Framework

ZKP

Zero-knowledge proof primitives for the secp256k1 curve — adaptor signatures, range proofs, surjection proofs, and MuSig2 half-aggregation — layered on Blockstream’s secp256k1-zkp fork of libsecp256k1.

Mentioned In

Choosing Between P256K and ZKP

Overview

ZKP wraps the BlockstreamResearch/secp256k1-zkp fork of upstream bitcoin-core/secp256k1. The fork adds zero-knowledge proof primitives that the upstream library deliberately scopes out: range proofs (Confidential Transactions), surjection proofs (asset-swap unlinkability), ECDSA and BIP-340 adaptor signatures (atomic swaps and scriptless scripts), MuSig2 half-aggregation, and Bulletproofs++ (bppp trait). Blockstream’s Liquid Network — the canonical consumer — depends on the fork for its confidential-asset transaction format.

ZKP shares the same vanilla cryptographic surface as P256K via the package’s SharedSourcesPlugin build-tool plugin: every type in Sources/Shared/ (ECDSA, BIP-340 Schnorr, BIP-327 MuSig2, ECDH, recoverable signatures, SHA-256, tagged hashes) is compiled into both products. The two products differ only in their underlying C library (libsecp256k1 vs libsecp256k1_zkp) and the set of opt-in traits each enables. Read Choosing Between P256K and ZKP to decide which product fits your application.

Note

The ZKP-exclusive zero-knowledge surface is C-only at present — Swift wrappers for range proofs, surjection proofs, adaptor signatures, and MuSig2 half-aggregation will be added incrementally. The shared surface listed below is fully supported today.

Topics

Essentials

Choosing Between P256K and ZKP
When to reach for P256K (vanilla secp256k1 for Bitcoin, Lightning, Nostr) versus ZKP (Blockstream’s secp256k1-zkp fork for confidential transactions, adaptor signatures, and zero-knowledge proofs).
enum P256K
secp256k1 elliptic curve namespace providing ECDSA signing, Schnorr signatures (BIP-340), MuSig2 multi-signatures, ECDH key agreement, and key recovery.
struct Context
The secp256k1 context manages cryptographic state for ECDSA and Schnorr operations with automatic side-channel protection via base point blinding.
enum Format
Compressed (33-byte) and uncompressed (65-byte) serialization formats for secp256k1 public keys, passed as flags to secp256k1_ec_pubkey_serialize.

ECDSA

enum Signing
secp256k1 ECDSA signing namespace providing P256K.Signing.PrivateKey for RFC 6979 deterministic signing and P256K.Signing.PublicKey for signature verification; all produced signatures are lower-S normalized.
struct PrivateKey
secp256k1 ECDSA private key for deterministically signing messages and producing P256K.Signing.ECDSASignature values using the secp256k1 curve.
struct PublicKey
secp256k1 ECDSA public key for verifying P256K.Signing.ECDSASignature values, available in compressed (33-byte) or uncompressed (65-byte) serialized form.
struct XonlyKey
The 32-byte x-only form of a secp256k1 P256K.Signing.PublicKey, as defined by BIP-340: the X coordinate of the public key point with implicit even-Y parity unless parity is true.
struct ECDSASignature
64-byte secp256k1 ECDSA signature in libsecp256k1 internal format, convertible to and from DER (variable-length, up to 72 bytes) and compact (exactly 64 bytes) representations.

BIP-340 Schnorr

enum Schnorr
BIP-340 Schnorr signatures over secp256k1: sign with P256K.Schnorr.PrivateKey, verify against P256K.Schnorr.XonlyKey, using a fixed 64-byte P256K.Schnorr.SchnorrSignature encoding.
struct PrivateKey
secp256k1 BIP-340 Schnorr private key for signing messages with P256K.Schnorr.SchnorrSignature and for deriving the x-only public key used in verification.
struct PublicKey
secp256k1 BIP-340 Schnorr public key in compressed or uncompressed form, from which the x-only key used for signature verification is derived via the xonly property.
struct XonlyKey
The corresponding x-only public key for the secp256k1 curve, as defined by BIP-340.
struct SchnorrSignature
64-byte BIP-340 Schnorr signature over the secp256k1 elliptic curve, produced by secp256k1_schnorrsig_sign_custom and verified by secp256k1_schnorrsig_verify (both declared in Vendor/secp256k1/include/secp256k1_schnorrsig.h).

Structures

Type Aliases

typealias CryptoKitMetaError
typealias SHA256Digest
A type alias for HashDigest used as the concrete return type of hash(data:) and taggedHash(tag:data:).