deps: bump @noble/curves from 2.2.0 to 2.4.0

[dependabot]

Bumps @noble/curves from 2.2.0 to 2.4.0.

Release notes

Sourced from @​noble/curves's releases.

2.4.0

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

Full Changelog: paulmillr/noble-curves@2.3.0...2.4.0

2.3.0

Security & constant-timeness

• Hardened constant-time execution from best-effort to actual guarantees: no measurable timing behavior on 200K samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, un-precomputed points now use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New CT benchmarks track timing behavior.
• General hardening across all modules
• Fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery id, non-canonical BLS signature encodings are rejected, Edwards <-> Montgomery conversion helpers were corrected, and FROST DKG round-2 retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519, across many samples, and learn up to 4.036 bits of long-term private key. Other 247 bits were NOT affected.

The impact: mainly fingerprinting (recognition of key across deployments), NOT key recovery, NOT X25519 breakage. Maintainer was also not able to escalate to co-residency (SMT).

Reported and found by:

• George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr)
• Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece (kpatsak@unipi.gr)

Performance

• ECDSA/EdDSA verification up to +32%, Weierstrass ECDH up to +19%, x25519 getPublicKey 2.7×
• BLS signatures 2x
• Init time (first getPublicKey or sign) reduced ~2x for ed25519, p256, p384, p521
• Also faster verification of recovered signatures, pairing tower / FFT / Pippenger optimizations, and joint-MSM paths in FROST and OPRF
• getPublicKey / sign got slower because we've decreased window size (W=8 => W=6) and hardened CT execution (see above). Long-running apps that prefer 2.2.0-level speed can restore it with one line: secp256k1.Point.BASE.precompute(8) (likewise for other curves).

Misc

• Smaller bundles: improved tree-shaking across modules
• Better error messages and type checks
• Upgrade noble-hashes to 2.3.0, with performance boost
• Reduce on-disk size 1831kb → 1548kb (-282kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-curves@2.2.0...2.3.0

Changelog

Sourced from @​noble/curves's changelog.

2.4.0 (2026-08-27)

• Harden FROST distributed key generation against round-one transcript substitution.
  • This is not a vulnerability; it's protection against those who don't follow the FROST spec. Spec wants user to preserve rounds.
• FROST: Enforced RFC 9591 point validation for BLS and BN
• POPRF: replace inversion with const-time version
• Weierstrass: harden public-key boundaries & infinity handling
  • ECDH and ECDSA now reject the identity even for point types whose generic codec permits it
  • Curves that disallow infinity cannot encode it, while opted-in curves use the canonical SEC 1 0x00 encoding.
• DER: Bounded ECDSA signature and INTEGER sizes before bigint conversion, preventing malformed inputs from causing disproportionate parsing and allocation work
• Snapshot all security-sensitive state (passed arguments) to ensure it can't be mutated

Special thanks to Red Team (Rob Hamilton, CalleBTC, Omer Talip) and 1Password's Off-by-1 Labs.

2.3.0 (2026-08-06)

Security and constant-timeness

• Hardened constant-time execution from best-effort to actual guarantees, with no measurable timing behavior across 200,000 samples. Scalar multiplication now uses secret-scalar blinding via CSPRNG, unprecomputed points use a constant-time fixed-window multiply instead of variable-time fallbacks, and modular arithmetic helpers were hardened. New constant-time benchmarks track timing behavior.
• General hardening across all modules.
• Applied fixes from the Trail of Bits review: recovered ECDSA signatures are now bound to their recovery ID, non-canonical BLS signature encodings are rejected, Edwards-to-Montgomery conversion helpers were corrected, and FROST DKG round-two retry handling was hardened.

X25519 hardening

It was possible to execute a remote timing attack on X25519 across many samples and learn up to 4.036 bits of a long-term private key. The other 247 bits were not affected.

The impact is primarily fingerprinting—a key can be recognized across deployments—not key recovery or a break of X25519. The maintainer was also unable to escalate the attack to co-residency (SMT).

Reported and found by:

• George Stergiopoulos, Department of Informatics, Athens University of Economics and Business, Greece (geostergiop@aueb.gr).
• Constantinos Patsakis, Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou Street, 18534 Piraeus, Greece (kpatsak@unipi.gr).

Performance

• Improved ECDSA and EdDSA verification by up to 32%, Weierstrass ECDH by up to 19%, and X25519 getPublicKey by 2.7×.
• Improved BLS signature performance by 2×.
• Reduced initialization time for the first getPublicKey or sign call by approximately 2× for Ed25519, P-256, P-384, and P-521.
• Also improved verification of recovered signatures, pairing tower, FFT, and Pippenger performance, as well as joint-MSM paths in FROST and OPRF.
• getPublicKey and sign became slower because the window size was decreased from 8 to 6 and constant-time execution was hardened. Long-running applications that prefer 2.2.0-level speed can restore it with secp256k1.Point.BASE.precompute(8), and likewise for other curves.

Miscellaneous

• Improved tree-shaking for smaller bundles.
• Improved error messages and type checks.
• Upgraded noble-hashes to 2.3.0 for improved performance.
• Reduced on-disk size from 1,831 KB to 1,548 KB by disabling source maps, which have become less relevant.

Commits

• 656c436 Release 2.4.0.
• ca081f6 Add changelog
• 783fa9b Upgrade noble-hashes to 2.4.0
• 3becb84 readme
• bb52c57 readme
• 41f44d2 Restructure benchmarks. Update README
• 3587575 Bump vectors
• ae43344 Bump ci workflows
• 5c1aa39 Add fuzzing
• d5b95e4 test: add more hardening-related tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)