Repository: bitcoin-core/secp256k1
Pull request #813 (2020-09-12 19:18:42)

Enable configuring Valgrind support
Glancing at the internals of Valgrind annotations, it looks like they could have a performance impact even outside Valgrind.

In any case, it's nice to let the user disable things explicitly.

sipa: Just for context, the performance impact should be absolutely negligable. The actual valgrind instruction sequence is not invoked unless SECP256K1_CONTEXT_DECLASSIFY is specified at context creation time (which is only done in the ctime test). Without it, calls to `secp256k1_declassify` are just a (predictable) conditional jump, and there are just two such calls per signature creation. But indeed, if `VALGRIND` is not defined at comile time, it's nothing at all.

I think it's conceptually reasonable to permit disabling it though.
luke-jr: I was thinking more about the VG_CHECK calls in {field,scalar}_*_impl.h - not sure how relevant they are, though.
gmaxwell: I intentionally avoided this because i don't want the CTime testing testing a different binary than the users are using in practice.

As an option, I suppose I don't care... however: more options means that the CI needs to test that that combination compiles, and this (useless?) configuration option might not be worth the ci overhead.

@luke-jr Those aren't used at runtime, no _VERIFY macro is. They are purely test-only instrumentation See util.h.

sipa: There should only be `VG_CHECK_VERIFY` calls in non-tests, and those are only enabled when compiled inside unit tests.
sipa: > I intentionally avoided this because i don't want the CTime testing testing a different binary than the users are using in practice.

Well, arguably, if you want to guarantee that, it should be forced on (perhaps through this PR's `--with-valgrind`) rather than being auto-detected?
luke-jr: The problem with forcing it is that means everyone building needs Valgrind installed. (But forcing it only potentially makes sense for the application using the library, not the library itself, which goes along with @sipa's idea.)
gmaxwell: > Well, arguably, if you want to guarantee that, it should be forced on (perhaps through this PR's --with-valgrind) rather than being auto-detected?

If it doesn't get compiled in you don't get the test however. :)  so if you get the test you test the correct thing.  If you don't have the valgrind headers, you don't.    In that decision I was concerned there about making it "unusable" for people targeting devices/systems where there is no valgrind at all.

I don't understand what luke is talking about wrt application.
luke-jr: @gmaxwell Bitcoin Core may need a high degree of certainty for consensus compatibility, but other applications may not.
sipa: @luke-jr Mind changing the travis configuration so that --with-valgrind and --without-valgrind get exercised at least once?
gmaxwell: @luke-jr The runtime valgrind stuff isn't for consensus compatibility it's to detect if you compiler 'optimized' the code in a way that creates timing sidechannels which leak your secrets.
real-or-random: As explained in the thread, the performance overhead of the valgrind stuff is negligible, so I don't really see a reason for a config option.

> @gmaxwell Bitcoin Core may need a high degree of certainty for consensus compatibility, but other applications may not.

Right, but I believe this has nothing to do with our use of valgrind.

real-or-random: Looking at https://github.com/bitcoin/bitcoin/pull/19944, this PR seems to be based on the wrong assumption that do some magic valgrind calls unconditionally. It has been said in this thread already but let me stress again that this is just not the case.

We have explicit valgrind magic in our code for two purposes.

1) The only runtime overhead is a single (runtime) check whether we should do valgrind magic, and the result of the check will be "no" unless you're running a specific test binary. See https://github.com/bitcoin-core/secp256k1/pull/708 for context. This is indeed new.

2) The VG_CHECK macros. These are disabled at compile-time (unless you're building the tests), so there's no overhead at all. And those are not new at all, they've been there since 2015.


gmaxwell: > The only runtime overhead is a single (runtime) check whether we should do valgrind magic,

For context, it's right here:  https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/secp256k1.c#L141

> and the result of the check will be "no" unless you're running a specific test binary. See #708 for context. This is indeed new.

It's relatively recent but as the link demonstrates it's not something newly introduced in PR 19944.

So I'm super duper confused.  There isn't any valgrind anything in 19944 except for the addition of the valgrind-using test components for the new functions which are pretty much just copy-pasting the existing tests.

> The VG_CHECK macros. These are disabled at compile-time (unless you're building the tests), so there's no overhead at all. And those are not new at all, they've been there since 2015.

Particularly, VG_CHECK_VERIFY which is a total no-op macro except when building ./tests binary.  (There is VG_CHECK which is unconditional, but it isn't and shouldn't be used outside of the test binary).

FWIW, The valgrind instrumentation has never made a benchmarkable performance difference for me regardless, but as real-or-random notes it isn't executed in the library for users at all, only in special test binaries.

luke-jr: > @luke-jr The runtime valgrind stuff isn't for consensus compatibility it's to detect if you compiler 'optimized' the code in a way that creates timing sidechannels which leak your secrets.

Can we do that without valgrind? Is the valgrind stuff even *supposed* to do that, or is it a side effect on certain architectures?


luke-jr: >@luke-jr Mind changing the travis configuration so that --with-valgrind and --without-valgrind get exercised at least once?

Which would you recommend?

>As explained in the thread, the performance overhead of the valgrind stuff is negligible, so I don't really see a reason for a config option.

The reason is to ensure the build is deterministic (functionally, not necessarily byte-for-byte) for a given configuration (eg, Gentoo USE flags). With autodetection, the only way to do that is to either forbid or strictly require Valgrind.

Using this patch, the current bitcoin overlay ebuild either DEPENDs on valgrind and uses it (with `USE='valgrind'`), or doesn't build using it (with `USE='-valgrind'`).
gmaxwell: I can't tell if there is still a miscommunication. There is no valgrind code ran by non-test code, so the library itself is functionally equivalent either way. The macros you're looking at in libsecp256k1 compile into nothing (for VG_CHECK_VERIFY) outside of the test binaries and are behind a boolean that causes them to never get executed outside of a special test harness:

```C
/* Define `VG_UNDEF` and `VG_CHECK` when VALGRIND is defined  */
#if !defined(VG_CHECK)
# if defined(VALGRIND)
#  include <valgrind/memcheck.h>
#  define VG_UNDEF(x,y) VALGRIND_MAKE_MEM_UNDEFINED((x),(y))
#  define VG_CHECK(x,y) VALGRIND_CHECK_MEM_IS_DEFINED((x),(y))
# else
#  define VG_UNDEF(x,y)
#  define VG_CHECK(x,y)
# endif
#endif
``

-DVERIFY is only set when compiling the tests.c.

> Can we do that without valgrind?

No known way.

> Is the valgrind stuff even supposed to do that, or is it a side effect on certain architectures?

It's not much a side effect of certain architectures but it is a bit of an off-label use.

Valgrind memcheck is a CPU simulator which performs bit-level taint tracking of data.  Any data computed from tainted data is treated as tainted (except for operations like xor x,x or mul x,0  which destroy the taint), if memory access index or branch condition depends on tainted data it throws a warning.  The original purpose of this is to make uninitialized memory tainted to alert on use of it. The libraries test's use it, among other reasons, to mark secret keys as tainted.  It just so happens that the operations that matter the constant time behaviour everywhere are memory indexes and branching.

On some architectures there may be additional relevant operations which data-dependant non-constant time. E.g. s390x has a comparison operation which works basically like memcmp.  Valgrind correctly (for our use and its original use) also alerts on the use of this on tainted data... which is useful because GCC sometimes emits it for uint64_t comparisons, which brought it to my attention and I have a GCC bug open on that.   Or-- on x86/x86_64 there is division  which valgrind does not currently alert on,  but this is clearly incorrect for both our usage and the usage memcheck is intended for (especially since division by 0 traps on x86/x86_64, you really don't want to divide by uninitilized memory)-- so the omission of this check is just an outright bug in memcheck.  It's a ~2 line change to valgrind to also catch tainted inputs to division, I assume upstream will take it if I ever get around to submitting a patch. ... but divisions of secret data aren't a particularly likely error to pass review or get injected by compilers, so I haven't bothered yet.  (though our tests do pass with them applied for me locally, of course).

It's possible that at some point in the future there would be some arch specific relevant operation which we cared about for constant time behaviour but which memcheck didn't care about because it never mattered for it's intended use (rather than being a clear bug like the above mentioned division case).  In which case, your "side effect only on some architectures" concern would apply.  If that were the case, I'd hope that the valgrind authors would consider constant-time-checking to be a first class supported use of valgrind and add support for catching that operation-- because there is no alternative and valgrind's taint-tracking approach is an extraordinarily useful and effective way of doing exactly what is needed and because doing so is trivial with how valgrind is designed.

luke-jr: >There is no valgrind code ran by non-test code, so the library itself is functionally equivalent either way. 

Then why would this be a problem? "i don't want the CTime testing testing a different binary than the users are using in practice."

gmaxwell: You've trimmed the operative part of my comment:

> behind a boolean that causes them to never get executed outside of a special test harness:

Valgrind is used for multiple different testing things.  Some of them-- VG_CHECK_VERIFY -- are only for specially instrumented testing builds, these aren't testing for miscompilation and don't show up in the library.

The constant time test, however, is substantially a miscompilation test.  It uses valgrind in the actual library, but it's behind a boolean and only runs that code ( https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/secp256k1.c#L231 ) if a special debugging argument is sent to context creation (see link in my prior comment).

I believe the valgrind call there is completely and totally harmless and could be run all the time for everyone, but out of maximum conservativeness, it's only run with a hidden test argument sent to the context creation.

This allows the constant time test to run on the actual unmodified production binary.

sipa: @luke-jr It's just the fact that compiling with the valgrind macros (even though they're skipped over in normal operation) changes the binary - a few bytes get inserted, alignments change, sections are ordered differently, ... means that the exact library binary tested by the ctime test would be distinct from the one the user will use for production if the latter was compiled without -DVALGRIND. The approach used here means that if Valgrind is available, the ctime test will run on the exact binary used in production.

That is an argument for not compiling the library-as-tested-by-ctime and library-for-production differently, and an argument for having the ctime test and valgrind macro usage default on (especially given the negligible performance impact). I don't think it's an argument why the user shouldn't be able to select whether they want those tests at all or not, though, and the argument about deterministic builds not being dependent on whether or not you had valgrind installed is a very reasonable one IMO.
real-or-random: > the argument about deterministic builds not being dependent on whether or not you had valgrind installed is a very reasonable one IMO.

Yes, I think that's valid point.

gmaxwell: A build is going to be  byte wise different depending on a multitude of different headers, unfortunately. I assume that's why luke said "(functionally, not necessarily byte-for-byte)".

> I don't think it's an argument why the user shouldn't be able to select whether they want those tests at all or not, though,

Sure, I don't see any reason why you shouldn't be able to force the result of the detection. If nothing else it'll make it easier for testers to test that the build isn't broken when the header isn't there.



Patch:
diff --git a/.gitignore b/.gitignore
index ccdef02..cb4331a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,9 @@
 bench_inv
 bench_ecdh
 bench_ecmult
-bench_schnorrsig
 bench_sign
 bench_verify
+bench_schnorr_verify
 bench_recover
 bench_internal
 tests
@@ -31,8 +31,6 @@ libtool
 *.lo
 *.o
 *~
-*.log
-*.trs
 src/libsecp256k1-config.h
 src/libsecp256k1-config.h.in
 src/ecmult_static_context.h
diff --git a/.travis.yml b/.travis.yml
index e1a88c4..81d1ba8 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,19 +17,19 @@ compiler:
   - gcc
 env:
   global:
-    - WIDEMUL=auto  BIGNUM=auto  ENDOMORPHISM=no  STATICPRECOMPUTATION=yes  ECMULTGENPRECISION=auto  ASM=no  BUILD=check  EXTRAFLAGS=  HOST=  ECDH=no  RECOVERY=no SCHNORRSIG=no EXPERIMENTAL=no CTIMETEST=yes BENCH=yes ITERS=2
+    - WIDEMUL=auto  BIGNUM=auto  ENDOMORPHISM=no  STATICPRECOMPUTATION=yes  ECMULTGENPRECISION=auto  ASM=no  BUILD=check  EXTRAFLAGS=  HOST=  ECDH=no  RECOVERY=no  EXPERIMENTAL=no CTIMETEST=yes BENCH=yes ITERS=2
   matrix:
     - WIDEMUL=int64   RECOVERY=yes
-    - WIDEMUL=int64   ECDH=yes  EXPERIMENTAL=yes SCHNORRSIG=yes
+    - WIDEMUL=int64   ECDH=yes  EXPERIMENTAL=yes
     - WIDEMUL=int64   ENDOMORPHISM=yes
     - WIDEMUL=int128
-    - WIDEMUL=int128  RECOVERY=yes EXPERIMENTAL=yes SCHNORRSIG=yes
+    - WIDEMUL=int128  RECOVERY=yes
     - WIDEMUL=int128  ENDOMORPHISM=yes
-    - WIDEMUL=int128  ENDOMORPHISM=yes  ECDH=yes EXPERIMENTAL=yes SCHNORRSIG=yes
+    - WIDEMUL=int128  ENDOMORPHISM=yes  ECDH=yes EXPERIMENTAL=yes
     - WIDEMUL=int128                    ASM=x86_64
     - WIDEMUL=int128  ENDOMORPHISM=yes  ASM=x86_64
     - BIGNUM=no
-    - BIGNUM=no       ENDOMORPHISM=yes RECOVERY=yes EXPERIMENTAL=yes SCHNORRSIG=yes
+    - BIGNUM=no       ENDOMORPHISM=yes RECOVERY=yes EXPERIMENTAL=yes
     - BIGNUM=no       STATICPRECOMPUTATION=no
     - BUILD=distcheck CTIMETEST= BENCH=
     - CPPFLAGS=-DDETERMINISTIC
diff --git a/Makefile.am b/Makefile.am
index 023fa60..d8c1c79 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -34,11 +34,9 @@ noinst_HEADERS += src/field_5x52.h
 noinst_HEADERS += src/field_5x52_impl.h
 noinst_HEADERS += src/field_5x52_int128_impl.h
 noinst_HEADERS += src/field_5x52_asm_impl.h
-noinst_HEADERS += src/assumptions.h
 noinst_HEADERS += src/util.h
 noinst_HEADERS += src/scratch.h
 noinst_HEADERS += src/scratch_impl.h
-noinst_HEADERS += src/selftest.h
 noinst_HEADERS += src/testrand.h
 noinst_HEADERS += src/testrand_impl.h
 noinst_HEADERS += src/hash.h
@@ -101,7 +99,7 @@ if VALGRIND_ENABLED
 tests_CPPFLAGS += -DVALGRIND
 noinst_PROGRAMS += valgrind_ctime_test
 valgrind_ctime_test_SOURCES = src/valgrind_ctime_test.c
-valgrind_ctime_test_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_LIBS) $(COMMON_LIB)
+valgrind_ctime_test_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
 endif
 if !ENABLE_COVERAGE
 tests_CPPFLAGS += -DVERIFY
@@ -154,11 +152,3 @@ endif
 if ENABLE_MODULE_RECOVERY
 include src/modules/recovery/Makefile.am.include
 endif
-
-if ENABLE_MODULE_EXTRAKEYS
-include src/modules/extrakeys/Makefile.am.include
-endif
-
-if ENABLE_MODULE_SCHNORRSIG
-include src/modules/schnorrsig/Makefile.am.include
-endif
diff --git a/TODO b/TODO
new file mode 100644
index 0000000..a300e1c
--- /dev/null
+++ b/TODO
@@ -0,0 +1,3 @@
+* Unit tests for fieldelem/groupelem, including ones intended to
+  trigger fieldelem's boundary cases.
+* Complete constant-time operations for signing/keygen
diff --git a/configure.ac b/configure.ac
index 6fe8984..97ace61 100644
--- a/configure.ac
+++ b/configure.ac
@@ -136,16 +136,6 @@ AC_ARG_ENABLE(module_recovery,
     [enable_module_recovery=$enableval],
     [enable_module_recovery=no])
 
-AC_ARG_ENABLE(module_extrakeys,
-    AS_HELP_STRING([--enable-module-extrakeys],[enable extrakeys module (experimental)]),
-    [enable_module_extrakeys=$enableval],
-    [enable_module_extrakeys=no])
-
-AC_ARG_ENABLE(module_schnorrsig,
-    AS_HELP_STRING([--enable-module-schnorrsig],[enable schnorrsig module (experimental)]),
-    [enable_module_schnorrsig=$enableval],
-    [enable_module_schnorrsig=no])
-
 AC_ARG_ENABLE(external_default_callbacks,
     AS_HELP_STRING([--enable-external-default-callbacks],[enable external default callback functions [default=no]]),
     [use_external_default_callbacks=$enableval],
@@ -178,7 +168,21 @@ AC_ARG_WITH([ecmult-gen-precision], [AS_HELP_STRING([--with-ecmult-gen-precision
 )],
 [req_ecmult_gen_precision=$withval], [req_ecmult_gen_precision=auto])
 
-AC_CHECK_HEADER([valgrind/memcheck.h], [enable_valgrind=yes], [enable_valgrind=no], [])
+AC_ARG_WITH([valgrind], [AS_HELP_STRING([--with-valgrind=yes|no|auto],
+[Build with extra checks for running inside Valgrind [default=auto]]
+)],
+[req_valgrind=$withval], [req_valgrind=auto])
+
+if test x"$req_valgrind" = x"no"; then
+  enable_valgrind=no
+else
+  AC_CHECK_HEADER([valgrind/memcheck.h], [enable_valgrind=yes], [
+    if test x"$req_valgrind" = x"yes"; then
+      AC_MSG_ERROR([Valgrind support explicitly requested but valgrind/memcheck.h header not available])
+    fi
+    enable_valgrind=no
+  ], [])
+fi
 AM_CONDITIONAL([VALGRIND_ENABLED],[test "$enable_valgrind" = "yes"])
 
 if test x"$enable_coverage" = x"yes"; then
@@ -431,16 +435,7 @@ if test x"$enable_module_recovery" = x"yes"; then
   AC_DEFINE(ENABLE_MODULE_RECOVERY, 1, [Define this symbol to enable the ECDSA pubkey recovery module])
 fi
 
-if test x"$enable_module_schnorrsig" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_SCHNORRSIG, 1, [Define this symbol to enable the schnorrsig module])
-  enable_module_extrakeys=yes
-fi
-
-# Test if extrakeys is set after the schnorrsig module to allow the schnorrsig
-# module to set enable_module_extrakeys=yes
-if test x"$enable_module_extrakeys" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_EXTRAKEYS, 1, [Define this symbol to enable the extrakeys module])
-fi
+AC_C_BIGENDIAN()
 
 if test x"$use_external_asm" = x"yes"; then
   AC_DEFINE(USE_EXTERNAL_ASM, 1, [Define this symbol if an external (non-inline) assembly implementation is used])
@@ -455,19 +450,11 @@ if test x"$enable_experimental" = x"yes"; then
   AC_MSG_NOTICE([WARNING: experimental build])
   AC_MSG_NOTICE([Experimental features do not have stable APIs or properties, and may not be safe for production use.])
   AC_MSG_NOTICE([Building ECDH module: $enable_module_ecdh])
-  AC_MSG_NOTICE([Building extrakeys module: $enable_module_extrakeys])
-  AC_MSG_NOTICE([Building schnorrsig module: $enable_module_schnorrsig])
   AC_MSG_NOTICE([******])
 else
   if test x"$enable_module_ecdh" = x"yes"; then
     AC_MSG_ERROR([ECDH module is experimental. Use --enable-experimental to allow.])
   fi
-  if test x"$enable_module_extrakeys" = x"yes"; then
-    AC_MSG_ERROR([extrakeys module is experimental. Use --enable-experimental to allow.])
-  fi
-  if test x"$enable_module_schnorrsig" = x"yes"; then
-    AC_MSG_ERROR([schnorrsig module is experimental. Use --enable-experimental to allow.])
-  fi
   if test x"$set_asm" = x"arm"; then
     AC_MSG_ERROR([ARM assembly optimization is experimental. Use --enable-experimental to allow.])
   fi
@@ -486,8 +473,6 @@ AM_CONDITIONAL([USE_BENCHMARK], [test x"$use_benchmark" = x"yes"])
 AM_CONDITIONAL([USE_ECMULT_STATIC_PRECOMPUTATION], [test x"$set_precomp" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_ECDH], [test x"$enable_module_ecdh" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_RECOVERY], [test x"$enable_module_recovery" = x"yes"])
-AM_CONDITIONAL([ENABLE_MODULE_EXTRAKEYS], [test x"$enable_module_extrakeys" = x"yes"])
-AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG], [test x"$enable_module_schnorrsig" = x"yes"])
 AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$use_external_asm" = x"yes"])
 AM_CONDITIONAL([USE_ASM_ARM], [test x"$set_asm" = x"arm"])
 
@@ -507,8 +492,6 @@ echo "  with benchmarks         = $use_benchmark"
 echo "  with coverage           = $enable_coverage"
 echo "  module ecdh             = $enable_module_ecdh"
 echo "  module recovery         = $enable_module_recovery"
-echo "  module extrakeys        = $enable_module_extrakeys"
-echo "  module schnorrsig       = $enable_module_schnorrsig"
 echo
 echo "  asm                     = $set_asm"
 echo "  bignum                  = $set_bignum"
diff --git a/contrib/travis.sh b/contrib/travis.sh
index 4859756..2023d0b 100755
--- a/contrib/travis.sh
+++ b/contrib/travis.sh
@@ -17,7 +17,6 @@ fi
     --with-test-override-wide-multiply="$WIDEMUL" --with-bignum="$BIGNUM" --with-asm="$ASM" \
     --enable-ecmult-static-precomputation="$STATICPRECOMPUTATION" --with-ecmult-gen-precision="$ECMULTGENPRECISION" \
     --enable-module-ecdh="$ECDH" --enable-module-recovery="$RECOVERY" \
-    --enable-module-schnorrsig="$SCHNORRSIG" \
     --host="$HOST" $EXTRAFLAGS
 
 if [ -n "$BUILD" ]
@@ -56,10 +55,6 @@ then
     then
         $EXEC ./bench_ecdh >> bench.log 2>&1
     fi
-    if [ "$SCHNORRSIG" = "yes" ]
-    then
-        $EXEC ./bench_schnorrsig >> bench.log 2>&1
-    fi
 fi
 if [ -n "$CTIMETEST" ]
 then
diff --git a/include/secp256k1_extrakeys.h b/include/secp256k1_extrakeys.h
deleted file mode 100644
index 0c5dff2..0000000
--- a/include/secp256k1_extrakeys.h
+++ /dev/null
@@ -1,236 +0,0 @@
-#ifndef SECP256K1_EXTRAKEYS_H
-#define SECP256K1_EXTRAKEYS_H
-
-#include "secp256k1.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/** Opaque data structure that holds a parsed and valid "x-only" public key.
- *  An x-only pubkey encodes a point whose Y coordinate is even. It is
- *  serialized using only its X coordinate (32 bytes). See BIP-340 for more
- *  information about x-only pubkeys.
- *
- *  The exact representation of data inside is implementation defined and not
- *  guaranteed to be portable between different platforms or versions. It is
- *  however guaranteed to be 64 bytes in size, and can be safely copied/moved.
- *  If you need to convert to a format suitable for storage, transmission, or
- *  comparison, use secp256k1_xonly_pubkey_serialize and
- *  secp256k1_xonly_pubkey_parse.
- */
-typedef struct {
-    unsigned char data[64];
-} secp256k1_xonly_pubkey;
-
-/** Opaque data structure that holds a keypair consisting of a secret and a
- *  public key.
- *
- *  The exact representation of data inside is implementation defined and not
- *  guaranteed to be portable between different platforms or versions. It is
- *  however guaranteed to be 96 bytes in size, and can be safely copied/moved.
- */
-typedef struct {
-    unsigned char data[96];
-} secp256k1_keypair;
-
-/** Parse a 32-byte sequence into a xonly_pubkey object.
- *
- *  Returns: 1 if the public key was fully valid.
- *           0 if the public key could not be parsed or is invalid.
- *
- *  Args:   ctx: a secp256k1 context object (cannot be NULL).
- *  Out: pubkey: pointer to a pubkey object. If 1 is returned, it is set to a
- *               parsed version of input. If not, it's set to an invalid value.
- *               (cannot be NULL).
- *  In: input32: pointer to a serialized xonly_pubkey (cannot be NULL)
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_parse(
-    const secp256k1_context* ctx,
-    secp256k1_xonly_pubkey* pubkey,
-    const unsigned char *input32
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-/** Serialize an xonly_pubkey object into a 32-byte sequence.
- *
- *  Returns: 1 always.
- *
- *  Args:     ctx: a secp256k1 context object (cannot be NULL).
- *  Out: output32: a pointer to a 32-byte array to place the serialized key in
- *                 (cannot be NULL).
- *  In:    pubkey: a pointer to a secp256k1_xonly_pubkey containing an
- *                 initialized public key (cannot be NULL).
- */
-SECP256K1_API int secp256k1_xonly_pubkey_serialize(
-    const secp256k1_context* ctx,
-    unsigned char *output32,
-    const secp256k1_xonly_pubkey* pubkey
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-/** Converts a secp256k1_pubkey into a secp256k1_xonly_pubkey.
- *
- *  Returns: 1 if the public key was successfully converted
- *           0 otherwise
- *
- *  Args:         ctx: pointer to a context object (cannot be NULL)
- *  Out: xonly_pubkey: pointer to an x-only public key object for placing the
- *                     converted public key (cannot be NULL)
- *          pk_parity: pointer to an integer that will be set to 1 if the point
- *                     encoded by xonly_pubkey is the negation of the pubkey and
- *                     set to 0 otherwise. (can be NULL)
- *  In:        pubkey: pointer to a public key that is converted (cannot be NULL)
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_from_pubkey(
-    const secp256k1_context* ctx,
-    secp256k1_xonly_pubkey *xonly_pubkey,
-    int *pk_parity,
-    const secp256k1_pubkey *pubkey
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
-
-/** Tweak an x-only public key by adding the generator multiplied with tweak32
- *  to it.
- *
- *  Note that the resulting point can not in general be represented by an x-only
- *  pubkey because it may have an odd Y coordinate. Instead, the output_pubkey
- *  is a normal secp256k1_pubkey.
- *
- *  Returns: 0 if the arguments are invalid or the resulting public key would be
- *           invalid (only when the tweak is the negation of the corresponding
- *           secret key). 1 otherwise.
- *
- *  Args:           ctx: pointer to a context object initialized for verification
- *                       (cannot be NULL)
- *  Out:  output_pubkey: pointer to a public key to store the result. Will be set
- *                       to an invalid value if this function returns 0 (cannot
- *                       be NULL)
- *  In: internal_pubkey: pointer to an x-only pubkey to apply the tweak to.
- *                       (cannot be NULL).
- *              tweak32: pointer to a 32-byte tweak. If the tweak is invalid
- *                       according to secp256k1_ec_seckey_verify, this function
- *                       returns 0. For uniformly random 32-byte arrays the
- *                       chance of being invalid is negligible (around 1 in
- *                       2^128) (cannot be NULL).
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_tweak_add(
-    const secp256k1_context* ctx,
-    secp256k1_pubkey *output_pubkey,
-    const secp256k1_xonly_pubkey *internal_pubkey,
-    const unsigned char *tweak32
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
-
-/** Checks that a tweaked pubkey is the result of calling
- *  secp256k1_xonly_pubkey_tweak_add with internal_pubkey and tweak32.
- *
- *  The tweaked pubkey is represented by its 32-byte x-only serialization and
- *  its pk_parity, which can both be obtained by converting the result of
- *  tweak_add to a secp256k1_xonly_pubkey.
- *
- *  Note that this alone does _not_ verify that the tweaked pubkey is a
- *  commitment. If the tweak is not chosen in a specific way, the tweaked pubkey
- *  can easily be the result of a different internal_pubkey and tweak.
- *
- *  Returns: 0 if the arguments are invalid or the tweaked pubkey is not the
- *           result of tweaking the internal_pubkey with tweak32. 1 otherwise.
- *  Args:            ctx: pointer to a context object initialized for verification
- *                       (cannot be NULL)
- *  In: tweaked_pubkey32: pointer to a serialized xonly_pubkey (cannot be NULL)
- *     tweaked_pk_parity: the parity of the tweaked pubkey (whose serialization
- *                        is passed in as tweaked_pubkey32). This must match the
- *                        pk_parity value that is returned when calling
- *                        secp256k1_xonly_pubkey with the tweaked pubkey, or
- *                        this function will fail.
- *       internal_pubkey: pointer to an x-only public key object to apply the
- *                        tweak to (cannot be NULL)
- *               tweak32: pointer to a 32-byte tweak (cannot be NULL)
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_tweak_add_check(
-    const secp256k1_context* ctx,
-    const unsigned char *tweaked_pubkey32,
-    int tweaked_pk_parity,
-    const secp256k1_xonly_pubkey *internal_pubkey,
-    const unsigned char *tweak32
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
-
-/** Compute the keypair for a secret key.
- *
- *  Returns: 1: secret was valid, keypair is ready to use
- *           0: secret was invalid, try again with a different secret
- *  Args:    ctx: pointer to a context object, initialized for signing (cannot be NULL)
- *  Out: keypair: pointer to the created keypair (cannot be NULL)
- *  In:   seckey: pointer to a 32-byte secret key (cannot be NULL)
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_create(
-    const secp256k1_context* ctx,
-    secp256k1_keypair *keypair,
-    const unsigned char *seckey
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-/** Get the public key from a keypair.
- *
- *  Returns: 0 if the arguments are invalid. 1 otherwise.
- *  Args:    ctx: pointer to a context object (cannot be NULL)
- *  Out: pubkey: pointer to a pubkey object. If 1 is returned, it is set to
- *               the keypair public key. If not, it's set to an invalid value.
- *               (cannot be NULL)
- *  In: keypair: pointer to a keypair (cannot be NULL)
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_pub(
-    const secp256k1_context* ctx,
-    secp256k1_pubkey *pubkey,
-    const secp256k1_keypair *keypair
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-/** Get the x-only public key from a keypair.
- *
- *  This is the same as calling secp256k1_keypair_pub and then
- *  secp256k1_xonly_pubkey_from_pubkey.
- *
- *  Returns: 0 if the arguments are invalid. 1 otherwise.
- *  Args:   ctx: pointer to a context object (cannot be NULL)
- *  Out: pubkey: pointer to an xonly_pubkey object. If 1 is returned, it is set
- *               to the keypair public key after converting it to an
- *               xonly_pubkey. If not, it's set to an invalid value (cannot be
- *               NULL).
- *    pk_parity: pointer to an integer that will be set to the pk_parity
- *               argument of secp256k1_xonly_pubkey_from_pubkey (can be NULL).
- *  In: keypair: pointer to a keypair (cannot be NULL)
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_pub(
-    const secp256k1_context* ctx,
-    secp256k1_xonly_pubkey *pubkey,
-    int *pk_parity,
-    const secp256k1_keypair *keypair
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
-
-/** Tweak a keypair by adding tweak32 to the secret key and updating the public
- *  key accordingly.
- *
- *  Calling this function and then secp256k1_keypair_pub results in the same
- *  public key as calling secp256k1_keypair_xonly_pub and then
- *  secp256k1_xonly_pubkey_tweak_add.
- *
- *  Returns: 0 if the arguments are invalid or the resulting keypair would be
- *           invalid (only when the tweak is the negation of the keypair's
- *           secret key). 1 otherwise.
- *
- *  Args:       ctx: pointer to a context object initialized for verification
- *                   (cannot be NULL)
- *  In/Out: keypair: pointer to a keypair to apply the tweak to. Will be set to
- *                   an invalid value if this function returns 0 (cannot be
- *                   NULL).
- *  In:     tweak32: pointer to a 32-byte tweak. If the tweak is invalid according
- *                   to secp256k1_ec_seckey_verify, this function returns 0. For
- *                   uniformly random 32-byte arrays the chance of being invalid
- *                   is negligible (around 1 in 2^128) (cannot be NULL).
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_tweak_add(
-    const secp256k1_context* ctx,
-    secp256k1_keypair *keypair,
-    const unsigned char *tweak32
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* SECP256K1_EXTRAKEYS_H */
diff --git a/include/secp256k1_schnorrsig.h b/include/secp256k1_schnorrsig.h
deleted file mode 100644
index 0150cd3..0000000
--- a/include/secp256k1_schnorrsig.h
+++ /dev/null
@@ -1,111 +0,0 @@
-#ifndef SECP256K1_SCHNORRSIG_H
-#define SECP256K1_SCHNORRSIG_H
-
-#include "secp256k1.h"
-#include "secp256k1_extrakeys.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/** This module implements a variant of Schnorr signatures compliant with
- *  Bitcoin Improvement Proposal 340 "Schnorr Signatures for secp256k1"
- *  (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
- */
-
-/** A pointer to a function to deterministically generate a nonce.
- *
- *  Same as secp256k1_nonce function with the exception of accepting an
- *  additional pubkey argument and not requiring an attempt argument. The pubkey
- *  argument can protect signature schemes with key-prefixed challenge hash
- *  inputs against reusing the nonce when signing with the wrong precomputed
- *  pubkey.
- *
- *  Returns: 1 if a nonce was successfully generated. 0 will cause signing to
- *           return an error.
- *  Out:     nonce32:   pointer to a 32-byte array to be filled by the function.
- *  In:      msg32:     the 32-byte message hash being verified (will not be NULL)
- *           key32:     pointer to a 32-byte secret key (will not be NULL)
- *      xonly_pk32:     the 32-byte serialized xonly pubkey corresponding to key32
- *                      (will not be NULL)
- *           algo16:    pointer to a 16-byte array describing the signature
- *                      algorithm (will not be NULL).
- *           data:      Arbitrary data pointer that is passed through.
- *
- *  Except for test cases, this function should compute some cryptographic hash of
- *  the message, the key, the pubkey, the algorithm description, and data.
- */
-typedef int (*secp256k1_nonce_function_hardened)(
-    unsigned char *nonce32,
-    const unsigned char *msg32,
-    const unsigned char *key32,
-    const unsigned char *xonly_pk32,
-    const unsigned char *algo16,
-    void *data
-);
-
-/** An implementation of the nonce generation function as defined in Bitcoin
- *  Improvement Proposal 340 "Schnorr Signatures for secp256k1"
- *  (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
- *
- *  If a data pointer is passed, it is assumed to be a pointer to 32 bytes of
- *  auxiliary random data as defined in BIP-340. If the data pointer is NULL,
- *  schnorrsig_sign does not produce BIP-340 compliant signatures. The algo16
- *  argument must be non-NULL, otherwise the function will fail and return 0.
- *  The hash will be tagged with algo16 after removing all terminating null
- *  bytes. Therefore, to create BIP-340 compliant signatures, algo16 must be set
- *  to "BIP0340/nonce\0\0\0"
- */
-SECP256K1_API extern const secp256k1_nonce_function_hardened secp256k1_nonce_function_bip340;
-
-/** Create a Schnorr signature.
- *
- *  Does _not_ strictly follow BIP-340 because it does not verify the resulting
- *  signature. Instead, you can manually use secp256k1_schnorrsig_verify and
- *  abort if it fails.
- *
- *  Otherwise BIP-340 compliant if the noncefp argument is NULL or
- *  secp256k1_nonce_function_bip340 and the ndata argument is 32-byte auxiliary
- *  randomness.
- *
- *  Returns 1 on success, 0 on failure.
- *  Args:    ctx: pointer to a context object, initialized for signing (cannot be NULL)
- *  Out:   sig64: pointer to a 64-byte array to store the serialized signature (cannot be NULL)
- *  In:    msg32: the 32-byte message being signed (cannot be NULL)
- *       keypair: pointer to an initialized keypair (cannot be NULL)
- *       noncefp: pointer to a nonce generation function. If NULL, secp256k1_nonce_function_bip340 is used
- *         ndata: pointer to arbitrary data used by the nonce generation
- *                function (can be NULL). If it is non-NULL and
- *                secp256k1_nonce_function_bip340 is used, then ndata must be a
- *                pointer to 32-byte auxiliary randomness as per BIP-340.
- */
-SECP256K1_API int secp256k1_schnorrsig_sign(
-    const secp256k1_context* ctx,
-    unsigned char *sig64,
-    const unsigned char *msg32,
-    const secp256k1_keypair *keypair,
-    secp256k1_nonce_function_hardened noncefp,
-    void *ndata
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
-
-/** Verify a Schnorr signature.
- *
- *  Returns: 1: correct signature
- *           0: incorrect signature
- *  Args:    ctx: a secp256k1 context object, initialized for verification.
- *  In:    sig64: pointer to the 64-byte signature to verify (cannot be NULL)
- *         msg32: the 32-byte message being verified (cannot be NULL)
- *        pubkey: pointer to an x-only public key to verify with (cannot be NULL)
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_verify(
-    const secp256k1_context* ctx,
-    const unsigned char *sig64,
-    const unsigned char *msg32,
-    const secp256k1_xonly_pubkey *pubkey
-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* SECP256K1_SCHNORRSIG_H */
diff --git a/src/assumptions.h b/src/assumptions.h
deleted file mode 100644
index f9d4e8e..0000000
--- a/src/assumptions.h
+++ /dev/null
@@ -1,74 +0,0 @@
-/**********************************************************************
- * Copyright (c) 2020 Pieter Wuille                                   *
- * Distributed under the MIT software license, see the accompanying   *
- * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
- **********************************************************************/
-
-#ifndef SECP256K1_ASSUMPTIONS_H
-#define SECP256K1_ASSUMPTIONS_H
-
-#include "util.h"
-
-/* This library, like most software, relies on a number of compiler implementation defined (but not undefined)
-   behaviours. Although the behaviours we require are essentially universal we test them specifically here to
-   reduce the odds of experiencing an unwelcome surprise.
-*/
-
-struct secp256k1_assumption_checker {
-    /* This uses a trick to implement a static assertion in C89: a type with an array of negative size is not
-       allowed. */
-    int dummy_array[(
-        /* Bytes are 8 bits. */
-        CHAR_BIT == 8 &&
-
-        /* Conversions from unsigned to signed outside of the bounds of the signed type are
-           implementation-defined. Verify that they function as reinterpreting the lower
-           bits of the input in two's complement notation. Do this for conversions:
-           - from uint(N)_t to int(N)_t with negative result
-           - from uint(2N)_t to int(N)_t with negative result
-           - from int(2N)_t to int(N)_t with negative result
-           - from int(2N)_t to int(N)_t with positive result */
-
-        /* To int8_t. */
-        ((int8_t)(uint8_t)0xAB == (int8_t)-(int8_t)0x55) &&
-        ((int8_t)(uint16_t)0xABCD == (int8_t)-(int8_t)0x33) &&
-        ((int8_t)(int16_t)(uint16_t)0xCDEF == (int8_t)(uint8_t)0xEF) &&
-        ((int8_t)(int16_t)(uint16_t)0x9234 == (int8_t)(uint8_t)0x34) &&
-
-        /* To int16_t. */
-        ((int16_t)(uint16_t)0xBCDE == (int16_t)-(int16_t)0x4322) &&
-        ((int16_t)(uint32_t)0xA1B2C3D4 == (int16_t)-(int16_t)0x3C2C) &&
-        ((int16_t)(int32_t)(uint32_t)0xC1D2E3F4 == (int16_t)(uint16_t)0xE3F4) &&
-        ((int16_t)(int32_t)(uint32_t)0x92345678 == (int16_t)(uint16_t)0x5678) &&
-
-        /* To int32_t. */
-        ((int32_t)(uint32_t)0xB2C3D4E5 == (int32_t)-(int32_t)0x4D3C2B1B) &&
-        ((int32_t)(uint64_t)0xA123B456C789D012ULL == (int32_t)-(int32_t)0x38762FEE) &&
-        ((int32_t)(int64_t)(uint64_t)0xC1D2E3F4A5B6C7D8ULL == (int32_t)(uint32_t)0xA5B6C7D8) &&
-        ((int32_t)(int64_t)(uint64_t)0xABCDEF0123456789ULL == (int32_t)(uint32_t)0x23456789) &&
-
-        /* To int64_t. */
-        ((int64_t)(uint64_t)0xB123C456D789E012ULL == (int64_t)-(int64_t)0x4EDC3BA928761FEEULL) &&
-#if defined(SECP256K1_WIDEMUL_INT128)
-        ((int64_t)(((uint128_t)0xA1234567B8901234ULL << 64) + 0xC5678901D2345678ULL) == (int64_t)-(int64_t)0x3A9876FE2DCBA988ULL) &&
-        (((int64_t)(int128_t)(((uint128_t)0xB1C2D3E4F5A6B7C8ULL << 64) + 0xD9E0F1A2B3C4D5E6ULL)) == (int64_t)(uint64_t)0xD9E0F1A2B3C4D5E6ULL) &&
-        (((int64_t)(int128_t)(((uint128_t)0xABCDEF0123456789ULL << 64) + 0x0123456789ABCDEFULL)) == (int64_t)(uint64_t)0x0123456789ABCDEFULL) &&
-
-        /* To int128_t. */
-        ((int128_t)(((uint128_t)0xB1234567C8901234ULL << 64) + 0xD5678901E2345678ULL) == (int128_t)(-(int128_t)0x8E1648B3F50E80DCULL * 0x8E1648B3F50E80DDULL + 0x5EA688D5482F9464ULL)) &&
-#endif
-
-        /* Right shift on negative signed values is implementation defined. Verify that it
-           acts as a right shift in two's complement with sign extension (i.e duplicating
-           the top bit into newly added bits). */
-        ((((int8_t)0xE8) >> 2) == (int8_t)(uint8_t)0xFA) &&
-        ((((int16_t)0xE9AC) >> 4) == (int16_t)(uint16_t)0xFE9A) &&
-        ((((int32_t)0x937C918A) >> 9) == (int32_t)(uint32_t)0xFFC9BE48) &&
-        ((((int64_t)0xA8B72231DF9CF4B9ULL) >> 19) == (int64_t)(uint64_t)0xFFFFF516E4463BF3ULL) &&
-#if defined(SECP256K1_WIDEMUL_INT128)
-        ((((int128_t)(((uint128_t)0xCD833A65684A0DBCULL << 64) + 0xB349312F71EA7637ULL)) >> 39) == (int128_t)(((uint128_t)0xFFFFFFFFFF9B0674ULL << 64) + 0xCAD0941B79669262ULL)) &&
-#endif
-    1) * 2 - 1];
-};
-
-#endif /* SECP256K1_ASSUMPTIONS_H */
diff --git a/src/bench_internal.c b/src/bench_internal.c
index 9687fe4..2075912 100644
--- a/src/bench_internal.c
+++ b/src/bench_internal.c
@@ -7,7 +7,6 @@
 
 #include "include/secp256k1.h"
 
-#include "assumptions.h"
 #include "util.h"
 #include "hash_impl.h"
 #include "num_impl.h"
@@ -20,10 +19,10 @@
 #include "secp256k1.c"
 
 typedef struct {
-    secp256k1_scalar scalar[2];
-    secp256k1_fe fe[4];
-    secp256k1_ge ge[2];
-    secp256k1_gej gej[2];
+    secp256k1_scalar scalar_x, scalar_y;
+    secp256k1_fe fe_x, fe_y;
+    secp256k1_ge ge_x, ge_y;
+    secp256k1_gej gej_x, gej_y;
     unsigned char data[64];
     int wnaf[256];
 } bench_inv;
@@ -31,53 +30,30 @@ typedef struct {
 void bench_setup(void* arg) {
     bench_inv *data = (bench_inv*)arg;
 
-    static const unsigned char init[4][32] = {
-        /* Initializer for scalar[0], fe[0], first half of data, the X coordinate of ge[0],
-           and the (implied affine) X coordinate of gej[0]. */
-        {
-            0x02, 0x03, 0x05, 0x07, 0x0b, 0x0d, 0x11, 0x13,
-            0x17, 0x1d, 0x1f, 0x25, 0x29, 0x2b, 0x2f, 0x35,
-            0x3b, 0x3d, 0x43, 0x47, 0x49, 0x4f, 0x53, 0x59,
-            0x61, 0x65, 0x67, 0x6b, 0x6d, 0x71, 0x7f, 0x83
-        },
-        /* Initializer for scalar[1], fe[1], first half of data, the X coordinate of ge[1],
-           and the (implied affine) X coordinate of gej[1]. */
-        {
-            0x82, 0x83, 0x85, 0x87, 0x8b, 0x8d, 0x81, 0x83,
-            0x97, 0xad, 0xaf, 0xb5, 0xb9, 0xbb, 0xbf, 0xc5,
-            0xdb, 0xdd, 0xe3, 0xe7, 0xe9, 0xef, 0xf3, 0xf9,
-            0x11, 0x15, 0x17, 0x1b, 0x1d, 0xb1, 0xbf, 0xd3
-        },
-        /* Initializer for fe[2] and the Z coordinate of gej[0]. */
-        {
-            0x3d, 0x2d, 0xef, 0xf4, 0x25, 0x98, 0x4f, 0x5d,
-            0xe2, 0xca, 0x5f, 0x41, 0x3f, 0x3f, 0xce, 0x44,
-            0xaa, 0x2c, 0x53, 0x8a, 0xc6, 0x59, 0x1f, 0x38,
-            0x38, 0x23, 0xe4, 0x11, 0x27, 0xc6, 0xa0, 0xe7
-        },
-        /* Initializer for fe[3] and the Z coordinate of gej[1]. */
-        {
-            0xbd, 0x21, 0xa5, 0xe1, 0x13, 0x50, 0x73, 0x2e,
-            0x52, 0x98, 0xc8, 0x9e, 0xab, 0x00, 0xa2, 0x68,
-            0x43, 0xf5, 0xd7, 0x49, 0x80, 0x72, 0xa7, 0xf3,
-            0xd7, 0x60, 0xe6, 0xab, 0x90, 0x92, 0xdf, 0xc5
-        }
+    static const unsigned char init_x[32] = {
+        0x02, 0x03, 0x05, 0x07, 0x0b, 0x0d, 0x11, 0x13,
+        0x17, 0x1d, 0x1f, 0x25, 0x29, 0x2b, 0x2f, 0x35,
+        0x3b, 0x3d, 0x43, 0x47, 0x49, 0x4f, 0x53, 0x59,
+        0x61, 0x65, 0x67, 0x6b, 0x6d, 0x71, 0x7f, 0x83
     };
 
-    secp256k1_scalar_set_b32(&data->scalar[0], init[0], NULL);
-    secp256k1_scalar_set_b32(&data->scalar[1], init[1], NULL);
-    secp256k1_fe_set_b32(&data->fe[0], init[0]);
-    secp256k1_fe_set_b32(&data->fe[1], init[1]);
-    secp256k1_fe_set_b32(&data->fe[2], init[2]);
-    secp256k1_fe_set_b32(&data->fe[3], init[3]);
-    CHECK(secp256k1_ge_set_xo_var(&data->ge[0], &data->fe[0], 0));
-    CHECK(secp256k1_ge_set_xo_var(&data->ge[1], &data->fe[1], 1));
-    secp256k1_gej_set_ge(&data->gej[0], &data->ge[0]);
-    secp256k1_gej_rescale(&data->gej[0], &data->fe[2]);
-    secp256k1_gej_set_ge(&data->gej[1], &data->ge[1]);
-    secp256k1_gej_rescale(&data->gej[1], &data->fe[3]);
-    memcpy(data->data, init[0], 32);
-    memcpy(data->data + 32, init[1], 32);
+    static const unsigned char init_y[32] = {
+        0x82, 0x83, 0x85, 0x87, 0x8b, 0x8d, 0x81, 0x83,
+        0x97, 0xad, 0xaf, 0xb5, 0xb9, 0xbb, 0xbf, 0xc5,
+        0xdb, 0xdd, 0xe3, 0xe7, 0xe9, 0xef, 0xf3, 0xf9,
+        0x11, 0x15, 0x17, 0x1b, 0x1d, 0xb1, 0xbf, 0xd3
+    };
+
+    secp256k1_scalar_set_b32(&data->scalar_x, init_x, NULL);
+    secp256k1_scalar_set_b32(&data->scalar_y, init_y, NULL);
+    secp256k1_fe_set_b32(&data->fe_x, init_x);
+    secp256k1_fe_set_b32(&data->fe_y, init_y);
+    CHECK(secp256k1_ge_set_xo_var(&data->ge_x, &data->fe_x, 0));
+    CHECK(secp256k1_ge_set_xo_var(&data->ge_y, &data->fe_y, 1));
+    secp256k1_gej_set_ge(&data->gej_x, &data->ge_x);
+    secp256k1_gej_set_ge(&data->gej_y, &data->ge_y);
+    memcpy(data->data, init_x, 32);
+    memcpy(data->data + 32, init_y, 32);
 }
 
 void bench_scalar_add(void* arg, int iters) {
@@ -85,7 +61,7 @@ void bench_scalar_add(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        j += secp256k1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        j += secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
     }
     CHECK(j <= iters);
 }
@@ -95,7 +71,7 @@ void bench_scalar_negate(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_scalar_negate(&data->scalar[0], &data->scalar[0]);
+        secp256k1_scalar_negate(&data->scalar_x, &data->scalar_x);
     }
 }
 
@@ -104,7 +80,7 @@ void bench_scalar_sqr(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_scalar_sqr(&data->scalar[0], &data->scalar[0]);
+        secp256k1_scalar_sqr(&data->scalar_x, &data->scalar_x);
     }
 }
 
@@ -113,7 +89,7 @@ void bench_scalar_mul(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_scalar_mul(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        secp256k1_scalar_mul(&data->scalar_x, &data->scalar_x, &data->scalar_y);
     }
 }
 
@@ -123,8 +99,8 @@ void bench_scalar_split(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_scalar_split_lambda(&data->scalar[0], &data->scalar[1], &data->scalar[0]);
-        j += secp256k1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        secp256k1_scalar_split_lambda(&data->scalar_x, &data->scalar_y, &data->scalar_x);
+        j += secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
     }
     CHECK(j <= iters);
 }
@@ -135,8 +111,8 @@ void bench_scalar_inverse(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_scalar_inverse(&data->scalar[0], &data->scalar[0]);
-        j += secp256k1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        secp256k1_scalar_inverse(&data->scalar_x, &data->scalar_x);
+        j += secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
     }
     CHECK(j <= iters);
 }
@@ -146,8 +122,8 @@ void bench_scalar_inverse_var(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_scalar_inverse_var(&data->scalar[0], &data->scalar[0]);
-        j += secp256k1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        secp256k1_scalar_inverse_var(&data->scalar_x, &data->scalar_x);
+        j += secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
     }
     CHECK(j <= iters);
 }
@@ -157,7 +133,7 @@ void bench_field_normalize(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_fe_normalize(&data->fe[0]);
+        secp256k1_fe_normalize(&data->fe_x);
     }
 }
 
@@ -166,7 +142,7 @@ void bench_field_normalize_weak(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_fe_normalize_weak(&data->fe[0]);
+        secp256k1_fe_normalize_weak(&data->fe_x);
     }
 }
 
@@ -175,7 +151,7 @@ void bench_field_mul(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_fe_mul(&data->fe[0], &data->fe[0], &data->fe[1]);
+        secp256k1_fe_mul(&data->fe_x, &data->fe_x, &data->fe_y);
     }
 }
 
@@ -184,7 +160,7 @@ void bench_field_sqr(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_fe_sqr(&data->fe[0], &data->fe[0]);
+        secp256k1_fe_sqr(&data->fe_x, &data->fe_x);
     }
 }
 
@@ -193,8 +169,8 @@ void bench_field_inverse(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_fe_inv(&data->fe[0], &data->fe[0]);
-        secp256k1_fe_add(&data->fe[0], &data->fe[1]);
+        secp256k1_fe_inv(&data->fe_x, &data->fe_x);
+        secp256k1_fe_add(&data->fe_x, &data->fe_y);
     }
 }
 
@@ -203,8 +179,8 @@ void bench_field_inverse_var(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_fe_inv_var(&data->fe[0], &data->fe[0]);
-        secp256k1_fe_add(&data->fe[0], &data->fe[1]);
+        secp256k1_fe_inv_var(&data->fe_x, &data->fe_x);
+        secp256k1_fe_add(&data->fe_x, &data->fe_y);
     }
 }
 
@@ -214,9 +190,9 @@ void bench_field_sqrt(void* arg, int iters) {
     secp256k1_fe t;
 
     for (i = 0; i < iters; i++) {
-        t = data->fe[0];
-        j += secp256k1_fe_sqrt(&data->fe[0], &t);
-        secp256k1_fe_add(&data->fe[0], &data->fe[1]);
+        t = data->fe_x;
+        j += secp256k1_fe_sqrt(&data->fe_x, &t);
+        secp256k1_fe_add(&data->fe_x, &data->fe_y);
     }
     CHECK(j <= iters);
 }
@@ -226,7 +202,7 @@ void bench_group_double_var(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_gej_double_var(&data->gej[0], &data->gej[0], NULL);
+        secp256k1_gej_double_var(&data->gej_x, &data->gej_x, NULL);
     }
 }
 
@@ -235,7 +211,7 @@ void bench_group_add_var(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_gej_add_var(&data->gej[0], &data->gej[0], &data->gej[1], NULL);
+        secp256k1_gej_add_var(&data->gej_x, &data->gej_x, &data->gej_y, NULL);
     }
 }
 
@@ -244,7 +220,7 @@ void bench_group_add_affine(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_gej_add_ge(&data->gej[0], &data->gej[0], &data->ge[1]);
+        secp256k1_gej_add_ge(&data->gej_x, &data->gej_x, &data->ge_y);
     }
 }
 
@@ -253,7 +229,7 @@ void bench_group_add_affine_var(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        secp256k1_gej_add_ge_var(&data->gej[0], &data->gej[0], &data->ge[1], NULL);
+        secp256k1_gej_add_ge_var(&data->gej_x, &data->gej_x, &data->ge_y, NULL);
     }
 }
 
@@ -262,37 +238,9 @@ void bench_group_jacobi_var(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        j += secp256k1_gej_has_quad_y_var(&data->gej[0]);
-        /* Vary the Y and Z coordinates of the input (the X coordinate doesn't matter to
-           secp256k1_gej_has_quad_y_var). Note that the resulting coordinates will
-           generally not correspond to a point on the curve, but this is not a problem
-           for the code being benchmarked here. Adding and normalizing have less
-           overhead than EC operations (which could guarantee the point remains on the
-           curve). */
-        secp256k1_fe_add(&data->gej[0].y, &data->fe[1]);
-        secp256k1_fe_add(&data->gej[0].z, &data->fe[2]);
-        secp256k1_fe_normalize_var(&data->gej[0].y);
-        secp256k1_fe_normalize_var(&data->gej[0].z);
-    }
-    CHECK(j <= iters);
-}
-
-void bench_group_to_affine_var(void* arg, int iters) {
-    int i;
-    bench_inv *data = (bench_inv*)arg;
-
-    for (i = 0; i < iters; ++i) {
-        secp256k1_ge_set_gej_var(&data->ge[1], &data->gej[0]);
-        /* Use the output affine X/Y coordinates to vary the input X/Y/Z coordinates.
-           Similar to bench_group_jacobi_var, this approach does not result in
-           coordinates of points on the curve. */
-        secp256k1_fe_add(&data->gej[0].x, &data->ge[1].y);
-        secp256k1_fe_add(&data->gej[0].y, &data->fe[2]);
-        secp256k1_fe_add(&data->gej[0].z, &data->ge[1].x);
-        secp256k1_fe_normalize_var(&data->gej[0].x);
-        secp256k1_fe_normalize_var(&data->gej[0].y);
-        secp256k1_fe_normalize_var(&data->gej[0].z);
+        j += secp256k1_gej_has_quad_y_var(&data->gej_x);
     }
+    CHECK(j == iters);
 }
 
 void bench_ecmult_wnaf(void* arg, int iters) {
@@ -300,8 +248,8 @@ void bench_ecmult_wnaf(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        bits += secp256k1_ecmult_wnaf(data->wnaf, 256, &data->scalar[0], WINDOW_A);
-        overflow += secp256k1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        bits += secp256k1_ecmult_wnaf(data->wnaf, 256, &data->scalar_x, WINDOW_A);
+        overflow += secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
     }
     CHECK(overflow >= 0);
     CHECK(bits <= 256*iters);
@@ -312,8 +260,8 @@ void bench_wnaf_const(void* arg, int iters) {
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        bits += secp256k1_wnaf_const(data->wnaf, &data->scalar[0], WINDOW_A, 256);
-        overflow += secp256k1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        bits += secp256k1_wnaf_const(data->wnaf, &data->scalar_x, WINDOW_A, 256);
+        overflow += secp256k1_scalar_add(&data->scalar_x, &data->scalar_x, &data->scalar_y);
     }
     CHECK(overflow >= 0);
     CHECK(bits <= 256*iters);
@@ -375,15 +323,14 @@ void bench_context_sign(void* arg, int iters) {
 void bench_num_jacobi(void* arg, int iters) {
     int i, j = 0;
     bench_inv *data = (bench_inv*)arg;
-    secp256k1_num nx, na, norder;
+    secp256k1_num nx, norder;
 
-    secp256k1_scalar_get_num(&nx, &data->scalar[0]);
+    secp256k1_scalar_get_num(&nx, &data->scalar_x);
     secp256k1_scalar_order_get_num(&norder);
-    secp256k1_scalar_get_num(&na, &data->scalar[1]);
+    secp256k1_scalar_get_num(&norder, &data->scalar_y);
 
     for (i = 0; i < iters; i++) {
         j += secp256k1_num_jacobi(&nx, &norder);
-        secp256k1_num_add(&nx, &nx, &na);
     }
     CHECK(j <= iters);
 }
@@ -416,7 +363,6 @@ int main(int argc, char **argv) {
     if (have_flag(argc, argv, "group") || have_flag(argc, argv, "add")) run_benchmark("group_add_affine", bench_group_add_affine, bench_setup, NULL, &data, 10, iters*10);
     if (have_flag(argc, argv, "group") || have_flag(argc, argv, "add")) run_benchmark("group_add_affine_var", bench_group_add_affine_var, bench_setup, NULL, &data, 10, iters*10);
     if (have_flag(argc, argv, "group") || have_flag(argc, argv, "jacobi")) run_benchmark("group_jacobi_var", bench_group_jacobi_var, bench_setup, NULL, &data, 10, iters);
-    if (have_flag(argc, argv, "group") || have_flag(argc, argv, "to_affine")) run_benchmark("group_to_affine_var", bench_group_to_affine_var, bench_setup, NULL, &data, 10, iters);
 
     if (have_flag(argc, argv, "ecmult") || have_flag(argc, argv, "wnaf")) run_benchmark("wnaf_const", bench_wnaf_const, bench_setup, NULL, &data, 10, iters);
     if (have_flag(argc, argv, "ecmult") || have_flag(argc, argv, "wnaf")) run_benchmark("ecmult_wnaf", bench_ecmult_wnaf, bench_setup, NULL, &data, 10, iters);
diff --git a/src/bench_schnorrsig.c b/src/bench_schnorrsig.c
deleted file mode 100644
index 315f5af..0000000
--- a/src/bench_schnorrsig.c
+++ /dev/null
@@ -1,102 +0,0 @@
-/**********************************************************************
- * Copyright (c) 2018-2020 Andrew Poelstra, Jonas Nick                *
- * Distributed under the MIT software license, see the accompanying   *
- * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
- **********************************************************************/
-
-#include <string.h>
-#include <stdlib.h>
-
-
-#include "include/secp256k1.h"
-#include "include/secp256k1_schnorrsig.h"
-#include "util.h"
-#include "bench.h"
-
-typedef struct {
-    secp256k1_context *ctx;
-    int n;
-
-    const secp256k1_keypair **keypairs;
-    const unsigned char **pk;
-    const unsigned char **sigs;
-    const unsigned char **msgs;
-} bench_schnorrsig_data;
-
-void bench_schnorrsig_sign(void* arg, int iters) {
-    bench_schnorrsig_data *data = (bench_schnorrsig_data *)arg;
-    int i;
-    unsigned char msg[32] = "benchmarkexamplemessagetemplate";
-    unsigned char sig[64];
-
-    for (i = 0; i < iters; i++) {
-        msg[0] = i;
-        msg[1] = i >> 8;
-        CHECK(secp256k1_schnorrsig_sign(data->ctx, sig, msg, data->keypairs[i], NULL, NULL));
-    }
-}
-
-void bench_schnorrsig_verify(void* arg, int iters) {
-    bench_schnorrsig_data *data = (bench_schnorrsig_data *)arg;
-    int i;
-
-    for (i = 0; i < iters; i++) {
-        secp256k1_xonly_pubkey pk;
-        CHECK(secp256k1_xonly_pubkey_parse(data->ctx, &pk, data->pk[i]) == 1);
-        CHECK(secp256k1_schnorrsig_verify(data->ctx, data->sigs[i], data->msgs[i], &pk));
-    }
-}
-
-int main(void) {
-    int i;
-    bench_schnorrsig_data data;
-    int iters = get_iters(10000);
-
-    data.ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
-    data.keypairs = (const secp256k1_keypair **)malloc(iters * sizeof(secp256k1_keypair *));
-    data.pk = (const unsigned char **)malloc(iters * sizeof(unsigned char *));
-    data.msgs = (const unsigned char **)malloc(iters * sizeof(unsigned char *));
-    data.sigs = (const unsigned char **)malloc(iters * sizeof(unsigned char *));
-
-    for (i = 0; i < iters; i++) {
-        unsigned char sk[32];
-        unsigned char *msg = (unsigned char *)malloc(32);
-        unsigned char *sig = (unsigned char *)malloc(64);
-        secp256k1_keypair *keypair = (secp256k1_keypair *)malloc(sizeof(*keypair));
-        unsigned char *pk_char = (unsigned char *)malloc(32);
-        secp256k1_xonly_pubkey pk;
-        msg[0] = sk[0] = i;
-        msg[1] = sk[1] = i >> 8;
-        msg[2] = sk[2] = i >> 16;
-        msg[3] = sk[3] = i >> 24;
-        memset(&msg[4], 'm', 28);
-        memset(&sk[4], 's', 28);
-
-        data.keypairs[i] = keypair;
-        data.pk[i] = pk_char;
-        data.msgs[i] = msg;
-        data.sigs[i] = sig;
-
-        CHECK(secp256k1_keypair_create(data.ctx, keypair, sk));
-        CHECK(secp256k1_schnorrsig_sign(data.ctx, sig, msg, keypair, NULL, NULL));
-        CHECK(secp256k1_keypair_xonly_pub(data.ctx, &pk, NULL, keypair));
-        CHECK(secp256k1_xonly_pubkey_serialize(data.ctx, pk_char, &pk) == 1);
-    }
-
-    run_benchmark("schnorrsig_sign", bench_schnorrsig_sign, NULL, NULL, (void *) &data, 10, iters);
-    run_benchmark("schnorrsig_verify", bench_schnorrsig_verify, NULL, NULL, (void *) &data, 10, iters);
-
-    for (i = 0; i < iters; i++) {
-        free((void *)data.keypairs[i]);
-        free((void *)data.pk[i]);
-        free((void *)data.msgs[i]);
-        free((void *)data.sigs[i]);
-    }
-    free(data.keypairs);
-    free(data.pk);
-    free(data.msgs);
-    free(data.sigs);
-
-    secp256k1_context_destroy(data.ctx);
-    return 0;
-}
diff --git a/src/gen_context.c b/src/gen_context.c
index 8b7729a..539f574 100644
--- a/src/gen_context.c
+++ b/src/gen_context.c
@@ -13,7 +13,6 @@
 #include "basic-config.h"
 
 #include "include/secp256k1.h"
-#include "assumptions.h"
 #include "util.h"
 #include "field_impl.h"
 #include "scalar_impl.h"
diff --git a/src/group.h b/src/group.h
index 32236fb..6185be0 100644
--- a/src/group.h
+++ b/src/group.h
@@ -59,7 +59,6 @@ static int secp256k1_ge_is_infinity(const secp256k1_ge *a);
 /** Check whether a group element is valid (i.e., on the curve). */
 static int secp256k1_ge_is_valid_var(const secp256k1_ge *a);
 
-/** Set r equal to the inverse of a (i.e., mirrored around the X axis) */
 static void secp256k1_ge_neg(secp256k1_ge *r, const secp256k1_ge *a);
 
 /** Set a group element equal to another which is given in jacobian coordinates */
diff --git a/src/group_impl.h b/src/group_impl.h
index ccd93d3..fbfd348 100644
--- a/src/group_impl.h
+++ b/src/group_impl.h
@@ -399,7 +399,7 @@ static void secp256k1_gej_add_var(secp256k1_gej *r, const secp256k1_gej *a, cons
             if (rzr != NULL) {
                 secp256k1_fe_set_int(rzr, 0);
             }
-            secp256k1_gej_set_infinity(r);
+            r->infinity = 1;
         }
         return;
     }
@@ -449,7 +449,7 @@ static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, c
             if (rzr != NULL) {
                 secp256k1_fe_set_int(rzr, 0);
             }
-            secp256k1_gej_set_infinity(r);
+            r->infinity = 1;
         }
         return;
     }
@@ -508,7 +508,7 @@ static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a,
         if (secp256k1_fe_normalizes_to_zero_var(&i)) {
             secp256k1_gej_double_var(r, a, NULL);
         } else {
-            secp256k1_gej_set_infinity(r);
+            r->infinity = 1;
         }
         return;
     }
diff --git a/src/hash_impl.h b/src/hash_impl.h
index 4097725..782f972 100644
--- a/src/hash_impl.h
+++ b/src/hash_impl.h
@@ -8,7 +8,6 @@
 #define SECP256K1_HASH_IMPL_H
 
 #include "hash.h"
-#include "util.h"
 
 #include <stdlib.h>
 #include <stdint.h>
@@ -28,9 +27,9 @@
     (h) = t1 + t2; \
 } while(0)
 
-#if defined(SECP256K1_BIG_ENDIAN)
+#ifdef WORDS_BIGENDIAN
 #define BE32(x) (x)
-#elif defined(SECP256K1_LITTLE_ENDIAN)
+#else
 #define BE32(p) ((((p) & 0xFF) << 24) | (((p) & 0xFF00) << 8) | (((p) & 0xFF0000) >> 8) | (((p) & 0xFF000000) >> 24))
 #endif
 
@@ -164,19 +163,6 @@ static void secp256k1_sha256_finalize(secp256k1_sha256 *hash, unsigned char *out
     memcpy(out32, (const unsigned char*)out, 32);
 }
 
-/* Initializes a sha256 struct and writes the 64 byte string
- * SHA256(tag)||SHA256(tag) into it. */
-static void secp256k1_sha256_initialize_tagged(secp256k1_sha256 *hash, const unsigned char *tag, size_t taglen) {
-    unsigned char buf[32];
-    secp256k1_sha256_initialize(hash);
-    secp256k1_sha256_write(hash, tag, taglen);
-    secp256k1_sha256_finalize(hash, buf);
-
-    secp256k1_sha256_initialize(hash);
-    secp256k1_sha256_write(hash, buf, 32);
-    secp256k1_sha256_write(hash, buf, 32);
-}
-
 static void secp256k1_hmac_sha256_initialize(secp256k1_hmac_sha256 *hash, const unsigned char *key, size_t keylen) {
     size_t n;
     unsigned char rkey[64];
diff --git a/src/modules/extrakeys/Makefile.am.include b/src/modules/extrakeys/Makefile.am.include
deleted file mode 100644
index 8515f92..0000000
--- a/src/modules/extrakeys/Makefile.am.include
+++ /dev/null
@@ -1,3 +0,0 @@
-include_HEADERS += include/secp256k1_extrakeys.h
-noinst_HEADERS += src/modules/extrakeys/tests_impl.h
-noinst_HEADERS += src/modules/extrakeys/main_impl.h
diff --git a/src/modules/extrakeys/main_impl.h b/src/modules/extrakeys/main_impl.h
deleted file mode 100644
index d319215..0000000
--- a/src/modules/extrakeys/main_impl.h
+++ /dev/null
@@ -1,248 +0,0 @@
-/**********************************************************************
- * Copyright (c) 2020 Jonas Nick                                      *
- * Distributed under the MIT software license, see the accompanying   *
- * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
- **********************************************************************/
-
-#ifndef _SECP256K1_MODULE_EXTRAKEYS_MAIN_
-#define _SECP256K1_MODULE_EXTRAKEYS_MAIN_
-
-#include "include/secp256k1.h"
-#include "include/secp256k1_extrakeys.h"
-
-static SECP256K1_INLINE int secp256k1_xonly_pubkey_load(const secp256k1_context* ctx, secp256k1_ge *ge, const secp256k1_xonly_pubkey *pubkey) {
-    return secp256k1_pubkey_load(ctx, ge, (const secp256k1_pubkey *) pubkey);
-}
-
-static SECP256K1_INLINE void secp256k1_xonly_pubkey_save(secp256k1_xonly_pubkey *pubkey, secp256k1_ge *ge) {
-    secp256k1_pubkey_save((secp256k1_pubkey *) pubkey, ge);
-}
-
-int secp256k1_xonly_pubkey_parse(const secp256k1_context* ctx, secp256k1_xonly_pubkey *pubkey, const unsigned char *input32) {
-    secp256k1_ge pk;
-    secp256k1_fe x;
-
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(pubkey != NULL);
-    memset(pubkey, 0, sizeof(*pubkey));
-    ARG_CHECK(input32 != NULL);
-
-    if (!secp256k1_fe_set_b32(&x, input32)) {
-        return 0;
-    }
-    if (!secp256k1_ge_set_xo_var(&pk, &x, 0)) {
-        return 0;
-    }
-    secp256k1_xonly_pubkey_save(pubkey, &pk);
-    return 1;
-}
-
-int secp256k1_xonly_pubkey_serialize(const secp256k1_context* ctx, unsigned char *output32, const secp256k1_xonly_pubkey *pubkey) {
-    secp256k1_ge pk;
-
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(output32 != NULL);
-    memset(output32, 0, 32);
-    ARG_CHECK(pubkey != NULL);
-
-    if (!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) {
-        return 0;
-    }
-    secp256k1_fe_get_b32(output32, &pk.x);
-    return 1;
-}
-
-/** Keeps a group element as is if it has an even Y and otherwise negates it.
- *  y_parity is set to 0 in the former case and to 1 in the latter case.
- *  Requires that the coordinates of r are normalized. */
-static int secp256k1_extrakeys_ge_even_y(secp256k1_ge *r) {
-    int y_parity = 0;
-    VERIFY_CHECK(!secp256k1_ge_is_infinity(r));
-
-    if (secp256k1_fe_is_odd(&r->y)) {
-        secp256k1_fe_negate(&r->y, &r->y, 1);
-        y_parity = 1;
-    }
-    return y_parity;
-}
-
-int secp256k1_xonly_pubkey_from_pubkey(const secp256k1_context* ctx, secp256k1_xonly_pubkey *xonly_pubkey, int *pk_parity, const secp256k1_pubkey *pubkey) {
-    secp256k1_ge pk;
-    int tmp;
-
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(xonly_pubkey != NULL);
-    ARG_CHECK(pubkey != NULL);
-
-    if (!secp256k1_pubkey_load(ctx, &pk, pubkey)) {
-        return 0;
-    }
-    tmp = secp256k1_extrakeys_ge_even_y(&pk);
-    if (pk_parity != NULL) {
-        *pk_parity = tmp;
-    }
-    secp256k1_xonly_pubkey_save(xonly_pubkey, &pk);
-    return 1;
-}
-
-int secp256k1_xonly_pubkey_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *output_pubkey, const secp256k1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
-    secp256k1_ge pk;
-
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(output_pubkey != NULL);
-    memset(output_pubkey, 0, sizeof(*output_pubkey));
-    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
-    ARG_CHECK(internal_pubkey != NULL);
-    ARG_CHECK(tweak32 != NULL);
-
-    if (!secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
-        || !secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &pk, tweak32)) {
-        return 0;
-    }
-    secp256k1_pubkey_save(output_pubkey, &pk);
-    return 1;
-}
-
-int secp256k1_xonly_pubkey_tweak_add_check(const secp256k1_context* ctx, const unsigned char *tweaked_pubkey32, int tweaked_pk_parity, const secp256k1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
-    secp256k1_ge pk;
-    unsigned char pk_expected32[32];
-
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
-    ARG_CHECK(internal_pubkey != NULL);
-    ARG_CHECK(tweaked_pubkey32 != NULL);
-    ARG_CHECK(tweak32 != NULL);
-
-    if (!secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
-        || !secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &pk, tweak32)) {
-        return 0;
-    }
-    secp256k1_fe_normalize_var(&pk.x);
-    secp256k1_fe_normalize_var(&pk.y);
-    secp256k1_fe_get_b32(pk_expected32, &pk.x);
-
-    return memcmp(&pk_expected32, tweaked_pubkey32, 32) == 0
-            && secp256k1_fe_is_odd(&pk.y) == tweaked_pk_parity;
-}
-
-static void secp256k1_keypair_save(secp256k1_keypair *keypair, const secp256k1_scalar *sk, secp256k1_ge *pk) {
-    secp256k1_scalar_get_b32(&keypair->data[0], sk);
-    secp256k1_pubkey_save((secp256k1_pubkey *)&keypair->data[32], pk);
-}
-
-
-static int secp256k1_keypair_seckey_load(const secp256k1_context* ctx, secp256k1_scalar *sk, const secp256k1_keypair *keypair) {
-    int ret;
-
-    ret = secp256k1_scalar_set_b32_seckey(sk, &keypair->data[0]);
-    /* We can declassify ret here because sk is only zero if a keypair function
-     * failed (which zeroes the keypair) and its return value is ignored. */
-    secp256k1_declassify(ctx, &ret, sizeof(ret));
-    ARG_CHECK(ret);
-    return ret;
-}
-
-/* Load a keypair into pk and sk (if non-NULL). This function declassifies pk
- * and ARG_CHECKs that the keypair is not invalid. It always initializes sk and
- * pk with dummy values. */
-static int secp256k1_keypair_load(const secp256k1_context* ctx, secp256k1_scalar *sk, secp256k1_ge *pk, const secp256k1_keypair *keypair) {
-    int ret;
-    const secp256k1_pubkey *pubkey = (const secp256k1_pubkey *)&keypair->data[32];
-
-    /* Need to declassify the pubkey because pubkey_load ARG_CHECKs if it's
-     * invalid. */
-    secp256k1_declassify(ctx, pubkey, sizeof(*pubkey));
-    ret = secp256k1_pubkey_load(ctx, pk, pubkey);
-    if (sk != NULL) {
-        ret = ret && secp256k1_keypair_seckey_load(ctx, sk, keypair);
-    }
-    if (!ret) {
-        *pk = secp256k1_ge_const_g;
-        if (sk != NULL) {
-            *sk = secp256k1_scalar_one;
-        }
-    }
-    return ret;
-}
-
-int secp256k1_keypair_create(const secp256k1_context* ctx, secp256k1_keypair *keypair, const unsigned char *seckey32) {
-    secp256k1_scalar sk;
-    secp256k1_ge pk;
-    int ret = 0;
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(keypair != NULL);
-    memset(keypair, 0, sizeof(*keypair));
-    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
-    ARG_CHECK(seckey32 != NULL);
-
-    ret = secp256k1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &sk, &pk, seckey32);
-    secp256k1_keypair_save(keypair, &sk, &pk);
-    memczero(keypair, sizeof(*keypair), !ret);
-
-    secp256k1_scalar_clear(&sk);
-    return ret;
-}
-
-int secp256k1_keypair_pub(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const secp256k1_keypair *keypair) {
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(pubkey != NULL);
-    memset(pubkey, 0, sizeof(*pubkey));
-    ARG_CHECK(keypair != NULL);
-
-    memcpy(pubkey->data, &keypair->data[32], sizeof(*pubkey));
-    return 1;
-}
-
-int secp256k1_keypair_xonly_pub(const secp256k1_context* ctx, secp256k1_xonly_pubkey *pubkey, int *pk_parity, const secp256k1_keypair *keypair) {
-    secp256k1_ge pk;
-    int tmp;
-
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(pubkey != NULL);
-    memset(pubkey, 0, sizeof(*pubkey));
-    ARG_CHECK(keypair != NULL);
-
-    if (!secp256k1_keypair_load(ctx, NULL, &pk, keypair)) {
-        return 0;
-    }
-    tmp = secp256k1_extrakeys_ge_even_y(&pk);
-    if (pk_parity != NULL) {
-        *pk_parity = tmp;
-    }
-    secp256k1_xonly_pubkey_save(pubkey, &pk);
-
-    return 1;
-}
-
-int secp256k1_keypair_xonly_tweak_add(const secp256k1_context* ctx, secp256k1_keypair *keypair, const unsigned char *tweak32) {
-    secp256k1_ge pk;
-    secp256k1_scalar sk;
-    int y_parity;
-    int ret;
-
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
-    ARG_CHECK(keypair != NULL);
-    ARG_CHECK(tweak32 != NULL);
-
-    ret = secp256k1_keypair_load(ctx, &sk, &pk, keypair);
-    memset(keypair, 0, sizeof(*keypair));
-
-    y_parity = secp256k1_extrakeys_ge_even_y(&pk);
-    if (y_parity == 1) {
-        secp256k1_scalar_negate(&sk, &sk);
-    }
-
-    ret &= secp256k1_ec_seckey_tweak_add_helper(&sk, tweak32);
-    ret &= secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &pk, tweak32);
-
-    secp256k1_declassify(ctx, &ret, sizeof(ret));
-    if (ret) {
-        secp256k1_keypair_save(keypair, &sk, &pk);
-    }
-
-    secp256k1_scalar_clear(&sk);
-    return ret;
-}
-
-#endif
diff --git a/src/modules/schnorrsig/Makefile.am.include b/src/modules/schnorrsig/Makefile.am.include
deleted file mode 100644
index a82bafe..0000000
--- a/src/modules/schnorrsig/Makefile.am.include
+++ /dev/null
@@ -1,8 +0,0 @@
-include_HEADERS += include/secp256k1_schnorrsig.h
-noinst_HEADERS += src/modules/schnorrsig/main_impl.h
-noinst_HEADERS += src/modules/schnorrsig/tests_impl.h
-if USE_BENCHMARK
-noinst_PROGRAMS += bench_schnorrsig
-bench_schnorrsig_SOURCES = src/bench_schnorrsig.c
-bench_schnorrsig_LDADD = libsecp256k1.la $(SECP_LIBS) $(COMMON_LIB)
-endif
diff --git a/src/modules/schnorrsig/main_impl.h b/src/modules/schnorrsig/main_impl.h
deleted file mode 100644
index a0218f8..0000000
--- a/src/modules/schnorrsig/main_impl.h
+++ /dev/null
@@ -1,238 +0,0 @@
-/**********************************************************************
- * Copyright (c) 2018-2020 Andrew Poelstra, Jonas Nick                *
- * Distributed under the MIT software license, see the accompanying   *
- * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
- **********************************************************************/
-
-#ifndef _SECP256K1_MODULE_SCHNORRSIG_MAIN_
-#define _SECP256K1_MODULE_SCHNORRSIG_MAIN_
-
-#include "include/secp256k1.h"
-#include "include/secp256k1_schnorrsig.h"
-#include "hash.h"
-
-/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
- * SHA256 to SHA256("BIP0340/nonce")||SHA256("BIP0340/nonce"). */
-static void secp256k1_nonce_function_bip340_sha256_tagged(secp256k1_sha256 *sha) {
-    secp256k1_sha256_initialize(sha);
-    sha->s[0] = 0x46615b35ul;
-    sha->s[1] = 0xf4bfbff7ul;
-    sha->s[2] = 0x9f8dc671ul;
-    sha->s[3] = 0x83627ab3ul;
-    sha->s[4] = 0x60217180ul;
-    sha->s[5] = 0x57358661ul;
-    sha->s[6] = 0x21a29e54ul;
-    sha->s[7] = 0x68b07b4cul;
-
-    sha->bytes = 64;
-}
-
-/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
- * SHA256 to SHA256("BIP0340/aux")||SHA256("BIP0340/aux"). */
-static void secp256k1_nonce_function_bip340_sha256_tagged_aux(secp256k1_sha256 *sha) {
-    secp256k1_sha256_initialize(sha);
-    sha->s[0] = 0x24dd3219ul;
-    sha->s[1] = 0x4eba7e70ul;
-    sha->s[2] = 0xca0fabb9ul;
-    sha->s[3] = 0x0fa3166dul;
-    sha->s[4] = 0x3afbe4b1ul;
-    sha->s[5] = 0x4c44df97ul;
-    sha->s[6] = 0x4aac2739ul;
-    sha->s[7] = 0x249e850aul;
-
-    sha->bytes = 64;
-}
-
-/* algo16 argument for nonce_function_bip340 to derive the nonce exactly as stated in BIP-340
- * by using the correct tagged hash function. */
-static const unsigned char bip340_algo16[16] = "BIP0340/nonce\0\0\0";
-
-static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo16, void *data) {
-    secp256k1_sha256 sha;
-    unsigned char masked_key[32];
-    int i;
-
-    if (algo16 == NULL) {
-        return 0;
-    }
-
-    if (data != NULL) {
-        secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha);
-        secp256k1_sha256_write(&sha, data, 32);
-        secp256k1_sha256_finalize(&sha, masked_key);
-        for (i = 0; i < 32; i++) {
-            masked_key[i] ^= key32[i];
-        }
-    }
-
-    /* Tag the hash with algo16 which is important to avoid nonce reuse across
-     * algorithms. If this nonce function is used in BIP-340 signing as defined
-     * in the spec, an optimized tagging implementation is used. */
-    if (memcmp(algo16, bip340_algo16, 16) == 0) {
-        secp256k1_nonce_function_bip340_sha256_tagged(&sha);
-    } else {
-        int algo16_len = 16;
-        /* Remove terminating null bytes */
-        while (algo16_len > 0 && !algo16[algo16_len - 1]) {
-            algo16_len--;
-        }
-        secp256k1_sha256_initialize_tagged(&sha, algo16, algo16_len);
-    }
-
-    /* Hash (masked-)key||pk||msg using the tagged hash as per the spec */
-    if (data != NULL) {
-        secp256k1_sha256_write(&sha, masked_key, 32);
-    } else {
-        secp256k1_sha256_write(&sha, key32, 32);
-    }
-    secp256k1_sha256_write(&sha, xonly_pk32, 32);
-    secp256k1_sha256_write(&sha, msg32, 32);
-    secp256k1_sha256_finalize(&sha, nonce32);
-    return 1;
-}
-
-const secp256k1_nonce_function_hardened secp256k1_nonce_function_bip340 = nonce_function_bip340;
-
-/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
- * SHA256 to SHA256("BIP0340/challenge")||SHA256("BIP0340/challenge"). */
-static void secp256k1_schnorrsig_sha256_tagged(secp256k1_sha256 *sha) {
-    secp256k1_sha256_initialize(sha);
-    sha->s[0] = 0x9cecba11ul;
-    sha->s[1] = 0x23925381ul;
-    sha->s[2] = 0x11679112ul;
-    sha->s[3] = 0xd1627e0ful;
-    sha->s[4] = 0x97c87550ul;
-    sha->s[5] = 0x003cc765ul;
-    sha->s[6] = 0x90f61164ul;
-    sha->s[7] = 0x33e9b66aul;
-    sha->bytes = 64;
-}
-
-int secp256k1_schnorrsig_sign(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_nonce_function_hardened noncefp, void *ndata) {
-    secp256k1_scalar sk;
-    secp256k1_scalar e;
-    secp256k1_scalar k;
-    secp256k1_gej rj;
-    secp256k1_ge pk;
-    secp256k1_ge r;
-    secp256k1_sha256 sha;
-    unsigned char buf[32] = { 0 };
-    unsigned char pk_buf[32];
-    unsigned char seckey[32];
-    int ret = 1;
-
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
-    ARG_CHECK(sig64 != NULL);
-    ARG_CHECK(msg32 != NULL);
-    ARG_CHECK(keypair != NULL);
-
-    if (noncefp == NULL) {
-        noncefp = secp256k1_nonce_function_bip340;
-    }
-
-    ret &= secp256k1_keypair_load(ctx, &sk, &pk, keypair);
-    /* Because we are signing for a x-only pubkey, the secret key is negated
-     * before signing if the point corresponding to the secret key does not
-     * have an even Y. */
-    if (secp256k1_fe_is_odd(&pk.y)) {
-        secp256k1_scalar_negate(&sk, &sk);
-    }
-
-    secp256k1_scalar_get_b32(seckey, &sk);
-    secp256k1_fe_get_b32(pk_buf, &pk.x);
-    ret &= !!noncefp(buf, msg32, seckey, pk_buf, bip340_algo16, ndata);
-    secp256k1_scalar_set_b32(&k, buf, NULL);
-    ret &= !secp256k1_scalar_is_zero(&k);
-    secp256k1_scalar_cmov(&k, &secp256k1_scalar_one, !ret);
-
-    secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &k);
-    secp256k1_ge_set_gej(&r, &rj);
-
-    /* We declassify r to allow using it as a branch point. This is fine
-     * because r is not a secret. */
-    secp256k1_declassify(ctx, &r, sizeof(r));
-    secp256k1_fe_normalize_var(&r.y);
-    if (secp256k1_fe_is_odd(&r.y)) {
-        secp256k1_scalar_negate(&k, &k);
-    }
-    secp256k1_fe_normalize_var(&r.x);
-    secp256k1_fe_get_b32(&sig64[0], &r.x);
-
-    /* tagged hash(r.x, pk.x, msg32) */
-    secp256k1_schnorrsig_sha256_tagged(&sha);
-    secp256k1_sha256_write(&sha, &sig64[0], 32);
-    secp256k1_sha256_write(&sha, pk_buf, sizeof(pk_buf));
-    secp256k1_sha256_write(&sha, msg32, 32);
-    secp256k1_sha256_finalize(&sha, buf);
-
-    /* Set scalar e to the challenge hash modulo the curve order as per
-     * BIP340. */
-    secp256k1_scalar_set_b32(&e, buf, NULL);
-    secp256k1_scalar_mul(&e, &e, &sk);
-    secp256k1_scalar_add(&e, &e, &k);
-    secp256k1_scalar_get_b32(&sig64[32], &e);
-
-    memczero(sig64, 64, !ret);
-    secp256k1_scalar_clear(&k);
-    secp256k1_scalar_clear(&sk);
-    memset(seckey, 0, sizeof(seckey));
-
-    return ret;
-}
-
-int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const unsigned char *sig64, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey) {
-    secp256k1_scalar s;
-    secp256k1_scalar e;
-    secp256k1_gej rj;
-    secp256k1_ge pk;
-    secp256k1_gej pkj;
-    secp256k1_fe rx;
-    secp256k1_ge r;
-    secp256k1_sha256 sha;
-    unsigned char buf[32];
-    int overflow;
-
-    VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
-    ARG_CHECK(sig64 != NULL);
-    ARG_CHECK(msg32 != NULL);
-    ARG_CHECK(pubkey != NULL);
-
-    if (!secp256k1_fe_set_b32(&rx, &sig64[0])) {
-        return 0;
-    }
-
-    secp256k1_scalar_set_b32(&s, &sig64[32], &overflow);
-    if (overflow) {
-        return 0;
-    }
-
-    if (!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) {
-        return 0;
-    }
-
-    secp256k1_schnorrsig_sha256_tagged(&sha);
-    secp256k1_sha256_write(&sha, &sig64[0], 32);
-    secp256k1_fe_get_b32(buf, &pk.x);
-    secp256k1_sha256_write(&sha, buf, sizeof(buf));
-    secp256k1_sha256_write(&sha, msg32, 32);
-    secp256k1_sha256_finalize(&sha, buf);
-    secp256k1_scalar_set_b32(&e, buf, NULL);
-
-    /* Compute rj =  s*G + (-e)*pkj */
-    secp256k1_scalar_negate(&e, &e);
-    secp256k1_gej_set_ge(&pkj, &pk);
-    secp256k1_ecmult(&ctx->ecmult_ctx, &rj, &pkj, &e, &s);
-
-    secp256k1_ge_set_gej_var(&r, &rj);
-    if (secp256k1_ge_is_infinity(&r)) {
-        return 0;
-    }
-
-    secp256k1_fe_normalize_var(&r.y);
-    return !secp256k1_fe_is_odd(&r.y) &&
-           secp256k1_fe_equal_var(&rx, &r.x);
-}
-
-#endif
diff --git a/src/scratch_impl.h b/src/scratch_impl.h
index b205620..4cee700 100644
--- a/src/scratch_impl.h
+++ b/src/scratch_impl.h
@@ -11,7 +11,7 @@
 #include "scratch.h"
 
 static secp256k1_scratch* secp256k1_scratch_create(const secp256k1_callback* error_callback, size_t size) {
-    const size_t base_alloc = ROUND_TO_ALIGN(sizeof(secp256k1_scratch));
+    const size_t base_alloc = ((sizeof(secp256k1_scratch) + ALIGNMENT - 1) / ALIGNMENT) * ALIGNMENT;
     void *alloc = checked_malloc(error_callback, base_alloc + size);
     secp256k1_scratch* ret = (secp256k1_scratch *)alloc;
     if (ret != NULL) {
@@ -60,10 +60,6 @@ static size_t secp256k1_scratch_max_allocation(const secp256k1_callback* error_c
         secp256k1_callback_call(error_callback, "invalid scratch space");
         return 0;
     }
-    /* Ensure that multiplication will not wrap around */
-    if (ALIGNMENT > 1 && objects > SIZE_MAX/(ALIGNMENT - 1)) {
-        return 0;
-    }
     if (scratch->max_size - scratch->alloc_size <= objects * (ALIGNMENT - 1)) {
         return 0;
     }
@@ -72,14 +68,7 @@ static size_t secp256k1_scratch_max_allocation(const secp256k1_callback* error_c
 
 static void *secp256k1_scratch_alloc(const secp256k1_callback* error_callback, secp256k1_scratch* scratch, size_t size) {
     void *ret;
-    size_t rounded_size;
-
-    rounded_size = ROUND_TO_ALIGN(size);
-    /* Check that rounding did not wrap around */
-    if (rounded_size < size) {
-        return NULL;
-    }
-    size = rounded_size;
+    size = ROUND_TO_ALIGN(size);
 
     if (memcmp(scratch->magic, "scratch", 8) != 0) {
         secp256k1_callback_call(error_callback, "invalid scratch space");
diff --git a/src/secp256k1.c b/src/secp256k1.c
index eaafb3a..3e79265 100644
--- a/src/secp256k1.c
+++ b/src/secp256k1.c
@@ -7,7 +7,6 @@
 #include "include/secp256k1.h"
 #include "include/secp256k1_preallocated.h"
 
-#include "assumptions.h"
 #include "util.h"
 #include "num_impl.h"
 #include "field_impl.h"
@@ -20,7 +19,6 @@
 #include "eckey_impl.h"
 #include "hash_impl.h"
 #include "scratch_impl.h"
-#include "selftest.h"
 
 #if defined(VALGRIND)
 # include <valgrind/memcheck.h>
@@ -119,9 +117,6 @@ secp256k1_context* secp256k1_context_preallocated_create(void* prealloc, unsigne
     size_t prealloc_size;
     secp256k1_context* ret;
 
-    if (!secp256k1_selftest()) {
-        secp256k1_callback_call(&default_error_callback, "self test failed");
-    }
     VERIFY_CHECK(prealloc != NULL);
     prealloc_size = secp256k1_context_preallocated_size(flags);
     ret = (secp256k1_context*)manual_alloc(&prealloc, sizeof(secp256k1_context), base, prealloc_size);
@@ -231,7 +226,7 @@ void secp256k1_scratch_space_destroy(const secp256k1_context *ctx, secp256k1_scr
  *  of the software. This is setup for use with valgrind but could be substituted with
  *  the appropriate instrumentation for other analysis tools.
  */
-static SECP256K1_INLINE void secp256k1_declassify(const secp256k1_context* ctx, const void *p, size_t len) {
+static SECP256K1_INLINE void secp256k1_declassify(const secp256k1_context* ctx, void *p, size_t len) {
 #if defined(VALGRIND)
     if (EXPECT(ctx->declassify,0)) VALGRIND_MAKE_MEM_DEFINED(p, len);
 #else
@@ -553,21 +548,10 @@ int secp256k1_ec_seckey_verify(const secp256k1_context* ctx, const unsigned char
     return ret;
 }
 
-static int secp256k1_ec_pubkey_create_helper(const secp256k1_ecmult_gen_context *ecmult_gen_ctx, secp256k1_scalar *seckey_scalar, secp256k1_ge *p, const unsigned char *seckey) {
-    secp256k1_gej pj;
-    int ret;
-
-    ret = secp256k1_scalar_set_b32_seckey(seckey_scalar, seckey);
-    secp256k1_scalar_cmov(seckey_scalar, &secp256k1_scalar_one, !ret);
-
-    secp256k1_ecmult_gen(ecmult_gen_ctx, &pj, seckey_scalar);
-    secp256k1_ge_set_gej(p, &pj);
-    return ret;
-}
-
 int secp256k1_ec_pubkey_create(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) {
+    secp256k1_gej pj;
     secp256k1_ge p;
-    secp256k1_scalar seckey_scalar;
+    secp256k1_scalar sec;
     int ret = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(pubkey != NULL);
@@ -575,11 +559,15 @@ int secp256k1_ec_pubkey_create(const secp256k1_context* ctx, secp256k1_pubkey *p
     ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
     ARG_CHECK(seckey != NULL);
 
-    ret = secp256k1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &seckey_scalar, &p, seckey);
+    ret = secp256k1_scalar_set_b32_seckey(&sec, seckey);
+    secp256k1_scalar_cmov(&sec, &secp256k1_scalar_one, !ret);
+
+    secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pj, &sec);
+    secp256k1_ge_set_gej(&p, &pj);
     secp256k1_pubkey_save(pubkey, &p);
     memczero(pubkey, sizeof(*pubkey), !ret);
 
-    secp256k1_scalar_clear(&seckey_scalar);
+    secp256k1_scalar_clear(&sec);
     return ret;
 }
 
@@ -617,31 +605,24 @@ int secp256k1_ec_pubkey_negate(const secp256k1_context* ctx, secp256k1_pubkey *p
     return ret;
 }
 
-
-static int secp256k1_ec_seckey_tweak_add_helper(secp256k1_scalar *sec, const unsigned char *tweak) {
-    secp256k1_scalar term;
-    int overflow = 0;
-    int ret = 0;
-
-    secp256k1_scalar_set_b32(&term, tweak, &overflow);
-    ret = (!overflow) & secp256k1_eckey_privkey_tweak_add(sec, &term);
-    secp256k1_scalar_clear(&term);
-    return ret;
-}
-
 int secp256k1_ec_seckey_tweak_add(const secp256k1_context* ctx, unsigned char *seckey, const unsigned char *tweak) {
+    secp256k1_scalar term;
     secp256k1_scalar sec;
     int ret = 0;
+    int overflow = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(seckey != NULL);
     ARG_CHECK(tweak != NULL);
 
+    secp256k1_scalar_set_b32(&term, tweak, &overflow);
     ret = secp256k1_scalar_set_b32_seckey(&sec, seckey);
-    ret &= secp256k1_ec_seckey_tweak_add_helper(&sec, tweak);
+
+    ret &= (!overflow) & secp256k1_eckey_privkey_tweak_add(&sec, &term);
     secp256k1_scalar_cmov(&sec, &secp256k1_scalar_zero, !ret);
     secp256k1_scalar_get_b32(seckey, &sec);
 
     secp256k1_scalar_clear(&sec);
+    secp256k1_scalar_clear(&term);
     return ret;
 }
 
@@ -649,26 +630,25 @@ int secp256k1_ec_privkey_tweak_add(const secp256k1_context* ctx, unsigned char *
     return secp256k1_ec_seckey_tweak_add(ctx, seckey, tweak);
 }
 
-static int secp256k1_ec_pubkey_tweak_add_helper(const secp256k1_ecmult_context* ecmult_ctx, secp256k1_ge *p, const unsigned char *tweak) {
-    secp256k1_scalar term;
-    int overflow = 0;
-    secp256k1_scalar_set_b32(&term, tweak, &overflow);
-    return !overflow && secp256k1_eckey_pubkey_tweak_add(ecmult_ctx, p, &term);
-}
-
 int secp256k1_ec_pubkey_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *tweak) {
     secp256k1_ge p;
+    secp256k1_scalar term;
     int ret = 0;
+    int overflow = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
     ARG_CHECK(pubkey != NULL);
     ARG_CHECK(tweak != NULL);
 
-    ret = secp256k1_pubkey_load(ctx, &p, pubkey);
+    secp256k1_scalar_set_b32(&term, tweak, &overflow);
+    ret = !overflow && secp256k1_pubkey_load(ctx, &p, pubkey);
     memset(pubkey, 0, sizeof(*pubkey));
-    ret = ret && secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &p, tweak);
     if (ret) {
-        secp256k1_pubkey_save(pubkey, &p);
+        if (secp256k1_eckey_pubkey_tweak_add(&ctx->ecmult_ctx, &p, &term)) {
+            secp256k1_pubkey_save(pubkey, &p);
+        } else {
+            ret = 0;
+        }
     }
 
     return ret;
@@ -761,11 +741,3 @@ int secp256k1_ec_pubkey_combine(const secp256k1_context* ctx, secp256k1_pubkey *
 #ifdef ENABLE_MODULE_RECOVERY
 # include "modules/recovery/main_impl.h"
 #endif
-
-#ifdef ENABLE_MODULE_EXTRAKEYS
-# include "modules/extrakeys/main_impl.h"
-#endif
-
-#ifdef ENABLE_MODULE_SCHNORRSIG
-# include "modules/schnorrsig/main_impl.h"
-#endif
diff --git a/src/util.h b/src/util.h
index a5cbe03..c14bf0e 100644
--- a/src/util.h
+++ b/src/util.h
@@ -176,31 +176,6 @@ static SECP256K1_INLINE void *manual_alloc(void** prealloc_ptr, size_t alloc_siz
 # define SECP256K1_GNUC_EXT
 #endif
 
-/* If SECP256K1_{LITTLE,BIG}_ENDIAN is not explicitly provided, infer from various other system macros. */
-#if !defined(SECP256K1_LITTLE_ENDIAN) && !defined(SECP256K1_BIG_ENDIAN)
-/* Inspired by https://github.com/rofl0r/endianness.h/blob/9853923246b065a3b52d2c43835f3819a62c7199/endianness.h#L52L73 */
-# if (defined(__BYTE_ORDER__) && defined(__ORDER_LITTLE_ENDIAN__) && __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__) || \
-     defined(_X86_) || defined(__x86_64__) || defined(__i386__) || \
-     defined(__i486__) || defined(__i586__) || defined(__i686__) || \
-     defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL) || \
-     defined(__ARMEL__) || defined(__AARCH64EL__) || \
-     (defined(__LITTLE_ENDIAN__) && __LITTLE_ENDIAN__ == 1) || \
-     (defined(_LITTLE_ENDIAN) && _LITTLE_ENDIAN == 1) || \
-     defined(_M_IX86) || defined(_M_AMD64) || defined(_M_ARM) /* MSVC */
-#  define SECP256K1_LITTLE_ENDIAN
-# endif
-# if (defined(__BYTE_ORDER__) && defined(__ORDER_BIG_ENDIAN__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__) || \
-     defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB) || \
-     defined(__MICROBLAZEEB__) || defined(__ARMEB__) || defined(__AARCH64EB__) || \
-     (defined(__BIG_ENDIAN__) && __BIG_ENDIAN__ == 1) || \
-     (defined(_BIG_ENDIAN) && _BIG_ENDIAN == 1)
-#  define SECP256K1_BIG_ENDIAN
-# endif
-#endif
-#if defined(SECP256K1_LITTLE_ENDIAN) == defined(SECP256K1_BIG_ENDIAN)
-# error Please make sure that either SECP256K1_LITTLE_ENDIAN or SECP256K1_BIG_ENDIAN is set, see src/util.h.
-#endif
-
 /* Zero memory if flag == 1. Flag must be 0 or 1. Constant time. */
 static SECP256K1_INLINE void memczero(void *s, size_t len, int flag) {
     unsigned char *p = (unsigned char *)s;
@@ -249,7 +224,6 @@ static SECP256K1_INLINE void secp256k1_int_cmov(int *r, const int *a, int flag)
 #endif
 #if defined(SECP256K1_WIDEMUL_INT128)
 SECP256K1_GNUC_EXT typedef unsigned __int128 uint128_t;
-SECP256K1_GNUC_EXT typedef __int128 int128_t;
 #endif
 
 #endif /* SECP256K1_UTIL_H */


Test patch:
diff --git a/src/modules/extrakeys/tests_impl.h b/src/modules/extrakeys/tests_impl.h
deleted file mode 100644
index fc9d40e..0000000
--- a/src/modules/extrakeys/tests_impl.h
+++ /dev/null
@@ -1,524 +0,0 @@
-/**********************************************************************
- * Copyright (c) 2020 Jonas Nick                                      *
- * Distributed under the MIT software license, see the accompanying   *
- * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
- **********************************************************************/
-
-#ifndef _SECP256K1_MODULE_EXTRAKEYS_TESTS_
-#define _SECP256K1_MODULE_EXTRAKEYS_TESTS_
-
-#include "secp256k1_extrakeys.h"
-
-static secp256k1_context* api_test_context(int flags, int *ecount) {
-    secp256k1_context *ctx0 = secp256k1_context_create(flags);
-    secp256k1_context_set_error_callback(ctx0, counting_illegal_callback_fn, ecount);
-    secp256k1_context_set_illegal_callback(ctx0, counting_illegal_callback_fn, ecount);
-    return ctx0;
-}
-
-void test_xonly_pubkey(void) {
-    secp256k1_pubkey pk;
-    secp256k1_xonly_pubkey xonly_pk, xonly_pk_tmp;
-    secp256k1_ge pk1;
-    secp256k1_ge pk2;
-    secp256k1_fe y;
-    unsigned char sk[32];
-    unsigned char xy_sk[32];
-    unsigned char buf32[32];
-    unsigned char ones32[32];
-    unsigned char zeros64[64] = { 0 };
-    int pk_parity;
-    int i;
-
-    int ecount;
-    secp256k1_context *none = api_test_context(SECP256K1_CONTEXT_NONE, &ecount);
-    secp256k1_context *sign = api_test_context(SECP256K1_CONTEXT_SIGN, &ecount);
-    secp256k1_context *verify = api_test_context(SECP256K1_CONTEXT_VERIFY, &ecount);
-
-    secp256k1_rand256(sk);
-    memset(ones32, 0xFF, 32);
-    secp256k1_rand256(xy_sk);
-    CHECK(secp256k1_ec_pubkey_create(sign, &pk, sk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, &xonly_pk, &pk_parity, &pk) == 1);
-
-    /* Test xonly_pubkey_from_pubkey */
-    ecount = 0;
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(sign, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(verify, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, NULL, &pk_parity, &pk) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, &xonly_pk, NULL, &pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, &xonly_pk, &pk_parity, NULL) == 0);
-    CHECK(ecount == 2);
-    memset(&pk, 0, sizeof(pk));
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, &xonly_pk, &pk_parity, &pk) == 0);
-    CHECK(ecount == 3);
-
-    /* Choose a secret key such that the resulting pubkey and xonly_pubkey match. */
-    memset(sk, 0, sizeof(sk));
-    sk[0] = 1;
-    CHECK(secp256k1_ec_pubkey_create(ctx, &pk, sk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(memcmp(&pk, &xonly_pk, sizeof(pk)) == 0);
-    CHECK(pk_parity == 0);
-
-    /* Choose a secret key such that pubkey and xonly_pubkey are each others
-     * negation. */
-    sk[0] = 2;
-    CHECK(secp256k1_ec_pubkey_create(ctx, &pk, sk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(memcmp(&xonly_pk, &pk, sizeof(xonly_pk)) != 0);
-    CHECK(pk_parity == 1);
-    secp256k1_pubkey_load(ctx, &pk1, &pk);
-    secp256k1_pubkey_load(ctx, &pk2, (secp256k1_pubkey *) &xonly_pk);
-    CHECK(secp256k1_fe_equal(&pk1.x, &pk2.x) == 1);
-    secp256k1_fe_negate(&y, &pk2.y, 1);
-    CHECK(secp256k1_fe_equal(&pk1.y, &y) == 1);
-
-    /* Test xonly_pubkey_serialize and xonly_pubkey_parse */
-    ecount = 0;
-    CHECK(secp256k1_xonly_pubkey_serialize(none, NULL, &xonly_pk) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_xonly_pubkey_serialize(none, buf32, NULL) == 0);
-    CHECK(memcmp(buf32, zeros64, 32) == 0);
-    CHECK(ecount == 2);
-    {
-        /* A pubkey filled with 0s will fail to serialize due to pubkey_load
-         * special casing. */
-        secp256k1_xonly_pubkey pk_tmp;
-        memset(&pk_tmp, 0, sizeof(pk_tmp));
-        CHECK(secp256k1_xonly_pubkey_serialize(none, buf32, &pk_tmp) == 0);
-    }
-    /* pubkey_load called illegal callback */
-    CHECK(ecount == 3);
-
-    CHECK(secp256k1_xonly_pubkey_serialize(none, buf32, &xonly_pk) == 1);
-    ecount = 0;
-    CHECK(secp256k1_xonly_pubkey_parse(none, NULL, buf32) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_xonly_pubkey_parse(none, &xonly_pk, NULL) == 0);
-    CHECK(ecount == 2);
-
-    /* Serialization and parse roundtrip */
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, &xonly_pk, NULL, &pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_serialize(ctx, buf32, &xonly_pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_parse(ctx, &xonly_pk_tmp, buf32) == 1);
-    CHECK(memcmp(&xonly_pk, &xonly_pk_tmp, sizeof(xonly_pk)) == 0);
-
-    /* Test parsing invalid field elements */
-    memset(&xonly_pk, 1, sizeof(xonly_pk));
-    /* Overflowing field element */
-    CHECK(secp256k1_xonly_pubkey_parse(none, &xonly_pk, ones32) == 0);
-    CHECK(memcmp(&xonly_pk, zeros64, sizeof(xonly_pk)) == 0);
-    memset(&xonly_pk, 1, sizeof(xonly_pk));
-    /* There's no point with x-coordinate 0 on secp256k1 */
-    CHECK(secp256k1_xonly_pubkey_parse(none, &xonly_pk, zeros64) == 0);
-    CHECK(memcmp(&xonly_pk, zeros64, sizeof(xonly_pk)) == 0);
-    /* If a random 32-byte string can not be parsed with ec_pubkey_parse
-     * (because interpreted as X coordinate it does not correspond to a point on
-     * the curve) then xonly_pubkey_parse should fail as well. */
-    for (i = 0; i < count; i++) {
-        unsigned char rand33[33];
-        secp256k1_rand256(&rand33[1]);
-        rand33[0] = SECP256K1_TAG_PUBKEY_EVEN;
-        if (!secp256k1_ec_pubkey_parse(ctx, &pk, rand33, 33)) {
-            memset(&xonly_pk, 1, sizeof(xonly_pk));
-            CHECK(secp256k1_xonly_pubkey_parse(ctx, &xonly_pk, &rand33[1]) == 0);
-            CHECK(memcmp(&xonly_pk, zeros64, sizeof(xonly_pk)) == 0);
-        } else {
-            CHECK(secp256k1_xonly_pubkey_parse(ctx, &xonly_pk, &rand33[1]) == 1);
-        }
-    }
-    CHECK(ecount == 2);
-
-    secp256k1_context_destroy(none);
-    secp256k1_context_destroy(sign);
-    secp256k1_context_destroy(verify);
-}
-
-void test_xonly_pubkey_tweak(void) {
-    unsigned char zeros64[64] = { 0 };
-    unsigned char overflows[32];
-    unsigned char sk[32];
-    secp256k1_pubkey internal_pk;
-    secp256k1_xonly_pubkey internal_xonly_pk;
-    secp256k1_pubkey output_pk;
-    int pk_parity;
-    unsigned char tweak[32];
-    int i;
-
-    int ecount;
-    secp256k1_context *none = api_test_context(SECP256K1_CONTEXT_NONE, &ecount);
-    secp256k1_context *sign = api_test_context(SECP256K1_CONTEXT_SIGN, &ecount);
-    secp256k1_context *verify = api_test_context(SECP256K1_CONTEXT_VERIFY, &ecount);
-
-    memset(overflows, 0xff, sizeof(overflows));
-    secp256k1_rand256(tweak);
-    secp256k1_rand256(sk);
-    CHECK(secp256k1_ec_pubkey_create(ctx, &internal_pk, sk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
-
-    ecount = 0;
-    CHECK(secp256k1_xonly_pubkey_tweak_add(none, &output_pk, &internal_xonly_pk, tweak) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add(sign, &output_pk, &internal_xonly_pk, tweak) == 0);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_xonly_pubkey_tweak_add(verify, &output_pk, &internal_xonly_pk, tweak) == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add(verify, NULL, &internal_xonly_pk, tweak) == 0);
-    CHECK(ecount == 3);
-    CHECK(secp256k1_xonly_pubkey_tweak_add(verify, &output_pk, NULL, tweak) == 0);
-    CHECK(ecount == 4);
-    /* NULL internal_xonly_pk zeroes the output_pk */
-    CHECK(memcmp(&output_pk, zeros64, sizeof(output_pk)) == 0);
-    CHECK(secp256k1_xonly_pubkey_tweak_add(verify, &output_pk, &internal_xonly_pk, NULL) == 0);
-    CHECK(ecount == 5);
-    /* NULL tweak zeroes the output_pk */
-    CHECK(memcmp(&output_pk, zeros64, sizeof(output_pk)) == 0);
-
-    /* Invalid tweak zeroes the output_pk */
-    CHECK(secp256k1_xonly_pubkey_tweak_add(verify, &output_pk, &internal_xonly_pk, overflows) == 0);
-    CHECK(memcmp(&output_pk, zeros64, sizeof(output_pk))  == 0);
-
-    /* A zero tweak is fine */
-    CHECK(secp256k1_xonly_pubkey_tweak_add(verify, &output_pk, &internal_xonly_pk, zeros64) == 1);
-
-    /* Fails if the resulting key was infinity */
-    for (i = 0; i < count; i++) {
-        secp256k1_scalar scalar_tweak;
-        /* Because sk may be negated before adding, we need to try with tweak =
-         * sk as well as tweak = -sk. */
-        secp256k1_scalar_set_b32(&scalar_tweak, sk, NULL);
-        secp256k1_scalar_negate(&scalar_tweak, &scalar_tweak);
-        secp256k1_scalar_get_b32(tweak, &scalar_tweak);
-        CHECK((secp256k1_xonly_pubkey_tweak_add(verify, &output_pk, &internal_xonly_pk, sk) == 0)
-              || (secp256k1_xonly_pubkey_tweak_add(verify, &output_pk, &internal_xonly_pk, tweak) == 0));
-        CHECK(memcmp(&output_pk, zeros64, sizeof(output_pk)) == 0);
-    }
-
-    /* Invalid pk with a valid tweak */
-    memset(&internal_xonly_pk, 0, sizeof(internal_xonly_pk));
-    secp256k1_rand256(tweak);
-    ecount = 0;
-    CHECK(secp256k1_xonly_pubkey_tweak_add(verify, &output_pk, &internal_xonly_pk, tweak) == 0);
-    CHECK(ecount == 1);
-    CHECK(memcmp(&output_pk, zeros64, sizeof(output_pk))  == 0);
-
-    secp256k1_context_destroy(none);
-    secp256k1_context_destroy(sign);
-    secp256k1_context_destroy(verify);
-}
-
-void test_xonly_pubkey_tweak_check(void) {
-    unsigned char zeros64[64] = { 0 };
-    unsigned char overflows[32];
-    unsigned char sk[32];
-    secp256k1_pubkey internal_pk;
-    secp256k1_xonly_pubkey internal_xonly_pk;
-    secp256k1_pubkey output_pk;
-    secp256k1_xonly_pubkey output_xonly_pk;
-    unsigned char output_pk32[32];
-    unsigned char buf32[32];
-    int pk_parity;
-    unsigned char tweak[32];
-
-    int ecount;
-    secp256k1_context *none = api_test_context(SECP256K1_CONTEXT_NONE, &ecount);
-    secp256k1_context *sign = api_test_context(SECP256K1_CONTEXT_SIGN, &ecount);
-    secp256k1_context *verify = api_test_context(SECP256K1_CONTEXT_VERIFY, &ecount);
-
-    memset(overflows, 0xff, sizeof(overflows));
-    secp256k1_rand256(tweak);
-    secp256k1_rand256(sk);
-    CHECK(secp256k1_ec_pubkey_create(ctx, &internal_pk, sk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
-
-    ecount = 0;
-    CHECK(secp256k1_xonly_pubkey_tweak_add(verify, &output_pk, &internal_xonly_pk, tweak) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(verify, &output_xonly_pk, &pk_parity, &output_pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_serialize(ctx, buf32, &output_xonly_pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(none, buf32, pk_parity, &internal_xonly_pk, tweak) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(sign, buf32, pk_parity, &internal_xonly_pk, tweak) == 0);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(verify, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(verify, NULL, pk_parity, &internal_xonly_pk, tweak) == 0);
-    CHECK(ecount == 3);
-    /* invalid pk_parity value */
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(verify, buf32, 2, &internal_xonly_pk, tweak) == 0);
-    CHECK(ecount == 3);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(verify, buf32, pk_parity, NULL, tweak) == 0);
-    CHECK(ecount == 4);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(verify, buf32, pk_parity, &internal_xonly_pk, NULL) == 0);
-    CHECK(ecount == 5);
-
-    memset(tweak, 1, sizeof(tweak));
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(ctx, &internal_xonly_pk, NULL, &internal_pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, tweak) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(ctx, &output_xonly_pk, &pk_parity, &output_pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_serialize(ctx, output_pk32, &output_xonly_pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(ctx, output_pk32, pk_parity, &internal_xonly_pk, tweak) == 1);
-
-    /* Wrong pk_parity */
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(ctx, output_pk32, !pk_parity, &internal_xonly_pk, tweak) == 0);
-    /* Wrong public key */
-    CHECK(secp256k1_xonly_pubkey_serialize(ctx, buf32, &internal_xonly_pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(ctx, buf32, pk_parity, &internal_xonly_pk, tweak) == 0);
-
-    /* Overflowing tweak not allowed */
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(ctx, output_pk32, pk_parity, &internal_xonly_pk, overflows) == 0);
-    CHECK(secp256k1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, overflows) == 0);
-    CHECK(memcmp(&output_pk, zeros64, sizeof(output_pk)) == 0);
-    CHECK(ecount == 5);
-
-    secp256k1_context_destroy(none);
-    secp256k1_context_destroy(sign);
-    secp256k1_context_destroy(verify);
-}
-
-/* Starts with an initial pubkey and recursively creates N_PUBKEYS - 1
- * additional pubkeys by calling tweak_add. Then verifies every tweak starting
- * from the last pubkey. */
-#define N_PUBKEYS 32
-void test_xonly_pubkey_tweak_recursive(void) {
-    unsigned char sk[32];
-    secp256k1_pubkey pk[N_PUBKEYS];
-    unsigned char pk_serialized[32];
-    unsigned char tweak[N_PUBKEYS - 1][32];
-    int i;
-
-    secp256k1_rand256(sk);
-    CHECK(secp256k1_ec_pubkey_create(ctx, &pk[0], sk) == 1);
-    /* Add tweaks */
-    for (i = 0; i < N_PUBKEYS - 1; i++) {
-        secp256k1_xonly_pubkey xonly_pk;
-        memset(tweak[i], i + 1, sizeof(tweak[i]));
-        CHECK(secp256k1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, NULL, &pk[i]) == 1);
-        CHECK(secp256k1_xonly_pubkey_tweak_add(ctx, &pk[i + 1], &xonly_pk, tweak[i]) == 1);
-    }
-
-    /* Verify tweaks */
-    for (i = N_PUBKEYS - 1; i > 0; i--) {
-        secp256k1_xonly_pubkey xonly_pk;
-        int pk_parity;
-        CHECK(secp256k1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk[i]) == 1);
-        CHECK(secp256k1_xonly_pubkey_serialize(ctx, pk_serialized, &xonly_pk) == 1);
-        CHECK(secp256k1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, NULL, &pk[i - 1]) == 1);
-        CHECK(secp256k1_xonly_pubkey_tweak_add_check(ctx, pk_serialized, pk_parity, &xonly_pk, tweak[i - 1]) == 1);
-    }
-}
-#undef N_PUBKEYS
-
-void test_keypair(void) {
-    unsigned char sk[32];
-    unsigned char zeros96[96] = { 0 };
-    unsigned char overflows[32];
-    secp256k1_keypair keypair;
-    secp256k1_pubkey pk, pk_tmp;
-    secp256k1_xonly_pubkey xonly_pk, xonly_pk_tmp;
-    int pk_parity, pk_parity_tmp;
-    int ecount;
-    secp256k1_context *none = api_test_context(SECP256K1_CONTEXT_NONE, &ecount);
-    secp256k1_context *sign = api_test_context(SECP256K1_CONTEXT_SIGN, &ecount);
-    secp256k1_context *verify = api_test_context(SECP256K1_CONTEXT_VERIFY, &ecount);
-
-    CHECK(sizeof(zeros96) == sizeof(keypair));
-    memset(overflows, 0xFF, sizeof(overflows));
-
-    /* Test keypair_create */
-    ecount = 0;
-    secp256k1_rand256(sk);
-    CHECK(secp256k1_keypair_create(none, &keypair, sk) == 0);
-    CHECK(memcmp(zeros96, &keypair, sizeof(keypair)) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_keypair_create(verify, &keypair, sk) == 0);
-    CHECK(memcmp(zeros96, &keypair, sizeof(keypair)) == 0);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_keypair_create(sign, &keypair, sk) == 1);
-    CHECK(secp256k1_keypair_create(sign, NULL, sk) == 0);
-    CHECK(ecount == 3);
-    CHECK(secp256k1_keypair_create(sign, &keypair, NULL) == 0);
-    CHECK(memcmp(zeros96, &keypair, sizeof(keypair)) == 0);
-    CHECK(ecount == 4);
-
-    /* Invalid secret key */
-    CHECK(secp256k1_keypair_create(sign, &keypair, zeros96) == 0);
-    CHECK(memcmp(zeros96, &keypair, sizeof(keypair)) == 0);
-    CHECK(secp256k1_keypair_create(sign, &keypair, overflows) == 0);
-    CHECK(memcmp(zeros96, &keypair, sizeof(keypair)) == 0);
-
-    /* Test keypair_pub */
-    ecount = 0;
-    secp256k1_rand256(sk);
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(secp256k1_keypair_pub(none, &pk, &keypair) == 1);
-    CHECK(secp256k1_keypair_pub(none, NULL, &keypair) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_keypair_pub(none, &pk, NULL) == 0);
-    CHECK(ecount == 2);
-    CHECK(memcmp(zeros96, &pk, sizeof(pk)) == 0);
-
-    /* Using an invalid keypair is fine for keypair_pub */
-    memset(&keypair, 0, sizeof(keypair));
-    CHECK(secp256k1_keypair_pub(none, &pk, &keypair) == 1);
-    CHECK(memcmp(zeros96, &pk, sizeof(pk)) == 0);
-
-    /* keypair holds the same pubkey as pubkey_create */
-    CHECK(secp256k1_ec_pubkey_create(sign, &pk, sk) == 1);
-    CHECK(secp256k1_keypair_create(sign, &keypair, sk) == 1);
-    CHECK(secp256k1_keypair_pub(none, &pk_tmp, &keypair) == 1);
-    CHECK(memcmp(&pk, &pk_tmp, sizeof(pk)) == 0);
-
-    /** Test keypair_xonly_pub **/
-    ecount = 0;
-    secp256k1_rand256(sk);
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(none, &xonly_pk, &pk_parity, &keypair) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(none, NULL, &pk_parity, &keypair) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_keypair_xonly_pub(none, &xonly_pk, NULL, &keypair) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(none, &xonly_pk, &pk_parity, NULL) == 0);
-    CHECK(ecount == 2);
-    CHECK(memcmp(zeros96, &xonly_pk, sizeof(xonly_pk)) == 0);
-    /* Using an invalid keypair will set the xonly_pk to 0 (first reset
-     * xonly_pk). */
-    CHECK(secp256k1_keypair_xonly_pub(none, &xonly_pk, &pk_parity, &keypair) == 1);
-    memset(&keypair, 0, sizeof(keypair));
-    CHECK(secp256k1_keypair_xonly_pub(none, &xonly_pk, &pk_parity, &keypair) == 0);
-    CHECK(memcmp(zeros96, &xonly_pk, sizeof(xonly_pk)) == 0);
-    CHECK(ecount == 3);
-
-    /** keypair holds the same xonly pubkey as pubkey_create **/
-    CHECK(secp256k1_ec_pubkey_create(sign, &pk, sk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(none, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(secp256k1_keypair_create(sign, &keypair, sk) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(none, &xonly_pk_tmp, &pk_parity_tmp, &keypair) == 1);
-    CHECK(memcmp(&xonly_pk, &xonly_pk_tmp, sizeof(pk)) == 0);
-    CHECK(pk_parity == pk_parity_tmp);
-
-    secp256k1_context_destroy(none);
-    secp256k1_context_destroy(sign);
-    secp256k1_context_destroy(verify);
-}
-
-void test_keypair_add(void) {
-    unsigned char sk[32];
-    secp256k1_keypair keypair;
-    unsigned char overflows[32];
-    unsigned char zeros96[96] = { 0 };
-    unsigned char tweak[32];
-    int i;
-    int ecount = 0;
-    secp256k1_context *none = api_test_context(SECP256K1_CONTEXT_NONE, &ecount);
-    secp256k1_context *sign = api_test_context(SECP256K1_CONTEXT_SIGN, &ecount);
-    secp256k1_context *verify = api_test_context(SECP256K1_CONTEXT_VERIFY, &ecount);
-
-    CHECK(sizeof(zeros96) == sizeof(keypair));
-    secp256k1_rand256(sk);
-    secp256k1_rand256(tweak);
-    memset(overflows, 0xFF, 32);
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-
-    CHECK(secp256k1_keypair_xonly_tweak_add(none, &keypair, tweak) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_keypair_xonly_tweak_add(sign, &keypair, tweak) == 0);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_keypair_xonly_tweak_add(verify, &keypair, tweak) == 1);
-    CHECK(secp256k1_keypair_xonly_tweak_add(verify, NULL, tweak) == 0);
-    CHECK(ecount == 3);
-    CHECK(secp256k1_keypair_xonly_tweak_add(verify, &keypair, NULL) == 0);
-    CHECK(ecount == 4);
-    /* This does not set the keypair to zeroes */
-    CHECK(memcmp(&keypair, zeros96, sizeof(keypair)) != 0);
-
-    /* Invalid tweak zeroes the keypair */
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(secp256k1_keypair_xonly_tweak_add(ctx, &keypair, overflows) == 0);
-    CHECK(memcmp(&keypair, zeros96, sizeof(keypair))  == 0);
-
-    /* A zero tweak is fine */
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(secp256k1_keypair_xonly_tweak_add(ctx, &keypair, zeros96) == 1);
-
-    /* Fails if the resulting keypair was (sk=0, pk=infinity) */
-    for (i = 0; i < count; i++) {
-        secp256k1_scalar scalar_tweak;
-        secp256k1_keypair keypair_tmp;
-        secp256k1_rand256(sk);
-        CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-        memcpy(&keypair_tmp, &keypair, sizeof(keypair));
-        /* Because sk may be negated before adding, we need to try with tweak =
-         * sk as well as tweak = -sk. */
-        secp256k1_scalar_set_b32(&scalar_tweak, sk, NULL);
-        secp256k1_scalar_negate(&scalar_tweak, &scalar_tweak);
-        secp256k1_scalar_get_b32(tweak, &scalar_tweak);
-        CHECK((secp256k1_keypair_xonly_tweak_add(ctx, &keypair, sk) == 0)
-              || (secp256k1_keypair_xonly_tweak_add(ctx, &keypair_tmp, tweak) == 0));
-        CHECK(memcmp(&keypair, zeros96, sizeof(keypair)) == 0
-              || memcmp(&keypair_tmp, zeros96, sizeof(keypair_tmp)) == 0);
-    }
-
-    /* Invalid keypair with a valid tweak */
-    memset(&keypair, 0, sizeof(keypair));
-    secp256k1_rand256(tweak);
-    ecount = 0;
-    CHECK(secp256k1_keypair_xonly_tweak_add(verify, &keypair, tweak) == 0);
-    CHECK(ecount == 1);
-    CHECK(memcmp(&keypair, zeros96, sizeof(keypair))  == 0);
-    /* Only seckey part of keypair invalid */
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-    memset(&keypair, 0, 32);
-    CHECK(secp256k1_keypair_xonly_tweak_add(verify, &keypair, tweak) == 0);
-    CHECK(ecount == 2);
-    /* Only pubkey part of keypair invalid */
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-    memset(&keypair.data[32], 0, 64);
-    CHECK(secp256k1_keypair_xonly_tweak_add(verify, &keypair, tweak) == 0);
-    CHECK(ecount == 3);
-
-    /* Check that the keypair_tweak_add implementation is correct */
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-    for (i = 0; i < count; i++) {
-        secp256k1_xonly_pubkey internal_pk;
-        secp256k1_xonly_pubkey output_pk;
-        secp256k1_pubkey output_pk_xy;
-        secp256k1_pubkey output_pk_expected;
-        unsigned char pk32[32];
-        int pk_parity;
-
-        secp256k1_rand256(tweak);
-        CHECK(secp256k1_keypair_xonly_pub(ctx, &internal_pk, NULL, &keypair) == 1);
-        CHECK(secp256k1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 1);
-        CHECK(secp256k1_keypair_xonly_pub(ctx, &output_pk, &pk_parity, &keypair) == 1);
-
-        /* Check that it passes xonly_pubkey_tweak_add_check */
-        CHECK(secp256k1_xonly_pubkey_serialize(ctx, pk32, &output_pk) == 1);
-        CHECK(secp256k1_xonly_pubkey_tweak_add_check(ctx, pk32, pk_parity, &internal_pk, tweak) == 1);
-
-        /* Check that the resulting pubkey matches xonly_pubkey_tweak_add */
-        CHECK(secp256k1_keypair_pub(ctx, &output_pk_xy, &keypair) == 1);
-        CHECK(secp256k1_xonly_pubkey_tweak_add(ctx, &output_pk_expected, &internal_pk, tweak) == 1);
-        CHECK(memcmp(&output_pk_xy, &output_pk_expected, sizeof(output_pk_xy)) == 0);
-
-        /* Check that the secret key in the keypair is tweaked correctly */
-        CHECK(secp256k1_ec_pubkey_create(ctx, &output_pk_expected, &keypair.data[0]) == 1);
-        CHECK(memcmp(&output_pk_xy, &output_pk_expected, sizeof(output_pk_xy)) == 0);
-    }
-    secp256k1_context_destroy(none);
-    secp256k1_context_destroy(sign);
-    secp256k1_context_destroy(verify);
-}
-
-void run_extrakeys_tests(void) {
-    /* xonly key test cases */
-    test_xonly_pubkey();
-    test_xonly_pubkey_tweak();
-    test_xonly_pubkey_tweak_check();
-    test_xonly_pubkey_tweak_recursive();
-
-    /* keypair tests */
-    test_keypair();
-    test_keypair_add();
-}
-
-#endif
diff --git a/src/modules/schnorrsig/tests_impl.h b/src/modules/schnorrsig/tests_impl.h
deleted file mode 100644
index 88d8f56..0000000
--- a/src/modules/schnorrsig/tests_impl.h
+++ /dev/null
@@ -1,806 +0,0 @@
-/**********************************************************************
- * Copyright (c) 2018-2020 Andrew Poelstra, Jonas Nick                *
- * Distributed under the MIT software license, see the accompanying   *
- * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
- **********************************************************************/
-
-#ifndef _SECP256K1_MODULE_SCHNORRSIG_TESTS_
-#define _SECP256K1_MODULE_SCHNORRSIG_TESTS_
-
-#include "secp256k1_schnorrsig.h"
-
-/* Checks that a bit flip in the n_flip-th argument (that has n_bytes many
- * bytes) changes the hash function
- */
-void nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes) {
-    unsigned char nonces[2][32];
-    CHECK(nonce_function_bip340(nonces[0], args[0], args[1], args[2], args[3], args[4]) == 1);
-    secp256k1_rand_flip(args[n_flip], n_bytes);
-    CHECK(nonce_function_bip340(nonces[1], args[0], args[1], args[2], args[3], args[4]) == 1);
-    CHECK(memcmp(nonces[0], nonces[1], 32) != 0);
-}
-
-/* Tests for the equality of two sha256 structs. This function only produces a
- * correct result if an integer multiple of 64 many bytes have been written
- * into the hash functions. */
-void test_sha256_eq(const secp256k1_sha256 *sha1, const secp256k1_sha256 *sha2) {
-    /* Is buffer fully consumed? */
-    CHECK((sha1->bytes & 0x3F) == 0);
-
-    CHECK(sha1->bytes == sha2->bytes);
-    CHECK(memcmp(sha1->s, sha2->s, sizeof(sha1->s)) == 0);
-}
-
-void run_nonce_function_bip340_tests(void) {
-    unsigned char tag[13] = "BIP0340/nonce";
-    unsigned char aux_tag[11] = "BIP0340/aux";
-    unsigned char algo16[16] = "BIP0340/nonce\0\0\0";
-    secp256k1_sha256 sha;
-    secp256k1_sha256 sha_optimized;
-    unsigned char nonce[32];
-    unsigned char msg[32];
-    unsigned char key[32];
-    unsigned char pk[32];
-    unsigned char aux_rand[32];
-    unsigned char *args[5];
-    int i;
-
-    /* Check that hash initialized by
-     * secp256k1_nonce_function_bip340_sha256_tagged has the expected
-     * state. */
-    secp256k1_sha256_initialize_tagged(&sha, tag, sizeof(tag));
-    secp256k1_nonce_function_bip340_sha256_tagged(&sha_optimized);
-    test_sha256_eq(&sha, &sha_optimized);
-
-   /* Check that hash initialized by
-    * secp256k1_nonce_function_bip340_sha256_tagged_aux has the expected
-    * state. */
-    secp256k1_sha256_initialize_tagged(&sha, aux_tag, sizeof(aux_tag));
-    secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha_optimized);
-    test_sha256_eq(&sha, &sha_optimized);
-
-    secp256k1_rand256(msg);
-    secp256k1_rand256(key);
-    secp256k1_rand256(pk);
-    secp256k1_rand256(aux_rand);
-
-    /* Check that a bitflip in an argument results in different nonces. */
-    args[0] = msg;
-    args[1] = key;
-    args[2] = pk;
-    args[3] = algo16;
-    args[4] = aux_rand;
-    for (i = 0; i < count; i++) {
-        nonce_function_bip340_bitflip(args, 0, 32);
-        nonce_function_bip340_bitflip(args, 1, 32);
-        nonce_function_bip340_bitflip(args, 2, 32);
-        /* Flip algo16 special case "BIP0340/nonce" */
-        nonce_function_bip340_bitflip(args, 3, 16);
-        /* Flip algo16 again */
-        nonce_function_bip340_bitflip(args, 3, 16);
-        nonce_function_bip340_bitflip(args, 4, 32);
-    }
-
-    /* NULL algo16 is disallowed */
-    CHECK(nonce_function_bip340(nonce, msg, key, pk, NULL, NULL) == 0);
-    /* Empty algo16 is fine */
-    memset(algo16, 0x00, 16);
-    CHECK(nonce_function_bip340(nonce, msg, key, pk, algo16, NULL) == 1);
-    /* algo16 with terminating null bytes is fine */
-    algo16[1] = 65;
-    CHECK(nonce_function_bip340(nonce, msg, key, pk, algo16, NULL) == 1);
-    /* Other algo16 is fine */
-    memset(algo16, 0xFF, 16);
-    CHECK(nonce_function_bip340(nonce, msg, key, pk, algo16, NULL) == 1);
-
-    /* NULL aux_rand argument is allowed. */
-    CHECK(nonce_function_bip340(nonce, msg, key, pk, algo16, NULL) == 1);
-}
-
-void test_schnorrsig_api(void) {
-    unsigned char sk1[32];
-    unsigned char sk2[32];
-    unsigned char sk3[32];
-    unsigned char msg[32];
-    secp256k1_keypair keypairs[3];
-    secp256k1_keypair invalid_keypair = { 0 };
-    secp256k1_xonly_pubkey pk[3];
-    secp256k1_xonly_pubkey zero_pk;
-    unsigned char sig[64];
-
-    /** setup **/
-    secp256k1_context *none = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
-    secp256k1_context *sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
-    secp256k1_context *vrfy = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
-    secp256k1_context *both = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
-    int ecount;
-
-    secp256k1_context_set_error_callback(none, counting_illegal_callback_fn, &ecount);
-    secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, &ecount);
-    secp256k1_context_set_error_callback(vrfy, counting_illegal_callback_fn, &ecount);
-    secp256k1_context_set_error_callback(both, counting_illegal_callback_fn, &ecount);
-    secp256k1_context_set_illegal_callback(none, counting_illegal_callback_fn, &ecount);
-    secp256k1_context_set_illegal_callback(sign, counting_illegal_callback_fn, &ecount);
-    secp256k1_context_set_illegal_callback(vrfy, counting_illegal_callback_fn, &ecount);
-    secp256k1_context_set_illegal_callback(both, counting_illegal_callback_fn, &ecount);
-
-    secp256k1_rand256(sk1);
-    secp256k1_rand256(sk2);
-    secp256k1_rand256(sk3);
-    secp256k1_rand256(msg);
-    CHECK(secp256k1_keypair_create(ctx, &keypairs[0], sk1) == 1);
-    CHECK(secp256k1_keypair_create(ctx, &keypairs[1], sk2) == 1);
-    CHECK(secp256k1_keypair_create(ctx, &keypairs[2], sk3) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(ctx, &pk[0], NULL, &keypairs[0]) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(ctx, &pk[1], NULL, &keypairs[1]) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(ctx, &pk[2], NULL, &keypairs[2]) == 1);
-    memset(&zero_pk, 0, sizeof(zero_pk));
-
-    /** main test body **/
-    ecount = 0;
-    CHECK(secp256k1_schnorrsig_sign(none, sig, msg, &keypairs[0], NULL, NULL) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_schnorrsig_sign(vrfy, sig, msg, &keypairs[0], NULL, NULL) == 0);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL, NULL) == 1);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_schnorrsig_sign(sign, NULL, msg, &keypairs[0], NULL, NULL) == 0);
-    CHECK(ecount == 3);
-    CHECK(secp256k1_schnorrsig_sign(sign, sig, NULL, &keypairs[0], NULL, NULL) == 0);
-    CHECK(ecount == 4);
-    CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, NULL, NULL, NULL) == 0);
-    CHECK(ecount == 5);
-    CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &invalid_keypair, NULL, NULL) == 0);
-    CHECK(ecount == 6);
-
-    ecount = 0;
-    CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL, NULL) == 1);
-    CHECK(secp256k1_schnorrsig_verify(none, sig, msg, &pk[0]) == 0);
-    CHECK(ecount == 1);
-    CHECK(secp256k1_schnorrsig_verify(sign, sig, msg, &pk[0]) == 0);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, &pk[0]) == 1);
-    CHECK(ecount == 2);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, NULL, msg, &pk[0]) == 0);
-    CHECK(ecount == 3);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, NULL, &pk[0]) == 0);
-    CHECK(ecount == 4);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, NULL) == 0);
-    CHECK(ecount == 5);
-    CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, &zero_pk) == 0);
-    CHECK(ecount == 6);
-
-    secp256k1_context_destroy(none);
-    secp256k1_context_destroy(sign);
-    secp256k1_context_destroy(vrfy);
-    secp256k1_context_destroy(both);
-}
-
-/* Checks that hash initialized by secp256k1_schnorrsig_sha256_tagged has the
- * expected state. */
-void test_schnorrsig_sha256_tagged(void) {
-    char tag[17] = "BIP0340/challenge";
-    secp256k1_sha256 sha;
-    secp256k1_sha256 sha_optimized;
-
-    secp256k1_sha256_initialize_tagged(&sha, (unsigned char *) tag, sizeof(tag));
-    secp256k1_schnorrsig_sha256_tagged(&sha_optimized);
-    test_sha256_eq(&sha, &sha_optimized);
-}
-
-/* Helper function for schnorrsig_bip_vectors
- * Signs the message and checks that it's the same as expected_sig. */
-void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const unsigned char *pk_serialized, unsigned char *aux_rand, const unsigned char *msg, const unsigned char *expected_sig) {
-    unsigned char sig[64];
-    secp256k1_keypair keypair;
-    secp256k1_xonly_pubkey pk, pk_expected;
-
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
-    CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, aux_rand));
-    CHECK(memcmp(sig, expected_sig, 64) == 0);
-
-    CHECK(secp256k1_xonly_pubkey_parse(ctx, &pk_expected, pk_serialized));
-    CHECK(secp256k1_keypair_xonly_pub(ctx, &pk, NULL, &keypair));
-    CHECK(memcmp(&pk, &pk_expected, sizeof(pk)) == 0);
-    CHECK(secp256k1_schnorrsig_verify(ctx, sig, msg, &pk));
-}
-
-/* Helper function for schnorrsig_bip_vectors
- * Checks that both verify and verify_batch (TODO) return the same value as expected. */
-void test_schnorrsig_bip_vectors_check_verify(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, int expected) {
-    secp256k1_xonly_pubkey pk;
-
-    CHECK(secp256k1_xonly_pubkey_parse(ctx, &pk, pk_serialized));
-    CHECK(expected == secp256k1_schnorrsig_verify(ctx, sig, msg32, &pk));
-}
-
-/* Test vectors according to BIP-340 ("Schnorr Signatures for secp256k1"). See
- * https://github.com/bitcoin/bips/blob/master/bip-0340/test-vectors.csv. */
-void test_schnorrsig_bip_vectors(void) {
-    {
-        /* Test vector 0 */
-        const unsigned char sk[32] = {
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03
-        };
-        const unsigned char pk[32] = {
-            0xF9, 0x30, 0x8A, 0x01, 0x92, 0x58, 0xC3, 0x10,
-            0x49, 0x34, 0x4F, 0x85, 0xF8, 0x9D, 0x52, 0x29,
-            0xB5, 0x31, 0xC8, 0x45, 0x83, 0x6F, 0x99, 0xB0,
-            0x86, 0x01, 0xF1, 0x13, 0xBC, 0xE0, 0x36, 0xF9
-        };
-        unsigned char aux_rand[32] = {
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-        };
-        const unsigned char msg[32] = {
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-        };
-        const unsigned char sig[64] = {
-            0xE9, 0x07, 0x83, 0x1F, 0x80, 0x84, 0x8D, 0x10,
-            0x69, 0xA5, 0x37, 0x1B, 0x40, 0x24, 0x10, 0x36,
-            0x4B, 0xDF, 0x1C, 0x5F, 0x83, 0x07, 0xB0, 0x08,
-            0x4C, 0x55, 0xF1, 0xCE, 0x2D, 0xCA, 0x82, 0x15,
-            0x25, 0xF6, 0x6A, 0x4A, 0x85, 0xEA, 0x8B, 0x71,
-            0xE4, 0x82, 0xA7, 0x4F, 0x38, 0x2D, 0x2C, 0xE5,
-            0xEB, 0xEE, 0xE8, 0xFD, 0xB2, 0x17, 0x2F, 0x47,
-            0x7D, 0xF4, 0x90, 0x0D, 0x31, 0x05, 0x36, 0xC0
-        };
-        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
-    }
-    {
-        /* Test vector 1 */
-        const unsigned char sk[32] = {
-            0xB7, 0xE1, 0x51, 0x62, 0x8A, 0xED, 0x2A, 0x6A,
-            0xBF, 0x71, 0x58, 0x80, 0x9C, 0xF4, 0xF3, 0xC7,
-            0x62, 0xE7, 0x16, 0x0F, 0x38, 0xB4, 0xDA, 0x56,
-            0xA7, 0x84, 0xD9, 0x04, 0x51, 0x90, 0xCF, 0xEF
-        };
-        const unsigned char pk[32] = {
-            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
-            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
-            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
-            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
-        };
-        unsigned char aux_rand[32] = {
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
-        };
-        const unsigned char msg[32] = {
-            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
-            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
-            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
-            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
-        };
-        const unsigned char sig[64] = {
-            0x68, 0x96, 0xBD, 0x60, 0xEE, 0xAE, 0x29, 0x6D,
-            0xB4, 0x8A, 0x22, 0x9F, 0xF7, 0x1D, 0xFE, 0x07,
-            0x1B, 0xDE, 0x41, 0x3E, 0x6D, 0x43, 0xF9, 0x17,
-            0xDC, 0x8D, 0xCF, 0x8C, 0x78, 0xDE, 0x33, 0x41,
-            0x89, 0x06, 0xD1, 0x1A, 0xC9, 0x76, 0xAB, 0xCC,
-            0xB2, 0x0B, 0x09, 0x12, 0x92, 0xBF, 0xF4, 0xEA,
-            0x89, 0x7E, 0xFC, 0xB6, 0x39, 0xEA, 0x87, 0x1C,
-            0xFA, 0x95, 0xF6, 0xDE, 0x33, 0x9E, 0x4B, 0x0A
-        };
-        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
-    }
-    {
-        /* Test vector 2 */
-        const unsigned char sk[32] = {
-            0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
-            0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
-            0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
-            0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x14, 0xE5, 0xC9
-        };
-        const unsigned char pk[32] = {
-            0xDD, 0x30, 0x8A, 0xFE, 0xC5, 0x77, 0x7E, 0x13,
-            0x12, 0x1F, 0xA7, 0x2B, 0x9C, 0xC1, 0xB7, 0xCC,
-            0x01, 0x39, 0x71, 0x53, 0x09, 0xB0, 0x86, 0xC9,
-            0x60, 0xE1, 0x8F, 0xD9, 0x69, 0x77, 0x4E, 0xB8
-        };
-        unsigned char aux_rand[32] = {
-            0xC8, 0x7A, 0xA5, 0x38, 0x24, 0xB4, 0xD7, 0xAE,
-            0x2E, 0xB0, 0x35, 0xA2, 0xB5, 0xBB, 0xBC, 0xCC,
-            0x08, 0x0E, 0x76, 0xCD, 0xC6, 0xD1, 0x69, 0x2C,
-            0x4B, 0x0B, 0x62, 0xD7, 0x98, 0xE6, 0xD9, 0x06
-        };
-        const unsigned char msg[32] = {
-            0x7E, 0x2D, 0x58, 0xD8, 0xB3, 0xBC, 0xDF, 0x1A,
-            0xBA, 0xDE, 0xC7, 0x82, 0x90, 0x54, 0xF9, 0x0D,
-            0xDA, 0x98, 0x05, 0xAA, 0xB5, 0x6C, 0x77, 0x33,
-            0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C
-        };
-        const unsigned char sig[64] = {
-            0x58, 0x31, 0xAA, 0xEE, 0xD7, 0xB4, 0x4B, 0xB7,
-            0x4E, 0x5E, 0xAB, 0x94, 0xBA, 0x9D, 0x42, 0x94,
-            0xC4, 0x9B, 0xCF, 0x2A, 0x60, 0x72, 0x8D, 0x8B,
-            0x4C, 0x20, 0x0F, 0x50, 0xDD, 0x31, 0x3C, 0x1B,
-            0xAB, 0x74, 0x58, 0x79, 0xA5, 0xAD, 0x95, 0x4A,
-            0x72, 0xC4, 0x5A, 0x91, 0xC3, 0xA5, 0x1D, 0x3C,
-            0x7A, 0xDE, 0xA9, 0x8D, 0x82, 0xF8, 0x48, 0x1E,
-            0x0E, 0x1E, 0x03, 0x67, 0x4A, 0x6F, 0x3F, 0xB7
-        };
-        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
-    }
-    {
-        /* Test vector 3 */
-        const unsigned char sk[32] = {
-            0x0B, 0x43, 0x2B, 0x26, 0x77, 0x93, 0x73, 0x81,
-            0xAE, 0xF0, 0x5B, 0xB0, 0x2A, 0x66, 0xEC, 0xD0,
-            0x12, 0x77, 0x30, 0x62, 0xCF, 0x3F, 0xA2, 0x54,
-            0x9E, 0x44, 0xF5, 0x8E, 0xD2, 0x40, 0x17, 0x10
-        };
-        const unsigned char pk[32] = {
-            0x25, 0xD1, 0xDF, 0xF9, 0x51, 0x05, 0xF5, 0x25,
-            0x3C, 0x40, 0x22, 0xF6, 0x28, 0xA9, 0x96, 0xAD,
-            0x3A, 0x0D, 0x95, 0xFB, 0xF2, 0x1D, 0x46, 0x8A,
-            0x1B, 0x33, 0xF8, 0xC1, 0x60, 0xD8, 0xF5, 0x17
-        };
-        unsigned char aux_rand[32] = {
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-        };
-        const unsigned char msg[32] = {
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
-        };
-        const unsigned char sig[64] = {
-            0x7E, 0xB0, 0x50, 0x97, 0x57, 0xE2, 0x46, 0xF1,
-            0x94, 0x49, 0x88, 0x56, 0x51, 0x61, 0x1C, 0xB9,
-            0x65, 0xEC, 0xC1, 0xA1, 0x87, 0xDD, 0x51, 0xB6,
-            0x4F, 0xDA, 0x1E, 0xDC, 0x96, 0x37, 0xD5, 0xEC,
-            0x97, 0x58, 0x2B, 0x9C, 0xB1, 0x3D, 0xB3, 0x93,
-            0x37, 0x05, 0xB3, 0x2B, 0xA9, 0x82, 0xAF, 0x5A,
-            0xF2, 0x5F, 0xD7, 0x88, 0x81, 0xEB, 0xB3, 0x27,
-            0x71, 0xFC, 0x59, 0x22, 0xEF, 0xC6, 0x6E, 0xA3
-        };
-        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
-    }
-    {
-        /* Test vector 4 */
-        const unsigned char pk[32] = {
-            0xD6, 0x9C, 0x35, 0x09, 0xBB, 0x99, 0xE4, 0x12,
-            0xE6, 0x8B, 0x0F, 0xE8, 0x54, 0x4E, 0x72, 0x83,
-            0x7D, 0xFA, 0x30, 0x74, 0x6D, 0x8B, 0xE2, 0xAA,
-            0x65, 0x97, 0x5F, 0x29, 0xD2, 0x2D, 0xC7, 0xB9
-        };
-        const unsigned char msg[32] = {
-            0x4D, 0xF3, 0xC3, 0xF6, 0x8F, 0xCC, 0x83, 0xB2,
-            0x7E, 0x9D, 0x42, 0xC9, 0x04, 0x31, 0xA7, 0x24,
-            0x99, 0xF1, 0x78, 0x75, 0xC8, 0x1A, 0x59, 0x9B,
-            0x56, 0x6C, 0x98, 0x89, 0xB9, 0x69, 0x67, 0x03
-        };
-        const unsigned char sig[64] = {
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x3B, 0x78, 0xCE, 0x56, 0x3F,
-            0x89, 0xA0, 0xED, 0x94, 0x14, 0xF5, 0xAA, 0x28,
-            0xAD, 0x0D, 0x96, 0xD6, 0x79, 0x5F, 0x9C, 0x63,
-            0x76, 0xAF, 0xB1, 0x54, 0x8A, 0xF6, 0x03, 0xB3,
-            0xEB, 0x45, 0xC9, 0xF8, 0x20, 0x7D, 0xEE, 0x10,
-            0x60, 0xCB, 0x71, 0xC0, 0x4E, 0x80, 0xF5, 0x93,
-            0x06, 0x0B, 0x07, 0xD2, 0x83, 0x08, 0xD7, 0xF4
-        };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
-    }
-    {
-        /* Test vector 5 */
-        const unsigned char pk[32] = {
-            0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, 0x50,
-            0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF, 0x21,
-            0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76, 0x87,
-            0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A, 0x34
-        };
-        secp256k1_xonly_pubkey pk_parsed;
-        /* No need to check the signature of the test vector as parsing the pubkey already fails */
-        CHECK(!secp256k1_xonly_pubkey_parse(ctx, &pk_parsed, pk));
-    }
-    {
-        /* Test vector 6 */
-        const unsigned char pk[32] = {
-            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
-            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
-            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
-            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
-        };
-        const unsigned char msg[32] = {
-            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
-            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
-            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
-            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
-        };
-        const unsigned char sig[64] = {
-            0xFF, 0xF9, 0x7B, 0xD5, 0x75, 0x5E, 0xEE, 0xA4,
-            0x20, 0x45, 0x3A, 0x14, 0x35, 0x52, 0x35, 0xD3,
-            0x82, 0xF6, 0x47, 0x2F, 0x85, 0x68, 0xA1, 0x8B,
-            0x2F, 0x05, 0x7A, 0x14, 0x60, 0x29, 0x75, 0x56,
-            0x3C, 0xC2, 0x79, 0x44, 0x64, 0x0A, 0xC6, 0x07,
-            0xCD, 0x10, 0x7A, 0xE1, 0x09, 0x23, 0xD9, 0xEF,
-            0x7A, 0x73, 0xC6, 0x43, 0xE1, 0x66, 0xBE, 0x5E,
-            0xBE, 0xAF, 0xA3, 0x4B, 0x1A, 0xC5, 0x53, 0xE2
-        };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
-    }
-    {
-        /* Test vector 7 */
-        const unsigned char pk[32] = {
-            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
-            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
-            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
-            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
-        };
-        const unsigned char msg[32] = {
-            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
-            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
-            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
-            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
-        };
-        const unsigned char sig[64] = {
-            0x1F, 0xA6, 0x2E, 0x33, 0x1E, 0xDB, 0xC2, 0x1C,
-            0x39, 0x47, 0x92, 0xD2, 0xAB, 0x11, 0x00, 0xA7,
-            0xB4, 0x32, 0xB0, 0x13, 0xDF, 0x3F, 0x6F, 0xF4,
-            0xF9, 0x9F, 0xCB, 0x33, 0xE0, 0xE1, 0x51, 0x5F,
-            0x28, 0x89, 0x0B, 0x3E, 0xDB, 0x6E, 0x71, 0x89,
-            0xB6, 0x30, 0x44, 0x8B, 0x51, 0x5C, 0xE4, 0xF8,
-            0x62, 0x2A, 0x95, 0x4C, 0xFE, 0x54, 0x57, 0x35,
-            0xAA, 0xEA, 0x51, 0x34, 0xFC, 0xCD, 0xB2, 0xBD
-        };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
-    }
-    {
-        /* Test vector 8 */
-        const unsigned char pk[32] = {
-            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
-            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
-            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
-            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
-        };
-        const unsigned char msg[32] = {
-            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
-            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
-            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
-            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
-        };
-        const unsigned char sig[64] = {
-            0x6C, 0xFF, 0x5C, 0x3B, 0xA8, 0x6C, 0x69, 0xEA,
-            0x4B, 0x73, 0x76, 0xF3, 0x1A, 0x9B, 0xCB, 0x4F,
-            0x74, 0xC1, 0x97, 0x60, 0x89, 0xB2, 0xD9, 0x96,
-            0x3D, 0xA2, 0xE5, 0x54, 0x3E, 0x17, 0x77, 0x69,
-            0x96, 0x17, 0x64, 0xB3, 0xAA, 0x9B, 0x2F, 0xFC,
-            0xB6, 0xEF, 0x94, 0x7B, 0x68, 0x87, 0xA2, 0x26,
-            0xE8, 0xD7, 0xC9, 0x3E, 0x00, 0xC5, 0xED, 0x0C,
-            0x18, 0x34, 0xFF, 0x0D, 0x0C, 0x2E, 0x6D, 0xA6
-        };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
-    }
-    {
-        /* Test vector 9 */
-        const unsigned char pk[32] = {
-            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
-            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
-            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
-            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
-        };
-        const unsigned char msg[32] = {
-            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
-            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
-            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
-            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
-        };
-        const unsigned char sig[64] = {
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x12, 0x3D, 0xDA, 0x83, 0x28, 0xAF, 0x9C, 0x23,
-            0xA9, 0x4C, 0x1F, 0xEE, 0xCF, 0xD1, 0x23, 0xBA,
-            0x4F, 0xB7, 0x34, 0x76, 0xF0, 0xD5, 0x94, 0xDC,
-            0xB6, 0x5C, 0x64, 0x25, 0xBD, 0x18, 0x60, 0x51
-        };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
-    }
-    {
-        /* Test vector 10 */
-        const unsigned char pk[32] = {
-            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
-            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
-            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
-            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
-        };
-        const unsigned char msg[32] = {
-            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
-            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
-            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
-            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
-        };
-        const unsigned char sig[64] = {
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-            0x76, 0x15, 0xFB, 0xAF, 0x5A, 0xE2, 0x88, 0x64,
-            0x01, 0x3C, 0x09, 0x97, 0x42, 0xDE, 0xAD, 0xB4,
-            0xDB, 0xA8, 0x7F, 0x11, 0xAC, 0x67, 0x54, 0xF9,
-            0x37, 0x80, 0xD5, 0xA1, 0x83, 0x7C, 0xF1, 0x97
-        };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
-    }
-    {
-        /* Test vector 11 */
-        const unsigned char pk[32] = {
-            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
-            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
-            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
-            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
-        };
-        const unsigned char msg[32] = {
-            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
-            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
-            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
-            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
-        };
-        const unsigned char sig[64] = {
-            0x4A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
-            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
-            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
-            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
-            0x69, 0xE8, 0x9B, 0x4C, 0x55, 0x64, 0xD0, 0x03,
-            0x49, 0x10, 0x6B, 0x84, 0x97, 0x78, 0x5D, 0xD7,
-            0xD1, 0xD7, 0x13, 0xA8, 0xAE, 0x82, 0xB3, 0x2F,
-            0xA7, 0x9D, 0x5F, 0x7F, 0xC4, 0x07, 0xD3, 0x9B
-        };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
-    }
-    {
-        /* Test vector 12 */
-        const unsigned char pk[32] = {
-            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
-            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
-            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
-            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
-        };
-        const unsigned char msg[32] = {
-            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
-            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
-            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
-            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
-        };
-        const unsigned char sig[64] = {
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x2F,
-            0x69, 0xE8, 0x9B, 0x4C, 0x55, 0x64, 0xD0, 0x03,
-            0x49, 0x10, 0x6B, 0x84, 0x97, 0x78, 0x5D, 0xD7,
-            0xD1, 0xD7, 0x13, 0xA8, 0xAE, 0x82, 0xB3, 0x2F,
-            0xA7, 0x9D, 0x5F, 0x7F, 0xC4, 0x07, 0xD3, 0x9B
-        };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
-    }
-    {
-        /* Test vector 13 */
-        const unsigned char pk[32] = {
-            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
-            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
-            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
-            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
-        };
-        const unsigned char msg[32] = {
-            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
-            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
-            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
-            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
-        };
-        const unsigned char sig[64] = {
-            0x6C, 0xFF, 0x5C, 0x3B, 0xA8, 0x6C, 0x69, 0xEA,
-            0x4B, 0x73, 0x76, 0xF3, 0x1A, 0x9B, 0xCB, 0x4F,
-            0x74, 0xC1, 0x97, 0x60, 0x89, 0xB2, 0xD9, 0x96,
-            0x3D, 0xA2, 0xE5, 0x54, 0x3E, 0x17, 0x77, 0x69,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,
-            0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,
-            0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41
-        };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
-    }
-    {
-        /* Test vector 14 */
-        const unsigned char pk[32] = {
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-            0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x30
-        };
-        secp256k1_xonly_pubkey pk_parsed;
-        /* No need to check the signature of the test vector as parsing the pubkey already fails */
-        CHECK(!secp256k1_xonly_pubkey_parse(ctx, &pk_parsed, pk));
-    }
-}
-
-/* Nonce function that returns constant 0 */
-static int nonce_function_failing(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo16, void *data) {
-    (void) msg32;
-    (void) key32;
-    (void) xonly_pk32;
-    (void) algo16;
-    (void) data;
-    (void) nonce32;
-    return 0;
-}
-
-/* Nonce function that sets nonce to 0 */
-static int nonce_function_0(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo16, void *data) {
-    (void) msg32;
-    (void) key32;
-    (void) xonly_pk32;
-    (void) algo16;
-    (void) data;
-
-    memset(nonce32, 0, 32);
-    return 1;
-}
-
-/* Nonce function that sets nonce to 0xFF...0xFF */
-static int nonce_function_overflowing(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo16, void *data) {
-    (void) msg32;
-    (void) key32;
-    (void) xonly_pk32;
-    (void) algo16;
-    (void) data;
-
-    memset(nonce32, 0xFF, 32);
-    return 1;
-}
-
-void test_schnorrsig_sign(void) {
-    unsigned char sk[32];
-    secp256k1_keypair keypair;
-    const unsigned char msg[32] = "this is a msg for a schnorrsig..";
-    unsigned char sig[64];
-    unsigned char zeros64[64] = { 0 };
-
-    secp256k1_rand256(sk);
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
-    CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, NULL) == 1);
-
-    /* Test different nonce functions */
-    memset(sig, 1, sizeof(sig));
-    CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, nonce_function_failing, NULL) == 0);
-    CHECK(memcmp(sig, zeros64, sizeof(sig)) == 0);
-    memset(&sig, 1, sizeof(sig));
-    CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, nonce_function_0, NULL) == 0);
-    CHECK(memcmp(sig, zeros64, sizeof(sig)) == 0);
-    CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, nonce_function_overflowing, NULL) == 1);
-    CHECK(memcmp(sig, zeros64, sizeof(sig)) != 0);
-}
-
-#define N_SIGS 3
-/* Creates N_SIGS valid signatures and verifies them with verify and
- * verify_batch (TODO). Then flips some bits and checks that verification now
- * fails. */
-void test_schnorrsig_sign_verify(void) {
-    unsigned char sk[32];
-    unsigned char msg[N_SIGS][32];
-    unsigned char sig[N_SIGS][64];
-    size_t i;
-    secp256k1_keypair keypair;
-    secp256k1_xonly_pubkey pk;
-    secp256k1_scalar s;
-
-    secp256k1_rand256(sk);
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
-    CHECK(secp256k1_keypair_xonly_pub(ctx, &pk, NULL, &keypair));
-
-    for (i = 0; i < N_SIGS; i++) {
-        secp256k1_rand256(msg[i]);
-        CHECK(secp256k1_schnorrsig_sign(ctx, sig[i], msg[i], &keypair, NULL, NULL));
-        CHECK(secp256k1_schnorrsig_verify(ctx, sig[i], msg[i], &pk));
-    }
-
-    {
-        /* Flip a few bits in the signature and in the message and check that
-         * verify and verify_batch (TODO) fail */
-        size_t sig_idx = secp256k1_rand_int(N_SIGS);
-        size_t byte_idx = secp256k1_rand_int(32);
-        unsigned char xorbyte = secp256k1_rand_int(254)+1;
-        sig[sig_idx][byte_idx] ^= xorbyte;
-        CHECK(!secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], &pk));
-        sig[sig_idx][byte_idx] ^= xorbyte;
-
-        byte_idx = secp256k1_rand_int(32);
-        sig[sig_idx][32+byte_idx] ^= xorbyte;
-        CHECK(!secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], &pk));
-        sig[sig_idx][32+byte_idx] ^= xorbyte;
-
-        byte_idx = secp256k1_rand_int(32);
-        msg[sig_idx][byte_idx] ^= xorbyte;
-        CHECK(!secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], &pk));
-        msg[sig_idx][byte_idx] ^= xorbyte;
-
-        /* Check that above bitflips have been reversed correctly */
-        CHECK(secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], &pk));
-    }
-
-    /* Test overflowing s */
-    CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL, NULL));
-    CHECK(secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
-    memset(&sig[0][32], 0xFF, 32);
-    CHECK(!secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
-
-    /* Test negative s */
-    CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL, NULL));
-    CHECK(secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
-    secp256k1_scalar_set_b32(&s, &sig[0][32], NULL);
-    secp256k1_scalar_negate(&s, &s);
-    secp256k1_scalar_get_b32(&sig[0][32], &s);
-    CHECK(!secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
-}
-#undef N_SIGS
-
-void test_schnorrsig_taproot(void) {
-    unsigned char sk[32];
-    secp256k1_keypair keypair;
-    secp256k1_xonly_pubkey internal_pk;
-    unsigned char internal_pk_bytes[32];
-    secp256k1_xonly_pubkey output_pk;
-    unsigned char output_pk_bytes[32];
-    unsigned char tweak[32];
-    int pk_parity;
-    unsigned char msg[32];
-    unsigned char sig[64];
-
-    /* Create output key */
-    secp256k1_rand256(sk);
-    CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(ctx, &internal_pk, NULL, &keypair) == 1);
-    /* In actual taproot the tweak would be hash of internal_pk */
-    CHECK(secp256k1_xonly_pubkey_serialize(ctx, tweak, &internal_pk) == 1);
-    CHECK(secp256k1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(ctx, &output_pk, &pk_parity, &keypair) == 1);
-    CHECK(secp256k1_xonly_pubkey_serialize(ctx, output_pk_bytes, &output_pk) == 1);
-
-    /* Key spend */
-    secp256k1_rand256(msg);
-    CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, NULL) == 1);
-    /* Verify key spend */
-    CHECK(secp256k1_xonly_pubkey_parse(ctx, &output_pk, output_pk_bytes) == 1);
-    CHECK(secp256k1_schnorrsig_verify(ctx, sig, msg, &output_pk) == 1);
-
-    /* Script spend */
-    CHECK(secp256k1_xonly_pubkey_serialize(ctx, internal_pk_bytes, &internal_pk) == 1);
-    /* Verify script spend */
-    CHECK(secp256k1_xonly_pubkey_parse(ctx, &internal_pk, internal_pk_bytes) == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(ctx, output_pk_bytes, pk_parity, &internal_pk, tweak) == 1);
-}
-
-void run_schnorrsig_tests(void) {
-    int i;
-    run_nonce_function_bip340_tests();
-
-    test_schnorrsig_api();
-    test_schnorrsig_sha256_tagged();
-    test_schnorrsig_bip_vectors();
-    for (i = 0; i < count; i++) {
-        test_schnorrsig_sign();
-        test_schnorrsig_sign_verify();
-    }
-    test_schnorrsig_taproot();
-}
-
-#endif
diff --git a/src/selftest.h b/src/selftest.h
deleted file mode 100644
index 885983a..0000000
--- a/src/selftest.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/**********************************************************************
- * Copyright (c) 2020 Pieter Wuille                                   *
- * Distributed under the MIT software license, see the accompanying   *
- * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
- **********************************************************************/
-
-#ifndef SECP256K1_SELFTEST_H
-#define SECP256K1_SELFTEST_H
-
-#include "hash.h"
-
-#include <string.h>
-
-static int secp256k1_selftest_sha256(void) {
-    static const char *input63 = "For this sample, this 63-byte string will be used as input data";
-    static const unsigned char output32[32] = {
-        0xf0, 0x8a, 0x78, 0xcb, 0xba, 0xee, 0x08, 0x2b, 0x05, 0x2a, 0xe0, 0x70, 0x8f, 0x32, 0xfa, 0x1e,
-        0x50, 0xc5, 0xc4, 0x21, 0xaa, 0x77, 0x2b, 0xa5, 0xdb, 0xb4, 0x06, 0xa2, 0xea, 0x6b, 0xe3, 0x42,
-    };
-    unsigned char out[32];
-    secp256k1_sha256 hasher;
-    secp256k1_sha256_initialize(&hasher);
-    secp256k1_sha256_write(&hasher, (const unsigned char*)input63, 63);
-    secp256k1_sha256_finalize(&hasher, out);
-    return memcmp(out, output32, 32) == 0;
-}
-
-static int secp256k1_selftest(void) {
-    return secp256k1_selftest_sha256();
-}
-
-#endif /* SECP256K1_SELFTEST_H */
diff --git a/src/testrand.h b/src/testrand.h
index bcbe15a..f1f9be0 100644
--- a/src/testrand.h
+++ b/src/testrand.h
@@ -35,7 +35,4 @@ static void secp256k1_rand256_test(unsigned char *b32);
 /** Generate pseudorandom bytes with long sequences of zero and one bits. */
 static void secp256k1_rand_bytes_test(unsigned char *bytes, size_t len);
 
-/** Flip a single random bit in a byte array */
-static void secp256k1_rand_flip(unsigned char *b, size_t len);
-
 #endif /* SECP256K1_TESTRAND_H */
diff --git a/src/testrand_impl.h b/src/testrand_impl.h
index dfb658d..30a91e5 100644
--- a/src/testrand_impl.h
+++ b/src/testrand_impl.h
@@ -107,8 +107,4 @@ static void secp256k1_rand256_test(unsigned char *b32) {
     secp256k1_rand_bytes_test(b32, 32);
 }
 
-static void secp256k1_rand_flip(unsigned char *b, size_t len) {
-    b[secp256k1_rand_int(len)] ^= (1 << secp256k1_rand_int(8));
-}
-
 #endif /* SECP256K1_TESTRAND_IMPL_H */
diff --git a/src/tests.c b/src/tests.c
index f2881e2..58d2ad2 100644
--- a/src/tests.c
+++ b/src/tests.c
@@ -86,7 +86,6 @@ void random_group_element_test(secp256k1_ge *ge) {
             break;
         }
     } while(1);
-    ge->infinity = 0;
 }
 
 void random_group_element_jacobian_test(secp256k1_gej *gej, const secp256k1_ge *ge) {
@@ -365,8 +364,8 @@ void run_scratch_tests(void) {
     CHECK(scratch->alloc_size != 0);
     CHECK(scratch->alloc_size % ALIGNMENT == 0);
 
-    /* Allocating another 501 bytes fails */
-    CHECK(secp256k1_scratch_alloc(&none->error_callback, scratch, 501) == NULL);
+    /* Allocating another 500 bytes fails */
+    CHECK(secp256k1_scratch_alloc(&none->error_callback, scratch, 500) == NULL);
     CHECK(secp256k1_scratch_max_allocation(&none->error_callback, scratch, 0) == 1000 - adj_alloc);
     CHECK(secp256k1_scratch_max_allocation(&none->error_callback, scratch, 1) == 1000 - adj_alloc - (ALIGNMENT - 1));
     CHECK(scratch->alloc_size != 0);
@@ -399,18 +398,6 @@ void run_scratch_tests(void) {
     secp256k1_scratch_space_destroy(none, scratch);
     CHECK(ecount == 5);
 
-    /* Test that large integers do not wrap around in a bad way */
-    scratch = secp256k1_scratch_space_create(none, 1000);
-    /* Try max allocation with a large number of objects. Only makes sense if
-     * ALIGNMENT is greater than 1 because otherwise the objects take no extra
-     * space. */
-    CHECK(ALIGNMENT <= 1 || !secp256k1_scratch_max_allocation(&none->error_callback, scratch, (SIZE_MAX / (ALIGNMENT - 1)) + 1));
-    /* Try allocating SIZE_MAX to test wrap around which only happens if
-     * ALIGNMENT > 1, otherwise it returns NULL anyway because the scratch
-     * space is too small. */
-    CHECK(secp256k1_scratch_alloc(&none->error_callback, scratch, SIZE_MAX) == NULL);
-    secp256k1_scratch_space_destroy(none, scratch);
-
     /* cleanup */
     secp256k1_scratch_space_destroy(none, NULL); /* no-op */
     secp256k1_context_destroy(none);
@@ -2319,39 +2306,6 @@ void test_ge(void) {
     free(zinv);
 }
 
-
-void test_intialized_inf(void) {
-    secp256k1_ge p;
-    secp256k1_gej pj, npj, infj1, infj2, infj3;
-    secp256k1_fe zinv;
-
-    /* Test that adding P+(-P) results in a fully initalized infinity*/
-    random_group_element_test(&p);
-    secp256k1_gej_set_ge(&pj, &p);
-    secp256k1_gej_neg(&npj, &pj);
-
-    secp256k1_gej_add_var(&infj1, &pj, &npj, NULL);
-    CHECK(secp256k1_gej_is_infinity(&infj1));
-    CHECK(secp256k1_fe_is_zero(&infj1.x));
-    CHECK(secp256k1_fe_is_zero(&infj1.y));
-    CHECK(secp256k1_fe_is_zero(&infj1.z));
-
-    secp256k1_gej_add_ge_var(&infj2, &npj, &p, NULL);
-    CHECK(secp256k1_gej_is_infinity(&infj2));
-    CHECK(secp256k1_fe_is_zero(&infj2.x));
-    CHECK(secp256k1_fe_is_zero(&infj2.y));
-    CHECK(secp256k1_fe_is_zero(&infj2.z));
-
-    secp256k1_fe_set_int(&zinv, 1);
-    secp256k1_gej_add_zinv_var(&infj3, &npj, &p, &zinv);
-    CHECK(secp256k1_gej_is_infinity(&infj3));
-    CHECK(secp256k1_fe_is_zero(&infj3.x));
-    CHECK(secp256k1_fe_is_zero(&infj3.y));
-    CHECK(secp256k1_fe_is_zero(&infj3.z));
-
-
-}
-
 void test_add_neg_y_diff_x(void) {
     /* The point of this test is to check that we can add two points
      * whose y-coordinates are negatives of each other but whose x
@@ -2425,7 +2379,6 @@ void run_ge(void) {
         test_ge();
     }
     test_add_neg_y_diff_x();
-    test_intialized_inf();
 }
 
 void test_ec_combine(void) {
@@ -5353,14 +5306,6 @@ void run_ecdsa_openssl(void) {
 # include "modules/recovery/tests_impl.h"
 #endif
 
-#ifdef ENABLE_MODULE_EXTRAKEYS
-# include "modules/extrakeys/tests_impl.h"
-#endif
-
-#ifdef ENABLE_MODULE_SCHNORRSIG
-# include "modules/schnorrsig/tests_impl.h"
-#endif
-
 void run_memczero_test(void) {
     unsigned char buf1[6] = {1, 2, 3, 4, 5, 6};
     unsigned char buf2[sizeof(buf1)];
@@ -5667,14 +5612,6 @@ int main(int argc, char **argv) {
     run_recovery_tests();
 #endif
 
-#ifdef ENABLE_MODULE_EXTRAKEYS
-    run_extrakeys_tests();
-#endif
-
-#ifdef ENABLE_MODULE_SCHNORRSIG
-    run_schnorrsig_tests();
-#endif
-
     /* util tests */
     run_memczero_test();
 
diff --git a/src/tests_exhaustive.c b/src/tests_exhaustive.c
index 681ed80..8f34670 100644
--- a/src/tests_exhaustive.c
+++ b/src/tests_exhaustive.c
@@ -22,7 +22,6 @@
 #endif
 
 #include "include/secp256k1.h"
-#include "assumptions.h"
 #include "group.h"
 #include "secp256k1.c"
 #include "testrand_impl.h"
diff --git a/src/valgrind_ctime_test.c b/src/valgrind_ctime_test.c
index e676a83..60a82d5 100644
--- a/src/valgrind_ctime_test.c
+++ b/src/valgrind_ctime_test.c
@@ -6,7 +6,6 @@
 
 #include <valgrind/memcheck.h>
 #include "include/secp256k1.h"
-#include "assumptions.h"
 #include "util.h"
 
 #if ENABLE_MODULE_ECDH
@@ -17,14 +16,6 @@
 # include "include/secp256k1_recovery.h"
 #endif
 
-#if ENABLE_MODULE_EXTRAKEYS
-# include "include/secp256k1_extrakeys.h"
-#endif
-
-#if ENABLE_MODULE_SCHNORRSIG
-#include "include/secp256k1_schnorrsig.h"
-#endif
-
 int main(void) {
     secp256k1_context* ctx;
     secp256k1_ecdsa_signature signature;
@@ -41,9 +32,6 @@ int main(void) {
     secp256k1_ecdsa_recoverable_signature recoverable_signature;
     int recid;
 #endif
-#if ENABLE_MODULE_EXTRAKEYS
-    secp256k1_keypair keypair;
-#endif
 
     if (!RUNNING_ON_VALGRIND) {
         fprintf(stderr, "This test can only usefully be run inside valgrind.\n");
@@ -61,9 +49,7 @@ int main(void) {
         msg[i] = i + 1;
     }
 
-    ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN
-                                   | SECP256K1_CONTEXT_VERIFY
-                                   | SECP256K1_CONTEXT_DECLASSIFY);
+    ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_DECLASSIFY);
 
     /* Test keygen. */
     VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
@@ -128,30 +114,6 @@ int main(void) {
     VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
     CHECK(ret);
 
-    /* Test keypair_create and keypair_xonly_tweak_add. */
-#if ENABLE_MODULE_EXTRAKEYS
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = secp256k1_keypair_create(ctx, &keypair, key);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-
-    /* The tweak is not treated as a secret in keypair_tweak_add */
-    VALGRIND_MAKE_MEM_DEFINED(msg, 32);
-    ret = secp256k1_keypair_xonly_tweak_add(ctx, &keypair, msg);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-#endif
-
-#if ENABLE_MODULE_SCHNORRSIG
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = secp256k1_keypair_create(ctx, &keypair, key);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-    ret = secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, NULL);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-#endif
-
     secp256k1_context_destroy(ctx);
     return 0;
 }