Squashed 'src/secp256k1/' changes from 427bc3c..3e3d125

3e3d125 Merge bitcoin-core/secp256k1#1309: changelog: Catch up e8295d0 Merge bitcoin-core/secp256k1#1311: Revert "Remove unused scratch space from API" 697e1cc changelog: Catch up 3ad1027 Revert "Remove unused scratch space from API" 76b43f3 changelog: Add entry for #1303 7d4f86d Merge bitcoin-core/secp256k1#1307: Mark more assembly outputs as early clobber b54a067 Merge bitcoin-core/secp256k1#1304: build: Rename arm to arm32 and check if it's really supported c6bb29b build: Rename `64bit` to `x86_64` 8c9ae37 Add release note 0324645 autotools: Add `SECP_ARM32_ASM_CHECK` macro ed4ba23 cmake: Add `check_arm32_assembly` function 350b4bd Mark stack variables as early clobber for technical correctness 0c729ba Bugfix: mark outputs as early clobber in scalar x86_64 asm 3353d3c Merge bitcoin-core/secp256k1#1207: Split fe_set_b32 into reducing and normalizing variants 5b32602 Split fe_set_b32 into reducing and normalizing variants 006ddc1 Merge bitcoin-core/secp256k1#1306: build: Make tests work with external default callbacks 1907f0f build: Make tests work with external default callbacks fb3a806 Merge bitcoin-core/secp256k1#1133: schnorrsig: Add test vectors for variable-length messages cd54ac7 schnorrsig: Improve docs of schnorrsig_sign_custom 28687b0 schnorrsig: Add BIP340 varlen test vectors 97a98be schnorrsig: Refactor test vector code to allow varlen messages ab5a917 Merge bitcoin-core/secp256k1#1303: ct: Use more volatile 9eb6934 Merge bitcoin-core/secp256k1#1305: Remove unused scratch space from API 073d98a Merge bitcoin-core/secp256k1#1292: refactor: Make 64-bit shift explicit 17fa217 ct: Be cautious and use volatile trick in more "conditional" paths 5fb336f ct: Use volatile trick in scalar_cond_negate 712e7f8 Remove unused scratch space from API 54d34b6 Merge bitcoin-core/secp256k1#1300: Avoid normalize conditional on VERIFY c63ec88 Merge bitcoin-core/secp256k1#1066: Abstract out and merge all the magnitude/normalized logic 7fc642f Simplify secp256k1_fe_{impl_,}verify 4e176ad Abstract out verify logic for fe_is_square_var 4371f98 Abstract out verify logic for fe_add_int 89e324c Abstract out verify logic for fe_half 283cd80 Abstract out verify logic for fe_get_bounds d5aa2f0 Abstract out verify logic for fe_inv{,_var} 3167646 Abstract out verify logic for fe_from_storage 76d31e5 Abstract out verify logic for fe_to_storage 1e6894b Abstract out verify logic for fe_cmov be82bd8 Improve comments/checks for fe_sqrt 6ab3508 Abstract out verify logic for fe_sqr 4c25f6e Abstract out verify logic for fe_mul e179e65 Abstract out verify logic for fe_add 7e7ad7f Abstract out verify logic for fe_mul_int 65d82a3 Abstract out verify logic for fe_negate 1446708 Abstract out verify logic for fe_get_b32 f7a7666 Abstract out verify logic for fe_set_b32 ce4d209 Abstract out verify logic for fe_cmp_var 7d7d43c Improve comments/check for fe_equal{,_var} c5e788d Abstract out verify logic for fe_is_odd d3f3fe8 Abstract out verify logic for fe_is_zero c701d9a Abstract out verify logic for fe_clear 19a2bfe Abstract out verify logic for fe_set_int 864f9db Abstract out verify logic for fe_normalizes_to_zero{,_var} 6c31371 Abstract out verify logic for fe_normalize_var e28b51f Abstract out verify logic for fe_normalize_weak b6b6f9c Abstract out verify logic for fe_normalize 7fa5195 Bugfix: correct SECP256K1_FE_CONST mag/norm fields e5cf4bf build: Rename `arm` to `arm32` b29566c Merge magnitude/normalized fields, move/improve comments 97c63b9 Avoid normalize conditional on VERIFY 341cc19 Merge bitcoin-core/secp256k1#1299: Infinity handling: ecmult_const(infinity) works, and group verification bbc8344 Avoid secp256k1_ge_set_gej_zinv with uninitialized z 0a2e0b2 Make secp256k1_{fe,ge,gej}_verify work as no-op if non-VERIFY f202667 Add invariant checking to group elements a18821d Always initialize output coordinates in secp256k1_ge_set_gej 3086cb9 Expose secp256k1_fe_verify to other modules a0e696f Make secp256k1_ecmult_const handle infinity 24c768a Merge bitcoin-core/secp256k1#1301: Avoid using bench_verify_data as bench_sign_data; merge them 2e65f1f Avoid using bench_verify_data as bench_sign_data; merge them 1cf15eb Merge bitcoin-core/secp256k1#1296: docs: complete interface description for `secp256k1_schnorrsig_sign_custom` 149c41c docs: complete interface description for `secp256k1_schnorrsig_sign_custom` f30c748 Merge bitcoin-core/secp256k1#1270: cmake: Fix library ABI versioning d1e48e5 refactor: Make 64-bit shift explicit b2e29e4 ci: Treat all compiler warnings as errors in "Windows (VS 2022)" task 3c81838 Merge bitcoin-core/secp256k1#1289: cmake: Use full signature of `add_test()` command 755629b cmake: Use full signature of `add_test()` command bef448f cmake: Fix library ABI versioning 4b0f711 Merge bitcoin-core/secp256k1#1277: autotools: Clean up after adding Wycheproof 222ecaf Merge bitcoin-core/secp256k1#1284: cmake: Some improvements using `PROJECT_IS_TOP_LEVEL` variable 71f746c cmake: Include `include` directory for subtree builds 024a409 Merge bitcoin-core/secp256k1#1240: cmake: Improve and document compiler flag checks a8d059f cmake, doc: Document compiler flags 6ece150 cmake, refactor: Rename `try_add_compile_option` to `try_append_cflags` 19516ed cmake: Use `add_compile_options()` in `try_add_compile_option()` 4b84f4b Merge bitcoin-core/secp256k1#1239: cmake: Bugfix and other improvements after bumping CMake up to 3.13 596b336 Merge bitcoin-core/secp256k1#1234: cmake: Add dev-mode 6b7e5b7 Merge bitcoin-core/secp256k1#1275: build: Fix C4005 "macro redefinition" MSVC warnings in examples 1c89536 Merge bitcoin-core/secp256k1#1286: tests: remove extra semicolon in macro c4062d6 debug: move helper for printing buffers into util.h 7e977b3 autotools: Take VPATH builds into account when generating testvectors 2418d32 autotools: Create src/wycheproof dir before creating file in it 8764034 autotools: Make all "pregenerated" targets .PHONY e1b9ce8 autotools: Use same conventions for all pregenerated files 3858bad tests: remove extra semicolon in macro 1f33bb2 Merge bitcoin-core/secp256k1#1205: field: Improve docs +tests of secp256k1_fe_set_b32 162da73 tests: Add debug helper for printing buffers e9fd3df field: Improve docs and tests of secp256k1_fe_set_b32 f6bef03 Merge bitcoin-core/secp256k1#1283: Get rid of secp256k1_fe_const_b 5431b9d cmake: Make `SECP256K1_INSTALL` default depend on `PROJECT_IS_TOP_LEVEL` 5ec1333 Merge bitcoin-core/secp256k1#1285: bench: Make sys/time.h a system include 68b16a1 bench: Make sys/time.h a system include 162608c cmake: Emulate `PROJECT_IS_TOP_LEVEL` for CMake<3.21 69e1ec0 Get rid of secp256k1_fe_const_b ce5ba9e gitignore: Add CMakeUserPresets.json 0a446a3 cmake: Add dev-mode CMake preset a6f4bcf Merge bitcoin-core/secp256k1#1231: Move `SECP256K1_INLINE` macro definition out from `include/secp256k1.h` a273d74 cmake: Improve version comparison 6a58b48 cmake: Use `if(... IN_LIST ...)` command 2445808 cmake: Use dedicated `GENERATOR_IS_MULTI_CONFIG` property 9f8703e cmake: Use dedicated `CMAKE_HOST_APPLE` variable 8c20170 cmake: Use recommended `add_compile_definitions` command 04d4cc0 cmake: Add `DESCRIPTION` and `HOMEPAGE_URL` options to `project` command 8a8b653 cmake: Use `SameMinorVersion` compatibility mode 5b0444a Merge bitcoin-core/secp256k1#1263: cmake: Make installation optional 47ac3d6 cmake: Make installation optional 2e035af Merge bitcoin-core/secp256k1#1273: build: Make `SECP_VALGRIND_CHECK` preserve `CPPFLAGS` 5be353d Merge bitcoin-core/secp256k1#1279: tests: lint wycheproof's python script 08f4b16 autotools: Move code around to tidy Makefile 04bf3f6 Merge bitcoin-core/secp256k1#1230: Build: allow static or shared but not both 9ce9984 Merge bitcoin-core/secp256k1#1265: Remove bits argument from secp256k1_wnaf_const{_xonly} 566faa1 Merge bitcoin-core/secp256k1#1267: doc: clarify process for patch releases ef49a11 build: allow static or shared but not both 35ada3b tests: lint wycheproof's python script 4258c54 Merge bitcoin-core/secp256k1#1276: autotools: Don't regenerate Wycheproof header automatically 529b54d autotools: Move Wycheproof header from EXTRA_DIST to noinst_HEADERS 06c67de autotools: Don't regenerate Wycheproof header automatically dc0657c build: Fix C4005 "macro redefinition" MSVC warnings in examples 1ecb94e build: Make `SECP_VALGRIND_CHECK` preserve `CPPFLAGS` 3bab71c Merge bitcoin-core/secp256k1#1268: release cleanup: bump version after 0.3.1 656c6ea release cleanup: bump version after 0.3.1 346a053 Merge bitcoin-core/secp256k1#1269: changelog: Fix link 6a37b2a changelog: Fix link ec98fce Merge bitcoin-core/secp256k1#1266: release: Prepare for 0.3.1 1b6fb55 doc: clarify process for patch releases 898e1c6 release: Prepare for 0.3.1 1d9a13f changelog: Remove inconsistent newlines 0e09166 changelog: Catch up in preparation of 0.3.1 7b7503d Merge bitcoin-core/secp256k1#1245: tests: Add Wycheproof ECDSA vectors a575339 Remove bits argument from secp256k1_wnaf_const (always 256) 145078c Merge bitcoin-core/secp256k1#1118: Add x-only ecmult_const version with x specified as n/d e5de454 tests: Add Wycheproof ECDSA vectors 0f86420 Add exhaustive tests for ecmult_const_xonly 4485926 Add x-only ecmult_const version for x=n/d a0f4644 Merge bitcoin-core/secp256k1#1252: Make position of * in pointer declarations in include/ consistent 4e68262 Merge bitcoin-core/secp256k1#1226: Add CMake instructions to release process 2d51a45 Merge bitcoin-core/secp256k1#1257: ct: Use volatile "trick" in all fe/scalar cmov implementations 4a496a3 ct: Use volatile "trick" in all fe/scalar cmov implementations 3d1f430 Make position of * in pointer declarations in include/ consistent 2bca0a5 Merge bitcoin-core/secp256k1#1241: build: Improve `SECP_TRY_APPEND_DEFAULT_CFLAGS` macro afd8b23 Merge bitcoin-core/secp256k1#1244: Suppress `-Wunused-parameter` when building for coverage analysis 1d8f367 Merge bitcoin-core/secp256k1#1250: No need to subtract 1 before doing a right shift 3e43041 No need to subtract 1 before doing a right shift 3addb4c build: Improve `SECP_TRY_APPEND_DEFAULT_CFLAGS` macro 0c07c82 Add CMake instructions to release process 464a911 Merge bitcoin-core/secp256k1#1242: Set ARM ASM symbol visibility to `hidden` f16a709 Merge bitcoin-core/secp256k1#1247: Apply Checks only in VERIFY mode. 70be3ca Merge bitcoin-core/secp256k1#1246: Typo 4ebd828 Apply Checks only in VERIFY mode. d1e7ca1 Typo 36b0adf build: remove warning until it's reproducible 5bb03c2 Replace `SECP256K1_ECMULT_TABLE_VERIFY` macro by a function 9c8c4f4 Merge bitcoin-core/secp256k1#1238: build: bump CMake minimum requirement to 3.13 0cf2fb9 Merge bitcoin-core/secp256k1#1243: build: Ensure no optimization when building for coverage analysis fd2a408 Set ARM ASM symbol visibility to `hidden` 4429a8c Suppress `-Wunused-parameter` when building for coverage analysis 8e79c7e build: Ensure no optimization when building for coverage analysis 96dd062 build: bump CMake minimum requirement to 3.13 8e142ca Move `SECP256K1_INLINE` macro definition out from `include/secp256k1.h` 7744589 Remove `SECP256K1_INLINE` usage from examples ca92a35 field: Simplify code in secp256k1_fe_set_b32 d93f62e field: Verify field element even after secp256k1_fe_set_b32 fails git-subtree-dir: src/secp256k1 git-subtree-split: 3e3d125b83f8426fb70535c469e7ef6aac412a2a
hebasto · May 13, 2023 · 49c52ea · 49c52ea
1 parent dd3ab6a
commit 49c52ea
Show file tree

Hide file tree

Showing 71 changed files with 10,339 additions and 1,092 deletions.
diff --git a/.cirrus.yml b/.cirrus.yml
@@ -176,7 +176,7 @@ task:
     CTIMETESTS: no
   matrix:
     - env: {}
-    - env: {EXPERIMENTAL: yes, ASM: arm}
+    - env: {EXPERIMENTAL: yes, ASM: arm32}
   << : *MERGE_BASE
   test_script:
     - ./ci/cirrus.sh
@@ -397,13 +397,13 @@ task:
     - PowerShell -NoLogo -Command if ($env:CIRRUS_PR -ne $null) { git fetch $env:CIRRUS_REPO_CLONE_URL pull/$env:CIRRUS_PR/merge; git reset --hard FETCH_HEAD; }
   configure_script:
     - '%x64_NATIVE_TOOLS%'
-    - cmake -G "Visual Studio 17 2022" -A x64 -S . -B build -DSECP256K1_ENABLE_MODULE_RECOVERY=ON -DSECP256K1_BUILD_EXAMPLES=ON
+    - cmake -E env CFLAGS="/WX" cmake -G "Visual Studio 17 2022" -A x64 -S . -B build -DSECP256K1_ENABLE_MODULE_RECOVERY=ON -DSECP256K1_BUILD_EXAMPLES=ON
   build_script:
     - '%x64_NATIVE_TOOLS%'
     - cmake --build build --config RelWithDebInfo -- -property:UseMultiToolTask=true;CL_MPcount=5
   check_script:
     - '%x64_NATIVE_TOOLS%'
-    - ctest --test-dir build -j 5
+    - ctest -C RelWithDebInfo --test-dir build -j 5
     - build\src\RelWithDebInfo\bench_ecmult.exe
     - build\src\RelWithDebInfo\bench_internal.exe
     - build\src\RelWithDebInfo\bench.exe
diff --git a/.gitignore b/.gitignore
@@ -59,5 +59,7 @@ build-aux/compile
 build-aux/test-driver
 libsecp256k1.pc
 
+### CMake
+/CMakeUserPresets.json
 # Default CMake build directory.
 /build
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+#### Security
+ - Module `ecdh`: Fix "constant-timeness" issue with GCC 13.1 (and potentially future versions of GCC) that could leave applications using libsecp256k1's ECDH module vulnerable to a timing side-channel attack. The fix avoids secret-dependent control flow during ECDH computations when libsecp256k1 is compiled with GCC 13.1.
+
+#### Fixed
+ - Fixed an old bug that permitted compilers to potentially output bad assembly code on x86_64. In theory, it could lead to a crash or a read of unrelated memory, but this has never been observed on any compilers so far.
+
+#### Changed
+ - Various improvements and changes to CMake builds. CMake builds remain experimental.
+   - Made API versioning consistent with GNU Autotools builds.
+   - Switched to `BUILD_SHARED_LIBS` variable for controlling whether to build a static or a shared library.
+   - Added `SECP256K1_INSTALL` variable for the controlling whether to install the build artefacts.
+ - Renamed asm build option `arm` to `arm32`. Use `--with-asm=arm32` instead of `--with-asm=arm` (GNU Autotools), and `-DSECP256K1_ASM=arm32` instead of `-DSECP256K1_ASM=arm` (CMake).
+
+## [0.3.1] - 2023-04-10
+We strongly recommend updating to 0.3.1 if you use or plan to use Clang >=14 to compile libsecp256k1, e.g., Xcode >=14 on macOS has Clang >=14. When in doubt, check the Clang version using `clang -v`.
+
+#### Security
+ - Fix "constant-timeness" issue with Clang >=14 that could leave applications using libsecp256k1 vulnerable to a timing side-channel attack. The fix avoids secret-dependent control flow and secret-dependent memory accesses in conditional moves of memory objects when libsecp256k1 is compiled with Clang >=14.
+
+#### Added
+  - Added tests against [Project Wycheproof's](https://github.com/google/wycheproof/) set of ECDSA test vectors (Bitcoin "low-S" variant), a fixed set of test cases designed to trigger various edge cases.
+
+#### Changed
+ - Increased minimum required CMake version to 3.13. CMake builds remain experimental.
+
+#### ABI Compatibility
+The ABI is compatible with version 0.3.0.
+
 ## [0.3.0] - 2023-03-08
 
 #### Added
@@ -25,7 +53,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
  - Removed the configuration header `src/libsecp256k1-config.h`. We recommend passing flags to `./configure` or `cmake` to set configuration options (see `./configure --help` or `cmake -LH`). If you cannot or do not want to use one of the supported build systems, pass configuration flags such as `-DSECP256K1_ENABLE_MODULE_SCHNORRSIG` manually to the compiler (see the file `configure.ac` for supported flags).
 
 #### ABI Compatibility
-
 Due to changes in the API regarding `secp256k1_context_static` described above, the ABI is *not* compatible with previous versions.
 
 ## [0.2.0] - 2022-12-12
@@ -45,7 +72,6 @@ Due to changes in the API regarding `secp256k1_context_static` described above,
  - Module `schnorrsig`: renamed `secp256k1_schnorrsig_sign` to `secp256k1_schnorrsig_sign32`.
 
 #### ABI Compatibility
-
 Since this is the first release, we do not compare application binary interfaces.
 However, there are earlier unreleased versions of libsecp256k1 that are *not* ABI compatible with this version.
 
@@ -55,7 +81,8 @@ This version was in fact never released.
 The number was given by the build system since the introduction of autotools in Jan 2014 (ea0fe5a5bf0c04f9cc955b2966b614f5f378c6f6).
 Therefore, this version number does not uniquely identify a set of source files.
 
-[unreleased]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.0...HEAD
+[unreleased]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.1...HEAD
+[0.3.1]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/bitcoin-core/secp256k1/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/bitcoin-core/secp256k1/compare/423b6d19d373f1224fd671a982584d7e7900bc93..v0.2.0
 [0.1.0]: https://github.com/bitcoin-core/secp256k1/commit/423b6d19d373f1224fd671a982584d7e7900bc93
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -1,61 +1,79 @@
-cmake_minimum_required(VERSION 3.1)
+cmake_minimum_required(VERSION 3.13)
 
-if(CMAKE_VERSION VERSION_GREATER 3.14)
+if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.15)
   # MSVC runtime library flags are selected by the CMAKE_MSVC_RUNTIME_LIBRARY abstraction.
   cmake_policy(SET CMP0091 NEW)
   # MSVC warning flags are not in CMAKE_<LANG>_FLAGS by default.
   cmake_policy(SET CMP0092 NEW)
 endif()
 
-# The package (a.k.a. release) version is based on semantic versioning 2.0.0 of
-# the API. All changes in experimental modules are treated as
-# backwards-compatible and therefore at most increase the minor version.
-project(libsecp256k1 VERSION 0.3.1 LANGUAGES C)
+project(libsecp256k1
+  # The package (a.k.a. release) version is based on semantic versioning 2.0.0 of
+  # the API. All changes in experimental modules are treated as
+  # backwards-compatible and therefore at most increase the minor version.
+  VERSION 0.3.2
+  DESCRIPTION "Optimized C library for ECDSA signatures and secret/public key operations on curve secp256k1."
+  HOMEPAGE_URL "https://github.com/bitcoin-core/secp256k1"
+  LANGUAGES C
+)
+
+if(CMAKE_VERSION VERSION_LESS 3.21)
+  get_directory_property(parent_directory PARENT_DIRECTORY)
+  if(parent_directory)
+    set(PROJECT_IS_TOP_LEVEL OFF CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+    set(${PROJECT_NAME}_IS_TOP_LEVEL OFF CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+  else()
+    set(PROJECT_IS_TOP_LEVEL ON CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+    set(${PROJECT_NAME}_IS_TOP_LEVEL ON CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+  endif()
+  unset(parent_directory)
+endif()
 
 # The library version is based on libtool versioning of the ABI. The set of
 # rules for updating the version can be found here:
 # https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
 # All changes in experimental modules are treated as if they don't affect the
 # interface and therefore only increase the revision.
 set(${PROJECT_NAME}_LIB_VERSION_CURRENT 2)
-set(${PROJECT_NAME}_LIB_VERSION_REVISION 1)
+set(${PROJECT_NAME}_LIB_VERSION_REVISION 2)
 set(${PROJECT_NAME}_LIB_VERSION_AGE 0)
 
 set(CMAKE_C_STANDARD 90)
 set(CMAKE_C_EXTENSIONS OFF)
 
 list(APPEND CMAKE_MODULE_PATH ${PROJECT_SOURCE_DIR}/cmake)
 
-# We do not use CMake's BUILD_SHARED_LIBS option.
-option(SECP256K1_BUILD_SHARED "Build shared library." ON)
-option(SECP256K1_BUILD_STATIC "Build static library." ON)
-if(NOT SECP256K1_BUILD_SHARED AND NOT SECP256K1_BUILD_STATIC)
-  message(FATAL_ERROR "At least one of SECP256K1_BUILD_SHARED and SECP256K1_BUILD_STATIC must be enabled.")
+option(BUILD_SHARED_LIBS "Build shared libraries." ON)
+option(SECP256K1_DISABLE_SHARED "Disable shared library. Overrides BUILD_SHARED_LIBS." OFF)
+if(SECP256K1_DISABLE_SHARED)
+  set(BUILD_SHARED_LIBS OFF)
 endif()
 
+option(SECP256K1_INSTALL "Enable installation." ${PROJECT_IS_TOP_LEVEL})
+
 option(SECP256K1_ENABLE_MODULE_ECDH "Enable ECDH module." ON)
 if(SECP256K1_ENABLE_MODULE_ECDH)
-  add_definitions(-DENABLE_MODULE_ECDH=1)
+  add_compile_definitions(ENABLE_MODULE_ECDH=1)
 endif()
 
 option(SECP256K1_ENABLE_MODULE_RECOVERY "Enable ECDSA pubkey recovery module." OFF)
 if(SECP256K1_ENABLE_MODULE_RECOVERY)
-  add_definitions(-DENABLE_MODULE_RECOVERY=1)
+  add_compile_definitions(ENABLE_MODULE_RECOVERY=1)
 endif()
 
 option(SECP256K1_ENABLE_MODULE_EXTRAKEYS "Enable extrakeys module." ON)
 option(SECP256K1_ENABLE_MODULE_SCHNORRSIG "Enable schnorrsig module." ON)
 if(SECP256K1_ENABLE_MODULE_SCHNORRSIG)
   set(SECP256K1_ENABLE_MODULE_EXTRAKEYS ON)
-  add_definitions(-DENABLE_MODULE_SCHNORRSIG=1)
+  add_compile_definitions(ENABLE_MODULE_SCHNORRSIG=1)
 endif()
 if(SECP256K1_ENABLE_MODULE_EXTRAKEYS)
-  add_definitions(-DENABLE_MODULE_EXTRAKEYS=1)
+  add_compile_definitions(ENABLE_MODULE_EXTRAKEYS=1)
 endif()
 
 option(SECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS "Enable external default callback functions." OFF)
 if(SECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS)
-  add_definitions(-DUSE_EXTERNAL_DEFAULT_CALLBACKS=1)
+  add_compile_definitions(USE_EXTERNAL_DEFAULT_CALLBACKS=1)
 endif()
 
 set(SECP256K1_ECMULT_WINDOW_SIZE "AUTO" CACHE STRING "Window size for ecmult precomputation for verification, specified as integer in range [2..24]. \"AUTO\" is a reasonable setting for desktop machines (currently 15). [default=AUTO]")
@@ -65,37 +83,43 @@ check_string_option_value(SECP256K1_ECMULT_WINDOW_SIZE)
 if(SECP256K1_ECMULT_WINDOW_SIZE STREQUAL "AUTO")
   set(SECP256K1_ECMULT_WINDOW_SIZE 15)
 endif()
-add_definitions(-DECMULT_WINDOW_SIZE=${SECP256K1_ECMULT_WINDOW_SIZE})
+add_compile_definitions(ECMULT_WINDOW_SIZE=${SECP256K1_ECMULT_WINDOW_SIZE})
 
 set(SECP256K1_ECMULT_GEN_PREC_BITS "AUTO" CACHE STRING "Precision bits to tune the precomputed table size for signing, specified as integer 2, 4 or 8. \"AUTO\" is a reasonable setting for desktop machines (currently 4). [default=AUTO]")
 set_property(CACHE SECP256K1_ECMULT_GEN_PREC_BITS PROPERTY STRINGS "AUTO" 2 4 8)
 check_string_option_value(SECP256K1_ECMULT_GEN_PREC_BITS)
 if(SECP256K1_ECMULT_GEN_PREC_BITS STREQUAL "AUTO")
   set(SECP256K1_ECMULT_GEN_PREC_BITS 4)
 endif()
-add_definitions(-DECMULT_GEN_PREC_BITS=${SECP256K1_ECMULT_GEN_PREC_BITS})
+add_compile_definitions(ECMULT_GEN_PREC_BITS=${SECP256K1_ECMULT_GEN_PREC_BITS})
 
 set(SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY "OFF" CACHE STRING "Test-only override of the (autodetected by the C code) \"widemul\" setting. Legal values are: \"OFF\", \"int128_struct\", \"int128\" or \"int64\". [default=OFF]")
 set_property(CACHE SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY PROPERTY STRINGS "OFF" "int128_struct" "int128" "int64")
 check_string_option_value(SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY)
 if(SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY)
   string(TOUPPER "${SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY}" widemul_upper_value)
-  add_definitions(-DUSE_FORCE_WIDEMUL_${widemul_upper_value}=1)
+  add_compile_definitions(USE_FORCE_WIDEMUL_${widemul_upper_value}=1)
 endif()
 mark_as_advanced(FORCE SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY)
 
-set(SECP256K1_ASM "AUTO" CACHE STRING "Assembly optimizations to use: \"AUTO\", \"OFF\", \"x86_64\" or \"arm\" (experimental). [default=AUTO]")
-set_property(CACHE SECP256K1_ASM PROPERTY STRINGS "AUTO" "OFF" "x86_64" "arm")
+set(SECP256K1_ASM "AUTO" CACHE STRING "Assembly optimizations to use: \"AUTO\", \"OFF\", \"x86_64\" or \"arm32\" (experimental). [default=AUTO]")
+set_property(CACHE SECP256K1_ASM PROPERTY STRINGS "AUTO" "OFF" "x86_64" "arm32")
 check_string_option_value(SECP256K1_ASM)
-if(SECP256K1_ASM STREQUAL "arm")
+if(SECP256K1_ASM STREQUAL "arm32")
   enable_language(ASM)
-  add_definitions(-DUSE_EXTERNAL_ASM=1)
+  include(CheckArm32Assembly)
+  check_arm32_assembly()
+  if(HAVE_ARM32_ASM)
+    add_compile_definitions(USE_EXTERNAL_ASM=1)
+  else()
+    message(FATAL_ERROR "ARM32 assembly optimization requested but not available.")
+  endif()
 elseif(SECP256K1_ASM)
-  include(Check64bitAssembly)
-  check_64bit_assembly()
-  if(HAS_64BIT_ASM)
+  include(CheckX86_64Assembly)
+  check_x86_64_assembly()
+  if(HAVE_X86_64_ASM)
     set(SECP256K1_ASM "x86_64")
-    add_definitions(-DUSE_ASM_X86_64=1)
+    add_compile_definitions(USE_ASM_X86_64=1)
   elseif(SECP256K1_ASM STREQUAL "AUTO")
     set(SECP256K1_ASM "OFF")
   else()
@@ -105,8 +129,8 @@ endif()
 
 option(SECP256K1_EXPERIMENTAL "Allow experimental configuration options." OFF)
 if(NOT SECP256K1_EXPERIMENTAL)
-  if(SECP256K1_ASM STREQUAL "arm")
-    message(FATAL_ERROR "ARM assembly optimization is experimental. Use -DSECP256K1_EXPERIMENTAL=ON to allow.")
+  if(SECP256K1_ASM STREQUAL "arm32")
+    message(FATAL_ERROR "ARM32 assembly optimization is experimental. Use -DSECP256K1_EXPERIMENTAL=ON to allow.")
   endif()
 endif()
 
@@ -118,7 +142,7 @@ if(SECP256K1_VALGRIND)
   if(Valgrind_FOUND)
     set(SECP256K1_VALGRIND ON)
     include_directories(${Valgrind_INCLUDE_DIR})
-    add_definitions(-DVALGRIND)
+    add_compile_definitions(VALGRIND)
   elseif(SECP256K1_VALGRIND STREQUAL "AUTO")
     set(SECP256K1_VALGRIND OFF)
   else()
@@ -147,7 +171,7 @@ else()
 endif()
 
 # Define custom "Coverage" build type.
-set(CMAKE_C_FLAGS_COVERAGE "${CMAKE_C_FLAGS_RELWITHDEBINFO} -O0 -DCOVERAGE=1 --coverage -Wno-unused-parameter" CACHE STRING
+set(CMAKE_C_FLAGS_COVERAGE "${CMAKE_C_FLAGS_RELWITHDEBINFO} -O0 -DCOVERAGE=1 --coverage" CACHE STRING
   "Flags used by the C compiler during \"Coverage\" builds."
   FORCE
 )
@@ -165,49 +189,49 @@ mark_as_advanced(
   CMAKE_SHARED_LINKER_FLAGS_COVERAGE
 )
 
-if(CMAKE_CONFIGURATION_TYPES)
-  set(CMAKE_CONFIGURATION_TYPES "RelWithDebInfo" "Release" "Debug" "MinSizeRel" "Coverage")
-endif()
-
-get_property(cached_cmake_build_type CACHE CMAKE_BUILD_TYPE PROPERTY TYPE)
-if(cached_cmake_build_type)
+get_property(is_multi_config GLOBAL PROPERTY GENERATOR_IS_MULTI_CONFIG)
+set(default_build_type "RelWithDebInfo")
+if(is_multi_config)
+  set(CMAKE_CONFIGURATION_TYPES "${default_build_type}" "Release" "Debug" "MinSizeRel" "Coverage" CACHE STRING
+    "Supported configuration types."
+    FORCE
+  )
+else()
   set_property(CACHE CMAKE_BUILD_TYPE PROPERTY
-    STRINGS "RelWithDebInfo" "Release" "Debug" "MinSizeRel" "Coverage"
+    STRINGS "${default_build_type}" "Release" "Debug" "MinSizeRel" "Coverage"
   )
+  if(NOT CMAKE_BUILD_TYPE)
+    message(STATUS "Setting build type to \"${default_build_type}\" as none was specified")
+    set(CMAKE_BUILD_TYPE "${default_build_type}" CACHE STRING
+      "Choose the type of build."
+      FORCE
+    )
+  endif()
 endif()
 
-set(default_build_type "RelWithDebInfo")
-if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
-  message(STATUS "Setting build type to \"${default_build_type}\" as none was specified")
-  set(CMAKE_BUILD_TYPE "${default_build_type}" CACHE STRING "Choose the type of build." FORCE)
-endif()
-
-include(TryAddCompileOption)
+include(TryAppendCFlags)
 if(MSVC)
-  try_add_compile_option(/W2)
-  try_add_compile_option(/wd4146)
+  # Keep the following commands ordered lexicographically.
+  try_append_c_flags(/W2) # Moderate warning level.
+  try_append_c_flags(/wd4146) # Disable warning C4146 "unary minus operator applied to unsigned type, result still unsigned".
 else()
-  try_add_compile_option(-pedantic)
-  try_add_compile_option(-Wall)
-  try_add_compile_option(-Wcast-align)
-  try_add_compile_option(-Wcast-align=strict)
-  try_add_compile_option(-Wconditional-uninitialized)
-  try_add_compile_option(-Wextra)
-  try_add_compile_option(-Wnested-externs)
-  try_add_compile_option(-Wno-long-long)
-  try_add_compile_option(-Wno-overlength-strings)
-  try_add_compile_option(-Wno-unused-function)
-  try_add_compile_option(-Wreserved-identifier)
-  try_add_compile_option(-Wshadow)
-  try_add_compile_option(-Wstrict-prototypes)
-  try_add_compile_option(-Wundef)
+  # Keep the following commands ordered lexicographically.
+  try_append_c_flags(-pedantic)
+  try_append_c_flags(-Wall) # GCC >= 2.95 and probably many other compilers.
+  try_append_c_flags(-Wcast-align) # GCC >= 2.95.
+  try_append_c_flags(-Wcast-align=strict) # GCC >= 8.0.
+  try_append_c_flags(-Wconditional-uninitialized) # Clang >= 3.0 only.
+  try_append_c_flags(-Wextra) # GCC >= 3.4, this is the newer name of -W, which we don't use because older GCCs will warn about unused functions.
+  try_append_c_flags(-Wnested-externs)
+  try_append_c_flags(-Wno-long-long) # GCC >= 3.0, -Wlong-long is implied by -pedantic.
+  try_append_c_flags(-Wno-overlength-strings) # GCC >= 4.2, -Woverlength-strings is implied by -pedantic.
+  try_append_c_flags(-Wno-unused-function) # GCC >= 3.0, -Wunused-function is implied by -Wall.
+  try_append_c_flags(-Wreserved-identifier) # Clang >= 13.0 only.
+  try_append_c_flags(-Wshadow)
+  try_append_c_flags(-Wstrict-prototypes)
+  try_append_c_flags(-Wundef)
 endif()
 
-if(CMAKE_VERSION VERSION_GREATER 3.2)
-  # Honor visibility properties for all target types.
-  # See: https://cmake.org/cmake/help/latest/policy/CMP0063.html
-  cmake_policy(SET CMP0063 NEW)
-endif()
 set(CMAKE_C_VISIBILITY_PRESET hidden)
 
 # Ask CTest to create a "check" target (e.g., make check) as alias for the "test" target.
@@ -230,8 +254,13 @@ message("\n")
 message("secp256k1 configure summary")
 message("===========================")
 message("Build artifacts:")
-message("  shared library ...................... ${SECP256K1_BUILD_SHARED}")
-message("  static library ...................... ${SECP256K1_BUILD_STATIC}")
+if(BUILD_SHARED_LIBS)
+  set(library_type "Shared")
+else()
+  set(library_type "Static")
+endif()
+
+message("  library type ........................ ${library_type}")
 message("Optional modules:")
 message("  ECDH ................................ ${SECP256K1_ENABLE_MODULE_ECDH}")
 message("  ECDSA pubkey recovery ............... ${SECP256K1_ENABLE_MODULE_RECOVERY}")
@@ -273,15 +302,15 @@ message("CFLAGS ................................ ${CMAKE_C_FLAGS}")
 get_directory_property(compile_options COMPILE_OPTIONS)
 string(REPLACE ";" " " compile_options "${compile_options}")
 message("Compile options ....................... " ${compile_options})
-if(DEFINED CMAKE_BUILD_TYPE)
+if(NOT is_multi_config)
   message("Build type:")
   message(" - CMAKE_BUILD_TYPE ................... ${CMAKE_BUILD_TYPE}")
   string(TOUPPER "${CMAKE_BUILD_TYPE}" build_type)
   message(" - CFLAGS ............................. ${CMAKE_C_FLAGS_${build_type}}")
   message(" - LDFLAGS for executables ............ ${CMAKE_EXE_LINKER_FLAGS_${build_type}}")
   message(" - LDFLAGS for shared libraries ....... ${CMAKE_SHARED_LINKER_FLAGS_${build_type}}")
 else()
-  message("Available configurations .............. ${CMAKE_CONFIGURATION_TYPES}")
+  message("Supported configurations .............. ${CMAKE_CONFIGURATION_TYPES}")
   message("RelWithDebInfo configuration:")
   message(" - CFLAGS ............................. ${CMAKE_C_FLAGS_RELWITHDEBINFO}")
   message(" - LDFLAGS for executables ............ ${CMAKE_EXE_LINKER_FLAGS_RELWITHDEBINFO}")