<p>I just merged <a href="https://github.com/bitcoin-core/secp256k1/pull/441" rel="noreferrer">a PR by Rusty Russell</a> that aims to explain its purpose. From the text that was added:</p>

<blockquote>
  <p>While secp256k1 code is written to be constant-time no matter what secret values are, it's possible that a future compiler may output code which isn't, and also that the CPU may not emit the same radio frequencies or draw the same amount power for all values.</p>
  
  <p>This function provides a seed which is combined into the blinding value: that blinding value is added before each multiplication (and removed afterwards) so that it does not affect function results, but shields against attacks which rely on any input-dependent behaviour.</p>
  
  <p>You should call this after secp256k1_context_create or secp256k1_context_clone, and may call this repeatedly afterwards.</p>
</blockquote>

CC BY-SA 3.0
2017-03-22T00:41:40.673Z
2017-03-22T00:41:40.673Z
Pieter Wuille
<p>In the course of studying the secp256k1 library API, I came across<code>secp256k1_context_randomize</code> which seems similar to providing a seed to a pseudo-random generator. At the same time, the file <code>secp256k1.h</code> seemingly does not offer any functionality for generating random private keys, and the function <code>secp256k1_ecdsa_sign</code> relies on a deterministic secret (rfc 6979) rather than anything randomly generated. Now I can see the API being extended in file <code>secp256k1_ecdh.h</code> with the function <code>secp256k1_ecdh</code> which returns an EC Diffie-Hellman secret. But this doesn't seem to rely on random generation either since the scalar is provided as argument. So I am wondering, why would a user care to randomize a context, or in other words, where is randomization used with the library?   </p>

<secp256k1><random>
C secp256k1 : what is the purpose of secp256k1_context_randomize?
Sven Williamson
# C secp256k1 : what is the purpose of secp256k1_context_randomize?

(Asked by: username_0 on 2017-03-21)

In the course of studying the secp256k1 library API, I came across`secp256k1_context_randomize` which seems similar to providing a seed to a pseudo-random generator. At the same time, the file `secp256k1.h` seemingly does not offer any functionality for generating random private keys, and the function `secp256k1_ecdsa_sign` relies on a deterministic secret (rfc 6979) rather than anything randomly generated. Now I can see the API being extended in file `secp256k1_ecdh.h` with the function `secp256k1_ecdh` which returns an EC Diffie-Hellman secret. But this doesn't seem to rely on random generation either since the scalar is provided as argument. So I am wondering, why would a user care to randomize a context, or in other words, where is randomization used with the library?

**Tags:** secp256k1, random


---

## 1 answers

### Answer by username_1 on 2017-03-22. Score: 5 | Accepted answer

I just merged [a PR by Rusty Russell](https://github.com/bitcoin-core/secp256k1/pull/441) that aims to explain its purpose. From the text that was added:

> While secp256k1 code is written to be constant-time no matter what secret values are, it's possible that a future compiler may output code which isn't, and also that the CPU may not emit the same radio frequencies or draw the same amount power for all values.
>
> This function provides a seed which is combined into the blinding value: that blinding value is added before each multiplication (and removed afterwards) so that it does not affect function results, but shields against attacks which rely on any input-dependent behaviour.
>
> You should call this after secp256k1\_context\_create or secp256k1\_context\_clone, and may call this repeatedly afterwards.


---

