session->n_signers);
+    session->nonce_commitments_hash_is_set = 0;
+
+    /* Compute secret key */
+    secp256k1_scalar_set_b32(&secret, seckey, &overflow);
+    if (overflow) {
+        secp256k1_scalar_clear(&secret);
+        return 0;
+    }
+    secp256k1_musig_coefficient(&mu, pk_hash32, (uint32_t) my_index);
+    secp256k1_scalar_mul(&secret, &secret, &mu);
+    secp256k1_scalar_get_b32(session->seckey, &secret);
+
+    /* Compute secret nonce */
+    secp256k1_sha256_initialize(&sha);
+    secp256k1_sha256_write(&sha, session_id32, 32);
+    if (session->msg_is_set) {
+        secp256k1_sha256_write(&sha, msg32, 32);
+    }
+    secp256k1_ec_pubkey_serialize(ctx, combined_ser, &combined_ser_size, combined_pk, SECP256K1_EC_COMPRESSED);
+    secp256k1_sha256_write(&sha, combined_ser, combined_ser_size);
+    secp256k1_sha256_write(&sha, seckey, 32);
+    secp256k1_sha256_finalize(&sha, session->secnonce);
+    secp256k1_scalar_set_b32(&secret, session->secnonce, &overflow);
+    if (overflow) {
+        secp256k1_scalar_clear(&secret);
+        return 0;
+    }
+
+    /* Compute public nonce and commitment */
+    secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &secret);
+    secp256k1_ge_set_gej(&rp, &rj);
+    secp256k1_pubkey_save(&session->nonce, &rp);
+
+    if (nonce_commitment32 != NULL) {
+        unsigned char commit[33];
+        size_t commit_size = sizeof(commit);
+        secp256k1_sha256_initialize(&sha);
+        secp256k1_ec_pubkey_serialize(ctx, commit, &commit_size, &session->nonce, SECP256K1_EC_COMPRESSED);
+        secp256k1_sha256_write(&sha, commit, commit_size);
+        secp256k1_sha256_finalize(&sha, nonce_commitment32);
+    }
+
+    secp256k1_scalar_clear(&secret);
+    return 1;
+}
+
+int secp256k1_musig_session_get_public_nonce(const secp256k1_context* ctx, secp256k1_musig_session *session, secp256k1_musig_session_signer_data *signers, secp256k1_pubkey *nonce, const unsigned char *const *commitments, size_t n_commitments) {
+    secp256k1_sha256 sha;
+    unsigned char nonce_commitments_hash[32];
+    size_t i;
+    (void) ctx;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(session != NULL);
+    ARG_CHECK(signers != NULL);
+    ARG_CHECK(nonce != NULL);
+    ARG_CHECK(commitments != NULL);
+
+    if (!session->has_secret_data || n_commitments != session->n_signers) {
+        return 0;
+    }
+    for (i = 0; i < n_commitments; i++) {
+        ARG_CHECK(commitments[i] != NULL);
+    }
+
+    secp256k1_sha256_initialize(&sha);
+    for (i = 0; i < n_commitments; i++) {
+        memcpy(signers[i].nonce_commitment, commitments[i], 32);
+        secp256k1_sha256_write(&sha, commitments[i], 32);
+    }
+    secp256k1_sha256_finalize(&sha, nonce_commitments_hash);
+    if (session->nonce_commitments_hash_is_set
+            && memcmp(session->nonce_commitments_hash, nonce_commitments_hash, 32) != 0) {
+        /* Abort if get_public_nonce has been called before with a different array of
+         * commitments. */
+        return 0;
+    }
+    memcpy(session->nonce_commitments_hash, nonce_commitments_hash, 32);
+    session->nonce_commitments_hash_is_set = 1;
+    memcpy(nonce, &session->nonce, sizeof(*nonce));
+    return 1;
+}
+
+int secp256k1_musig_session_initialize_verifier(const secp256k1_context* ctx, secp256k1_musig_session *session, secp256k1_musig_session_signer_data *signers, const unsigned char *msg32, const secp256k1_pubkey *combined_pk, const unsigned char *pk_hash32, const unsigned char *const *commitments, size_t n_signers) {
+    size_t i;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(session != NULL);
+    ARG_CHECK(signers != NULL);
+    ARG_CHECK(combined_pk != NULL);
+    ARG_CHECK(pk_hash32 != NULL);
+    ARG_CHECK(commitments != NULL);
+    /* Check n_signers before checking commitments to allow testing the case where
+     * n_signers is big without allocating the space. */
+    if (n_signers > UINT32_MAX) {
+        return 0;
+    }
+    for (i = 0; i < n_signers; i++) {
+        ARG_CHECK(commitments[i] != NULL);
+    }
+    (void) ctx;
+
+    memset(session, 0, sizeof(*session));
+
+    memcpy(&session->combined_pk, combined_pk, sizeof(*combined_pk));
+    if (n_signers == 0) {
+        return 0;
+    }
+    session->n_signers = (uint32_t) n_signers;
+    secp256k1_musig_signers_init(signers, session->n_signers);
+
+    memcpy(session->pk_hash, pk_hash32, 32);
+    session->nonce_is_set = 0;
+    session->msg_is_set = 0;
+    if (msg32 != NULL) {
+        memcpy(session->msg, msg32, 32);
+        session->msg_is_set = 1;
+    }
+    session->has_secret_data = 0;
+    session->nonce_commitments_hash_is_set = 0;
+
+    for (i = 0; i < n_signers; i++) {
+        memcpy(signers[i].nonce_commitment, commitments[i], 32);
+    }
+    return 1;
+}
+
+int secp256k1_musig_set_nonce(const secp256k1_context* ctx, secp256k1_musig_session_signer_data *signer, const secp256k1_pubkey *nonce) {
+    unsigned char commit[33];
+    size_t commit_size = sizeof(commit);
+    secp256k1_sha256 sha;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(signer != NULL);
+    ARG_CHECK(nonce != NULL);
+
+    secp256k1_sha256_initialize(&sha);
+    secp256k1_ec_pubkey_serialize(ctx, commit, &commit_size, nonce, SECP256K1_EC_COMPRESSED);
+    secp256k1_sha256_write(&sha, commit, commit_size);
+    secp256k1_sha256_finalize(&sha, commit);
+
+    if (memcmp(commit, signer->nonce_commitment, 32) != 0) {
+        return 0;
+    }
+    memcpy(&signer->nonce, nonce, sizeof(*nonce));
+    signer->present = 1;
+    return 1;
+}
+
+int secp256k1_musig_session_combine_nonces(const secp256k1_context* ctx, secp256k1_musig_session *session, const secp256k1_musig_session_signer_data *signers, size_t n_signers, int *nonce_is_negated, const secp256k1_pubkey *adaptor) {
+    secp256k1_gej combined_noncej;
+    secp256k1_ge combined_noncep;
+    secp256k1_ge noncep;
+    secp256k1_sha256 sha;
+    unsigned char nonce_commitments_hash[32];
+    size_t i;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(session != NULL);
+    ARG_CHECK(signers != NULL);
+
+    if (n_signers != session->n_signers) {
+        return 0;
+    }
+    secp256k1_sha256_initialize(&sha);
+    secp256k1_gej_set_infinity(&combined_noncej);
+    for (i = 0; i < n_signers; i++) {
+        if (!signers[i].present) {
+            return 0;
+        }
+        secp256k1_sha256_write(&sha, signers[i].nonce_commitment, 32);
+        secp256k1_pubkey_load(ctx, &noncep, &signers[i].nonce);
+        secp256k1_gej_add_ge_var(&combined_noncej, &combined_noncej, &noncep, NULL);
+    }
+    secp256k1_sha256_finalize(&sha, nonce_commitments_hash);
+    /* Either the session is a verifier session or or the nonce_commitments_hash has
+     * been set in `musig_session_get_public_nonce`. */
+    VERIFY_CHECK(!session->has_secret_data || session->nonce_commitments_hash_is_set);
+    if (session->has_secret_data
+            && memcmp(session->nonce_commitments_hash, nonce_commitments_hash, 32) != 0) {
+        /* If the signers' commitments changed between get_public_nonce and now we
+         * have to abort because in that case they may have seen our nonce before
+         * creating their commitment. That can happen if the signer_data given to
+         * this function is different to the signer_data given to get_public_nonce.
+         * */
+        return 0;
+    }
+
+    /* Add public adaptor to nonce */
+    if (adaptor != NULL) {
+        secp256k1_pubkey_load(ctx, &noncep, adaptor);
+        secp256k1_gej_add_ge_var(&combined_noncej, &combined_noncej, &noncep, NULL);
+    }
+    secp256k1_ge_set_gej(&combined_noncep, &combined_noncej);
+    if (secp256k1_fe_is_quad_var(&combined_noncep.y)) {
+        session->nonce_is_negated = 0;
+    } else {
+        session->nonce_is_negated = 1;
+        secp256k1_ge_neg(&combined_noncep, &combined_noncep);
+    }
+    if (nonce_is_negated != NULL) {
+        *nonce_is_negated = session->nonce_is_negated;
+    }
+    secp256k1_pubkey_save(&session->combined_nonce, &combined_noncep);
+    session->nonce_is_set = 1;
+    return 1;
+}
+
+int secp256k1_musig_session_set_msg(const secp256k1_context* ctx, secp256k1_musig_session *session, const unsigned char *msg32) {
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(session != NULL);
+    ARG_CHECK(msg32 != NULL);
+
+    if (session->msg_is_set) {
+        return 0;
+    }
+    memcpy(session->msg, msg32, 32);
+    session->msg_is_set = 1;
+    return 1;
+}
+
+int secp256k1_musig_partial_signature_serialize(const secp256k1_context* ctx, unsigned char *out32, const secp256k1_musig_partial_signature* sig) {
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(out32 != NULL);
+    ARG_CHECK(sig != NULL);
+    memcpy(out32, sig->data, 32);
+    return 1;
+}
+
+int secp256k1_musig_partial_signature_parse(const secp256k1_context* ctx, secp256k1_musig_partial_signature* sig, const unsigned char *in32) {
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(sig != NULL);
+    ARG_CHECK(in32 != NULL);
+    memcpy(sig->data, in32, 32);
+    return 1;
+}
+
+/* Compute msghash = SHA256(combined_nonce, combined_pk, msg) */
+static int secp256k1_musig_compute_messagehash(const secp256k1_context *ctx, unsigned char *msghash, const secp256k1_musig_session *session) {
+    unsigned char buf[33];
+    size_t bufsize = 33;
+    secp256k1_ge rp;
+    secp256k1_sha256 sha;
+
+    secp256k1_sha256_initialize(&sha);
+    if (!session->nonce_is_set) {
+        return 0;
+    }
+    secp256k1_pubkey_load(ctx, &rp, &session->combined_nonce);
+    secp256k1_fe_get_b32(buf, &rp.x);
+    secp256k1_sha256_write(&sha, buf, 32);
+    secp256k1_ec_pubkey_serialize(ctx, buf, &bufsize, &session->combined_pk, SECP256K1_EC_COMPRESSED);
+    VERIFY_CHECK(bufsize == 33);
+    secp256k1_sha256_write(&sha, buf, bufsize);
+    if (!session->msg_is_set) {
+        return 0;
+    }
+    secp256k1_sha256_write(&sha, session->msg, 32);
+    secp256k1_sha256_finalize(&sha, msghash);
+    return 1;
+}
+
+int secp256k1_musig_partial_sign(const secp256k1_context* ctx, const secp256k1_musig_session *session, secp256k1_musig_partial_signature *partial_sig) {
+    unsigned char msghash[32];
+    int overflow;
+    secp256k1_scalar sk;
+    secp256k1_scalar e, k;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(partial_sig != NULL);
+    ARG_CHECK(session != NULL);
+
+    if (!session->nonce_is_set || !session->has_secret_data) {
+        return 0;
+    }
+
+    /* build message hash */
+    if (!secp256k1_musig_compute_messagehash(ctx, msghash, session)) {
+        return 0;
+    }
+    secp256k1_scalar_set_b32(&e, msghash, NULL);
+
+    secp256k1_scalar_set_b32(&sk, session->seckey, &overflow);
+    if (overflow) {
+        secp256k1_scalar_clear(&sk);
+        return 0;
+    }
+
+    secp256k1_scalar_set_b32(&k, session->secnonce, &overflow);
+    if (overflow || secp256k1_scalar_is_zero(&k)) {
+        secp256k1_scalar_clear(&sk);
+        secp256k1_scalar_clear(&k);
+        return 0;
+    }
+    if (session->nonce_is_negated) {
+        secp256k1_scalar_negate(&k, &k);
+    }
+
+    /* Sign */
+    secp256k1_scalar_mul(&e, &e, &sk);
+    secp256k1_scalar_add(&e, &e, &k);
+    secp256k1_scalar_get_b32(&partial_sig->data[0], &e);
+    secp256k1_scalar_clear(&sk);
+    secp256k1_scalar_clear(&k);
+
+    return 1;
+}
+
+int secp256k1_musig_partial_sig_combine(const secp256k1_context* ctx, const secp256k1_musig_session *session, secp256k1_schnorrsig *sig, const secp256k1_musig_partial_signature *partial_sigs, size_t n_sigs) {
+    size_t i;
+    secp256k1_scalar s;
+    secp256k1_ge noncep;
+    (void) ctx;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(sig != NULL);
+    ARG_CHECK(partial_sigs != NULL);
+    ARG_CHECK(session != NULL);
+
+    if (!session->nonce_is_set) {
+        return 0;
+    }
+    if (n_sigs != session->n_signers) {
+        return 0;
+    }
+    secp256k1_scalar_clear(&s);
+    for (i = 0; i < n_sigs; i++) {
+        int overflow;
+        secp256k1_scalar term;
+
+        secp256k1_scalar_set_b32(&term, partial_sigs[i].data, &overflow);
+        if (overflow) {
+            return 0;
+        }
+        secp256k1_scalar_add(&s, &s, &term);
+    }
+
+    secp256k1_pubkey_load(ctx, &noncep, &session->combined_nonce);
+    VERIFY_CHECK(secp256k1_fe_is_quad_var(&noncep.y));
+    secp256k1_fe_normalize(&noncep.x);
+    secp256k1_fe_get_b32(&sig->data[0], &noncep.x);
+    secp256k1_scalar_get_b32(&sig->data[32], &s);
+
+    return 1;
+}
+
+int secp256k1_musig_partial_sig_verify(const secp256k1_context* ctx, const secp256k1_musig_session *session, const secp256k1_musig_session_signer_data *signer, const secp256k1_musig_partial_signature *partial_sig, const secp256k1_pubkey *pubkey) {
+    unsigned char msghash[32];
+    secp256k1_scalar s;
+    secp256k1_scalar e;
+    secp256k1_scalar mu;
+    secp256k1_gej rj;
+    secp256k1_ge rp;
+    int overflow;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
+    ARG_CHECK(session != NULL);
+    ARG_CHECK(signer != NULL);
+    ARG_CHECK(partial_sig != NULL);
+    ARG_CHECK(pubkey != NULL);
+
+    if (!session->nonce_is_set || !signer->present) {
+        return 0;
+    }
+    secp256k1_scalar_set_b32(&s, partial_sig->data, &overflow);
+    if (overflow) {
+        return 0;
+    }
+    if (!secp256k1_musig_compute_messagehash(ctx, msghash, session)) {
+        return 0;
+    }
+    secp256k1_scalar_set_b32(&e, msghash, NULL);
+
+    /* Multiplying the messagehash by the musig coefficient is equivalent
+     * to multiplying the signer's public key by the coefficient, except
+     * much easier to do. */
+    secp256k1_musig_coefficient(&mu, session->pk_hash, signer->index);
+    secp256k1_scalar_mul(&e, &e, &mu);
+
+    if (!secp256k1_pubkey_load(ctx, &rp, &signer->nonce)) {
+        return 0;
+    }
+
+    if (!secp256k1_schnorrsig_real_verify(ctx, &rj, &s, &e, pubkey)) {
+        return 0;
+    }
+    if (!session->nonce_is_negated) {
+        secp256k1_ge_neg(&rp, &rp);
+    }
+    secp256k1_gej_add_ge_var(&rj, &rj, &rp, NULL);
+
+    return secp256k1_gej_is_infinity(&rj);
+}
+
+int secp256k1_musig_partial_sig_adapt(const secp256k1_context* ctx, secp256k1_musig_partial_signature *adaptor_sig, const secp256k1_musig_partial_signature *partial_sig, const unsigned char *sec_adaptor32, int nonce_is_negated) {
+    secp256k1_scalar s;
+    secp256k1_scalar t;
+    int overflow;
+
+    (void) ctx;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(adaptor_sig != NULL);
+    ARG_CHECK(partial_sig != NULL);
+    ARG_CHECK(sec_adaptor32 != NULL);
+
+    secp256k1_scalar_set_b32(&s, partial_sig->data, &overflow);
+    if (overflow) {
+        return 0;
+    }
+    secp256k1_scalar_set_b32(&t, sec_adaptor32, &overflow);
+    if (overflow) {
+        secp256k1_scalar_clear(&t);
+        return 0;
+    }
+
+    if (nonce_is_negated) {
+        secp256k1_scalar_negate(&t, &t);
+    }
+
+    secp256k1_scalar_add(&s, &s, &t);
+    secp256k1_scalar_get_b32(adaptor_sig->data, &s);
+    secp256k1_scalar_clear(&t);
+    return 1;
+}
+
+int secp256k1_musig_extract_secret_adaptor(const secp256k1_context* ctx, unsigned char *sec_adaptor32, const secp256k1_schnorrsig *sig, const secp256k1_musig_partial_signature *partial_sigs, size_t n_partial_sigs, int nonce_is_negated) {
+    secp256k1_scalar t;
+    secp256k1_scalar s;
+    int overflow;
+    size_t i;
+
+    (void) ctx;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(sec_adaptor32 != NULL);
+    ARG_CHECK(sig != NULL);
+    ARG_CHECK(partial_sigs != NULL);
+
+    secp256k1_scalar_set_b32(&t, &sig->data[32], &overflow);
+    if (overflow) {
+        return 0;
+    }
+    secp256k1_scalar_negate(&t, &t);
+
+    for (i = 0; i < n_partial_sigs; i++) {
+        secp256k1_scalar_set_b32(&s, partial_sigs[i].data, &overflow);
+        if (overflow) {
+            secp256k1_scalar_clear(&t);
+            return 0;
+        }
+        secp256k1_scalar_add(&t, &t, &s);
+    }
+
+    if (!nonce_is_negated) {
+        secp256k1_scalar_negate(&t, &t);
+    }
+    secp256k1_scalar_get_b32(sec_adaptor32, &t);
+    secp256k1_scalar_clear(&t);
+    return 1;
+}
+
+#endif
diff --git a/src/modules/musig/tests_impl.h b/src/modules/musig/tests_impl.h
new file mode 100644
index 000000000..79688af24
--- /dev/null
+++ b/src/modules/musig/tests_impl.h
@@ -0,0 +1,757 @@
+/**********************************************************************
+ * Copyright (c) 2018 Andrew Poelstra                                 *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef _SECP256K1_MODULE_MUSIG_TESTS_
+#define _SECP256K1_MODULE_MUSIG_TESTS_
+
+#include "secp256k1_musig.h"
+
+void musig_api_tests(secp256k1_scratch_space *scratch) {
+    secp256k1_scratch_space *scratch_small;
+    secp256k1_musig_session session[2];
+    secp256k1_musig_session verifier_session;
+    secp256k1_musig_session_signer_data signer0[2];
+    secp256k1_musig_session_signer_data signer1[2];
+    secp256k1_musig_session_signer_data verifier_signer_data[2];
+    secp256k1_musig_partial_signature partial_sig[2];
+    secp256k1_musig_partial_signature partial_sig_adapted[2];
+    secp256k1_musig_partial_signature partial_sig_overflow;
+    secp256k1_schnorrsig final_sig;
+    secp256k1_schnorrsig final_sig_cmp;
+
+    unsigned char buf[32];
+    unsigned char sk[2][32];
+    unsigned char ones[32];
+    unsigned char session_id[2][32];
+    unsigned char nonce_commitment[2][32];
+    int nonce_is_negated;
+    const unsigned char *ncs[2];
+    unsigned char msg[32];
+    unsigned char msghash[32];
+    secp256k1_pubkey combined_pk;
+    unsigned char pk_hash[32];
+    secp256k1_pubkey pk[2];
+
+    unsigned char sec_adaptor[32];
+    unsigned char sec_adaptor1[32];
+    secp256k1_pubkey adaptor;
+
+    /** setup **/
+    secp256k1_context *none = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
+    secp256k1_context *sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
+    secp256k1_context *vrfy = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
+    int ecount;
+
+    secp256k1_context_set_error_callback(none, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_error_callback(vrfy, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_illegal_callback(none, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_illegal_callback(sign, counting_illegal_callback_fn, &ecount);
+    secp256k1_context_set_illegal_callback(vrfy, counting_illegal_callback_fn, &ecount);
+
+    memset(ones, 0xff, 32);
+
+    secp256k1_rand256(session_id[0]);
+    secp256k1_rand256(session_id[1]);
+    secp256k1_rand256(sk[0]);
+    secp256k1_rand256(sk[1]);
+    secp256k1_rand256(msg);
+    secp256k1_rand256(sec_adaptor);
+
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk[0], sk[0]) == 1);
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk[1], sk[1]) == 1);
+    CHECK(secp256k1_ec_pubkey_create(ctx, &adaptor, sec_adaptor) == 1);
+
+    /** main test body **/
+
+    /* Key combination */
+    ecount = 0;
+    CHECK(secp256k1_musig_pubkey_combine(none, scratch, &combined_pk, pk_hash, pk, 2) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_pubkey_combine(sign, scratch, &combined_pk, pk_hash, pk, 2) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch, &combined_pk, pk_hash, pk, 2) == 1);
+    CHECK(ecount == 2);
+    /* pubkey_combine does not require a scratch space */
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, NULL, &combined_pk, pk_hash, pk, 2) == 1);
+    CHECK(ecount == 2);
+    /* If a scratch space is given it shouldn't be too small */
+    scratch_small = secp256k1_scratch_space_create(ctx, 1);
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch_small, &combined_pk, pk_hash, pk, 2) == 0);
+    secp256k1_scratch_space_destroy(scratch_small);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch, NULL, pk_hash, pk, 2) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch, &combined_pk, NULL, pk, 2) == 1);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch, &combined_pk, pk_hash, NULL, 2) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch, &combined_pk, pk_hash, pk, 0) == 0);
+    CHECK(ecount == 5);
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch, &combined_pk, pk_hash, NULL, 0) == 0);
+    CHECK(ecount == 6);
+
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch, &combined_pk, pk_hash, pk, 2) == 1);
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch, &combined_pk, pk_hash, pk, 2) == 1);
+    CHECK(secp256k1_musig_pubkey_combine(vrfy, scratch, &combined_pk, pk_hash, pk, 2) == 1);
+
+    /** Session creation **/
+    ecount = 0;
+    CHECK(secp256k1_musig_session_initialize(none, &session[0], signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 2, 0, sk[0]) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_session_initialize(vrfy, &session[0], signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 2, 0, sk[0]) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 2, 0, sk[0]) == 1);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_session_initialize(sign, NULL, signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 2, 0, sk[0]) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], NULL, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 2, 0, sk[0]) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, NULL, session_id[0], msg, &combined_pk, pk_hash, 2, 0, sk[0]) == 0);
+    CHECK(ecount == 5);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], NULL, msg, &combined_pk, pk_hash, 2, 0, sk[0]) == 0);
+    CHECK(ecount == 6);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], session_id[0], NULL, &combined_pk, pk_hash, 2, 0, sk[0]) == 1);
+    CHECK(ecount == 6);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], session_id[0], msg, NULL, pk_hash, 2, 0, sk[0]) == 0);
+    CHECK(ecount == 7);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, NULL, 2, 0, sk[0]) == 0);
+    CHECK(ecount == 8);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 0, 0, sk[0]) == 0);
+    CHECK(ecount == 8);
+    /* If more than UINT32_MAX fits in a size_t, test that session_initialize
+     * rejects n_signers that high. */
+    if (SIZE_MAX > UINT32_MAX) {
+        CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, ((size_t) UINT32_MAX) + 2, 0, sk[0]) == 0);
+    }
+    CHECK(ecount == 8);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 2, 0, NULL) == 0);
+    CHECK(ecount == 9);
+    /* secret key overflows */
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 2, 0, ones) == 0);
+    CHECK(ecount == 9);
+
+
+    {
+        secp256k1_musig_session session_without_msg;
+        CHECK(secp256k1_musig_session_initialize(sign, &session_without_msg, signer0, nonce_commitment[0], session_id[0], NULL, &combined_pk, pk_hash, 2, 0, sk[0]) == 1);
+        CHECK(secp256k1_musig_session_set_msg(none, &session_without_msg, msg) == 1);
+        CHECK(secp256k1_musig_session_set_msg(none, &session_without_msg, msg) == 0);
+    }
+    CHECK(secp256k1_musig_session_initialize(sign, &session[0], signer0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 2, 0, sk[0]) == 1);
+    CHECK(secp256k1_musig_session_initialize(sign, &session[1], signer1, nonce_commitment[1], session_id[1], msg, &combined_pk, pk_hash, 2, 1, sk[1]) == 1);
+    ncs[0] = nonce_commitment[0];
+    ncs[1] = nonce_commitment[1];
+
+    ecount = 0;
+    CHECK(secp256k1_musig_session_initialize_verifier(none, &verifier_session, verifier_signer_data, msg, &combined_pk, pk_hash, ncs, 2) == 1);
+    CHECK(ecount == 0);
+    CHECK(secp256k1_musig_session_initialize_verifier(none, NULL, verifier_signer_data, msg, &combined_pk, pk_hash, ncs, 2) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_session_initialize_verifier(none, &verifier_session, verifier_signer_data, NULL, &combined_pk, pk_hash, ncs, 2) == 1);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_session_initialize_verifier(none, &verifier_session, verifier_signer_data, msg, NULL, pk_hash, ncs, 2) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_session_initialize_verifier(none, &verifier_session, verifier_signer_data, msg, &combined_pk, NULL, ncs, 2) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_musig_session_initialize_verifier(none, &verifier_session, verifier_signer_data, msg, &combined_pk, pk_hash, NULL, 2) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_musig_session_initialize_verifier(none, &verifier_session, verifier_signer_data, msg, &combined_pk, pk_hash, ncs, 0) == 0);
+    CHECK(ecount == 4);
+    if (SIZE_MAX > UINT32_MAX) {
+        CHECK(secp256k1_musig_session_initialize_verifier(none, &verifier_session, verifier_signer_data, msg, &combined_pk, pk_hash, ncs, ((size_t) UINT32_MAX) + 2) == 0);
+    }
+    CHECK(ecount == 4);
+    CHECK(secp256k1_musig_session_initialize_verifier(none, &verifier_session, verifier_signer_data, msg, &combined_pk, pk_hash, ncs, 2) == 1);
+
+    CHECK(secp256k1_musig_compute_messagehash(none, msghash, &verifier_session) == 0);
+    CHECK(secp256k1_musig_compute_messagehash(none, msghash, &session[0]) == 0);
+
+    /** Signing step 0 -- exchange nonce commitments */
+    ecount = 0;
+    {
+        secp256k1_pubkey nonce;
+
+        /* Can obtain public nonce after commitments have been exchanged; still can't sign */
+        CHECK(secp256k1_musig_session_get_public_nonce(none, &session[0], signer0, &nonce, ncs, 2) == 1);
+        CHECK(secp256k1_musig_partial_sign(none, &session[0], &partial_sig[0]) == 0);
+        CHECK(ecount == 0);
+    }
+
+    /** Signing step 1 -- exchange nonces */
+    ecount = 0;
+    {
+        secp256k1_pubkey public_nonce[3];
+
+        CHECK(secp256k1_musig_session_get_public_nonce(none, &session[0], signer0, &public_nonce[0], ncs, 2) == 1);
+        CHECK(ecount == 0);
+        CHECK(secp256k1_musig_session_get_public_nonce(none, NULL, signer0, &public_nonce[0], ncs, 2) == 0);
+        CHECK(ecount == 1);
+        CHECK(secp256k1_musig_session_get_public_nonce(none, &session[0], NULL, &public_nonce[0], ncs, 2) == 0);
+        CHECK(ecount == 2);
+        CHECK(secp256k1_musig_session_get_public_nonce(none, &session[0], signer0, NULL, ncs, 2) == 0);
+        CHECK(ecount == 3);
+        CHECK(secp256k1_musig_session_get_public_nonce(none, &session[0], signer0, &public_nonce[0], NULL, 2) == 0);
+        CHECK(ecount == 4);
+        /* Number of commitments and number of signers are different */
+        CHECK(secp256k1_musig_session_get_public_nonce(none, &session[0], signer0, &public_nonce[0], ncs, 1) == 0);
+        CHECK(ecount == 4);
+
+        CHECK(secp256k1_musig_session_get_public_nonce(none, &session[0], signer0, &public_nonce[0], ncs, 2) == 1);
+        CHECK(secp256k1_musig_session_get_public_nonce(none, &session[1], signer1, &public_nonce[1], ncs, 2) == 1);
+
+        CHECK(secp256k1_musig_set_nonce(none, &signer0[0], &public_nonce[0]) == 1);
+        CHECK(secp256k1_musig_set_nonce(none, &signer0[1], &public_nonce[0]) == 0);
+        CHECK(secp256k1_musig_set_nonce(none, &signer0[1], &public_nonce[1]) == 1);
+        CHECK(secp256k1_musig_set_nonce(none, &signer0[1], &public_nonce[1]) == 1);
+        CHECK(ecount == 4);
+
+        CHECK(secp256k1_musig_set_nonce(none, NULL, &public_nonce[0]) == 0);
+        CHECK(ecount == 5);
+        CHECK(secp256k1_musig_set_nonce(none, &signer1[0], NULL) == 0);
+        CHECK(ecount == 6);
+
+        CHECK(secp256k1_musig_set_nonce(none, &signer1[0], &public_nonce[0]) == 1);
+        CHECK(secp256k1_musig_set_nonce(none, &signer1[1], &public_nonce[1]) == 1);
+        CHECK(secp256k1_musig_set_nonce(none, &verifier_signer_data[0], &public_nonce[0]) == 1);
+        CHECK(secp256k1_musig_set_nonce(none, &verifier_signer_data[1], &public_nonce[1]) == 1);
+
+        ecount = 0;
+        CHECK(secp256k1_musig_session_combine_nonces(none, &session[0], signer0, 2, &nonce_is_negated, &adaptor) == 1);
+        CHECK(secp256k1_musig_session_combine_nonces(none, NULL, signer0, 2, &nonce_is_negated, &adaptor) == 0);
+        CHECK(ecount == 1);
+        CHECK(secp256k1_musig_session_combine_nonces(none, &session[0], NULL, 2, &nonce_is_negated, &adaptor) == 0);
+        CHECK(ecount == 2);
+        /* Number of signers differs from number during intialization */
+        CHECK(secp256k1_musig_session_combine_nonces(none, &session[0], signer0, 1, &nonce_is_negated, &adaptor) == 0);
+        CHECK(ecount == 2);
+        CHECK(secp256k1_musig_session_combine_nonces(none, &session[0], signer0, 2, NULL, &adaptor) == 1);
+        CHECK(ecount == 2);
+        CHECK(secp256k1_musig_session_combine_nonces(none, &session[0], signer0, 2, &nonce_is_negated, NULL) == 1);
+
+        CHECK(secp256k1_musig_session_combine_nonces(none, &session[0], signer0, 2, &nonce_is_negated, &adaptor) == 1);
+        CHECK(secp256k1_musig_session_combine_nonces(none, &session[1], signer0, 2, &nonce_is_negated, &adaptor) == 1);
+        CHECK(secp256k1_musig_session_combine_nonces(none, &verifier_session, verifier_signer_data, 2, &nonce_is_negated, &adaptor) == 1);
+    }
+
+    /** Signing step 2 -- partial signatures */
+    ecount = 0;
+    CHECK(secp256k1_musig_partial_sign(none, &session[0], &partial_sig[0]) == 1);
+    CHECK(ecount == 0);
+    CHECK(secp256k1_musig_partial_sign(none, NULL, &partial_sig[0]) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_partial_sign(none, &session[0], NULL) == 0);
+    CHECK(ecount == 2);
+
+    CHECK(secp256k1_musig_partial_sign(none, &session[0], &partial_sig[0]) == 1);
+    CHECK(secp256k1_musig_partial_sign(none, &session[1], &partial_sig[1]) == 1);
+    /* observer can't sign */
+    CHECK(secp256k1_musig_partial_sign(none, &verifier_session, &partial_sig[2]) == 0);
+    CHECK(ecount == 2);
+
+    ecount = 0;
+    CHECK(secp256k1_musig_partial_signature_serialize(none, buf, &partial_sig[0]) == 1);
+    CHECK(secp256k1_musig_partial_signature_serialize(none, NULL, &partial_sig[0]) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_partial_signature_serialize(none, buf, NULL) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_partial_signature_parse(none, &partial_sig[0], buf) == 1);
+    CHECK(secp256k1_musig_partial_signature_parse(none, NULL, buf) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_musig_partial_signature_parse(none, &partial_sig[0], NULL) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_musig_partial_signature_parse(none, &partial_sig_overflow, ones) == 1);
+
+    /** Partial signature verification */
+    ecount = 0;
+    CHECK(secp256k1_musig_partial_sig_verify(none, &session[0], &signer0[0], &partial_sig[0], &pk[0]) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_partial_sig_verify(sign, &session[0], &signer0[0], &partial_sig[0], &pk[0]) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[0], &signer0[0], &partial_sig[0], &pk[0]) == 1);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[0], &signer0[0], &partial_sig[1], &pk[0]) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, NULL, &signer0[0], &partial_sig[0], &pk[0]) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[0], NULL, &partial_sig[0], &pk[0]) == 0);
+    CHECK(ecount == 4);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[0], &signer0[0], NULL, &pk[0]) == 0);
+    CHECK(ecount == 5);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[0], &signer0[0], &partial_sig_overflow, &pk[0]) == 0);
+    CHECK(ecount == 5);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[0], &signer0[0], &partial_sig[0], NULL) == 0);
+    CHECK(ecount == 6);
+
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[0], &signer0[0], &partial_sig[0], &pk[0]) == 1);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[1], &signer1[0], &partial_sig[0], &pk[0]) == 1);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[0], &signer0[1], &partial_sig[1], &pk[1]) == 1);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &session[1], &signer1[1], &partial_sig[1], &pk[1]) == 1);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &verifier_session, &verifier_signer_data[0], &partial_sig[0], &pk[0]) == 1);
+    CHECK(secp256k1_musig_partial_sig_verify(vrfy, &verifier_session, &verifier_signer_data[1], &partial_sig[1], &pk[1]) == 1);
+    CHECK(ecount == 6);
+
+    /** Adaptor signature verification */
+    memcpy(&partial_sig_adapted[1], &partial_sig[1], sizeof(partial_sig_adapted[1]));
+    ecount = 0;
+    CHECK(secp256k1_musig_partial_sig_adapt(none, &partial_sig_adapted[0], &partial_sig[0], sec_adaptor, nonce_is_negated) == 1);
+    CHECK(secp256k1_musig_partial_sig_adapt(none, NULL, &partial_sig[0], sec_adaptor, 0) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_partial_sig_adapt(none, &partial_sig_adapted[0], NULL, sec_adaptor, 0) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_partial_sig_adapt(none, &partial_sig_adapted[0], &partial_sig_overflow, sec_adaptor, nonce_is_negated) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_partial_sig_adapt(none, &partial_sig_adapted[0], &partial_sig[0], NULL, 0) == 0);
+    CHECK(ecount == 3);
+    CHECK(secp256k1_musig_partial_sig_adapt(none, &partial_sig_adapted[0], &partial_sig[0], ones, nonce_is_negated) == 0);
+    CHECK(ecount == 3);
+
+    /** Signing combining and verification */
+    ecount = 0;
+    CHECK(secp256k1_musig_partial_sig_combine(none, &session[0], &final_sig, partial_sig_adapted, 2) == 1);
+    CHECK(secp256k1_musig_partial_sig_combine(none, &session[0], &final_sig_cmp, partial_sig_adapted, 2) == 1);
+    CHECK(memcmp(&final_sig, &final_sig_cmp, sizeof(final_sig)) == 0);
+    CHECK(secp256k1_musig_partial_sig_combine(none, &session[0], &final_sig_cmp, partial_sig_adapted, 2) == 1);
+    CHECK(memcmp(&final_sig, &final_sig_cmp, sizeof(final_sig)) == 0);
+
+    CHECK(secp256k1_musig_partial_sig_combine(none, NULL, &final_sig, partial_sig_adapted, 2) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_partial_sig_combine(none, &session[0], NULL, partial_sig_adapted, 2) == 0);
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_partial_sig_combine(none, &session[0], &final_sig, NULL, 2) == 0);
+    CHECK(ecount == 3);
+    {
+        secp256k1_musig_partial_signature partial_sig_tmp[2];
+        partial_sig_tmp[0] = partial_sig_adapted[0];
+        partial_sig_tmp[1] = partial_sig_overflow;
+        CHECK(secp256k1_musig_partial_sig_combine(none, &session[0], &final_sig, partial_sig_tmp, 2) == 0);
+    }
+    CHECK(ecount == 3);
+    /* Wrong number of partial sigs */
+    CHECK(secp256k1_musig_partial_sig_combine(none, &session[0], &final_sig, partial_sig_adapted, 1) == 0);
+    CHECK(ecount == 3);
+
+    CHECK(secp256k1_schnorrsig_verify(vrfy, &final_sig, msg, &combined_pk) == 1);
+
+    /** Secret adaptor can be extracted from signature */
+    ecount = 0;
+    CHECK(secp256k1_musig_extract_secret_adaptor(none, sec_adaptor1, &final_sig, partial_sig, 2, nonce_is_negated) == 1);
+    CHECK(memcmp(sec_adaptor, sec_adaptor1, 32) == 0);
+    CHECK(secp256k1_musig_extract_secret_adaptor(none, NULL, &final_sig, partial_sig, 2, 0) == 0);
+    CHECK(ecount == 1);
+    CHECK(secp256k1_musig_extract_secret_adaptor(none, sec_adaptor1, NULL, partial_sig, 2, 0) == 0);
+    CHECK(ecount == 2);
+    {
+        secp256k1_schnorrsig final_sig_tmp = final_sig;
+        memcpy(&final_sig_tmp.data[32], ones, 32);
+        CHECK(secp256k1_musig_extract_secret_adaptor(none, sec_adaptor1, &final_sig_tmp, partial_sig, 2, nonce_is_negated) == 0);
+    }
+    CHECK(ecount == 2);
+    CHECK(secp256k1_musig_extract_secret_adaptor(none, sec_adaptor1, &final_sig, NULL, 2, 0) == 0);
+    CHECK(ecount == 3);
+    {
+        secp256k1_musig_partial_signature partial_sig_tmp[2];
+        partial_sig_tmp[0] = partial_sig[0];
+        partial_sig_tmp[1] = partial_sig_overflow;
+        CHECK(secp256k1_musig_extract_secret_adaptor(none, sec_adaptor1, &final_sig, partial_sig_tmp, 2, nonce_is_negated) == 0);
+    }
+    CHECK(ecount == 3);
+    CHECK(secp256k1_musig_extract_secret_adaptor(none, sec_adaptor1, &final_sig, partial_sig, 0, 0) == 1);
+    CHECK(secp256k1_musig_extract_secret_adaptor(none, sec_adaptor1, &final_sig, partial_sig, 2, 1) == 1);
+
+    /** cleanup **/
+    memset(&session, 0, sizeof(session));
+    secp256k1_context_destroy(none);
+    secp256k1_context_destroy(sign);
+    secp256k1_context_destroy(vrfy);
+}
+
+/* Initializes two sessions, one use the given parameters (session_id,
+ * nonce_commitments, etc.) except that `session_tmp` uses new signers with different
+ * public keys. The point of this test is to call `musig_session_get_public_nonce`
+ * with signers from `session_tmp` who have different public keys than the correct
+ * ones and return the resulting messagehash. This should not result in a different
+ * messagehash because the public keys of the signers are only used during session
+ * initialization. */
+int musig_state_machine_diff_signer_msghash_test(unsigned char *msghash, secp256k1_pubkey *pks, secp256k1_pubkey *combined_pk, unsigned char *pk_hash, const unsigned char * const *nonce_commitments, unsigned char *msg, secp256k1_pubkey *nonce_other, unsigned char *sk, unsigned char *session_id) {
+    secp256k1_musig_session session;
+    secp256k1_musig_session session_tmp;
+    unsigned char nonce_commitment[32];
+    secp256k1_musig_session_signer_data signers[2];
+    secp256k1_musig_session_signer_data signers_tmp[2];
+    unsigned char sk_dummy[32];
+    secp256k1_pubkey pks_tmp[2];
+    secp256k1_pubkey combined_pk_tmp;
+    unsigned char pk_hash_tmp[32];
+    secp256k1_pubkey nonce;
+
+    /* Set up signers with different public keys */
+    secp256k1_rand256(sk_dummy);
+    pks_tmp[0] = pks[0];
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pks_tmp[1], sk_dummy) == 1);
+    CHECK(secp256k1_musig_pubkey_combine(ctx, NULL, &combined_pk_tmp, pk_hash_tmp, pks_tmp, 2) == 1);
+    CHECK(secp256k1_musig_session_initialize(ctx, &session_tmp, signers_tmp, nonce_commitment, session_id, msg, &combined_pk_tmp, pk_hash_tmp, 2, 0, sk_dummy) == 1);
+
+    CHECK(secp256k1_musig_session_initialize(ctx, &session, signers, nonce_commitment, session_id, msg, combined_pk, pk_hash, 2, 0, sk) == 1);
+    CHECK(memcmp(nonce_commitment, nonce_commitments[1], 32) == 0);
+    /* Call get_public_nonce with different signers than the signers the session was
+     * initialized with. */
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session_tmp, signers, &nonce, nonce_commitments, 2) == 1);
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session, signers_tmp, &nonce, nonce_commitments, 2) == 1);
+    CHECK(secp256k1_musig_set_nonce(ctx, &signers[0], nonce_other) == 1);
+    CHECK(secp256k1_musig_set_nonce(ctx, &signers[1], &nonce) == 1);
+    CHECK(secp256k1_musig_session_combine_nonces(ctx, &session, signers, 2, NULL, NULL) == 1);
+
+    return secp256k1_musig_compute_messagehash(ctx, msghash, &session);
+}
+
+/* Creates a new session (with a different session id) and tries to use that session
+ * to combine nonces with given signers_other. This should fail, because the nonce
+ * commitments of signers_other do not match the nonce commitments the new session
+ * was initialized with. If do_test is 0, the correct signers are being used and
+ * therefore the function should return 1. */
+int musig_state_machine_diff_signers_combine_nonce_test(secp256k1_pubkey *combined_pk, unsigned char *pk_hash, unsigned char *nonce_commitment_other, secp256k1_pubkey *nonce_other, unsigned char *msg, unsigned char *sk, secp256k1_musig_session_signer_data *signers_other, int do_test) {
+    secp256k1_musig_session session;
+    secp256k1_musig_session_signer_data signers[2];
+    secp256k1_musig_session_signer_data *signers_to_use;
+    unsigned char nonce_commitment[32];
+    unsigned char session_id[32];
+    secp256k1_pubkey nonce;
+    const unsigned char *ncs[2];
+
+    /* Initialize new signers */
+    secp256k1_rand256(session_id);
+    CHECK(secp256k1_musig_session_initialize(ctx, &session, signers, nonce_commitment, session_id, msg, combined_pk, pk_hash, 2, 1, sk) == 1);
+    ncs[0] = nonce_commitment_other;
+    ncs[1] = nonce_commitment;
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session, signers, &nonce, ncs, 2) == 1);
+    CHECK(secp256k1_musig_set_nonce(ctx, &signers[0], nonce_other) == 1);
+    CHECK(secp256k1_musig_set_nonce(ctx, &signers[1], &nonce) == 1);
+    CHECK(secp256k1_musig_set_nonce(ctx, &signers[1], &nonce) == 1);
+    secp256k1_musig_session_combine_nonces(ctx, &session, signers_other, 2, NULL, NULL);
+    if (do_test) {
+        signers_to_use = signers_other;
+    } else {
+        signers_to_use = signers;
+    }
+    return secp256k1_musig_session_combine_nonces(ctx, &session, signers_to_use, 2, NULL, NULL);
+}
+
+/* Recreates a session with the given session_id, signers, pk, msg etc. parameters
+ * and tries to sign and verify the other signers partial signature. Both should fail
+ * if msg is NULL. */
+int musig_state_machine_missing_msg_test(secp256k1_pubkey *pks, secp256k1_pubkey *combined_pk, unsigned char *pk_hash, unsigned char *nonce_commitment_other, secp256k1_pubkey *nonce_other, secp256k1_musig_partial_signature *partial_sig_other, unsigned char *sk, unsigned char *session_id, unsigned char *msg) {
+    secp256k1_musig_session session;
+    secp256k1_musig_session_signer_data signers[2];
+    unsigned char nonce_commitment[32];
+    const unsigned char *ncs[2];
+    secp256k1_pubkey nonce;
+    secp256k1_musig_partial_signature partial_sig;
+    int partial_sign, partial_verify;
+
+    CHECK(secp256k1_musig_session_initialize(ctx, &session, signers, nonce_commitment, session_id, msg, combined_pk, pk_hash, 2, 0, sk) == 1);
+    ncs[0] = nonce_commitment_other;
+    ncs[1] = nonce_commitment;
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session, signers, &nonce, ncs, 2) == 1);
+    CHECK(secp256k1_musig_set_nonce(ctx, &signers[0], nonce_other) == 1);
+    CHECK(secp256k1_musig_set_nonce(ctx, &signers[1], &nonce) == 1);
+
+    CHECK(secp256k1_musig_session_combine_nonces(ctx, &session, signers, 2, NULL, NULL) == 1);
+    partial_sign = secp256k1_musig_partial_sign(ctx, &session, &partial_sig);
+    partial_verify = secp256k1_musig_partial_sig_verify(ctx, &session, &signers[0], partial_sig_other, &pks[0]);
+    if (msg != NULL) {
+        /* Return 1 if both succeeded */
+        return partial_sign && partial_verify;
+    }
+    /* Return 0 if both failed */
+    return partial_sign || partial_verify;
+}
+
+/* Recreates a session with the given session_id, signers, pk, msg etc. parameters
+ * and tries to verify and combine partial sigs. If do_combine is 0, the
+ * combine_nonces step is left out. In that case verify and combine should fail and
+ * this function should return 0. */
+int musig_state_machine_missing_combine_test(secp256k1_pubkey *pks, secp256k1_pubkey *combined_pk, unsigned char *pk_hash, unsigned char *nonce_commitment_other, secp256k1_pubkey *nonce_other, secp256k1_musig_partial_signature *partial_sig_other, unsigned char *msg, unsigned char *sk, unsigned char *session_id, secp256k1_musig_partial_signature *partial_sig, int do_combine) {
+    secp256k1_musig_session session;
+    secp256k1_musig_session_signer_data signers[2];
+    unsigned char nonce_commitment[32];
+    const unsigned char *ncs[2];
+    secp256k1_pubkey nonce;
+    secp256k1_musig_partial_signature partial_sigs[2];
+    secp256k1_schnorrsig sig;
+    int partial_verify, sig_combine;
+
+    CHECK(secp256k1_musig_session_initialize(ctx, &session, signers, nonce_commitment, session_id, msg, combined_pk, pk_hash, 2, 0, sk) == 1);
+    ncs[0] = nonce_commitment_other;
+    ncs[1] = nonce_commitment;
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session, signers, &nonce, ncs, 2) == 1);
+    CHECK(secp256k1_musig_set_nonce(ctx, &signers[0], nonce_other) == 1);
+    CHECK(secp256k1_musig_set_nonce(ctx, &signers[1], &nonce) == 1);
+
+    partial_sigs[0] = *partial_sig_other;
+    partial_sigs[1] = *partial_sig;
+    if (do_combine != 0) {
+        CHECK(secp256k1_musig_session_combine_nonces(ctx, &session, signers, 2, NULL, NULL) == 1);
+    }
+    partial_verify = secp256k1_musig_partial_sig_verify(ctx, &session, signers, partial_sig_other, &pks[0]);
+    sig_combine = secp256k1_musig_partial_sig_combine(ctx, &session, &sig, partial_sigs, 2);
+    if (do_combine != 0) {
+        /* Return 1 if both succeeded */
+        return partial_verify && sig_combine;
+    }
+    /* Return 0 if both failed */
+    return partial_verify || sig_combine;
+}
+
+void musig_state_machine_tests(secp256k1_scratch_space *scratch) {
+    size_t i;
+    secp256k1_musig_session session[2];
+    secp256k1_musig_session_signer_data signers0[2];
+    secp256k1_musig_session_signer_data signers1[2];
+    unsigned char nonce_commitment[2][32];
+    unsigned char session_id[2][32];
+    unsigned char msg[32];
+    unsigned char sk[2][32];
+    secp256k1_pubkey pk[2];
+    secp256k1_pubkey combined_pk;
+    unsigned char pk_hash[32];
+    secp256k1_pubkey nonce[2];
+    const unsigned char *ncs[2];
+    secp256k1_musig_partial_signature partial_sig[2];
+    unsigned char msghash1[32];
+    unsigned char msghash2[32];
+
+    /* Run state machine with the same objects twice to test that it's allowed to
+     * reinitialize session and session_signer_data. */
+    for (i = 0; i < 2; i++) {
+        /* Setup */
+        secp256k1_rand256(session_id[0]);
+        secp256k1_rand256(session_id[1]);
+        secp256k1_rand256(sk[0]);
+        secp256k1_rand256(sk[1]);
+        secp256k1_rand256(msg);
+        CHECK(secp256k1_ec_pubkey_create(ctx, &pk[0], sk[0]) == 1);
+        CHECK(secp256k1_ec_pubkey_create(ctx, &pk[1], sk[1]) == 1);
+        CHECK(secp256k1_musig_pubkey_combine(ctx, scratch, &combined_pk, pk_hash, pk, 2) == 1);
+        CHECK(secp256k1_musig_session_initialize(ctx, &session[0], signers0, nonce_commitment[0], session_id[0], msg, &combined_pk, pk_hash, 2, 0, sk[0]) == 1);
+        CHECK(secp256k1_musig_session_initialize(ctx, &session[1], signers1, nonce_commitment[1], session_id[1], msg, &combined_pk, pk_hash, 2, 1, sk[1]) == 1);
+
+        /* Set nonce commitments */
+        ncs[0] = nonce_commitment[0];
+        ncs[1] = nonce_commitment[1];
+        CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session[0], signers0, &nonce[0], ncs, 2) == 1);
+        /* Changing a nonce commitment is not okay */
+        ncs[1] = (unsigned char*) "this isn't a nonce commitment...";
+        CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session[0], signers0, &nonce[0], ncs, 2) == 0);
+        /* Repeating with the same nonce commitments is okay */
+        ncs[1] = nonce_commitment[1];
+        CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session[0], signers0, &nonce[0], ncs, 2) == 1);
+
+        /* Get nonce for signer 1 */
+        CHECK(secp256k1_musig_session_get_public_nonce(ctx, &session[1], signers1, &nonce[1], ncs, 2) == 1);
+
+        /* Set nonces */
+        CHECK(secp256k1_musig_set_nonce(ctx, &signers0[0], &nonce[0]) == 1);
+        /* Can't set nonce that doesn't match nonce commitment */
+        CHECK(secp256k1_musig_set_nonce(ctx, &signers0[1], &nonce[0]) == 0);
+        /* Set correct nonce */
+        CHECK(secp256k1_musig_set_nonce(ctx, &signers0[1], &nonce[1]) == 1);
+
+        /* Combine nonces */
+        CHECK(secp256k1_musig_session_combine_nonces(ctx, &session[0], signers0, 2, NULL, NULL) == 1);
+        /* Not everyone is present from signer 1's view */
+        CHECK(secp256k1_musig_session_combine_nonces(ctx, &session[1], signers1, 2, NULL, NULL) == 0);
+        /* Make everyone present */
+        CHECK(secp256k1_musig_set_nonce(ctx, &signers1[0], &nonce[0]) == 1);
+        CHECK(secp256k1_musig_set_nonce(ctx, &signers1[1], &nonce[1]) == 1);
+
+        /* Can't combine nonces from signers of a different session */
+        CHECK(musig_state_machine_diff_signers_combine_nonce_test(&combined_pk, pk_hash, nonce_commitment[0], &nonce[0], msg, sk[1], signers1, 1) == 0);
+        CHECK(musig_state_machine_diff_signers_combine_nonce_test(&combined_pk, pk_hash, nonce_commitment[0], &nonce[0], msg, sk[1], signers1, 0) == 1);
+
+        /* Partially sign */
+        CHECK(secp256k1_musig_partial_sign(ctx, &session[0], &partial_sig[0]) == 1);
+        /* Can't verify or sign until nonce is combined */
+        CHECK(secp256k1_musig_partial_sig_verify(ctx, &session[1], &signers1[0], &partial_sig[0], &pk[0]) == 0);
+        CHECK(secp256k1_musig_partial_sign(ctx, &session[1], &partial_sig[1]) == 0);
+        CHECK(secp256k1_musig_session_combine_nonces(ctx, &session[1], signers1, 2, NULL, NULL) == 1);
+        CHECK(secp256k1_musig_partial_sig_verify(ctx, &session[1], &signers1[0], &partial_sig[0], &pk[0]) == 1);
+        /* messagehash should be the same as a session whose get_public_nonce was called
+         * with different signers (i.e. they diff in public keys). This is because the
+         * public keys of the signers is set in stone when initializing the session. */
+        CHECK(secp256k1_musig_compute_messagehash(ctx, msghash1, &session[1]) == 1);
+        CHECK(musig_state_machine_diff_signer_msghash_test(msghash2, pk, &combined_pk, pk_hash, ncs, msg, &nonce[0], sk[1], session_id[1]) == 1);
+        CHECK(memcmp(msghash1, msghash2, 32) == 0);
+        CHECK(secp256k1_musig_partial_sign(ctx, &session[1], &partial_sig[1]) == 1);
+        CHECK(secp256k1_musig_partial_sig_verify(ctx, &session[1], &signers1[1], &partial_sig[1], &pk[1]) == 1);
+        /* Wrong signature */
+        CHECK(secp256k1_musig_partial_sig_verify(ctx, &session[1], &signers1[1], &partial_sig[0], &pk[1]) == 0);
+        /* Can't sign or verify until msg is set */
+        CHECK(musig_state_machine_missing_msg_test(pk, &combined_pk, pk_hash, nonce_commitment[0], &nonce[0], &partial_sig[0], sk[1], session_id[1], NULL) == 0);
+        CHECK(musig_state_machine_missing_msg_test(pk, &combined_pk, pk_hash, nonce_commitment[0], &nonce[0], &partial_sig[0], sk[1], session_id[1], msg) == 1);
+
+        /* Can't verify and combine partial sigs until nonces are combined */
+        CHECK(musig_state_machine_missing_combine_test(pk, &combined_pk, pk_hash, nonce_commitment[0], &nonce[0], &partial_sig[0], msg, sk[1], session_id[1], &partial_sig[1], 0) == 0);
+        CHECK(musig_state_machine_missing_combine_test(pk, &combined_pk, pk_hash, nonce_commitment[0], &nonce[0], &partial_sig[0], msg, sk[1], session_id[1], &partial_sig[1], 1) == 1);
+    }
+}
+
+void scriptless_atomic_swap(secp256k1_scratch_space *scratch) {
+    /* Throughout this test "a" and "b" refer to two hypothetical blockchains,
+     * while the indices 0 and 1 refer to the two signers. Here signer 0 is
+     * sending a-coins to signer 1, while signer 1 is sending b-coins to signer
+     * 0. Signer 0 produces the adaptor signatures. */
+    secp256k1_schnorrsig final_sig_a;
+    secp256k1_schnorrsig final_sig_b;
+    secp256k1_musig_partial_signature partial_sig_a[2];
+    secp256k1_musig_partial_signature partial_sig_b_adapted[2];
+    secp256k1_musig_partial_signature partial_sig_b[2];
+    unsigned char sec_adaptor[32];
+    unsigned char sec_adaptor_extracted[32];
+    secp256k1_pubkey pub_adaptor;
+
+    unsigned char seckey_a[2][32];
+    unsigned char seckey_b[2][32];
+    secp256k1_pubkey pk_a[2];
+    secp256k1_pubkey pk_b[2];
+    unsigned char pk_hash_a[32];
+    unsigned char pk_hash_b[32];
+    secp256k1_pubkey combined_pk_a;
+    secp256k1_pubkey combined_pk_b;
+    secp256k1_musig_session musig_session_a[2];
+    secp256k1_musig_session musig_session_b[2];
+    unsigned char noncommit_a[2][32];
+    unsigned char noncommit_b[2][32];
+    const unsigned char *noncommit_a_ptr[2];
+    const unsigned char *noncommit_b_ptr[2];
+    secp256k1_pubkey pubnon_a[2];
+    secp256k1_pubkey pubnon_b[2];
+    int nonce_is_negated_a;
+    int nonce_is_negated_b;
+    secp256k1_musig_session_signer_data data_a[2];
+    secp256k1_musig_session_signer_data data_b[2];
+
+    const unsigned char seed[32] = "still tired of choosing seeds...";
+    const unsigned char msg32_a[32] = "this is the message blockchain a";
+    const unsigned char msg32_b[32] = "this is the message blockchain b";
+
+    /* Step 1: key setup */
+    secp256k1_rand256(seckey_a[0]);
+    secp256k1_rand256(seckey_a[1]);
+    secp256k1_rand256(seckey_b[0]);
+    secp256k1_rand256(seckey_b[1]);
+    secp256k1_rand256(sec_adaptor);
+
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk_a[0], seckey_a[0]));
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk_a[1], seckey_a[1]));
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk_b[0], seckey_b[0]));
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pk_b[1], seckey_b[1]));
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pub_adaptor, sec_adaptor));
+
+    CHECK(secp256k1_musig_pubkey_combine(ctx, scratch, &combined_pk_a, pk_hash_a, pk_a, 2));
+    CHECK(secp256k1_musig_pubkey_combine(ctx, scratch, &combined_pk_b, pk_hash_b, pk_b, 2));
+
+    CHECK(secp256k1_musig_session_initialize(ctx, &musig_session_a[0], data_a, noncommit_a[0], seed, msg32_a, &combined_pk_a, pk_hash_a, 2, 0, seckey_a[0]));
+    CHECK(secp256k1_musig_session_initialize(ctx, &musig_session_a[1], data_a, noncommit_a[1], seed, msg32_a, &combined_pk_a, pk_hash_a, 2, 1, seckey_a[1]));
+    noncommit_a_ptr[0] = noncommit_a[0];
+    noncommit_a_ptr[1] = noncommit_a[1];
+
+    CHECK(secp256k1_musig_session_initialize(ctx, &musig_session_b[0], data_b, noncommit_b[0], seed, msg32_b, &combined_pk_b, pk_hash_b, 2, 0, seckey_b[0]));
+    CHECK(secp256k1_musig_session_initialize(ctx, &musig_session_b[1], data_b, noncommit_b[1], seed, msg32_b, &combined_pk_b, pk_hash_b, 2, 1, seckey_b[1]));
+    noncommit_b_ptr[0] = noncommit_b[0];
+    noncommit_b_ptr[1] = noncommit_b[1];
+
+    /* Step 2: Exchange nonces */
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &musig_session_a[0], data_a, &pubnon_a[0], noncommit_a_ptr, 2));
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &musig_session_a[1], data_a, &pubnon_a[1], noncommit_a_ptr, 2));
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &musig_session_b[0], data_b, &pubnon_b[0], noncommit_b_ptr, 2));
+    CHECK(secp256k1_musig_session_get_public_nonce(ctx, &musig_session_b[1], data_b, &pubnon_b[1], noncommit_b_ptr, 2));
+    CHECK(secp256k1_musig_set_nonce(ctx, &data_a[0], &pubnon_a[0]));
+    CHECK(secp256k1_musig_set_nonce(ctx, &data_a[1], &pubnon_a[1]));
+    CHECK(secp256k1_musig_set_nonce(ctx, &data_b[0], &pubnon_b[0]));
+    CHECK(secp256k1_musig_set_nonce(ctx, &data_b[1], &pubnon_b[1]));
+    CHECK(secp256k1_musig_session_combine_nonces(ctx, &musig_session_a[0], data_a, 2, &nonce_is_negated_a, &pub_adaptor));
+    CHECK(secp256k1_musig_session_combine_nonces(ctx, &musig_session_a[1], data_a, 2, NULL, &pub_adaptor));
+    CHECK(secp256k1_musig_session_combine_nonces(ctx, &musig_session_b[0], data_b, 2, &nonce_is_negated_b, &pub_adaptor));
+    CHECK(secp256k1_musig_session_combine_nonces(ctx, &musig_session_b[1], data_b, 2, NULL, &pub_adaptor));
+
+    /* Step 3: Signer 0 produces partial signatures for both chains. */
+    CHECK(secp256k1_musig_partial_sign(ctx, &musig_session_a[0], &partial_sig_a[0]));
+    CHECK(secp256k1_musig_partial_sign(ctx, &musig_session_b[0], &partial_sig_b[0]));
+
+    /* Step 4: Signer 1 receives partial signatures, verifies them and creates a
+     * partial signature to send B-coins to signer 0. */
+    CHECK(secp256k1_musig_partial_sig_verify(ctx, &musig_session_a[1], data_a, &partial_sig_a[0], &pk_a[0]) == 1);
+    CHECK(secp256k1_musig_partial_sig_verify(ctx, &musig_session_b[1], data_b, &partial_sig_b[0], &pk_b[0]) == 1);
+    CHECK(secp256k1_musig_partial_sign(ctx, &musig_session_b[1], &partial_sig_b[1]));
+
+    /* Step 5: Signer 0 adapts its own partial signature and combines it with the
+     * partial signature from signer 1. This results in a complete signature which
+     * is broadcasted by signer 0 to take B-coins. */
+    CHECK(secp256k1_musig_partial_sig_adapt(ctx, &partial_sig_b_adapted[0], &partial_sig_b[0], sec_adaptor, nonce_is_negated_b));
+    memcpy(&partial_sig_b_adapted[1], &partial_sig_b[1], sizeof(partial_sig_b_adapted[1]));
+    CHECK(secp256k1_musig_partial_sig_combine(ctx, &musig_session_b[0], &final_sig_b, partial_sig_b_adapted, 2) == 1);
+    CHECK(secp256k1_schnorrsig_verify(ctx, &final_sig_b, msg32_b, &combined_pk_b) == 1);
+
+    /* Step 6: Signer 1 extracts adaptor from the published signature, applies it to
+     * other partial signature, and takes A-coins. */
+    CHECK(secp256k1_musig_extract_secret_adaptor(ctx, sec_adaptor_extracted, &final_sig_b, partial_sig_b, 2, nonce_is_negated_b) == 1);
+    CHECK(memcmp(sec_adaptor_extracted, sec_adaptor, sizeof(sec_adaptor)) == 0); /* in real life we couldn't check this, of course */
+    CHECK(secp256k1_musig_partial_sig_adapt(ctx, &partial_sig_a[0], &partial_sig_a[0], sec_adaptor_extracted, nonce_is_negated_a));
+    CHECK(secp256k1_musig_partial_sign(ctx, &musig_session_a[1], &partial_sig_a[1]));
+    CHECK(secp256k1_musig_partial_sig_combine(ctx, &musig_session_a[1], &final_sig_a, partial_sig_a, 2) == 1);
+    CHECK(secp256k1_schnorrsig_verify(ctx, &final_sig_a, msg32_a, &combined_pk_a) == 1);
+}
+
+/* Checks that hash initialized by secp256k1_musig_sha256_init_tagged has the
+ * expected state. */
+void sha256_tag_test(void) {
+    char tag[17] = "MuSig coefficient";
+    secp256k1_sha256 sha;
+    secp256k1_sha256 sha_tagged;
+    unsigned char buf[32];
+    unsigned char buf2[32];
+    size_t i;
+
+    secp256k1_sha256_initialize(&sha);
+    secp256k1_sha256_write(&sha, (unsigned char *) tag, 17);
+    secp256k1_sha256_finalize(&sha, buf);
+    /* buf = SHA256("MuSig coefficient") */
+
+    secp256k1_sha256_initialize(&sha);
+    secp256k1_sha256_write(&sha, buf, 32);
+    secp256k1_sha256_write(&sha, buf, 32);
+    /* Is buffer fully consumed? */
+    CHECK((sha.bytes & 0x3F) == 0);
+
+    /* Compare with tagged SHA */
+    secp256k1_musig_sha256_init_tagged(&sha_tagged);
+    for (i = 0; i < 8; i++) {
+        CHECK(sha_tagged.s[i] == sha.s[i]);
+    }
+    secp256k1_sha256_write(&sha, buf, 32);
+    secp256k1_sha256_write(&sha_tagged, buf, 32);
+    secp256k1_sha256_finalize(&sha, buf);
+    secp256k1_sha256_finalize(&sha_tagged, buf2);
+    CHECK(memcmp(buf, buf2, 32) == 0);
+}
+
+void run_musig_tests(void) {
+    int i;
+    secp256k1_scratch_space *scratch = secp256k1_scratch_space_create(ctx, 1024 * 1024);
+
+    musig_api_tests(scratch);
+    musig_state_machine_tests(scratch);
+    for (i = 0; i < count; i++) {
+        /* Run multiple times to ensure that the nonce is negated in some tests */
+        scriptless_atomic_swap(scratch);
+    }
+    sha256_tag_test();
+
+    secp256k1_scratch_space_destroy(scratch);
+}
+
+#endif
diff --git a/src/secp256k1.c b/src/secp256k1.c
index 95ad5a86f..a3f6726be 100644
--- a/src/secp256k1.c
+++ b/src/secp256k1.c
@@ -639,6 +639,10 @@ int secp256k1_ec_pubkey_combine(const secp256k1_context* ctx, secp256k1_pubkey *
 # include "modules/schnorrsig/main_impl.h"
 #endif
 
+#ifdef ENABLE_MODULE_MUSIG
+# include "modules/musig/main_impl.h"
+#endif
+
 #ifdef ENABLE_MODULE_RECOVERY
 # include "modules/recovery/main_impl.h"
 #endif
diff --git a/src/tests.c b/src/tests.c
index 60c451967..b7714e532 100644
--- a/src/tests.c
+++ b/src/tests.c
@@ -5123,6 +5123,10 @@ void run_ecdsa_openssl(void) {
 # include "modules/schnorrsig/tests_impl.h"
 #endif
 
+#ifdef ENABLE_MODULE_MUSIG
+# include "modules/musig/tests_impl.h"
+#endif
+
 #ifdef ENABLE_MODULE_RECOVERY
 # include "modules/recovery/tests_impl.h"
 #endif
@@ -5256,6 +5260,10 @@ int main(int argc, char **argv) {
     run_schnorrsig_tests();
 #endif
 
+#ifdef ENABLE_MODULE_MUSIG
+    run_musig_tests();
+#endif
+
     /* ecdsa tests */
     run_random_pubkeys();
     run_ecdsa_der_parse();

From 2fc700a943a52ecff7e6488b37de1a4f42da5f56 Mon Sep 17 00:00:00 2001
From: Jonas Nick <jonasd.nick@gmail.com>
Date: Sat, 22 Dec 2018 22:15:19 +0000
Subject: [PATCH 5/5] Add 3-of-3 MuSig example

---
 include/secp256k1_musig.h             |   4 +-
 src/modules/musig/Makefile.am.include |  13 ++
 src/modules/musig/example.c           | 165 ++++++++++++++++++++++++++
 3 files changed, 181 insertions(+), 1 deletion(-)
 create mode 100644 src/modules/musig/example.c

diff --git a/include/secp256k1_musig.h b/include/secp256k1_musig.h
index 035adfe0e..ead762d2c 100644
--- a/include/secp256k1_musig.h
+++ b/include/secp256k1_musig.h
@@ -4,7 +4,9 @@
 #include <stdint.h>
 
 /** This module implements a Schnorr-based multi-signature scheme called MuSig
- * (https://eprint.iacr.org/2018/068.pdf).
+ * (https://eprint.iacr.org/2018/068.pdf). There's an example C source file in the
+ * module's directory (src/modules/musig/example.c) that demonstrates how it can be
+ * used.
  */
 
 /** Data structure containing data related to a signing session resulting in a single
diff --git a/src/modules/musig/Makefile.am.include b/src/modules/musig/Makefile.am.include
index 6099ab727..0cd254d8a 100644
--- a/src/modules/musig/Makefile.am.include
+++ b/src/modules/musig/Makefile.am.include
@@ -1,3 +1,16 @@
 include_HEADERS += include/secp256k1_musig.h
 noinst_HEADERS += src/modules/musig/main_impl.h
 noinst_HEADERS += src/modules/musig/tests_impl.h
+
+noinst_PROGRAMS += example_musig
+example_musig_SOURCES = src/modules/musig/example.c
+example_musig_CPPFLAGS = -DSECP256K1_BUILD -I$(top_srcdir)/include $(SECP_INCLUDES)
+if !ENABLE_COVERAGE
+example_musig_CPPFLAGS += -DVERIFY
+endif
+example_musig_LDADD = libsecp256k1.la $(SECP_LIBS)
+example_musig_LDFLAGS = -static
+
+if USE_TESTS
+TESTS += example_musig
+endif
diff --git a/src/modules/musig/example.c b/src/modules/musig/example.c
new file mode 100644
index 000000000..5aebfa205
--- /dev/null
+++ b/src/modules/musig/example.c
@@ -0,0 +1,165 @@
+/**********************************************************************
+ * Copyright (c) 2018 Jonas Nick                                      *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+/**
+ * This file demonstrates how to use the MuSig module to create a multisignature.
+ * Additionally, see the documentation in include/secp256k1_musig.h.
+ */
+
+#include <stdio.h>
+#include <assert.h>
+#include <secp256k1.h>
+#include <secp256k1_schnorrsig.h>
+#include <secp256k1_musig.h>
+
+ /* Number of public keys involved in creating the aggregate signature */
+#define N_SIGNERS 3
+ /* Create a key pair and store it in seckey and pubkey */
+int create_key(const secp256k1_context* ctx, unsigned char* seckey, secp256k1_pubkey* pubkey) {
+    int ret;
+    FILE *frand = fopen("/dev/urandom", "r");
+    if (frand == NULL) {
+        return 0;
+    }
+    do {
+         if(!fread(seckey, 32, 1, frand)) {
+             fclose(frand);
+             return 0;
+         }
+    /* The probability that this not a valid secret key is approximately 2^-128 */
+    } while (!secp256k1_ec_seckey_verify(ctx, seckey));
+    fclose(frand);
+    ret = secp256k1_ec_pubkey_create(ctx, pubkey, seckey);
+    return ret;
+}
+
+/* Sign a message hash with the given key pairs and store the result in sig */
+int sign(const secp256k1_context* ctx, unsigned char seckeys[][32], const secp256k1_pubkey* pubkeys, const unsigned char* msg32, secp256k1_schnorrsig *sig) {
+    secp256k1_musig_session musig_session[N_SIGNERS];
+    unsigned char nonce_commitment[N_SIGNERS][32];
+    const unsigned char *nonce_commitment_ptr[N_SIGNERS];
+    secp256k1_musig_session_signer_data signer_data[N_SIGNERS][N_SIGNERS];
+    secp256k1_pubkey nonce[N_SIGNERS];
+    int i, j;
+    secp256k1_musig_partial_signature partial_sig[N_SIGNERS];
+
+    for (i = 0; i < N_SIGNERS; i++) {
+        FILE *frand;
+        unsigned char session_id32[32];
+        unsigned char pk_hash[32];
+        secp256k1_pubkey combined_pk;
+
+        /* Create combined pubkey and initialize signer data */
+        if (!secp256k1_musig_pubkey_combine(ctx, NULL, &combined_pk, pk_hash, pubkeys, N_SIGNERS)) {
+            return 0;
+        }
+        /* Create random session ID. It is absolutely necessary that the session ID
+         * is unique for every call of secp256k1_musig_session_initialize. Otherwise
+         * it's trivial for an attacker to extract the secret key! */
+        frand = fopen("/dev/urandom", "r");
+        if(frand == NULL) {
+            return 0;
+        }
+        if (!fread(session_id32, 32, 1, frand)) {
+            fclose(frand);
+            return 0;
+        }
+        fclose(frand);
+        /* Initialize session */
+        if (!secp256k1_musig_session_initialize(ctx, &musig_session[i], signer_data[i], nonce_commitment[i], session_id32, msg32, &combined_pk, pk_hash, N_SIGNERS, i, seckeys[i])) {
+            return 0;
+        }
+        nonce_commitment_ptr[i] = &nonce_commitment[i][0];
+    }
+    /* Communication round 1: Exchange nonce commitments */
+    for (i = 0; i < N_SIGNERS; i++) {
+        /* Set nonce commitments in the signer data and get the own public nonce */
+        if (!secp256k1_musig_session_get_public_nonce(ctx, &musig_session[i], signer_data[i], &nonce[i], nonce_commitment_ptr, N_SIGNERS)) {
+            return 0;
+        }
+    }
+    /* Communication round 2: Exchange nonces */
+    for (i = 0; i < N_SIGNERS; i++) {
+        for (j = 0; j < N_SIGNERS; j++) {
+            if (!secp256k1_musig_set_nonce(ctx, &signer_data[i][j], &nonce[j])) {
+                /* Signer j's nonce does not match the nonce commitment. In this case
+                 * abort the protocol. If you make another attempt at finishing the
+                 * protocol, create a new session (with a fresh session ID!). */
+                return 0;
+            }
+        }
+        if (!secp256k1_musig_session_combine_nonces(ctx, &musig_session[i], signer_data[i], N_SIGNERS, NULL, NULL)) {
+            return 0;
+        }
+    }
+    for (i = 0; i < N_SIGNERS; i++) {
+        if (!secp256k1_musig_partial_sign(ctx, &musig_session[i], &partial_sig[i])) {
+            return 0;
+        }
+    }
+    /* Communication round 3: Exchange partial signatures */
+    for (i = 0; i < N_SIGNERS; i++) {
+        for (j = 0; j < N_SIGNERS; j++) {
+            /* To check whether signing was successful, it suffices to either verify
+             * the the combined signature with the combined public key using
+             * secp256k1_schnorrsig_verify, or verify all partial signatures of all
+             * signers individually. Verifying the combined signature is cheaper but
+             * verifying the individual partial signatures has the advantage that it
+             * can be used to determine which of the partial signatures are invalid
+             * (if any), i.e., which of the partial signatures cause the combined
+             * signature to be invalid and thus the protocol run to fail. It's also
+             * fine to first verify the combined sig, and only verify the individual
+             * sigs if it does not work.
+             */
+            if (!secp256k1_musig_partial_sig_verify(ctx, &musig_session[i], &signer_data[i][j], &partial_sig[j], &pubkeys[j])) {
+                return 0;
+            }
+        }
+    }
+    return secp256k1_musig_partial_sig_combine(ctx, &musig_session[0], sig, partial_sig, N_SIGNERS);
+}
+
+ int main(void) {
+    secp256k1_context* ctx;
+    int i;
+    unsigned char seckeys[N_SIGNERS][32];
+    secp256k1_pubkey pubkeys[N_SIGNERS];
+    secp256k1_pubkey combined_pk;
+    unsigned char msg[32] = "this_could_be_the_hash_of_a_msg!";
+    secp256k1_schnorrsig sig;
+
+    /* Create a context for signing and verification */
+    ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
+    printf("Creating key pairs......");
+    for (i = 0; i < N_SIGNERS; i++) {
+        if (!create_key(ctx, seckeys[i], &pubkeys[i])) {
+            printf("FAILED\n");
+            return 1;
+        }
+    }
+    printf("ok\n");
+    printf("Combining public keys...");
+    if (!secp256k1_musig_pubkey_combine(ctx, NULL, &combined_pk, NULL, pubkeys, N_SIGNERS)) {
+        printf("FAILED\n");
+        return 1;
+    }
+    printf("ok\n");
+    printf("Signing message.........");
+    if (!sign(ctx, seckeys, pubkeys, msg, &sig)) {
+        printf("FAILED\n");
+        return 1;
+    }
+    printf("ok\n");
+    printf("Verifying signature.....");
+    if (!secp256k1_schnorrsig_verify(ctx, &sig, msg, &combined_pk)) {
+        printf("FAILED\n");
+        return 1;
+    }
+    printf("ok\n");
+    secp256k1_context_destroy(ctx);
+    return 0;
+}
+