Randomize secp256k1 contexts in Crypto.sign / getPublicKey #1225

Follow-up from #1185 (swift-secp256k1 0.17.0 → 0.24.0).

Problem

Crypto.sign and Crypto.getPublicKey (Bitkit/Utilities/Crypto.swift), plus Crypto.generateKeyPair, create a fresh secp256k1_context_create(SECP256K1_CONTEXT_SIGN) on every call and never call secp256k1_context_randomize. Without randomization, libsecp256k1 does not blind its generator multiplication (ecmult_gen). That blinding is the library's side-channel hardening for secret-key operations (signing, public key creation). The P256K wrapper randomizes its own shared context (Context.swift); our direct C calls do not.

SECP256K1_CONTEXT_SIGN is deprecated and now equivalent to SECP256K1_CONTEXT_NONE.

This predates #1185, which does not change it. generateSharedSecret (ECDH) is not affected, because ECDH does not benefit from context randomization.

Proposed fix

• Create one long-lived context, randomized once with 32 bytes from SecRandomCopyBytes, and reuse it. Alternatively, randomize each per-call context before use.
• Use SECP256K1_CONTEXT_NONE instead of the deprecated SECP256K1_CONTEXT_SIGN.
• Throw if randomization fails.

Testing

CryptoTests.testSignMatchesReferenceVector and testGetPublicKeyMatchesReferenceVector must still pass: randomization must not change outputs, since RFC 6979 signing is deterministic. Run the RN backup auth against staging (RNBackupClient.setup + hasBackup()), which exercises sign end to end.

Severity: low, hardening only.

🤖 Generated with Claude Code