Framework

ZKP

Swift bindings for Blockstream’s secp256k1-zkp fork of libsecp256k1, adding zero-knowledge proof primitives — range proofs, surjection proofs, ECDSA and BIP-340 adaptor signatures, MuSig2 half-aggregation, and Bulletproofs++ — that drive Blockstream’s Liquid Network.

Mentioned In

Choosing Between P256K and ZKP

Overview

ZKP wraps the BlockstreamResearch/secp256k1-zkp fork of upstream bitcoin-core/secp256k1. The fork adds zero-knowledge proof primitives that the upstream library deliberately scopes out: range proofs (Confidential Transactions), surjection proofs (asset-swap unlinkability), ECDSA and BIP-340 adaptor signatures (atomic swaps and scriptless scripts), MuSig2 half-aggregation, and Bulletproofs++ (bppp trait). Blockstream’s Liquid Network — the canonical consumer — depends on the fork for its confidential-asset transaction format.

ZKP shares the same vanilla cryptographic surface as P256K via the package’s SharedSourcesPlugin build-tool plugin: every type in Sources/Shared/ (ECDSA, BIP-340 Schnorr, BIP-327 MuSig2, ECDH, recoverable signatures, SHA-256, tagged hashes) is compiled into both products. The two products differ only in their underlying C library (libsecp256k1 vs libsecp256k1_zkp) and the set of opt-in traits each enables. Read Choosing Between P256K and ZKP to decide which product fits your application.

Note

The ZKP-exclusive zero-knowledge surface is C-only at present — Swift wrappers for range proofs, surjection proofs, adaptor signatures, and MuSig2 half-aggregation will be added incrementally. The shared surface listed below is fully supported today.

Where to start

Picking between ZKP and P256K? Read Choosing Between P256K and ZKP for the decision boundary and the trait-by-trait breakdown. The shared cryptographic surface (ECDSA, Schnorr, MuSig2, ECDH, recoverable signatures, hashing) is documented in P256K’s catalog — see Getting Started for a task-oriented walkthrough that applies equally to both products.

Topics

Guides

Choosing Between P256K and ZKP
When to reach for P256K (vanilla secp256k1 for Bitcoin, Lightning, Nostr) versus ZKP (Blockstream’s secp256k1-zkp fork for confidential transactions, adaptor signatures, and zero-knowledge proofs).

Essentials

ECDSA

enum Signing
secp256k1 ECDSA signing namespace providing P256K.Signing.PrivateKey for RFC 6979 deterministic signing and P256K.Signing.PublicKey for signature verification; all produced signatures are lower-S normalized.
struct PrivateKey
secp256k1 ECDSA private key for deterministically signing messages and producing P256K.Signing.ECDSASignature values using the secp256k1 curve.
struct PublicKey
secp256k1 ECDSA public key for verifying P256K.Signing.ECDSASignature values, available in compressed (33-byte) or uncompressed (65-byte) serialized form.
struct XonlyKey
The 32-byte x-only form of a secp256k1 P256K.Signing.PublicKey, as defined by BIP-340: the X coordinate of the public key point with implicit even-Y parity unless parity is true.
struct ECDSASignature
64-byte secp256k1 ECDSA signature in libsecp256k1 internal format, convertible to and from DER (variable-length, up to 72 bytes) and compact (exactly 64 bytes) representations.

BIP-340 Schnorr

enum Schnorr
BIP-340 Schnorr signatures over secp256k1: sign with P256K.Schnorr.PrivateKey, verify against P256K.Schnorr.XonlyKey, using a fixed 64-byte P256K.Schnorr.SchnorrSignature encoding.
struct PrivateKey
secp256k1 BIP-340 Schnorr private key for signing messages with P256K.Schnorr.SchnorrSignature and for deriving the x-only public key used in verification.
struct PublicKey
secp256k1 BIP-340 Schnorr public key in compressed or uncompressed form, from which the x-only key used for signature verification is derived via the xonly property.
struct XonlyKey
The corresponding x-only public key for the secp256k1 curve, as defined by BIP-340.
struct SchnorrSignature
64-byte BIP-340 Schnorr signature over the secp256k1 elliptic curve, produced by secp256k1_schnorrsig_sign_custom and verified by secp256k1_schnorrsig_verify (both declared in Vendor/secp256k1/include/secp256k1_schnorrsig.h).

Structures

Type Aliases

typealias CryptoKitMetaError
typealias SHA256Digest
A type alias for HashDigest used as the concrete return type of hash(data:) and taggedHash(tag:data:).