C secp256k1 : what is the purpose of secp256k1_context_randomize?

Question

In the course of studying the secp256k1 library API, I came acrosssecp256k1_context_randomize which seems similar to providing a seed to a pseudo-random generator. At the same time, the file secp256k1.h seemingly does not offer any functionality for generating random private keys, and the function secp256k1_ecdsa_sign relies on a deterministic secret (rfc 6979) rather than anything randomly generated. Now I can see the API being extended in file secp256k1_ecdh.h with the function secp256k1_ecdh which returns an EC Diffie-Hellman secret. But this doesn't seem to rely on random generation either since the scalar is provided as argument. So I am wondering, why would a user care to randomize a context, or in other words, where is randomization used with the library?

Answer 1

I just merged a PR by Rusty Russell that aims to explain its purpose. From the text that was added:

While secp256k1 code is written to be constant-time no matter what secret values are, it's possible that a future compiler may output code which isn't, and also that the CPU may not emit the same radio frequencies or draw the same amount power for all values.

This function provides a seed which is combined into the blinding value: that blinding value is added before each multiplication (and removed afterwards) so that it does not affect function results, but shields against attacks which rely on any input-dependent behaviour.

You should call this after secp256k1_context_create or secp256k1_context_clone, and may call this repeatedly afterwards.