From e4cca901ead00a8a7ca5746523aeec277cb00259 Mon Sep 17 00:00:00 2001
From: Andrew Poelstra <apoelstra@wpsoftware.net>
Date: Wed, 16 Aug 2023 20:29:23 +0000
Subject: [PATCH 1/6] gitignore: remove things that shouldn't be there

upstream libsecp now has a CMakeLists.txt file. Many years ago we added
some things to .gitignore which appear to be local developers committing
the names of their own stray files, and now this is causing the
revendoring script to lose track of vendored files.
---
 .gitignore | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index 06584376f..2c96eb1b6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,2 @@
 target/
 Cargo.lock
-
-#IntelliJ project files
-.idea
-*.iml
-
-CMakeLists.txt
-cmake-build-debug

From 04ce50891bb0d49be5355f5c0d82db70d7dda65a Mon Sep 17 00:00:00 2001
From: Andrew Poelstra <apoelstra@wpsoftware.net>
Date: Wed, 16 Aug 2023 19:29:12 +0000
Subject: [PATCH 2/6] lib: fix bad unit test

---
 src/lib.rs | 45 +++++++++++++++++++++++++++++++++++++--------
 1 file changed, 37 insertions(+), 8 deletions(-)

diff --git a/src/lib.rs b/src/lib.rs
index ae5a81679..254cc837f 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -591,15 +591,23 @@ mod tests {
 
     #[test]
     #[cfg(feature = "rand-std")]
+    // In rustc 1.72 this Clippy lint was pulled out of clippy and into rustc, and
+    // was made deny-by-default, breaking compilation of this test. Aside from this
+    // breaking change, which there is no point in bugging, the rename was done so
+    // clumsily that you need four separate "allow"s to disable this wrong lint.
+    #[allow(unknown_lints)]
+    #[allow(renamed_and_removed_lints)]
+    #[allow(undropped_manually_drops)]
+    #[allow(clippy::unknown_manually_drops)]
     fn test_raw_ctx() {
-        use std::mem::ManuallyDrop;
+        use std::mem::{forget, ManuallyDrop};
 
         let ctx_full = Secp256k1::new();
         let ctx_sign = Secp256k1::signing_only();
         let ctx_vrfy = Secp256k1::verification_only();
 
-        let mut full = unsafe { Secp256k1::from_raw_all(ctx_full.ctx) };
-        let mut sign = unsafe { Secp256k1::from_raw_signing_only(ctx_sign.ctx) };
+        let full = unsafe { Secp256k1::from_raw_all(ctx_full.ctx) };
+        let sign = unsafe { Secp256k1::from_raw_signing_only(ctx_sign.ctx) };
         let mut vrfy = unsafe { Secp256k1::from_raw_verification_only(ctx_vrfy.ctx) };
 
         let (sk, pk) = full.generate_keypair(&mut rand::thread_rng());
@@ -612,14 +620,35 @@ mod tests {
         assert!(vrfy.verify_ecdsa(&msg, &sig, &pk).is_ok());
         assert!(full.verify_ecdsa(&msg, &sig, &pk).is_ok());
 
+        // The following drop will have no effect; in fact, they will trigger a compiler
+        // error because manually dropping a `ManuallyDrop` is almost certainly incorrect.
+        // If you want to drop the inner object you should called `ManuallyDrop::drop`.
+        drop(full);
+        // This will actually drop the context, though it will leave `full` accessible and
+        // in an invalid state. However, this is almost certainly what you want to do.
+        drop(ctx_full);
+        unsafe {
+            // Need to compute the allocation size, and need to do so *before* dropping
+            // anything.
+            let sz = ffi::secp256k1_context_preallocated_clone_size(ctx_sign.ctx.as_ptr());
+            // We can alternately drop the `ManuallyDrop` by unwrapping it and then letting
+            // it be dropped. This is actually a safe function, but it will destruct the
+            // underlying context without deallocating it...
+            ManuallyDrop::into_inner(sign);
+            // ...leaving us holding the bag to deallocate the context's memory without
+            // double-calling `secp256k1_context_destroy`, which cannot be done safely.
+            SignOnly::deallocate(ctx_sign.ctx.as_ptr() as *mut u8, sz);
+            forget(ctx_sign);
+        }
+
         unsafe {
-            ManuallyDrop::drop(&mut full);
-            ManuallyDrop::drop(&mut sign);
+            // Finally, we can call `ManuallyDrop::drop`, which has the same effect, but
+            let sz = ffi::secp256k1_context_preallocated_clone_size(ctx_vrfy.ctx.as_ptr());
+            // leaves the `ManuallyDrop` itself accessible. This is marked unsafe.
             ManuallyDrop::drop(&mut vrfy);
+            VerifyOnly::deallocate(ctx_vrfy.ctx.as_ptr() as *mut u8, sz);
+            forget(ctx_vrfy);
         }
-        drop(ctx_full);
-        drop(ctx_sign);
-        drop(ctx_vrfy);
     }
 
     #[cfg(not(target_arch = "wasm32"))]

From acf9ac13e9f8df84dd52d2f012cda7211a6af10c Mon Sep 17 00:00:00 2001
From: Andrew Poelstra <apoelstra@wpsoftware.net>
Date: Wed, 16 Aug 2023 20:18:10 +0000
Subject: [PATCH 3/6] delete `test_manual_create_destroy` test

This is just a bad test. It constructs a preallocated context object by
starting from a non-preallocated context object, in a way that can't be
done by users (since it directly constructs a `Secp256k1` struct) and a
way that is very difficult to unwind, because you wind up with two
pointers to the same underlying context object, one a "preallocated" one
and one a normal one.

If you then drop the preallocated one, it will call
`secp256k1_context_destroy`, forcing you to manually deallocate the
other one. If you drop the normally-allocated one, you need to
mem::forget the preallocated one to avoid calling
`secp256k1_context_destroy` twice. The whole thing is pretty fragile.

There is another unit test, `test_raw_ctx`, which gets into the same
situation but using the public API, and demonstrates a few ways to get
out of it.
---
 src/lib.rs | 34 ----------------------------------
 1 file changed, 34 deletions(-)

diff --git a/src/lib.rs b/src/lib.rs
index 254cc837f..a1c86fc8d 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -555,40 +555,6 @@ mod tests {
         }};
     }
 
-    #[test]
-    #[cfg(feature = "rand-std")]
-    fn test_manual_create_destroy() {
-        use std::marker::PhantomData;
-
-        let ctx_full = unsafe { ffi::secp256k1_context_create(AllPreallocated::FLAGS) };
-        let ctx_sign = unsafe { ffi::secp256k1_context_create(SignOnlyPreallocated::FLAGS) };
-        let ctx_vrfy = unsafe { ffi::secp256k1_context_create(VerifyOnlyPreallocated::FLAGS) };
-
-        let full: Secp256k1<AllPreallocated> = Secp256k1 { ctx: ctx_full, phantom: PhantomData };
-        let sign: Secp256k1<SignOnlyPreallocated> =
-            Secp256k1 { ctx: ctx_sign, phantom: PhantomData };
-        let vrfy: Secp256k1<VerifyOnlyPreallocated> =
-            Secp256k1 { ctx: ctx_vrfy, phantom: PhantomData };
-
-        let (sk, pk) = full.generate_keypair(&mut rand::thread_rng());
-        let msg = Message::from_digest_slice(&[2u8; 32]).unwrap();
-        // Try signing
-        assert_eq!(sign.sign_ecdsa(&msg, &sk), full.sign_ecdsa(&msg, &sk));
-        let sig = full.sign_ecdsa(&msg, &sk);
-
-        // Try verifying
-        assert!(vrfy.verify_ecdsa(&msg, &sig, &pk).is_ok());
-        assert!(full.verify_ecdsa(&msg, &sig, &pk).is_ok());
-
-        drop(full);
-        drop(sign);
-        drop(vrfy);
-
-        unsafe { ffi::secp256k1_context_destroy(ctx_vrfy) };
-        unsafe { ffi::secp256k1_context_destroy(ctx_sign) };
-        unsafe { ffi::secp256k1_context_destroy(ctx_full) };
-    }
-
     #[test]
     #[cfg(feature = "rand-std")]
     // In rustc 1.72 this Clippy lint was pulled out of clippy and into rustc, and

From 0d58f50d523b40a78de0b87146208e3ad338c8ba Mon Sep 17 00:00:00 2001
From: Andrew Poelstra <apoelstra@wpsoftware.net>
Date: Wed, 16 Aug 2023 18:28:40 +0000
Subject: [PATCH 4/6] ci: generalize grp in "illegal callback" test

---
 contrib/_test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/_test.sh b/contrib/_test.sh
index 43c80759a..21ce87438 100755
--- a/contrib/_test.sh
+++ b/contrib/_test.sh
@@ -23,7 +23,7 @@ fi
 # Test if panic in C code aborts the process (either with a real panic or with SIGILL)
 cargo test -- --ignored --exact 'tests::test_panic_raw_ctx_should_terminate_abnormally' 2>&1 \
     | tee /dev/stderr \
-    | grep "SIGILL\\|\[libsecp256k1] illegal argument. !rustsecp256k1_v0_._._fe_is_zero(&ge->x)"
+    | grep "SIGILL\\|\[libsecp256k1] illegal argument. "
 
 # Make all cargo invocations verbose
 export CARGO_TERM_VERBOSE=true

From d2285c929a086276ce6d1670d795c49191e30c65 Mon Sep 17 00:00:00 2001
From: Davidson Souza <iokwsg9ex@relay.firefox.com>
Date: Sat, 23 Sep 2023 17:44:00 -0300
Subject: [PATCH 5/6] ci: Remove MIPS* from CI

MIPS was recently downgraded to Tier 3, which means it won't be installable by
rustup and may not work as expected. This commit removes all MIPS-related
CI jobs.
---
 .github/workflows/cross.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/cross.yml b/.github/workflows/cross.yml
index 10672b8d9..fb92c84d7 100644
--- a/.github/workflows/cross.yml
+++ b/.github/workflows/cross.yml
@@ -27,10 +27,6 @@ jobs:
           - arm-unknown-linux-gnueabi
           - arm-unknown-linux-gnueabihf
           - armv7-unknown-linux-gnueabihf
-          - mips-unknown-linux-gnu
-          - mips64-unknown-linux-gnuabi64
-          - mips64el-unknown-linux-gnuabi64
-          - mipsel-unknown-linux-gnu
           - powerpc-unknown-linux-gnu
           # - powerpc64-unknown-linux-gnu  # not supported by cross
           - powerpc64le-unknown-linux-gnu

From 80b2a8d4aa6ffa72041d569eab2278cd8c1ace2a Mon Sep 17 00:00:00 2001
From: Davidson Souza <iokwsg9ex@relay.firefox.com>
Date: Wed, 27 Sep 2023 15:37:09 -0300
Subject: [PATCH 6/6] Update vendored libsecp to v0.4.0

---
 Cargo-minimal.lock                            |    2 +-
 Cargo-recent.lock                             |    2 +-
 Cargo.toml                                    |    2 +-
 secp256k1-sys/Cargo.toml                      |    4 +-
 secp256k1-sys/depend/lax_der_parsing.c.patch  |    6 +
 .../depend/secp256k1-HEAD-revision.txt        |    2 +-
 secp256k1-sys/depend/secp256k1.c.patch        |   21 +-
 secp256k1-sys/depend/secp256k1.h.patch        |   40 +-
 secp256k1-sys/depend/secp256k1/.cirrus.yml    |  377 -
 .../install-homebrew-valgrind/action.yml      |   33 +
 .../actions/run-in-docker-action/action.yml   |   49 +
 .../depend/secp256k1/.github/workflows/ci.yml |  806 +++
 secp256k1-sys/depend/secp256k1/.gitignore     |   11 +-
 secp256k1-sys/depend/secp256k1/CHANGELOG.md   |  103 +-
 secp256k1-sys/depend/secp256k1/CMakeLists.txt |  341 +
 .../depend/secp256k1/CMakePresets.json        |   19 +
 secp256k1-sys/depend/secp256k1/Makefile.am    |  124 +-
 secp256k1-sys/depend/secp256k1/README.md      |   43 +-
 .../secp256k1/build-aux/m4/bitcoin_secp.m4    |   28 +-
 .../depend/secp256k1/ci/{cirrus.sh => ci.sh}  |   84 +-
 .../secp256k1/ci/linux-debian.Dockerfile      |   72 +-
 .../secp256k1/cmake/CheckArm32Assembly.cmake  |    6 +
 .../cmake/CheckStringOptionValue.cmake        |   10 +
 .../secp256k1/cmake/CheckX86_64Assembly.cmake |   14 +
 .../depend/secp256k1/cmake/FindValgrind.cmake |   41 +
 .../secp256k1/cmake/TryAppendCFlags.cmake     |   24 +
 .../cmake/arm-linux-gnueabihf.toolchain.cmake |    3 +
 .../depend/secp256k1/cmake/config.cmake.in    |    5 +
 .../depend/secp256k1/cmake/source_arm32.s     |    9 +
 .../cmake/x86_64-w64-mingw32.toolchain.cmake  |    3 +
 secp256k1-sys/depend/secp256k1/configure.ac   |  121 +-
 .../secp256k1/contrib/lax_der_parsing.c       |   12 +-
 .../secp256k1/contrib/lax_der_parsing.h       |   10 +-
 .../contrib/lax_der_privatekey_parsing.c      |   14 +-
 .../contrib/lax_der_privatekey_parsing.h      |    8 +-
 .../depend/secp256k1/doc/ellswift.md          |  483 ++
 .../depend/secp256k1/doc/release-process.md   |   50 +-
 .../secp256k1/doc/safegcd_implementation.md   |   54 +-
 .../depend/secp256k1/examples/CMakeLists.txt  |   30 +
 .../depend/secp256k1/examples/ecdh.c          |   39 +-
 .../depend/secp256k1/examples/ecdsa.c         |   48 +-
 .../examples/{random.h => examples_util.h}    |   35 +
 .../depend/secp256k1/examples/schnorr.c       |   52 +-
 .../depend/secp256k1/include/secp256k1.h      |  396 +-
 .../depend/secp256k1/include/secp256k1_ecdh.h |   26 +-
 .../secp256k1/include/secp256k1_ellswift.h    |  200 +
 .../secp256k1/include/secp256k1_extrakeys.h   |  136 +-
 .../include/secp256k1_preallocated.h          |   66 +-
 .../secp256k1/include/secp256k1_recovery.h    |   48 +-
 .../secp256k1/include/secp256k1_schnorrsig.h  |   70 +-
 .../depend/secp256k1/libsecp256k1.pc.in       |    1 -
 .../secp256k1/sage/gen_exhaustive_groups.sage |  202 +-
 .../sage/gen_split_lambda_constants.sage      |   16 +-
 .../depend/secp256k1/sage/group_prover.sage   |    2 +-
 .../sage/prove_group_implementations.sage     |   72 +-
 .../depend/secp256k1/src/CMakeLists.txt       |  165 +
 .../secp256k1/src/asm/field_10x26_arm.s       |   18 +-
 .../depend/secp256k1/src/assumptions.h        |    2 +-
 secp256k1-sys/depend/secp256k1/src/bench.c    |  110 +-
 secp256k1-sys/depend/secp256k1/src/bench.h    |   14 +-
 .../depend/secp256k1/src/bench_ecmult.c       |  127 +-
 .../depend/secp256k1/src/bench_internal.c     |  200 +-
 secp256k1-sys/depend/secp256k1/src/checkmem.h |   95 +
 .../depend/secp256k1/src/ctime_tests.c        |  209 +
 secp256k1-sys/depend/secp256k1/src/ecdsa.h    |    8 +-
 .../depend/secp256k1/src/ecdsa_impl.h         |  146 +-
 secp256k1-sys/depend/secp256k1/src/eckey.h    |   12 +-
 .../depend/secp256k1/src/eckey_impl.h         |   70 +-
 secp256k1-sys/depend/secp256k1/src/ecmult.h   |    8 +-
 .../secp256k1/src/ecmult_compute_table.h      |    6 +-
 .../secp256k1/src/ecmult_compute_table_impl.h |   36 +-
 .../depend/secp256k1/src/ecmult_const.h       |   27 +-
 .../depend/secp256k1/src/ecmult_const_impl.h  |  269 +-
 .../depend/secp256k1/src/ecmult_gen.h         |   14 +-
 .../secp256k1/src/ecmult_gen_compute_table.h  |    2 +-
 .../src/ecmult_gen_compute_table_impl.h       |   45 +-
 .../depend/secp256k1/src/ecmult_gen_impl.h    |   89 +-
 .../depend/secp256k1/src/ecmult_impl.h        |  424 +-
 secp256k1-sys/depend/secp256k1/src/field.h    |  382 +-
 .../depend/secp256k1/src/field_10x26.h        |   37 +-
 .../depend/secp256k1/src/field_10x26_impl.h   |  330 +-
 .../depend/secp256k1/src/field_5x52.h         |   37 +-
 .../secp256k1/src/field_5x52_asm_impl.h       |   10 +-
 .../depend/secp256k1/src/field_5x52_impl.h    |  327 +-
 .../secp256k1/src/field_5x52_int128_impl.h    |  151 +-
 .../depend/secp256k1/src/field_impl.h         |  384 +-
 secp256k1-sys/depend/secp256k1/src/group.h    |  111 +-
 .../depend/secp256k1/src/group_impl.h         |  873 ++-
 secp256k1-sys/depend/secp256k1/src/hash.h     |   26 +-
 .../depend/secp256k1/src/hash_impl.h          |  162 +-
 secp256k1-sys/depend/secp256k1/src/int128.h   |   45 +-
 .../depend/secp256k1/src/int128_native.h      |    4 +-
 .../depend/secp256k1/src/int128_native_impl.h |   45 +-
 .../depend/secp256k1/src/int128_struct.h      |    4 +-
 .../depend/secp256k1/src/int128_struct_impl.h |   85 +-
 secp256k1-sys/depend/secp256k1/src/modinv32.h |   21 +-
 .../depend/secp256k1/src/modinv32_impl.h      |  375 +-
 secp256k1-sys/depend/secp256k1/src/modinv64.h |   21 +-
 .../depend/secp256k1/src/modinv64_impl.h      |  583 +-
 .../src/modules/ecdh/Makefile.am.include      |    2 +-
 .../secp256k1/src/modules/ecdh/bench_impl.h   |   14 +-
 .../secp256k1/src/modules/ecdh/main_impl.h    |   46 +-
 .../secp256k1/src/modules/ecdh/tests_impl.h   |  112 +-
 .../src/modules/ellswift/Makefile.am.include  |    5 +
 .../src/modules/ellswift/bench_impl.h         |  106 +
 .../src/modules/ellswift/main_impl.h          |  589 ++
 .../modules/ellswift/tests_exhaustive_impl.h  |   39 +
 .../src/modules/ellswift/tests_impl.h         |  436 ++
 .../src/modules/extrakeys/Makefile.am.include |    2 +-
 .../src/modules/extrakeys/main_impl.h         |  163 +-
 .../modules/extrakeys/tests_exhaustive_impl.h |   46 +-
 .../src/modules/extrakeys/tests_impl.h        |  515 +-
 .../src/modules/recovery/Makefile.am.include  |    2 +-
 .../src/modules/recovery/bench_impl.h         |   22 +-
 .../src/modules/recovery/main_impl.h          |  116 +-
 .../modules/recovery/tests_exhaustive_impl.h  |   83 +-
 .../src/modules/recovery/tests_impl.h         |  254 +-
 .../modules/schnorrsig/Makefile.am.include    |    2 +-
 .../src/modules/schnorrsig/bench_impl.h       |   36 +-
 .../src/modules/schnorrsig/main_impl.h        |  174 +-
 .../schnorrsig/tests_exhaustive_impl.h        |   74 +-
 .../src/modules/schnorrsig/tests_impl.h       |  554 +-
 .../depend/secp256k1/src/precompute_ecmult.c  |   33 +-
 .../secp256k1/src/precompute_ecmult_gen.c     |   10 +-
 .../depend/secp256k1/src/precomputed_ecmult.c |   12 +-
 .../depend/secp256k1/src/precomputed_ecmult.h |   13 +-
 .../secp256k1/src/precomputed_ecmult_gen.c    |    6 +-
 .../secp256k1/src/precomputed_ecmult_gen.h    |    4 +-
 secp256k1-sys/depend/secp256k1/src/scalar.h   |   60 +-
 .../depend/secp256k1/src/scalar_4x64.h        |    2 +-
 .../depend/secp256k1/src/scalar_4x64_impl.h   |  394 +-
 .../depend/secp256k1/src/scalar_8x32.h        |    2 +-
 .../depend/secp256k1/src/scalar_8x32_impl.h   |  233 +-
 .../depend/secp256k1/src/scalar_impl.h        |  108 +-
 .../depend/secp256k1/src/scalar_low.h         |    2 +-
 .../depend/secp256k1/src/scalar_low_impl.h    |  125 +-
 secp256k1-sys/depend/secp256k1/src/scratch.h  |   20 +-
 .../depend/secp256k1/src/scratch_impl.h       |   26 +-
 .../depend/secp256k1/src/secp256k1.c          |  537 +-
 secp256k1-sys/depend/secp256k1/src/selftest.h |   16 +-
 secp256k1-sys/depend/secp256k1/src/testrand.h |   26 +-
 .../depend/secp256k1/src/testrand_impl.h      |  132 +-
 secp256k1-sys/depend/secp256k1/src/tests.c    | 4873 +++++++------
 .../depend/secp256k1/src/tests_exhaustive.c   |  316 +-
 secp256k1-sys/depend/secp256k1/src/util.h     |  152 +-
 .../depend/secp256k1/src/util.h.orig          |  154 +-
 .../secp256k1/src/valgrind_ctime_test.c       |  171 -
 .../src/wycheproof/WYCHEPROOF_COPYING         |  212 +
 .../ecdsa_secp256k1_sha256_bitcoin_test.h     | 1564 ++++
 .../ecdsa_secp256k1_sha256_bitcoin_test.json  | 6360 +++++++++++++++++
 .../tools/tests_wycheproof_generate.py        |  115 +
 secp256k1-sys/depend/util.h.patch             |   21 +-
 secp256k1-sys/src/lib.rs                      |  118 +-
 secp256k1-sys/src/recovery.rs                 |   10 +-
 secp256k1-sys/vendor-libsecp.sh               |    3 +
 155 files changed, 21787 insertions(+), 8019 deletions(-)
 create mode 100644 secp256k1-sys/depend/lax_der_parsing.c.patch
 delete mode 100644 secp256k1-sys/depend/secp256k1/.cirrus.yml
 create mode 100644 secp256k1-sys/depend/secp256k1/.github/actions/install-homebrew-valgrind/action.yml
 create mode 100644 secp256k1-sys/depend/secp256k1/.github/actions/run-in-docker-action/action.yml
 create mode 100644 secp256k1-sys/depend/secp256k1/.github/workflows/ci.yml
 create mode 100644 secp256k1-sys/depend/secp256k1/CMakeLists.txt
 create mode 100644 secp256k1-sys/depend/secp256k1/CMakePresets.json
 rename secp256k1-sys/depend/secp256k1/ci/{cirrus.sh => ci.sh} (51%)
 create mode 100644 secp256k1-sys/depend/secp256k1/cmake/CheckArm32Assembly.cmake
 create mode 100644 secp256k1-sys/depend/secp256k1/cmake/CheckStringOptionValue.cmake
 create mode 100644 secp256k1-sys/depend/secp256k1/cmake/CheckX86_64Assembly.cmake
 create mode 100644 secp256k1-sys/depend/secp256k1/cmake/FindValgrind.cmake
 create mode 100644 secp256k1-sys/depend/secp256k1/cmake/TryAppendCFlags.cmake
 create mode 100644 secp256k1-sys/depend/secp256k1/cmake/arm-linux-gnueabihf.toolchain.cmake
 create mode 100644 secp256k1-sys/depend/secp256k1/cmake/config.cmake.in
 create mode 100644 secp256k1-sys/depend/secp256k1/cmake/source_arm32.s
 create mode 100644 secp256k1-sys/depend/secp256k1/cmake/x86_64-w64-mingw32.toolchain.cmake
 create mode 100644 secp256k1-sys/depend/secp256k1/doc/ellswift.md
 create mode 100644 secp256k1-sys/depend/secp256k1/examples/CMakeLists.txt
 rename secp256k1-sys/depend/secp256k1/examples/{random.h => examples_util.h} (66%)
 create mode 100644 secp256k1-sys/depend/secp256k1/include/secp256k1_ellswift.h
 create mode 100644 secp256k1-sys/depend/secp256k1/src/CMakeLists.txt
 create mode 100644 secp256k1-sys/depend/secp256k1/src/checkmem.h
 create mode 100644 secp256k1-sys/depend/secp256k1/src/ctime_tests.c
 create mode 100644 secp256k1-sys/depend/secp256k1/src/modules/ellswift/Makefile.am.include
 create mode 100644 secp256k1-sys/depend/secp256k1/src/modules/ellswift/bench_impl.h
 create mode 100644 secp256k1-sys/depend/secp256k1/src/modules/ellswift/main_impl.h
 create mode 100644 secp256k1-sys/depend/secp256k1/src/modules/ellswift/tests_exhaustive_impl.h
 create mode 100644 secp256k1-sys/depend/secp256k1/src/modules/ellswift/tests_impl.h
 delete mode 100644 secp256k1-sys/depend/secp256k1/src/valgrind_ctime_test.c
 create mode 100644 secp256k1-sys/depend/secp256k1/src/wycheproof/WYCHEPROOF_COPYING
 create mode 100644 secp256k1-sys/depend/secp256k1/src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.h
 create mode 100644 secp256k1-sys/depend/secp256k1/src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.json
 create mode 100755 secp256k1-sys/depend/secp256k1/tools/tests_wycheproof_generate.py

diff --git a/Cargo-minimal.lock b/Cargo-minimal.lock
index a1c030577..f15fc8bbf 100644
--- a/Cargo-minimal.lock
+++ b/Cargo-minimal.lock
@@ -273,7 +273,7 @@ dependencies = [
 
 [[package]]
 name = "secp256k1-sys"
-version = "0.8.1"
+version = "0.9.0"
 dependencies = [
  "cc",
  "libc",
diff --git a/Cargo-recent.lock b/Cargo-recent.lock
index 8a68c3bda..6186dd09c 100644
--- a/Cargo-recent.lock
+++ b/Cargo-recent.lock
@@ -194,7 +194,7 @@ dependencies = [
 
 [[package]]
 name = "secp256k1-sys"
-version = "0.8.1"
+version = "0.9.0"
 dependencies = [
  "cc",
  "libc",
diff --git a/Cargo.toml b/Cargo.toml
index 5c9564018..b9fdc5615 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -35,7 +35,7 @@ global-context = ["std"]
 global-context-less-secure = ["global-context"]
 
 [dependencies]
-secp256k1-sys = { version = "0.8.1", default-features = false, path = "./secp256k1-sys" }
+secp256k1-sys = { version = "0.9.0", default-features = false, path = "./secp256k1-sys" }
 serde = { version = "1.0.103", default-features = false, optional = true }
 
 # You likely only want to enable these if you explicitly do not want to use "std", otherwise enable
diff --git a/secp256k1-sys/Cargo.toml b/secp256k1-sys/Cargo.toml
index d0cea9a35..7d03fb10c 100644
--- a/secp256k1-sys/Cargo.toml
+++ b/secp256k1-sys/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "secp256k1-sys"
-version = "0.8.1"
+version = "0.9.0"
 authors = [ "Dawid Ciężarkiewicz <dpc@ucore.info>",
             "Andrew Poelstra <apoelstra@wpsoftware.net>",
             "Steven Roose <steven@stevenroose.org>" ]
@@ -12,7 +12,7 @@ description = "FFI for Pieter Wuille's `libsecp256k1` library."
 keywords = [ "secp256k1", "libsecp256k1", "ffi" ]
 readme = "README.md"
 build = "build.rs"
-links = "rustsecp256k1_v0_8_1"
+links = "rustsecp256k1_v0_9_0"
 edition = "2018"
 
 [package.metadata.docs.rs]
diff --git a/secp256k1-sys/depend/lax_der_parsing.c.patch b/secp256k1-sys/depend/lax_der_parsing.c.patch
new file mode 100644
index 000000000..59b23e0df
--- /dev/null
+++ b/secp256k1-sys/depend/lax_der_parsing.c.patch
@@ -0,0 +1,6 @@
+10c10,12
+< 
+---
+> extern int secp256k1_ecdsa_signature_parse_compact(
+>         const secp256k1_context *ctx,
+>         secp256k1_ecdsa_signature *sig, const unsigned char *input64);
diff --git a/secp256k1-sys/depend/secp256k1-HEAD-revision.txt b/secp256k1-sys/depend/secp256k1-HEAD-revision.txt
index cd5bb0ce9..96fcb1e98 100644
--- a/secp256k1-sys/depend/secp256k1-HEAD-revision.txt
+++ b/secp256k1-sys/depend/secp256k1-HEAD-revision.txt
@@ -1,2 +1,2 @@
 # This file was automatically created by vendor-libsecp.sh
-21ffe4b22a9683cf24ae0763359e401d1284cc7a
+199d27cea32203b224b208627533c2e813cd3b21
diff --git a/secp256k1-sys/depend/secp256k1.c.patch b/secp256k1-sys/depend/secp256k1.c.patch
index c39705a00..3783b1524 100644
--- a/secp256k1-sys/depend/secp256k1.c.patch
+++ b/secp256k1-sys/depend/secp256k1.c.patch
@@ -1,4 +1,4 @@
-139,149d138
+140,150d139
 < secp256k1_context* secp256k1_context_create(unsigned int flags) {
 <     size_t const prealloc_size = secp256k1_context_preallocated_size(flags);
 <     secp256k1_context* ctx = (secp256k1_context*)checked_malloc(&default_error_callback, prealloc_size);
@@ -10,27 +10,34 @@
 <     return ctx;
 < }
 < 
-164,174d152
+162,174d150
 < secp256k1_context* secp256k1_context_clone(const secp256k1_context* ctx) {
 <     secp256k1_context* ret;
 <     size_t prealloc_size;
 < 
 <     VERIFY_CHECK(ctx != NULL);
+<     ARG_CHECK(secp256k1_context_is_proper(ctx));
+< 
 <     prealloc_size = secp256k1_context_preallocated_clone_size(ctx);
 <     ret = (secp256k1_context*)checked_malloc(&ctx->error_callback, prealloc_size);
 <     ret = secp256k1_context_preallocated_clone(ctx, ret);
 <     return ret;
 < }
 < 
-183,189d160
+186,197d161
 < void secp256k1_context_destroy(secp256k1_context* ctx) {
-<     if (ctx != NULL) {
-<         secp256k1_context_preallocated_destroy(ctx);
-<         free(ctx);
+<     ARG_CHECK_VOID(ctx == NULL || secp256k1_context_is_proper(ctx));
+< 
+<     /* Defined as noop */
+<     if (ctx == NULL) {
+<         return;
 <     }
+< 
+<     secp256k1_context_preallocated_destroy(ctx);
+<     free(ctx);
 < }
 < 
-206,215d176
+220,229d183
 < }
 < 
 < secp256k1_scratch_space* secp256k1_scratch_space_create(const secp256k1_context* ctx, size_t max_size) {
diff --git a/secp256k1-sys/depend/secp256k1.h.patch b/secp256k1-sys/depend/secp256k1.h.patch
index a22f8cfdd..193729bda 100644
--- a/secp256k1-sys/depend/secp256k1.h.patch
+++ b/secp256k1-sys/depend/secp256k1.h.patch
@@ -1,22 +1,36 @@
-226,228d225
-< SECP256K1_API secp256k1_context* secp256k1_context_create(
+236d235
+< SECP256K1_API const secp256k1_context *secp256k1_context_static;
+239,240d237
+< SECP256K1_API const secp256k1_context *secp256k1_context_no_precomp
+< SECP256K1_DEPRECATED("Use secp256k1_context_static instead");
+286,289d282
+< SECP256K1_API secp256k1_context *secp256k1_context_create(
 <     unsigned int flags
 < ) SECP256K1_WARN_UNUSED_RESULT;
-231,233d227
-< SECP256K1_API secp256k1_context* secp256k1_context_clone(
-<     const secp256k1_context* ctx
+< 
+302,305d294
+< SECP256K1_API secp256k1_context *secp256k1_context_clone(
+<     const secp256k1_context *ctx
 < ) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT;
-248,250d241
+< 
+320,323d308
 < SECP256K1_API void secp256k1_context_destroy(
-<     secp256k1_context* ctx
+<     secp256k1_context *ctx
 < ) SECP256K1_ARG_NONNULL(1);
-327,330d317
-< SECP256K1_API SECP256K1_WARN_UNUSED_RESULT secp256k1_scratch_space* secp256k1_scratch_space_create(
-<     const secp256k1_context* ctx,
+< 
+402,406d386
+< SECP256K1_API SECP256K1_WARN_UNUSED_RESULT secp256k1_scratch_space *secp256k1_scratch_space_create(
+<     const secp256k1_context *ctx,
 <     size_t size
 < ) SECP256K1_ARG_NONNULL(1);
-338,341d324
+< 
+413,417d392
 < SECP256K1_API void secp256k1_scratch_space_destroy(
-<     const secp256k1_context* ctx,
-<     secp256k1_scratch_space* scratch
+<     const secp256k1_context *ctx,
+<     secp256k1_scratch_space *scratch
 < ) SECP256K1_ARG_NONNULL(1);
+< 
+636d610
+< SECP256K1_API const secp256k1_nonce_function secp256k1_nonce_function_rfc6979;
+639d612
+< SECP256K1_API const secp256k1_nonce_function secp256k1_nonce_function_default;
diff --git a/secp256k1-sys/depend/secp256k1/.cirrus.yml b/secp256k1-sys/depend/secp256k1/.cirrus.yml
deleted file mode 100644
index 51e3bc948..000000000
--- a/secp256k1-sys/depend/secp256k1/.cirrus.yml
+++ /dev/null
@@ -1,377 +0,0 @@
-env:
-  ### compiler options
-  HOST:
-  # Specific warnings can be disabled with -Wno-error=foo.
-  # -pedantic-errors is not equivalent to -Werror=pedantic and thus not implied by -Werror according to the GCC manual.
-  WERROR_CFLAGS: -Werror -pedantic-errors
-  MAKEFLAGS: -j4
-  BUILD: check
-  ### secp256k1 config
-  ECMULTWINDOW: auto
-  ECMULTGENPRECISION: auto
-  ASM: no
-  WIDEMUL: auto
-  WITH_VALGRIND: yes
-  EXTRAFLAGS:
-  ### secp256k1 modules
-  EXPERIMENTAL: no
-  ECDH: no
-  RECOVERY: no
-  SCHNORRSIG: no
-  ### test options
-  SECP256K1_TEST_ITERS:
-  BENCH: yes
-  SECP256K1_BENCH_ITERS: 2
-  CTIMETEST: yes
-  # Compile and run the tests
-  EXAMPLES: yes
-
-# https://cirrus-ci.org/pricing/#compute-credits
-credits_snippet: &CREDITS
-  # Don't use any credits for now.
-  use_compute_credits: false
-
-cat_logs_snippet: &CAT_LOGS
-  always:
-    cat_tests_log_script:
-      - cat tests.log || true
-    cat_exhaustive_tests_log_script:
-      - cat exhaustive_tests.log || true
-    cat_valgrind_ctime_test_log_script:
-      - cat valgrind_ctime_test.log || true
-    cat_bench_log_script:
-      - cat bench.log || true
-    cat_config_log_script:
-      - cat config.log || true
-    cat_test_env_script:
-      - cat test_env.log || true
-    cat_ci_env_script:
-      - env
-
-merge_base_script_snippet: &MERGE_BASE
-  merge_base_script:
-    - if [ "$CIRRUS_PR" = "" ]; then exit 0; fi
-    - git fetch $CIRRUS_REPO_CLONE_URL $CIRRUS_BASE_BRANCH
-    - git config --global user.email "ci@ci.ci"
-    - git config --global user.name "ci"
-    - git merge FETCH_HEAD  # Merge base to detect silent merge conflicts
-
-linux_container_snippet: &LINUX_CONTAINER
-  container:
-    dockerfile: ci/linux-debian.Dockerfile
-    # Reduce number of CPUs to be able to do more builds in parallel.
-    cpu: 1
-    # Gives us more CPUs for free if they're available.
-    greedy: true
-    # More than enough for our scripts.
-    memory: 1G
-
-task:
-  name: "x86_64: Linux (Debian stable)"
-  << : *LINUX_CONTAINER
-  matrix: &ENV_MATRIX
-    - env: {WIDEMUL:  int64,  RECOVERY: yes}
-    - env: {WIDEMUL:  int64,                 ECDH: yes, SCHNORRSIG: yes}
-    - env: {WIDEMUL: int128}
-    - env: {WIDEMUL: int128_struct}
-    - env: {WIDEMUL: int128,  RECOVERY: yes,            SCHNORRSIG: yes}
-    - env: {WIDEMUL: int128,                 ECDH: yes, SCHNORRSIG: yes}
-    - env: {WIDEMUL: int128,  ASM: x86_64}
-    - env: {                  RECOVERY: yes,            SCHNORRSIG: yes}
-    - env: {BUILD: distcheck, WITH_VALGRIND: no, CTIMETEST: no, BENCH: no}
-    - env: {CPPFLAGS: -DDETERMINISTIC}
-    - env: {CFLAGS: -O0, CTIMETEST: no}
-    - env: { ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
-    - env: { ECMULTGENPRECISION: 8, ECMULTWINDOW: 4 }
-  matrix:
-    - env:
-        CC: gcc
-    - env:
-        CC: clang
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-task:
-  name: "i686: Linux (Debian stable)"
-  << : *LINUX_CONTAINER
-  env:
-    HOST: i686-linux-gnu
-    ECDH: yes
-    RECOVERY: yes
-    SCHNORRSIG: yes
-  matrix:
-    - env:
-        CC: i686-linux-gnu-gcc
-    - env:
-        CC: clang --target=i686-pc-linux-gnu -isystem /usr/i686-linux-gnu/include
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-task:
-  name: "arm64: macOS Ventura"
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-ventura-base:latest
-  env:
-    HOMEBREW_NO_AUTO_UPDATE: 1
-    HOMEBREW_NO_INSTALL_CLEANUP: 1
-    # Cirrus gives us a fixed number of 4 virtual CPUs. Not that we even have that many jobs at the moment...
-    MAKEFLAGS: -j5
-  matrix:
-    << : *ENV_MATRIX
-  env:
-    ASM: no
-    WITH_VALGRIND: no
-    CTIMETEST: no
-  matrix:
-    - env:
-        CC: gcc
-    - env:
-        CC: clang
-  brew_script:
-    - brew install automake libtool gcc
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-  << : *CREDITS
-
-task:
-  name: "s390x (big-endian): Linux (Debian stable, QEMU)"
-  << : *LINUX_CONTAINER
-  env:
-    WRAPPER_CMD: qemu-s390x
-    SECP256K1_TEST_ITERS: 16
-    HOST: s390x-linux-gnu
-    WITH_VALGRIND: no
-    ECDH: yes
-    RECOVERY: yes
-    SCHNORRSIG: yes
-    CTIMETEST: no
-  << : *MERGE_BASE
-  test_script:
-    # https://sourceware.org/bugzilla/show_bug.cgi?id=27008
-    - rm /etc/ld.so.cache
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-task:
-  name: "ARM32: Linux (Debian stable, QEMU)"
-  << : *LINUX_CONTAINER
-  env:
-    WRAPPER_CMD: qemu-arm
-    SECP256K1_TEST_ITERS: 16
-    HOST: arm-linux-gnueabihf
-    WITH_VALGRIND: no
-    ECDH: yes
-    RECOVERY: yes
-    SCHNORRSIG: yes
-    CTIMETEST: no
-  matrix:
-    - env: {}
-    - env: {EXPERIMENTAL: yes, ASM: arm}
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-task:
-  name: "ARM64: Linux (Debian stable, QEMU)"
-  << : *LINUX_CONTAINER
-  env:
-    WRAPPER_CMD: qemu-aarch64
-    SECP256K1_TEST_ITERS: 16
-    HOST: aarch64-linux-gnu
-    WITH_VALGRIND: no
-    ECDH: yes
-    RECOVERY: yes
-    SCHNORRSIG: yes
-    CTIMETEST: no
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-task:
-  name: "ppc64le: Linux (Debian stable, QEMU)"
-  << : *LINUX_CONTAINER
-  env:
-    WRAPPER_CMD: qemu-ppc64le
-    SECP256K1_TEST_ITERS: 16
-    HOST: powerpc64le-linux-gnu
-    WITH_VALGRIND: no
-    ECDH: yes
-    RECOVERY: yes
-    SCHNORRSIG: yes
-    CTIMETEST: no
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-task:
-  << : *LINUX_CONTAINER
-  env:
-    WRAPPER_CMD: wine
-    WITH_VALGRIND: no
-    ECDH: yes
-    RECOVERY: yes
-    SCHNORRSIG: yes
-    CTIMETEST: no
-  matrix:
-    - name: "x86_64 (mingw32-w64): Windows (Debian stable, Wine)"
-      env:
-        HOST: x86_64-w64-mingw32
-    - name: "i686 (mingw32-w64): Windows (Debian stable, Wine)"
-      env:
-        HOST: i686-w64-mingw32
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-task:
-  << : *LINUX_CONTAINER
-  env:
-    WRAPPER_CMD: wine
-    WERROR_CFLAGS: -WX
-    WITH_VALGRIND: no
-    ECDH: yes
-    RECOVERY: yes
-    EXPERIMENTAL: yes
-    SCHNORRSIG: yes
-    CTIMETEST: no
-    # Use a MinGW-w64 host to tell ./configure we're building for Windows.
-    # This will detect some MinGW-w64 tools but then make will need only
-    # the MSVC tools CC, AR and NM as specified below.
-    HOST: x86_64-w64-mingw32
-    CC: /opt/msvc/bin/x64/cl
-    AR: /opt/msvc/bin/x64/lib
-    NM: /opt/msvc/bin/x64/dumpbin -symbols -headers
-    # Set non-essential options that affect the CLI messages here.
-    # (They depend on the user's taste, so we don't want to set them automatically in configure.ac.)
-    CFLAGS: -nologo -diagnostics:caret
-    LDFLAGS: -XCClinker -nologo -XCClinker -diagnostics:caret
-  matrix:
-    - name: "x86_64 (MSVC): Windows (Debian stable, Wine)"
-    - name: "x86_64 (MSVC): Windows (Debian stable, Wine, int128_struct)"
-      env:
-        WIDEMUL: int128_struct
-    - name: "x86_64 (MSVC): Windows (Debian stable, Wine, int128_struct with __(u)mulh)"
-      env:
-        WIDEMUL: int128_struct
-        CPPFLAGS: -DSECP256K1_MSVC_MULH_TEST_OVERRIDE
-    - name: "i686 (MSVC): Windows (Debian stable, Wine)"
-      env:
-        HOST: i686-w64-mingw32
-        CC: /opt/msvc/bin/x86/cl
-        AR: /opt/msvc/bin/x86/lib
-        NM: /opt/msvc/bin/x86/dumpbin -symbols -headers
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-# Sanitizers
-task:
-  << : *LINUX_CONTAINER
-  env:
-    ECDH: yes
-    RECOVERY: yes
-    SCHNORRSIG: yes
-    CTIMETEST: no
-  matrix:
-    - name: "Valgrind (memcheck)"
-      container:
-        cpu: 2
-      env:
-        # The `--error-exitcode` is required to make the test fail if valgrind found errors, otherwise it'll return 0 (https://www.valgrind.org/docs/manual/manual-core.html)
-        WRAPPER_CMD: "valgrind --error-exitcode=42"
-        SECP256K1_TEST_ITERS: 2
-    - name: "UBSan, ASan, LSan"
-      container:
-        memory: 2G
-      env:
-        CFLAGS: "-fsanitize=undefined,address -g"
-        UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=1"
-        ASAN_OPTIONS: "strict_string_checks=1:detect_stack_use_after_return=1:detect_leaks=1"
-        LSAN_OPTIONS: "use_unaligned=1"
-        SECP256K1_TEST_ITERS: 32
-  # Try to cover many configurations with just a tiny matrix.
-  matrix:
-    - env:
-        ASM: auto
-    - env:
-        ASM: no
-        ECMULTGENPRECISION: 2
-        ECMULTWINDOW: 2
-  matrix:
-    - env:
-        CC: clang
-    - env:
-        HOST: i686-linux-gnu
-        CC: i686-linux-gnu-gcc
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-# Memory sanitizers
-task:
-  << : *LINUX_CONTAINER
-  name: "MSan"
-  env:
-    ECDH: yes
-    RECOVERY: yes
-    SCHNORRSIG: yes
-    CTIMETEST: no
-    CC: clang
-    SECP256K1_TEST_ITERS: 32
-    ASM: no
-  container:
-    memory: 2G
-  matrix:
-    - env:
-        CFLAGS: "-fsanitize=memory -g"
-    - env:
-        ECMULTGENPRECISION: 2
-        ECMULTWINDOW: 2
-        CFLAGS: "-fsanitize=memory -g -O3"
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-task:
-  name: "C++ -fpermissive (entire project)"
-  << : *LINUX_CONTAINER
-  env:
-    CC: g++
-    CFLAGS: -fpermissive -g
-    CPPFLAGS: -DSECP256K1_CPLUSPLUS_TEST_OVERRIDE
-    WERROR_CFLAGS:
-    ECDH: yes
-    RECOVERY: yes
-    SCHNORRSIG: yes
-  << : *MERGE_BASE
-  test_script:
-    - ./ci/cirrus.sh
-  << : *CAT_LOGS
-
-task:
-  name: "C++ (public headers)"
-  << : *LINUX_CONTAINER
-  test_script:
-    - g++ -Werror include/*.h
-    - clang -Werror -x c++-header include/*.h
-    - /opt/msvc/bin/x64/cl.exe -c -WX -TP include/*.h
-
-task:
-  name: "sage prover"
-  << : *LINUX_CONTAINER
-  test_script:
-    - cd sage
-    - sage prove_group_implementations.sage
diff --git a/secp256k1-sys/depend/secp256k1/.github/actions/install-homebrew-valgrind/action.yml b/secp256k1-sys/depend/secp256k1/.github/actions/install-homebrew-valgrind/action.yml
new file mode 100644
index 000000000..094ff891f
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/.github/actions/install-homebrew-valgrind/action.yml
@@ -0,0 +1,33 @@
+name: "Install Valgrind"
+description: "Install Homebrew's Valgrind package and cache it."
+runs:
+  using: "composite"
+  steps:
+    - run: |
+        brew tap LouisBrunner/valgrind
+        brew fetch --HEAD LouisBrunner/valgrind/valgrind
+        echo "CI_HOMEBREW_CELLAR_VALGRIND=$(brew --cellar valgrind)" >> "$GITHUB_ENV"
+      shell: bash
+
+    - run: |
+        sw_vers > valgrind_fingerprint
+        brew --version >> valgrind_fingerprint
+        git -C "$(brew --cache)/valgrind--git" rev-parse HEAD >> valgrind_fingerprint
+        cat valgrind_fingerprint
+      shell: bash
+
+    - uses: actions/cache@v3
+      id: cache
+      with:
+        path: ${{ env.CI_HOMEBREW_CELLAR_VALGRIND }}
+        key: ${{ github.job }}-valgrind-${{ hashFiles('valgrind_fingerprint') }}
+
+    - if: steps.cache.outputs.cache-hit != 'true'
+      run: |
+        brew install --HEAD LouisBrunner/valgrind/valgrind
+      shell: bash
+
+    - if: steps.cache.outputs.cache-hit == 'true'
+      run: |
+        brew link valgrind
+      shell: bash
diff --git a/secp256k1-sys/depend/secp256k1/.github/actions/run-in-docker-action/action.yml b/secp256k1-sys/depend/secp256k1/.github/actions/run-in-docker-action/action.yml
new file mode 100644
index 000000000..d357c3cf7
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/.github/actions/run-in-docker-action/action.yml
@@ -0,0 +1,49 @@
+name: 'Run in Docker with environment'
+description: 'Run a command in a Docker container, while passing explicitly set environment variables into the container.'
+inputs:
+  dockerfile:
+    description: 'A Dockerfile that defines an image'
+    required: true
+  tag:
+    description: 'A tag of an image'
+    required: true
+  command:
+    description: 'A command to run in a container'
+    required: false
+    default: ./ci/ci.sh
+runs:
+  using: "composite"
+  steps:
+    - uses: docker/setup-buildx-action@v2
+
+    - uses: docker/build-push-action@v4
+      id: main_builder
+      continue-on-error: true
+      with:
+        context: .
+        file: ${{ inputs.dockerfile }}
+        tags: ${{ inputs.tag }}
+        load: true
+        cache-from: type=gha
+
+    - uses: docker/build-push-action@v4
+      id: retry_builder
+      if: steps.main_builder.outcome == 'failure'
+      with:
+        context: .
+        file: ${{ inputs.dockerfile }}
+        tags: ${{ inputs.tag }}
+        load: true
+        cache-from: type=gha
+
+    - # Tell Docker to pass environment variables in `env` into the container.
+      run: >
+        docker run \
+          $(echo '${{ toJSON(env) }}' | jq -r 'keys[] | "--env \(.) "') \
+          --volume ${{ github.workspace }}:${{ github.workspace }} \
+          --workdir ${{ github.workspace }} \
+          ${{ inputs.tag }} bash -c "
+            git config --global --add safe.directory ${{ github.workspace }}
+            ${{ inputs.command }}
+          "
+      shell: bash
diff --git a/secp256k1-sys/depend/secp256k1/.github/workflows/ci.yml b/secp256k1-sys/depend/secp256k1/.github/workflows/ci.yml
new file mode 100644
index 000000000..b9a9eaa82
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/.github/workflows/ci.yml
@@ -0,0 +1,806 @@
+name: CI
+on:
+  pull_request:
+  push:
+    branches:
+      - '**'
+    tags-ignore:
+      - '**'
+
+concurrency:
+  group: ${{ github.event_name != 'pull_request' && github.run_id || github.ref }}
+  cancel-in-progress: true
+
+env:
+  ### compiler options
+  HOST:
+  WRAPPER_CMD:
+  # Specific warnings can be disabled with -Wno-error=foo.
+  # -pedantic-errors is not equivalent to -Werror=pedantic and thus not implied by -Werror according to the GCC manual.
+  WERROR_CFLAGS: '-Werror -pedantic-errors'
+  MAKEFLAGS: '-j4'
+  BUILD: 'check'
+  ### secp256k1 config
+  ECMULTWINDOW: 'auto'
+  ECMULTGENPRECISION: 'auto'
+  ASM: 'no'
+  WIDEMUL: 'auto'
+  WITH_VALGRIND: 'yes'
+  EXTRAFLAGS:
+  ### secp256k1 modules
+  EXPERIMENTAL: 'no'
+  ECDH: 'no'
+  RECOVERY: 'no'
+  SCHNORRSIG: 'no'
+  ELLSWIFT: 'no'
+  ### test options
+  SECP256K1_TEST_ITERS:
+  BENCH: 'yes'
+  SECP256K1_BENCH_ITERS: 2
+  CTIMETESTS: 'yes'
+  # Compile and run the examples.
+  EXAMPLES: 'yes'
+
+jobs:
+  docker_cache:
+    name: "Build Docker image"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          # See: https://github.com/moby/buildkit/issues/3969.
+          driver-opts: |
+            network=host
+
+      - name: Build container
+        uses: docker/build-push-action@v4
+        with:
+          file: ./ci/linux-debian.Dockerfile
+          tags: linux-debian-image
+          cache-from: type=gha
+          cache-to: type=gha,mode=min
+
+  linux_debian:
+    name: "x86_64: Linux (Debian stable)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration:
+          - env_vars: { WIDEMUL: 'int64',  RECOVERY: 'yes' }
+          - env_vars: { WIDEMUL: 'int64',                   ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
+          - env_vars: { WIDEMUL: 'int128' }
+          - env_vars: { WIDEMUL: 'int128_struct',                                           ELLSWIFT: 'yes' }
+          - env_vars: { WIDEMUL: 'int128', RECOVERY: 'yes',              SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
+          - env_vars: { WIDEMUL: 'int128',                  ECDH: 'yes', SCHNORRSIG: 'yes' }
+          - env_vars: { WIDEMUL: 'int128', ASM: 'x86_64',                                   ELLSWIFT: 'yes' }
+          - env_vars: {                    RECOVERY: 'yes',              SCHNORRSIG: 'yes' }
+          - env_vars: { CTIMETESTS: 'no',  RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', CPPFLAGS: '-DVERIFY' }
+          - env_vars: { BUILD: 'distcheck', WITH_VALGRIND: 'no', CTIMETESTS: 'no', BENCH: 'no' }
+          - env_vars: { CPPFLAGS: '-DDETERMINISTIC' }
+          - env_vars: { CFLAGS: '-O0', CTIMETESTS: 'no' }
+          - env_vars: { CFLAGS: '-O1',     RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
+          - env_vars: { ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
+          - env_vars: { ECMULTGENPRECISION: 8, ECMULTWINDOW: 4 }
+        cc:
+          - 'gcc'
+          - 'clang'
+          - 'gcc-snapshot'
+          - 'clang-snapshot'
+
+    env:
+      CC: ${{ matrix.cc }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        env: ${{ matrix.configuration.env_vars }}
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  i686_debian:
+    name: "i686: Linux (Debian stable)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    strategy:
+      fail-fast: false
+      matrix:
+        cc:
+          - 'i686-linux-gnu-gcc'
+          - 'clang --target=i686-pc-linux-gnu -isystem /usr/i686-linux-gnu/include'
+
+    env:
+      HOST: 'i686-linux-gnu'
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+      CC: ${{ matrix.cc }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  s390x_debian:
+    name: "s390x (big-endian): Linux (Debian stable, QEMU)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    env:
+      WRAPPER_CMD: 'qemu-s390x'
+      SECP256K1_TEST_ITERS: 16
+      HOST: 's390x-linux-gnu'
+      WITH_VALGRIND: 'no'
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+      CTIMETESTS: 'no'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  arm32_debian:
+    name: "ARM32: Linux (Debian stable, QEMU)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration:
+          - env_vars: {}
+          - env_vars: { EXPERIMENTAL: 'yes', ASM: 'arm32' }
+
+    env:
+      WRAPPER_CMD: 'qemu-arm'
+      SECP256K1_TEST_ITERS: 16
+      HOST: 'arm-linux-gnueabihf'
+      WITH_VALGRIND: 'no'
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+      CTIMETESTS: 'no'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        env: ${{ matrix.configuration.env_vars }}
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  arm64_debian:
+    name: "ARM64: Linux (Debian stable, QEMU)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    env:
+      WRAPPER_CMD: 'qemu-aarch64'
+      SECP256K1_TEST_ITERS: 16
+      HOST: 'aarch64-linux-gnu'
+      WITH_VALGRIND: 'no'
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+      CTIMETESTS: 'no'
+
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration:
+          - env_vars: { } # gcc
+          - env_vars: # clang
+              CC: 'clang --target=aarch64-linux-gnu'
+          - env_vars: # clang-snapshot
+              CC: 'clang-snapshot --target=aarch64-linux-gnu'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        env: ${{ matrix.configuration.env_vars }}
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  ppc64le_debian:
+    name: "ppc64le: Linux (Debian stable, QEMU)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    env:
+      WRAPPER_CMD: 'qemu-ppc64le'
+      SECP256K1_TEST_ITERS: 16
+      HOST: 'powerpc64le-linux-gnu'
+      WITH_VALGRIND: 'no'
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+      CTIMETESTS: 'no'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  valgrind_debian:
+    name: "Valgrind (memcheck)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration:
+          - env_vars: { CC: 'clang',                                      ASM: 'auto' }
+          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'auto' }
+          - env_vars: { CC: 'clang',                                      ASM: 'no', ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
+          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'no', ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
+
+    env:
+      # The `--error-exitcode` is required to make the test fail if valgrind found errors,
+      # otherwise it will return 0 (https://www.valgrind.org/docs/manual/manual-core.html).
+      WRAPPER_CMD: 'valgrind --error-exitcode=42'
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+      CTIMETESTS: 'no'
+      SECP256K1_TEST_ITERS: 2
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        env: ${{ matrix.configuration.env_vars }}
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  sanitizers_debian:
+    name: "UBSan, ASan, LSan"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration:
+          - env_vars: { CC: 'clang',                                      ASM: 'auto' }
+          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'auto' }
+          - env_vars: { CC: 'clang',                                      ASM: 'no', ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
+          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'no', ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
+
+    env:
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+      CTIMETESTS: 'no'
+      CFLAGS: '-fsanitize=undefined,address -g'
+      UBSAN_OPTIONS: 'print_stacktrace=1:halt_on_error=1'
+      ASAN_OPTIONS: 'strict_string_checks=1:detect_stack_use_after_return=1:detect_leaks=1'
+      LSAN_OPTIONS: 'use_unaligned=1'
+      SECP256K1_TEST_ITERS: 32
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        env: ${{ matrix.configuration.env_vars }}
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  msan_debian:
+    name: "MSan"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration:
+          - env_vars:
+              CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -g'
+          - env_vars:
+              ECMULTGENPRECISION: 2
+              ECMULTWINDOW: 2
+              CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -g -O3'
+
+    env:
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+      CTIMETESTS: 'yes'
+      CC: 'clang'
+      SECP256K1_TEST_ITERS: 32
+      ASM: 'no'
+      WITH_VALGRIND: 'no'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        env: ${{ matrix.configuration.env_vars }}
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  mingw_debian:
+    name: ${{ matrix.configuration.job_name }}
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    env:
+      WRAPPER_CMD: 'wine'
+      WITH_VALGRIND: 'no'
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+      CTIMETESTS: 'no'
+
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration:
+          - job_name: 'x86_64 (mingw32-w64): Windows (Debian stable, Wine)'
+            env_vars:
+              HOST: 'x86_64-w64-mingw32'
+          - job_name: 'i686 (mingw32-w64): Windows (Debian stable, Wine)'
+            env_vars:
+              HOST: 'i686-w64-mingw32'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        env: ${{ matrix.configuration.env_vars }}
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  macos-native:
+    name: "x86_64: macOS Monterey"
+    # See: https://github.com/actions/runner-images#available-images.
+    runs-on: macos-12 # Use M1 once available https://github.com/github/roadmap/issues/528
+
+    env:
+      CC: 'clang'
+      HOMEBREW_NO_AUTO_UPDATE: 1
+      HOMEBREW_NO_INSTALL_CLEANUP: 1
+
+    strategy:
+      fail-fast: false
+      matrix:
+        env_vars:
+          - { WIDEMUL: 'int64',  RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
+          - { WIDEMUL: 'int128_struct', ECMULTGENPRECISION: 2, ECMULTWINDOW: 4 }
+          - { WIDEMUL: 'int128',                  ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes' }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CC: 'gcc' }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes',            WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CC: 'gcc', WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CPPFLAGS: '-DVERIFY', CTIMETESTS: 'no' }
+          - BUILD: 'distcheck'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Homebrew packages
+        run: |
+          brew install automake libtool gcc
+          ln -s $(brew --prefix gcc)/bin/gcc-?? /usr/local/bin/gcc
+
+      - name: Install and cache Valgrind
+        uses: ./.github/actions/install-homebrew-valgrind
+
+      - name: CI script
+        env: ${{ matrix.env_vars }}
+        run: ./ci/ci.sh
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  win64-native:
+    name: ${{ matrix.configuration.job_name }}
+    # See: https://github.com/actions/runner-images#available-images.
+    runs-on: windows-2022
+
+    strategy:
+      fail-fast: false
+      matrix:
+        configuration:
+          - job_name: 'x64 (MSVC): Windows (VS 2022, shared)'
+            cmake_options: '-A x64 -DBUILD_SHARED_LIBS=ON'
+          - job_name: 'x64 (MSVC): Windows (VS 2022, static)'
+            cmake_options: '-A x64 -DBUILD_SHARED_LIBS=OFF'
+          - job_name: 'x64 (MSVC): Windows (VS 2022, int128_struct)'
+            cmake_options: '-A x64 -DSECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY=int128_struct'
+          - job_name: 'x64 (MSVC): Windows (VS 2022, int128_struct with __(u)mulh)'
+            cmake_options: '-A x64 -DSECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY=int128_struct'
+            cpp_flags: '/DSECP256K1_MSVC_MULH_TEST_OVERRIDE'
+          - job_name: 'x86 (MSVC): Windows (VS 2022)'
+            cmake_options: '-A Win32'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Generate buildsystem
+        run: cmake -E env CFLAGS="/WX ${{ matrix.configuration.cpp_flags }}" cmake -B build -DSECP256K1_ENABLE_MODULE_RECOVERY=ON -DSECP256K1_BUILD_EXAMPLES=ON ${{ matrix.configuration.cmake_options }}
+
+      - name: Build
+        run: cmake --build build --config RelWithDebInfo -- /p:UseMultiToolTask=true /maxCpuCount
+
+      - name: Binaries info
+        # Use the bash shell included with Git for Windows.
+        shell: bash
+        run: |
+          cd build/src/RelWithDebInfo && file *tests.exe bench*.exe libsecp256k1-*.dll || true
+
+      - name: Check
+        run: |
+          ctest -C RelWithDebInfo --test-dir build -j ([int]$env:NUMBER_OF_PROCESSORS + 1)
+          build\src\RelWithDebInfo\bench_ecmult.exe
+          build\src\RelWithDebInfo\bench_internal.exe
+          build\src\RelWithDebInfo\bench.exe
+
+  win64-native-headers:
+    name: "x64 (MSVC): C++ (public headers)"
+    # See: https://github.com/actions/runner-images#available-images.
+    runs-on: windows-2022
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Add cl.exe to PATH
+        uses: ilammy/msvc-dev-cmd@v1
+
+      - name: C++ (public headers)
+        run: |
+          cl.exe -c -WX -TP include/*.h
+
+  cxx_fpermissive_debian:
+    name: "C++ -fpermissive (entire project)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    env:
+      CC: 'g++'
+      CFLAGS: '-fpermissive -g'
+      CPPFLAGS: '-DSECP256K1_CPLUSPLUS_TEST_OVERRIDE'
+      WERROR_CFLAGS:
+      ECDH: 'yes'
+      RECOVERY: 'yes'
+      SCHNORRSIG: 'yes'
+      ELLSWIFT: 'yes'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
+  cxx_headers_debian:
+    name: "C++ (public headers)"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        uses: ./.github/actions/run-in-docker-action
+        with:
+          dockerfile: ./ci/linux-debian.Dockerfile
+          tag: linux-debian-image
+          command: |
+            g++ -Werror include/*.h
+            clang -Werror -x c++-header include/*.h
+
+  sage:
+    name: "SageMath prover"
+    runs-on: ubuntu-latest
+    container:
+      image: sagemath/sagemath:latest
+      options: --user root
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: CI script
+        run: |
+          cd sage
+          sage prove_group_implementations.sage
+
+  release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - run: ./autogen.sh && ./configure --enable-dev-mode && make distcheck
+
+      - name: Check installation with Autotools
+        env:
+          CI_INSTALL: ${{ runner.temp }}/${{ github.run_id }}${{ github.action }}
+        run: |
+          ./autogen.sh && ./configure --prefix=${{ env.CI_INSTALL }} && make clean && make install && ls -RlAh ${{ env.CI_INSTALL }}
+          gcc -o ecdsa examples/ecdsa.c $(PKG_CONFIG_PATH=${{ env.CI_INSTALL }}/lib/pkgconfig pkg-config --cflags --libs libsecp256k1) -Wl,-rpath,"${{ env.CI_INSTALL }}/lib" && ./ecdsa
+
+      - name: Check installation with CMake
+        env:
+          CI_BUILD: ${{ runner.temp }}/${{ github.run_id }}${{ github.action }}/build
+          CI_INSTALL: ${{ runner.temp }}/${{ github.run_id }}${{ github.action }}/install
+        run: |
+          cmake -B ${{ env.CI_BUILD }} -DCMAKE_INSTALL_PREFIX=${{ env.CI_INSTALL }} && cmake --build ${{ env.CI_BUILD }} --target install && ls -RlAh ${{ env.CI_INSTALL }}
+          gcc -o ecdsa examples/ecdsa.c -I ${{ env.CI_INSTALL }}/include -L ${{ env.CI_INSTALL }}/lib*/ -l secp256k1 -Wl,-rpath,"${{ env.CI_INSTALL }}/lib",-rpath,"${{ env.CI_INSTALL }}/lib64" && ./ecdsa
diff --git a/secp256k1-sys/depend/secp256k1/.gitignore b/secp256k1-sys/depend/secp256k1/.gitignore
index 80c646b77..574902b8b 100644
--- a/secp256k1-sys/depend/secp256k1/.gitignore
+++ b/secp256k1-sys/depend/secp256k1/.gitignore
@@ -1,11 +1,12 @@
 bench
 bench_ecmult
 bench_internal
+noverify_tests
 tests
 exhaustive_tests
 precompute_ecmult_gen
 precompute_ecmult
-valgrind_ctime_test
+ctime_tests
 ecdh_example
 ecdsa_example
 schnorr_example
@@ -42,8 +43,6 @@ coverage.*.html
 *.gcno
 *.gcov
 
-src/libsecp256k1-config.h
-src/libsecp256k1-config.h.in
 build-aux/ar-lib
 build-aux/config.guess
 build-aux/config.sub
@@ -58,5 +57,9 @@ build-aux/m4/ltversion.m4
 build-aux/missing
 build-aux/compile
 build-aux/test-driver
-src/stamp-h1
 libsecp256k1.pc
+
+### CMake
+/CMakeUserPresets.json
+# Default CMake build directory.
+/build
diff --git a/secp256k1-sys/depend/secp256k1/CHANGELOG.md b/secp256k1-sys/depend/secp256k1/CHANGELOG.md
index 744348342..e8d8db5a1 100644
--- a/secp256k1-sys/depend/secp256k1/CHANGELOG.md
+++ b/secp256k1-sys/depend/secp256k1/CHANGELOG.md
@@ -1,28 +1,113 @@
 # Changelog
 
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+All notable changes to this project will be documented in this file.
 
-## [Unreleased]
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.4.0] - 2023-09-04
+
+#### Added
+ - New module `ellswift` implements ElligatorSwift encoding for public keys and x-only Diffie-Hellman key exchange for them.
+   ElligatorSwift permits representing secp256k1 public keys as 64-byte arrays which cannot be distinguished from uniformly random. See:
+   - Header file `include/secp256k1_ellswift.h` which defines the new API.
+   - Document `doc/ellswift.md` which explains the mathematical background of the scheme.
+   - The [paper](https://eprint.iacr.org/2022/759) on which the scheme is based.
+ - We now test the library with unreleased development snapshots of GCC and Clang. This gives us an early chance to catch miscompilations and constant-time issues introduced by the compiler (such as those that led to the previous two releases).
+
+#### Fixed
+ - Fixed symbol visibility in Windows DLL builds, where three internal library symbols were wrongly exported.
+
+#### Changed
+ - When consuming libsecp256k1 as a static library on Windows, the user must now define the `SECP256K1_STATIC` macro before including `secp256k1.h`.
+
+#### ABI Compatibility
+This release is backward compatible with the ABI of 0.3.0, 0.3.1, and 0.3.2. Symbol visibility is now believed to be handled properly on supported platforms and is now considered to be part of the ABI. Please report any improperly exported symbols as a bug.
+
+## [0.3.2] - 2023-05-13
+We strongly recommend updating to 0.3.2 if you use or plan to use GCC >=13 to compile libsecp256k1. When in doubt, check the GCC version using `gcc -v`.
+
+#### Security
+ - Module `ecdh`: Fix "constant-timeness" issue with GCC 13.1 (and potentially future versions of GCC) that could leave applications using libsecp256k1's ECDH module vulnerable to a timing side-channel attack. The fix avoids secret-dependent control flow during ECDH computations when libsecp256k1 is compiled with GCC 13.1.
+
+#### Fixed
+ - Fixed an old bug that permitted compilers to potentially output bad assembly code on x86_64. In theory, it could lead to a crash or a read of unrelated memory, but this has never been observed on any compilers so far.
+
+#### Changed
+ - Various improvements and changes to CMake builds. CMake builds remain experimental.
+   - Made API versioning consistent with GNU Autotools builds.
+   - Switched to `BUILD_SHARED_LIBS` variable for controlling whether to build a static or a shared library.
+   - Added `SECP256K1_INSTALL` variable for the controlling whether to install the build artefacts.
+ - Renamed asm build option `arm` to `arm32`. Use `--with-asm=arm32` instead of `--with-asm=arm` (GNU Autotools), and `-DSECP256K1_ASM=arm32` instead of `-DSECP256K1_ASM=arm` (CMake).
+
+#### ABI Compatibility
+The ABI is compatible with versions 0.3.0 and 0.3.1.
+
+## [0.3.1] - 2023-04-10
+We strongly recommend updating to 0.3.1 if you use or plan to use Clang >=14 to compile libsecp256k1, e.g., Xcode >=14 on macOS has Clang >=14. When in doubt, check the Clang version using `clang -v`.
+
+#### Security
+ - Fix "constant-timeness" issue with Clang >=14 that could leave applications using libsecp256k1 vulnerable to a timing side-channel attack. The fix avoids secret-dependent control flow and secret-dependent memory accesses in conditional moves of memory objects when libsecp256k1 is compiled with Clang >=14.
+
+#### Added
+  - Added tests against [Project Wycheproof's](https://github.com/google/wycheproof/) set of ECDSA test vectors (Bitcoin "low-S" variant), a fixed set of test cases designed to trigger various edge cases.
+
+#### Changed
+ - Increased minimum required CMake version to 3.13. CMake builds remain experimental.
+
+#### ABI Compatibility
+The ABI is compatible with version 0.3.0.
+
+## [0.3.0] - 2023-03-08
+
+#### Added
+ - Added experimental support for CMake builds. Traditional GNU Autotools builds (`./configure` and `make`) remain fully supported.
+ - Usage examples: Added a recommended method for securely clearing sensitive data, e.g., secret keys, from memory.
+ - Tests: Added a new test binary `noverify_tests`. This binary runs the tests without some additional checks present in the ordinary `tests` binary and is thereby closer to production binaries. The `noverify_tests` binary is automatically run as part of the `make check` target.
+
+#### Fixed
+ - Fixed declarations of API variables for MSVC (`__declspec(dllimport)`). This fixes MSVC builds of programs which link against a libsecp256k1 DLL dynamically and use API variables (and not only API functions). Unfortunately, the MSVC linker now will emit warning `LNK4217` when trying to link against libsecp256k1 statically. Pass `/ignore:4217` to the linker to suppress this warning.
+
+#### Changed
+ - Forbade cloning or destroying `secp256k1_context_static`. Create a new context instead of cloning the static context. (If this change breaks your code, your code is probably wrong.)
+ - Forbade randomizing (copies of) `secp256k1_context_static`. Randomizing a copy of `secp256k1_context_static` did not have any effect and did not provide defense-in-depth protection against side-channel attacks. Create a new context if you want to benefit from randomization.
+
+#### Removed
+ - Removed the configuration header `src/libsecp256k1-config.h`. We recommend passing flags to `./configure` or `cmake` to set configuration options (see `./configure --help` or `cmake -LH`). If you cannot or do not want to use one of the supported build systems, pass configuration flags such as `-DSECP256K1_ENABLE_MODULE_SCHNORRSIG` manually to the compiler (see the file `configure.ac` for supported flags).
+
+#### ABI Compatibility
+Due to changes in the API regarding `secp256k1_context_static` described above, the ABI is *not* compatible with previous versions.
 
 ## [0.2.0] - 2022-12-12
 
-### Added
+#### Added
+ - Added usage examples for common use cases in a new `examples/` directory.
  - Added `secp256k1_selftest`, to be used in conjunction with `secp256k1_context_static`.
+ - Added support for 128-bit wide multiplication on MSVC for x86_64 and arm64, giving roughly a 20% speedup on those platforms.
 
-### Changed
- - Enabled modules schnorrsig, extrakeys and ECDH by default in `./configure`.
+#### Changed
+ - Enabled modules `schnorrsig`, `extrakeys` and `ecdh` by default in `./configure`.
+ - The `secp256k1_nonce_function_rfc6979` nonce function, used by default by `secp256k1_ecdsa_sign`, now reduces the message hash modulo the group order to match the specification. This only affects improper use of ECDSA signing API.
 
-### Deprecated
+#### Deprecated
  - Deprecated context flags `SECP256K1_CONTEXT_VERIFY` and `SECP256K1_CONTEXT_SIGN`. Use `SECP256K1_CONTEXT_NONE` instead.
  - Renamed `secp256k1_context_no_precomp` to `secp256k1_context_static`.
+ - Module `schnorrsig`: renamed `secp256k1_schnorrsig_sign` to `secp256k1_schnorrsig_sign32`.
 
-### ABI Compatibility
-
+#### ABI Compatibility
 Since this is the first release, we do not compare application binary interfaces.
-However, there are unreleased versions of libsecp256k1 that are *not* ABI compatible with this version.
+However, there are earlier unreleased versions of libsecp256k1 that are *not* ABI compatible with this version.
 
 ## [0.1.0] - 2013-03-05 to 2021-12-25
 
 This version was in fact never released.
 The number was given by the build system since the introduction of autotools in Jan 2014 (ea0fe5a5bf0c04f9cc955b2966b614f5f378c6f6).
 Therefore, this version number does not uniquely identify a set of source files.
+
+[unreleased]: https://github.com/bitcoin-core/secp256k1/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.2...v0.4.0
+[0.3.2]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.1...v0.3.2
+[0.3.1]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.0...v0.3.1
+[0.3.0]: https://github.com/bitcoin-core/secp256k1/compare/v0.2.0...v0.3.0
+[0.2.0]: https://github.com/bitcoin-core/secp256k1/compare/423b6d19d373f1224fd671a982584d7e7900bc93..v0.2.0
+[0.1.0]: https://github.com/bitcoin-core/secp256k1/commit/423b6d19d373f1224fd671a982584d7e7900bc93
diff --git a/secp256k1-sys/depend/secp256k1/CMakeLists.txt b/secp256k1-sys/depend/secp256k1/CMakeLists.txt
new file mode 100644
index 000000000..cdac47ba9
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/CMakeLists.txt
@@ -0,0 +1,341 @@
+cmake_minimum_required(VERSION 3.13)
+
+if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.15)
+  # MSVC runtime library flags are selected by the CMAKE_MSVC_RUNTIME_LIBRARY abstraction.
+  cmake_policy(SET CMP0091 NEW)
+  # MSVC warning flags are not in CMAKE_<LANG>_FLAGS by default.
+  cmake_policy(SET CMP0092 NEW)
+endif()
+
+project(libsecp256k1
+  # The package (a.k.a. release) version is based on semantic versioning 2.0.0 of
+  # the API. All changes in experimental modules are treated as
+  # backwards-compatible and therefore at most increase the minor version.
+  VERSION 0.4.0
+  DESCRIPTION "Optimized C library for ECDSA signatures and secret/public key operations on curve secp256k1."
+  HOMEPAGE_URL "https://github.com/bitcoin-core/secp256k1"
+  LANGUAGES C
+)
+
+if(CMAKE_VERSION VERSION_LESS 3.21)
+  get_directory_property(parent_directory PARENT_DIRECTORY)
+  if(parent_directory)
+    set(PROJECT_IS_TOP_LEVEL OFF CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+    set(${PROJECT_NAME}_IS_TOP_LEVEL OFF CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+  else()
+    set(PROJECT_IS_TOP_LEVEL ON CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+    set(${PROJECT_NAME}_IS_TOP_LEVEL ON CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+  endif()
+  unset(parent_directory)
+endif()
+
+# The library version is based on libtool versioning of the ABI. The set of
+# rules for updating the version can be found here:
+# https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
+# All changes in experimental modules are treated as if they don't affect the
+# interface and therefore only increase the revision.
+set(${PROJECT_NAME}_LIB_VERSION_CURRENT 3)
+set(${PROJECT_NAME}_LIB_VERSION_REVISION 0)
+set(${PROJECT_NAME}_LIB_VERSION_AGE 1)
+
+set(CMAKE_C_STANDARD 90)
+set(CMAKE_C_EXTENSIONS OFF)
+
+list(APPEND CMAKE_MODULE_PATH ${PROJECT_SOURCE_DIR}/cmake)
+
+option(BUILD_SHARED_LIBS "Build shared libraries." ON)
+option(SECP256K1_DISABLE_SHARED "Disable shared library. Overrides BUILD_SHARED_LIBS." OFF)
+if(SECP256K1_DISABLE_SHARED)
+  set(BUILD_SHARED_LIBS OFF)
+endif()
+
+option(SECP256K1_INSTALL "Enable installation." ${PROJECT_IS_TOP_LEVEL})
+
+option(SECP256K1_ENABLE_MODULE_ECDH "Enable ECDH module." ON)
+if(SECP256K1_ENABLE_MODULE_ECDH)
+  add_compile_definitions(ENABLE_MODULE_ECDH=1)
+endif()
+
+option(SECP256K1_ENABLE_MODULE_RECOVERY "Enable ECDSA pubkey recovery module." OFF)
+if(SECP256K1_ENABLE_MODULE_RECOVERY)
+  add_compile_definitions(ENABLE_MODULE_RECOVERY=1)
+endif()
+
+option(SECP256K1_ENABLE_MODULE_EXTRAKEYS "Enable extrakeys module." ON)
+option(SECP256K1_ENABLE_MODULE_SCHNORRSIG "Enable schnorrsig module." ON)
+if(SECP256K1_ENABLE_MODULE_SCHNORRSIG)
+  set(SECP256K1_ENABLE_MODULE_EXTRAKEYS ON)
+  add_compile_definitions(ENABLE_MODULE_SCHNORRSIG=1)
+endif()
+if(SECP256K1_ENABLE_MODULE_EXTRAKEYS)
+  add_compile_definitions(ENABLE_MODULE_EXTRAKEYS=1)
+endif()
+
+option(SECP256K1_ENABLE_MODULE_ELLSWIFT "Enable ElligatorSwift module." ON)
+if(SECP256K1_ENABLE_MODULE_ELLSWIFT)
+  add_compile_definitions(ENABLE_MODULE_ELLSWIFT=1)
+endif()
+
+option(SECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS "Enable external default callback functions." OFF)
+if(SECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS)
+  add_compile_definitions(USE_EXTERNAL_DEFAULT_CALLBACKS=1)
+endif()
+
+set(SECP256K1_ECMULT_WINDOW_SIZE "AUTO" CACHE STRING "Window size for ecmult precomputation for verification, specified as integer in range [2..24]. \"AUTO\" is a reasonable setting for desktop machines (currently 15). [default=AUTO]")
+set_property(CACHE SECP256K1_ECMULT_WINDOW_SIZE PROPERTY STRINGS "AUTO" 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24)
+include(CheckStringOptionValue)
+check_string_option_value(SECP256K1_ECMULT_WINDOW_SIZE)
+if(SECP256K1_ECMULT_WINDOW_SIZE STREQUAL "AUTO")
+  set(SECP256K1_ECMULT_WINDOW_SIZE 15)
+endif()
+add_compile_definitions(ECMULT_WINDOW_SIZE=${SECP256K1_ECMULT_WINDOW_SIZE})
+
+set(SECP256K1_ECMULT_GEN_PREC_BITS "AUTO" CACHE STRING "Precision bits to tune the precomputed table size for signing, specified as integer 2, 4 or 8. \"AUTO\" is a reasonable setting for desktop machines (currently 4). [default=AUTO]")
+set_property(CACHE SECP256K1_ECMULT_GEN_PREC_BITS PROPERTY STRINGS "AUTO" 2 4 8)
+check_string_option_value(SECP256K1_ECMULT_GEN_PREC_BITS)
+if(SECP256K1_ECMULT_GEN_PREC_BITS STREQUAL "AUTO")
+  set(SECP256K1_ECMULT_GEN_PREC_BITS 4)
+endif()
+add_compile_definitions(ECMULT_GEN_PREC_BITS=${SECP256K1_ECMULT_GEN_PREC_BITS})
+
+set(SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY "OFF" CACHE STRING "Test-only override of the (autodetected by the C code) \"widemul\" setting. Legal values are: \"OFF\", \"int128_struct\", \"int128\" or \"int64\". [default=OFF]")
+set_property(CACHE SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY PROPERTY STRINGS "OFF" "int128_struct" "int128" "int64")
+check_string_option_value(SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY)
+if(SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY)
+  string(TOUPPER "${SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY}" widemul_upper_value)
+  add_compile_definitions(USE_FORCE_WIDEMUL_${widemul_upper_value}=1)
+endif()
+mark_as_advanced(FORCE SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY)
+
+set(SECP256K1_ASM "AUTO" CACHE STRING "Assembly optimizations to use: \"AUTO\", \"OFF\", \"x86_64\" or \"arm32\" (experimental). [default=AUTO]")
+set_property(CACHE SECP256K1_ASM PROPERTY STRINGS "AUTO" "OFF" "x86_64" "arm32")
+check_string_option_value(SECP256K1_ASM)
+if(SECP256K1_ASM STREQUAL "arm32")
+  enable_language(ASM)
+  include(CheckArm32Assembly)
+  check_arm32_assembly()
+  if(HAVE_ARM32_ASM)
+    add_compile_definitions(USE_EXTERNAL_ASM=1)
+  else()
+    message(FATAL_ERROR "ARM32 assembly optimization requested but not available.")
+  endif()
+elseif(SECP256K1_ASM)
+  include(CheckX86_64Assembly)
+  check_x86_64_assembly()
+  if(HAVE_X86_64_ASM)
+    set(SECP256K1_ASM "x86_64")
+    add_compile_definitions(USE_ASM_X86_64=1)
+  elseif(SECP256K1_ASM STREQUAL "AUTO")
+    set(SECP256K1_ASM "OFF")
+  else()
+    message(FATAL_ERROR "x86_64 assembly optimization requested but not available.")
+  endif()
+endif()
+
+option(SECP256K1_EXPERIMENTAL "Allow experimental configuration options." OFF)
+if(NOT SECP256K1_EXPERIMENTAL)
+  if(SECP256K1_ASM STREQUAL "arm32")
+    message(FATAL_ERROR "ARM32 assembly optimization is experimental. Use -DSECP256K1_EXPERIMENTAL=ON to allow.")
+  endif()
+endif()
+
+set(SECP256K1_VALGRIND "AUTO" CACHE STRING "Build with extra checks for running inside Valgrind. [default=AUTO]")
+set_property(CACHE SECP256K1_VALGRIND PROPERTY STRINGS "AUTO" "OFF" "ON")
+check_string_option_value(SECP256K1_VALGRIND)
+if(SECP256K1_VALGRIND)
+  find_package(Valgrind MODULE)
+  if(Valgrind_FOUND)
+    set(SECP256K1_VALGRIND ON)
+    include_directories(${Valgrind_INCLUDE_DIR})
+    add_compile_definitions(VALGRIND)
+  elseif(SECP256K1_VALGRIND STREQUAL "AUTO")
+    set(SECP256K1_VALGRIND OFF)
+  else()
+    message(FATAL_ERROR "Valgrind support requested but valgrind/memcheck.h header not available.")
+  endif()
+endif()
+
+option(SECP256K1_BUILD_BENCHMARK "Build benchmarks." ON)
+option(SECP256K1_BUILD_TESTS "Build tests." ON)
+option(SECP256K1_BUILD_EXHAUSTIVE_TESTS "Build exhaustive tests." ON)
+option(SECP256K1_BUILD_CTIME_TESTS "Build constant-time tests." ${SECP256K1_VALGRIND})
+option(SECP256K1_BUILD_EXAMPLES "Build examples." OFF)
+
+# Redefine configuration flags.
+# We leave assertions on, because they are only used in the examples, and we want them always on there.
+if(MSVC)
+  string(REGEX REPLACE "/DNDEBUG[ \t\r\n]*" "" CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO}")
+  string(REGEX REPLACE "/DNDEBUG[ \t\r\n]*" "" CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
+  string(REGEX REPLACE "/DNDEBUG[ \t\r\n]*" "" CMAKE_C_FLAGS_MINSIZEREL "${CMAKE_C_FLAGS_MINSIZEREL}")
+else()
+  string(REGEX REPLACE "-DNDEBUG[ \t\r\n]*" "" CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO}")
+  string(REGEX REPLACE "-DNDEBUG[ \t\r\n]*" "" CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
+  string(REGEX REPLACE "-DNDEBUG[ \t\r\n]*" "" CMAKE_C_FLAGS_MINSIZEREL "${CMAKE_C_FLAGS_MINSIZEREL}")
+  # Prefer -O2 optimization level. (-O3 is CMake's default for Release for many compilers.)
+  string(REGEX REPLACE "-O3[ \t\r\n]*" "-O2" CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
+endif()
+
+# Define custom "Coverage" build type.
+set(CMAKE_C_FLAGS_COVERAGE "${CMAKE_C_FLAGS_RELWITHDEBINFO} -O0 -DCOVERAGE=1 --coverage" CACHE STRING
+  "Flags used by the C compiler during \"Coverage\" builds."
+  FORCE
+)
+set(CMAKE_EXE_LINKER_FLAGS_COVERAGE "${CMAKE_EXE_LINKER_FLAGS_RELWITHDEBINFO} --coverage" CACHE STRING
+  "Flags used for linking binaries during \"Coverage\" builds."
+  FORCE
+)
+set(CMAKE_SHARED_LINKER_FLAGS_COVERAGE "${CMAKE_SHARED_LINKER_FLAGS_RELWITHDEBINFO} --coverage" CACHE STRING
+  "Flags used by the shared libraries linker during \"Coverage\" builds."
+  FORCE
+)
+mark_as_advanced(
+  CMAKE_C_FLAGS_COVERAGE
+  CMAKE_EXE_LINKER_FLAGS_COVERAGE
+  CMAKE_SHARED_LINKER_FLAGS_COVERAGE
+)
+
+get_property(is_multi_config GLOBAL PROPERTY GENERATOR_IS_MULTI_CONFIG)
+set(default_build_type "RelWithDebInfo")
+if(is_multi_config)
+  set(CMAKE_CONFIGURATION_TYPES "${default_build_type}" "Release" "Debug" "MinSizeRel" "Coverage" CACHE STRING
+    "Supported configuration types."
+    FORCE
+  )
+else()
+  set_property(CACHE CMAKE_BUILD_TYPE PROPERTY
+    STRINGS "${default_build_type}" "Release" "Debug" "MinSizeRel" "Coverage"
+  )
+  if(NOT CMAKE_BUILD_TYPE)
+    message(STATUS "Setting build type to \"${default_build_type}\" as none was specified")
+    set(CMAKE_BUILD_TYPE "${default_build_type}" CACHE STRING
+      "Choose the type of build."
+      FORCE
+    )
+  endif()
+endif()
+
+include(TryAppendCFlags)
+if(MSVC)
+  # Keep the following commands ordered lexicographically.
+  try_append_c_flags(/W3) # Production quality warning level.
+  try_append_c_flags(/wd4146) # Disable warning C4146 "unary minus operator applied to unsigned type, result still unsigned".
+  try_append_c_flags(/wd4244) # Disable warning C4244 "'conversion' conversion from 'type1' to 'type2', possible loss of data".
+  try_append_c_flags(/wd4267) # Disable warning C4267 "'var' : conversion from 'size_t' to 'type', possible loss of data".
+  # Eliminate deprecation warnings for the older, less secure functions.
+  add_compile_definitions(_CRT_SECURE_NO_WARNINGS)
+else()
+  # Keep the following commands ordered lexicographically.
+  try_append_c_flags(-pedantic)
+  try_append_c_flags(-Wall) # GCC >= 2.95 and probably many other compilers.
+  try_append_c_flags(-Wcast-align) # GCC >= 2.95.
+  try_append_c_flags(-Wcast-align=strict) # GCC >= 8.0.
+  try_append_c_flags(-Wconditional-uninitialized) # Clang >= 3.0 only.
+  try_append_c_flags(-Wextra) # GCC >= 3.4, this is the newer name of -W, which we don't use because older GCCs will warn about unused functions.
+  try_append_c_flags(-Wnested-externs)
+  try_append_c_flags(-Wno-long-long) # GCC >= 3.0, -Wlong-long is implied by -pedantic.
+  try_append_c_flags(-Wno-overlength-strings) # GCC >= 4.2, -Woverlength-strings is implied by -pedantic.
+  try_append_c_flags(-Wno-unused-function) # GCC >= 3.0, -Wunused-function is implied by -Wall.
+  try_append_c_flags(-Wreserved-identifier) # Clang >= 13.0 only.
+  try_append_c_flags(-Wshadow)
+  try_append_c_flags(-Wstrict-prototypes)
+  try_append_c_flags(-Wundef)
+endif()
+
+set(CMAKE_C_VISIBILITY_PRESET hidden)
+
+# Ask CTest to create a "check" target (e.g., make check) as alias for the "test" target.
+# CTEST_TEST_TARGET_ALIAS is not documented but supposed to be user-facing.
+# See: https://gitlab.kitware.com/cmake/cmake/-/commit/816c9d1aa1f2b42d40c81a991b68c96eb12b6d2
+set(CTEST_TEST_TARGET_ALIAS check)
+include(CTest)
+# We do not use CTest's BUILD_TESTING because a single toggle for all tests is too coarse for our needs.
+mark_as_advanced(BUILD_TESTING)
+if(SECP256K1_BUILD_BENCHMARK OR SECP256K1_BUILD_TESTS OR SECP256K1_BUILD_EXHAUSTIVE_TESTS OR SECP256K1_BUILD_CTIME_TESTS OR SECP256K1_BUILD_EXAMPLES)
+  enable_testing()
+endif()
+
+add_subdirectory(src)
+if(SECP256K1_BUILD_EXAMPLES)
+  add_subdirectory(examples)
+endif()
+
+message("\n")
+message("secp256k1 configure summary")
+message("===========================")
+message("Build artifacts:")
+if(BUILD_SHARED_LIBS)
+  set(library_type "Shared")
+else()
+  set(library_type "Static")
+endif()
+
+message("  library type ........................ ${library_type}")
+message("Optional modules:")
+message("  ECDH ................................ ${SECP256K1_ENABLE_MODULE_ECDH}")
+message("  ECDSA pubkey recovery ............... ${SECP256K1_ENABLE_MODULE_RECOVERY}")
+message("  extrakeys ........................... ${SECP256K1_ENABLE_MODULE_EXTRAKEYS}")
+message("  schnorrsig .......................... ${SECP256K1_ENABLE_MODULE_SCHNORRSIG}")
+message("  ElligatorSwift ...................... ${SECP256K1_ENABLE_MODULE_ELLSWIFT}")
+message("Parameters:")
+message("  ecmult window size .................. ${SECP256K1_ECMULT_WINDOW_SIZE}")
+message("  ecmult gen precision bits ........... ${SECP256K1_ECMULT_GEN_PREC_BITS}")
+message("Optional features:")
+message("  assembly optimization ............... ${SECP256K1_ASM}")
+message("  external callbacks .................. ${SECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS}")
+if(SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY)
+  message("  wide multiplication (test-only) ..... ${SECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY}")
+endif()
+message("Optional binaries:")
+message("  benchmark ........................... ${SECP256K1_BUILD_BENCHMARK}")
+message("  noverify_tests ...................... ${SECP256K1_BUILD_TESTS}")
+set(tests_status "${SECP256K1_BUILD_TESTS}")
+if(CMAKE_BUILD_TYPE STREQUAL "Coverage")
+  set(tests_status OFF)
+endif()
+message("  tests ............................... ${tests_status}")
+message("  exhaustive tests .................... ${SECP256K1_BUILD_EXHAUSTIVE_TESTS}")
+message("  ctime_tests ......................... ${SECP256K1_BUILD_CTIME_TESTS}")
+message("  examples ............................ ${SECP256K1_BUILD_EXAMPLES}")
+message("")
+if(CMAKE_CROSSCOMPILING)
+  set(cross_status "TRUE, for ${CMAKE_SYSTEM_NAME}, ${CMAKE_SYSTEM_PROCESSOR}")
+else()
+  set(cross_status "FALSE")
+endif()
+message("Cross compiling ....................... ${cross_status}")
+message("Valgrind .............................. ${SECP256K1_VALGRIND}")
+get_directory_property(definitions COMPILE_DEFINITIONS)
+string(REPLACE ";" " " definitions "${definitions}")
+message("Preprocessor defined macros ........... ${definitions}")
+message("C compiler ............................ ${CMAKE_C_COMPILER}")
+message("CFLAGS ................................ ${CMAKE_C_FLAGS}")
+get_directory_property(compile_options COMPILE_OPTIONS)
+string(REPLACE ";" " " compile_options "${compile_options}")
+message("Compile options ....................... " ${compile_options})
+if(NOT is_multi_config)
+  message("Build type:")
+  message(" - CMAKE_BUILD_TYPE ................... ${CMAKE_BUILD_TYPE}")
+  string(TOUPPER "${CMAKE_BUILD_TYPE}" build_type)
+  message(" - CFLAGS ............................. ${CMAKE_C_FLAGS_${build_type}}")
+  message(" - LDFLAGS for executables ............ ${CMAKE_EXE_LINKER_FLAGS_${build_type}}")
+  message(" - LDFLAGS for shared libraries ....... ${CMAKE_SHARED_LINKER_FLAGS_${build_type}}")
+else()
+  message("Supported configurations .............. ${CMAKE_CONFIGURATION_TYPES}")
+  message("RelWithDebInfo configuration:")
+  message(" - CFLAGS ............................. ${CMAKE_C_FLAGS_RELWITHDEBINFO}")
+  message(" - LDFLAGS for executables ............ ${CMAKE_EXE_LINKER_FLAGS_RELWITHDEBINFO}")
+  message(" - LDFLAGS for shared libraries ....... ${CMAKE_SHARED_LINKER_FLAGS_RELWITHDEBINFO}")
+  message("Debug configuration:")
+  message(" - CFLAGS ............................. ${CMAKE_C_FLAGS_DEBUG}")
+  message(" - LDFLAGS for executables ............ ${CMAKE_EXE_LINKER_FLAGS_DEBUG}")
+  message(" - LDFLAGS for shared libraries ....... ${CMAKE_SHARED_LINKER_FLAGS_DEBUG}")
+endif()
+message("\n")
+if(SECP256K1_EXPERIMENTAL)
+  message(
+    "  ******\n"
+    "  WARNING: experimental build\n"
+    "  Experimental features do not have stable APIs or properties, and may not be safe for production use.\n"
+    "  ******\n"
+  )
+endif()
diff --git a/secp256k1-sys/depend/secp256k1/CMakePresets.json b/secp256k1-sys/depend/secp256k1/CMakePresets.json
new file mode 100644
index 000000000..b35cd8057
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/CMakePresets.json
@@ -0,0 +1,19 @@
+{
+  "cmakeMinimumRequired": {"major": 3, "minor": 21, "patch": 0}, 
+  "version": 3,
+  "configurePresets": [
+    {
+      "name": "dev-mode",
+      "displayName": "Development mode (intended only for developers of the library)",
+      "cacheVariables": {
+        "SECP256K1_EXPERIMENTAL": "ON",
+        "SECP256K1_ENABLE_MODULE_RECOVERY": "ON",
+        "SECP256K1_BUILD_EXAMPLES": "ON"
+      },
+      "warnings": {
+        "dev": true,
+        "uninitialized": true
+      }
+    }
+  ]
+}
diff --git a/secp256k1-sys/depend/secp256k1/Makefile.am b/secp256k1-sys/depend/secp256k1/Makefile.am
index 579a0fd22..3edc37096 100644
--- a/secp256k1-sys/depend/secp256k1/Makefile.am
+++ b/secp256k1-sys/depend/secp256k1/Makefile.am
@@ -1,5 +1,3 @@
-.PHONY: clean-precomp precomp
-
 ACLOCAL_AMFLAGS = -I build-aux/m4
 
 # AM_CFLAGS will be automatically prepended to CFLAGS by Automake when compiling some foo
@@ -8,7 +6,7 @@ AM_CFLAGS = $(SECP_CFLAGS)
 
 lib_LTLIBRARIES = libsecp256k1.la
 include_HEADERS = include/secp256k1.h
-include_HEADERS += include/rustsecp256k1_v0_8_1_preallocated.h
+include_HEADERS += include/rustsecp256k1_v0_9_0_preallocated.h
 noinst_HEADERS =
 noinst_HEADERS += src/scalar.h
 noinst_HEADERS += src/scalar_4x64.h
@@ -47,6 +45,7 @@ noinst_HEADERS += src/modinv64_impl.h
 noinst_HEADERS += src/precomputed_ecmult.h
 noinst_HEADERS += src/precomputed_ecmult_gen.h
 noinst_HEADERS += src/assumptions.h
+noinst_HEADERS += src/checkmem.h
 noinst_HEADERS += src/util.h
 noinst_HEADERS += src/int128.h
 noinst_HEADERS += src/int128_impl.h
@@ -64,19 +63,22 @@ noinst_HEADERS += src/hash_impl.h
 noinst_HEADERS += src/field.h
 noinst_HEADERS += src/field_impl.h
 noinst_HEADERS += src/bench.h
+noinst_HEADERS += src/wycheproof/ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.h
 noinst_HEADERS += contrib/lax_der_parsing.h
 noinst_HEADERS += contrib/lax_der_parsing.c
 noinst_HEADERS += contrib/lax_der_privatekey_parsing.h
 noinst_HEADERS += contrib/lax_der_privatekey_parsing.c
-noinst_HEADERS += examples/random.h
+noinst_HEADERS += examples/examples_util.h
 
-PRECOMPUTED_LIB = librustsecp256k1_v0_8_1_precomputed.la
+PRECOMPUTED_LIB = librustsecp256k1_v0_9_0_precomputed.la
 noinst_LTLIBRARIES = $(PRECOMPUTED_LIB)
-librustsecp256k1_v0_8_1_precomputed_la_SOURCES =  src/precomputed_ecmult.c src/precomputed_ecmult_gen.c
-librustsecp256k1_v0_8_1_precomputed_la_CPPFLAGS = $(SECP_INCLUDES)
+librustsecp256k1_v0_9_0_precomputed_la_SOURCES =  src/precomputed_ecmult.c src/precomputed_ecmult_gen.c
+# We need `-I$(top_srcdir)/src` in VPATH builds if librustsecp256k1_v0_9_0_precomputed_la_SOURCES have been recreated in the build tree.
+# This helps users and packagers who insist on recreating the precomputed files (e.g., Gentoo).
+librustsecp256k1_v0_9_0_precomputed_la_CPPFLAGS = -I$(top_srcdir)/src $(SECP_CONFIG_DEFINES)
 
 if USE_EXTERNAL_ASM
-COMMON_LIB = librustsecp256k1_v0_8_1_common.la
+COMMON_LIB = librustsecp256k1_v0_9_0_common.la
 else
 COMMON_LIB =
 endif
@@ -87,60 +89,63 @@ pkgconfig_DATA = libsecp256k1.pc
 
 if USE_EXTERNAL_ASM
 if USE_ASM_ARM
-librustsecp256k1_v0_8_1_common_la_SOURCES = src/asm/field_10x26_arm.s
+librustsecp256k1_v0_9_0_common_la_SOURCES = src/asm/field_10x26_arm.s
 endif
 endif
 
-librustsecp256k1_v0_8_1_la_SOURCES = src/secp256k1.c
-librustsecp256k1_v0_8_1_la_CPPFLAGS = $(SECP_INCLUDES)
-librustsecp256k1_v0_8_1_la_LIBADD = $(SECP_LIBS) $(COMMON_LIB) $(PRECOMPUTED_LIB)
-librustsecp256k1_v0_8_1_la_LDFLAGS = -no-undefined -version-info $(LIB_VERSION_CURRENT):$(LIB_VERSION_REVISION):$(LIB_VERSION_AGE)
-
-if VALGRIND_ENABLED
-librustsecp256k1_v0_8_1_la_CPPFLAGS += -DVALGRIND
-endif
+librustsecp256k1_v0_9_0_la_SOURCES = src/secp256k1.c
+librustsecp256k1_v0_9_0_la_CPPFLAGS = $(SECP_CONFIG_DEFINES)
+librustsecp256k1_v0_9_0_la_LIBADD = $(COMMON_LIB) $(PRECOMPUTED_LIB)
+librustsecp256k1_v0_9_0_la_LDFLAGS = -no-undefined -version-info $(LIB_VERSION_CURRENT):$(LIB_VERSION_REVISION):$(LIB_VERSION_AGE)
 
 noinst_PROGRAMS =
 if USE_BENCHMARK
 noinst_PROGRAMS += bench bench_internal bench_ecmult
 bench_SOURCES = src/bench.c
-bench_LDADD = libsecp256k1.la $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB)
+bench_LDADD = libsecp256k1.la
+bench_CPPFLAGS = $(SECP_CONFIG_DEFINES)
 bench_internal_SOURCES = src/bench_internal.c
-bench_internal_LDADD = $(SECP_LIBS) $(COMMON_LIB) $(PRECOMPUTED_LIB)
-bench_internal_CPPFLAGS = $(SECP_INCLUDES)
+bench_internal_LDADD = $(COMMON_LIB) $(PRECOMPUTED_LIB)
+bench_internal_CPPFLAGS = $(SECP_CONFIG_DEFINES)
 bench_ecmult_SOURCES = src/bench_ecmult.c
-bench_ecmult_LDADD = $(SECP_LIBS) $(COMMON_LIB) $(PRECOMPUTED_LIB)
-bench_ecmult_CPPFLAGS = $(SECP_INCLUDES)
+bench_ecmult_LDADD = $(COMMON_LIB) $(PRECOMPUTED_LIB)
+bench_ecmult_CPPFLAGS = $(SECP_CONFIG_DEFINES)
 endif
 
 TESTS =
 if USE_TESTS
+TESTS += noverify_tests
+noinst_PROGRAMS += noverify_tests
+noverify_tests_SOURCES = src/tests.c
+noverify_tests_CPPFLAGS = $(SECP_CONFIG_DEFINES)
+noverify_tests_LDADD = $(COMMON_LIB) $(PRECOMPUTED_LIB)
+noverify_tests_LDFLAGS = -static
+if !ENABLE_COVERAGE
+TESTS += tests
 noinst_PROGRAMS += tests
-tests_SOURCES = src/tests.c
-tests_CPPFLAGS = $(SECP_INCLUDES) $(SECP_TEST_INCLUDES)
-if VALGRIND_ENABLED
-tests_CPPFLAGS += -DVALGRIND
-noinst_PROGRAMS += valgrind_ctime_test
-valgrind_ctime_test_SOURCES = src/valgrind_ctime_test.c
-valgrind_ctime_test_LDADD = libsecp256k1.la $(SECP_LIBS) $(COMMON_LIB)
+tests_SOURCES  = $(noverify_tests_SOURCES)
+tests_CPPFLAGS = $(noverify_tests_CPPFLAGS) -DVERIFY
+tests_LDADD    = $(noverify_tests_LDADD)
+tests_LDFLAGS  = $(noverify_tests_LDFLAGS)
 endif
-if !ENABLE_COVERAGE
-tests_CPPFLAGS += -DVERIFY
 endif
-tests_LDADD = $(SECP_LIBS) $(SECP_TEST_LIBS) $(COMMON_LIB) $(PRECOMPUTED_LIB)
-tests_LDFLAGS = -static
-TESTS += tests
+
+if USE_CTIME_TESTS
+noinst_PROGRAMS += ctime_tests
+ctime_tests_SOURCES = src/ctime_tests.c
+ctime_tests_LDADD = libsecp256k1.la
+ctime_tests_CPPFLAGS = $(SECP_CONFIG_DEFINES)
 endif
 
 if USE_EXHAUSTIVE_TESTS
 noinst_PROGRAMS += exhaustive_tests
 exhaustive_tests_SOURCES = src/tests_exhaustive.c
-exhaustive_tests_CPPFLAGS = $(SECP_INCLUDES)
+exhaustive_tests_CPPFLAGS = $(SECP_CONFIG_DEFINES)
 if !ENABLE_COVERAGE
 exhaustive_tests_CPPFLAGS += -DVERIFY
 endif
 # Note: do not include $(PRECOMPUTED_LIB) in exhaustive_tests (it uses runtime-generated tables).
-exhaustive_tests_LDADD = $(SECP_LIBS) $(COMMON_LIB)
+exhaustive_tests_LDADD = $(COMMON_LIB)
 exhaustive_tests_LDFLAGS = -static
 TESTS += exhaustive_tests
 endif
@@ -148,7 +153,7 @@ endif
 if USE_EXAMPLES
 noinst_PROGRAMS += ecdsa_example
 ecdsa_example_SOURCES = examples/ecdsa.c
-ecdsa_example_CPPFLAGS = -I$(top_srcdir)/include
+ecdsa_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
 ecdsa_example_LDADD = libsecp256k1.la
 ecdsa_example_LDFLAGS = -static
 if BUILD_WINDOWS
@@ -158,7 +163,7 @@ TESTS += ecdsa_example
 if ENABLE_MODULE_ECDH
 noinst_PROGRAMS += ecdh_example
 ecdh_example_SOURCES = examples/ecdh.c
-ecdh_example_CPPFLAGS = -I$(top_srcdir)/include
+ecdh_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
 ecdh_example_LDADD = libsecp256k1.la
 ecdh_example_LDFLAGS = -static
 if BUILD_WINDOWS
@@ -169,7 +174,7 @@ endif
 if ENABLE_MODULE_SCHNORRSIG
 noinst_PROGRAMS += schnorr_example
 schnorr_example_SOURCES = examples/schnorr.c
-schnorr_example_CPPFLAGS = -I$(top_srcdir)/include
+schnorr_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
 schnorr_example_LDADD = libsecp256k1.la
 schnorr_example_LDFLAGS = -static
 if BUILD_WINDOWS
@@ -184,19 +189,19 @@ EXTRA_PROGRAMS = precompute_ecmult precompute_ecmult_gen
 CLEANFILES = $(EXTRA_PROGRAMS)
 
 precompute_ecmult_SOURCES = src/precompute_ecmult.c
-precompute_ecmult_CPPFLAGS = $(SECP_INCLUDES)
-precompute_ecmult_LDADD = $(SECP_LIBS) $(COMMON_LIB)
+precompute_ecmult_CPPFLAGS = $(SECP_CONFIG_DEFINES) -DVERIFY
+precompute_ecmult_LDADD = $(COMMON_LIB)
 
 precompute_ecmult_gen_SOURCES = src/precompute_ecmult_gen.c
-precompute_ecmult_gen_CPPFLAGS = $(SECP_INCLUDES)
-precompute_ecmult_gen_LDADD = $(SECP_LIBS) $(COMMON_LIB)
+precompute_ecmult_gen_CPPFLAGS = $(SECP_CONFIG_DEFINES) -DVERIFY
+precompute_ecmult_gen_LDADD = $(COMMON_LIB)
 
 # See Automake manual, Section "Errors with distclean".
 # We don't list any dependencies for the prebuilt files here because
 # otherwise make's decision whether to rebuild them (even in the first
 # build by a normal user) depends on mtimes, and thus is very fragile.
 # This means that rebuilds of the prebuilt files always need to be
-# forced by deleting them, e.g., by invoking `make clean-precomp`.
+# forced by deleting them.
 src/precomputed_ecmult.c:
 	$(MAKE) $(AM_MAKEFLAGS) precompute_ecmult$(EXEEXT)
 	./precompute_ecmult$(EXEEXT)
@@ -211,11 +216,29 @@ precomp: $(PRECOMP)
 # e.g., after `make maintainer-clean`).
 BUILT_SOURCES = $(PRECOMP)
 
-maintainer-clean-local: clean-precomp
-
+.PHONY: clean-precomp
 clean-precomp:
 	rm -f $(PRECOMP)
+maintainer-clean-local: clean-precomp
+
+### Pregenerated test vectors
+### (see the comments in the previous section for detailed rationale)
+TESTVECTORS = src/wycheproof/ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.h
+
+src/wycheproof/ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.h:
+	mkdir -p $(@D)
+	python3 $(top_srcdir)/tools/tests_wycheproof_generate.py $(top_srcdir)/src/wycheproof/ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.json > $@
+
+testvectors: $(TESTVECTORS)
 
+BUILT_SOURCES += $(TESTVECTORS)
+
+.PHONY: clean-testvectors
+clean-testvectors:
+	rm -f $(TESTVECTORS)
+maintainer-clean-local: clean-testvectors
+
+### Additional files to distribute
 EXTRA_DIST = autogen.sh CHANGELOG.md SECURITY.md
 EXTRA_DIST += doc/release-process.md doc/safegcd_implementation.md
 EXTRA_DIST += examples/EXAMPLES_COPYING
@@ -223,8 +246,11 @@ EXTRA_DIST += sage/gen_exhaustive_groups.sage
 EXTRA_DIST += sage/gen_split_lambda_constants.sage
 EXTRA_DIST += sage/group_prover.sage
 EXTRA_DIST += sage/prove_group_implementations.sage
-EXTRA_DIST += sage/rustsecp256k1_v0_8_1_params.sage
+EXTRA_DIST += sage/rustsecp256k1_v0_9_0_params.sage
 EXTRA_DIST += sage/weierstrass_prover.sage
+EXTRA_DIST += src/wycheproof/WYCHEPROOF_COPYING
+EXTRA_DIST += src/wycheproof/ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.json
+EXTRA_DIST += tools/tests_wycheproof_generate.py
 
 if ENABLE_MODULE_ECDH
 include src/modules/ecdh/Makefile.am.include
@@ -241,3 +267,7 @@ endif
 if ENABLE_MODULE_SCHNORRSIG
 include src/modules/schnorrsig/Makefile.am.include
 endif
+
+if ENABLE_MODULE_ELLSWIFT
+include src/modules/ellswift/Makefile.am.include
+endif
diff --git a/secp256k1-sys/depend/secp256k1/README.md b/secp256k1-sys/depend/secp256k1/README.md
index ffdc9aeae..19dabe850 100644
--- a/secp256k1-sys/depend/secp256k1/README.md
+++ b/secp256k1-sys/depend/secp256k1/README.md
@@ -60,10 +60,8 @@ Implementation details
   * Optional runtime blinding which attempts to frustrate differential power analysis.
   * The precomputed tables add and eventually subtract points for which no known scalar (secret key) is known, preventing even an attacker with control over the secret key used to control the data internally.
 
-Build steps
------------
-
-libsecp256k1 is built using autotools:
+Building with Autotools
+-----------------------
 
     $ ./autogen.sh
     $ ./configure
@@ -73,6 +71,43 @@ libsecp256k1 is built using autotools:
 
 To compile optional modules (such as Schnorr signatures), you need to run `./configure` with additional flags (such as `--enable-module-schnorrsig`). Run `./configure --help` to see the full list of available flags.
 
+Building with CMake (experimental)
+----------------------------------
+
+To maintain a pristine source tree, CMake encourages to perform an out-of-source build by using a separate dedicated build tree.
+
+### Building on POSIX systems
+
+    $ mkdir build && cd build
+    $ cmake ..
+    $ make
+    $ make check  # run the test suite
+    $ sudo make install  # optional
+
+To compile optional modules (such as Schnorr signatures), you need to run `cmake` with additional flags (such as `-DSECP256K1_ENABLE_MODULE_SCHNORRSIG=ON`). Run `cmake .. -LH` to see the full list of available flags.
+
+### Cross compiling
+
+To alleviate issues with cross compiling, preconfigured toolchain files are available in the `cmake` directory.
+For example, to cross compile for Windows:
+
+    $ cmake .. -DCMAKE_TOOLCHAIN_FILE=../cmake/x86_64-w64-mingw32.toolchain.cmake
+
+To cross compile for Android with [NDK](https://developer.android.com/ndk/guides/cmake) (using NDK's toolchain file, and assuming the `ANDROID_NDK_ROOT` environment variable has been set):
+
+    $ cmake .. -DCMAKE_TOOLCHAIN_FILE="${ANDROID_NDK_ROOT}/build/cmake/android.toolchain.cmake" -DANDROID_ABI=arm64-v8a -DANDROID_PLATFORM=28
+
+### Building on Windows
+
+To build on Windows with Visual Studio, a proper [generator](https://cmake.org/cmake/help/latest/manual/cmake-generators.7.html#visual-studio-generators) must be specified for a new build tree.
+
+The following example assumes using of Visual Studio 2022 and CMake v3.21+.
+
+In "Developer Command Prompt for VS 2022":
+
+    >cmake -G "Visual Studio 17 2022" -A x64 -S . -B build
+    >cmake --build build --config RelWithDebInfo
+
 Usage examples
 -----------
 Usage examples can be found in the [examples](examples) directory. To compile them you need to configure with `--enable-examples`.
diff --git a/secp256k1-sys/depend/secp256k1/build-aux/m4/bitcoin_secp.m4 b/secp256k1-sys/depend/secp256k1/build-aux/m4/bitcoin_secp.m4
index 98be915b6..11adef4f2 100644
--- a/secp256k1-sys/depend/secp256k1/build-aux/m4/bitcoin_secp.m4
+++ b/secp256k1-sys/depend/secp256k1/build-aux/m4/bitcoin_secp.m4
@@ -1,12 +1,31 @@
 dnl escape "$0x" below using the m4 quadrigaph @S|@, and escape it again with a \ for the shell.
-AC_DEFUN([SECP_64BIT_ASM_CHECK],[
+AC_DEFUN([SECP_X86_64_ASM_CHECK],[
 AC_MSG_CHECKING(for x86_64 assembly availability)
 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
   #include <stdint.h>]],[[
   uint64_t a = 11, tmp;
   __asm__ __volatile__("movq \@S|@0x100000000,%1; mulq %%rsi" : "+a"(a) : "S"(tmp) : "cc", "%rdx");
-  ]])],[has_64bit_asm=yes],[has_64bit_asm=no])
-AC_MSG_RESULT([$has_64bit_asm])
+  ]])], [has_x86_64_asm=yes], [has_x86_64_asm=no])
+AC_MSG_RESULT([$has_x86_64_asm])
+])
+
+AC_DEFUN([SECP_ARM32_ASM_CHECK], [
+  AC_MSG_CHECKING(for ARM32 assembly availability)
+  SECP_ARM32_ASM_CHECK_CFLAGS_saved_CFLAGS="$CFLAGS"
+  CFLAGS="-x assembler"
+  AC_LINK_IFELSE([AC_LANG_SOURCE([[
+    .syntax unified
+    .eabi_attribute 24, 1
+    .eabi_attribute 25, 1
+    .text
+    .global main
+    main:
+      ldr r0, =0x002A
+      mov r7, #1
+      swi 0   
+    ]])], [has_arm32_asm=yes], [has_arm32_asm=no])
+  AC_MSG_RESULT([$has_arm32_asm])
+  CFLAGS="$SECP_ARM32_ASM_CHECK_CFLAGS_saved_CFLAGS"
 ])
 
 AC_DEFUN([SECP_VALGRIND_CHECK],[
@@ -20,7 +39,8 @@ if test x"$has_valgrind" != x"yes"; then
     #if defined(NVALGRIND)
     #  error "Valgrind does not support this platform."
     #endif
-  ]])], [has_valgrind=yes; AC_DEFINE(HAVE_VALGRIND,1,[Define this symbol if valgrind is installed, and it supports the host platform])])
+  ]])], [has_valgrind=yes])
+  CPPFLAGS="$CPPFLAGS_TEMP"
 fi
 AC_MSG_RESULT($has_valgrind)
 ])
diff --git a/secp256k1-sys/depend/secp256k1/ci/cirrus.sh b/secp256k1-sys/depend/secp256k1/ci/ci.sh
similarity index 51%
rename from secp256k1-sys/depend/secp256k1/ci/cirrus.sh
rename to secp256k1-sys/depend/secp256k1/ci/ci.sh
index fb5854a77..719e7851e 100755
--- a/secp256k1-sys/depend/secp256k1/ci/cirrus.sh
+++ b/secp256k1-sys/depend/secp256k1/ci/ci.sh
@@ -1,42 +1,46 @@
 #!/bin/sh
 
-set -e
-set -x
+set -eux
 
 export LC_ALL=C
 
-# Print relevant CI environment to allow reproducing the job outside of CI.
+# Print commit and relevant CI environment to allow reproducing the job outside of CI.
+git show --no-patch
 print_environment() {
     # Turn off -x because it messes up the output
     set +x
     # There are many ways to print variable names and their content. This one
     # does not rely on bash.
-    for i in WERROR_CFLAGS MAKEFLAGS BUILD \
+    for var in WERROR_CFLAGS MAKEFLAGS BUILD \
             ECMULTWINDOW ECMULTGENPRECISION ASM WIDEMUL WITH_VALGRIND EXTRAFLAGS \
-            EXPERIMENTAL ECDH RECOVERY SCHNORRSIG \
-            SECP256K1_TEST_ITERS BENCH SECP256K1_BENCH_ITERS CTIMETEST\
+            EXPERIMENTAL ECDH RECOVERY SCHNORRSIG ELLSWIFT \
+            SECP256K1_TEST_ITERS BENCH SECP256K1_BENCH_ITERS CTIMETESTS\
             EXAMPLES \
-            WRAPPER_CMD CC AR NM HOST
+            HOST WRAPPER_CMD \
+            CC CFLAGS CPPFLAGS AR NM
     do
-        eval 'printf "%s %s " "$i=\"${'"$i"'}\""'
+        eval "isset=\${$var+x}"
+        if [ -n "$isset" ]; then
+            eval "val=\${$var}"
+            # shellcheck disable=SC2154
+            printf '%s="%s" ' "$var" "$val"
+        fi
     done
     echo "$0"
     set -x
 }
 print_environment
 
-# Start persistent wineserver if necessary.
-# This speeds up jobs with many invocations of wine (e.g., ./configure with MSVC) tremendously.
-case "$WRAPPER_CMD" in
-    *wine*)
-        # This is apparently only reliable when we run a dummy command such as "hh.exe" afterwards.
-        wineserver -p && wine hh.exe
+env >> test_env.log
+
+# If gcc is requested, assert that it's in fact gcc (and not some symlinked Apple clang).
+case "${CC:-undefined}" in
+    *gcc*)
+        $CC -v 2>&1 | grep -q "gcc version" || exit 1;
         ;;
 esac
 
-env >> test_env.log
-
-if [ -n "$CC" ]; then
+if [ -n "${CC+x}" ]; then
     # The MSVC compiler "cl" doesn't understand "-v"
     $CC -v || true
 fi
@@ -47,6 +51,22 @@ if [ -n "$WRAPPER_CMD" ]; then
     $WRAPPER_CMD --version
 fi
 
+# Workaround for https://bugs.kde.org/show_bug.cgi?id=452758 (fixed in valgrind 3.20.0).
+case "${CC:-undefined}" in
+    clang*)
+        if [ "$CTIMETESTS" = "yes" ] && [ "$WITH_VALGRIND" = "yes" ]
+        then
+            export CFLAGS="${CFLAGS:+$CFLAGS }-gdwarf-4"
+        else
+            case "$WRAPPER_CMD" in
+                valgrind*)
+                    export CFLAGS="${CFLAGS:+$CFLAGS }-gdwarf-4"
+                    ;;
+            esac
+        fi
+        ;;
+esac
+
 ./autogen.sh
 
 ./configure \
@@ -55,8 +75,10 @@ fi
     --with-ecmult-window="$ECMULTWINDOW" \
     --with-ecmult-gen-precision="$ECMULTGENPRECISION" \
     --enable-module-ecdh="$ECDH" --enable-module-recovery="$RECOVERY" \
+    --enable-module-ellswift="$ELLSWIFT" \
     --enable-module-schnorrsig="$SCHNORRSIG" \
     --enable-examples="$EXAMPLES" \
+    --enable-ctime-tests="$CTIMETESTS" \
     --with-valgrind="$WITH_VALGRIND" \
     --host="$HOST" $EXTRAFLAGS
 
@@ -73,14 +95,15 @@ export LOG_COMPILER="$WRAPPER_CMD"
 
 make "$BUILD"
 
+# Using the local `libtool` because on macOS the system's libtool has nothing to do with GNU libtool
+EXEC='./libtool --mode=execute'
+if [ -n "$WRAPPER_CMD" ]
+then
+    EXEC="$EXEC $WRAPPER_CMD"
+fi
+
 if [ "$BENCH" = "yes" ]
 then
-    # Using the local `libtool` because on macOS the system's libtool has nothing to do with GNU libtool
-    EXEC='./libtool --mode=execute'
-    if [ -n "$WRAPPER_CMD" ]
-    then
-        EXEC="$EXEC $WRAPPER_CMD"
-    fi
     {
         $EXEC ./bench_ecmult
         $EXEC ./bench_internal
@@ -88,21 +111,22 @@ then
     } >> bench.log 2>&1
 fi
 
-if [ "$CTIMETEST" = "yes" ]
+if [ "$CTIMETESTS" = "yes" ]
 then
-    ./libtool --mode=execute valgrind --error-exitcode=42 ./valgrind_ctime_test > valgrind_ctime_test.log 2>&1
+    if [ "$WITH_VALGRIND" = "yes" ]; then
+        ./libtool --mode=execute valgrind --error-exitcode=42 ./ctime_tests > ctime_tests.log 2>&1
+    else
+        $EXEC ./ctime_tests > ctime_tests.log 2>&1
+    fi
 fi
 
 # Rebuild precomputed files (if not cross-compiling).
 if [ -z "$HOST" ]
 then
-    make clean-precomp
-    make precomp
+    make clean-precomp clean-testvectors
+    make precomp testvectors
 fi
 
-# Shutdown wineserver again
-wineserver -k || true
-
 # Check that no repo files have been modified by the build.
 # (This fails for example if the precomp files need to be updated in the repo.)
 git diff --exit-code
diff --git a/secp256k1-sys/depend/secp256k1/ci/linux-debian.Dockerfile b/secp256k1-sys/depend/secp256k1/ci/linux-debian.Dockerfile
index a83a4e36d..e719907e8 100644
--- a/secp256k1-sys/depend/secp256k1/ci/linux-debian.Dockerfile
+++ b/secp256k1-sys/depend/secp256k1/ci/linux-debian.Dockerfile
@@ -1,4 +1,17 @@
-FROM debian:stable
+FROM debian:stable-slim
+
+SHELL ["/bin/bash", "-c"]
+
+WORKDIR /root
+
+# A too high maximum number of file descriptors (with the default value
+# inherited from the docker host) can cause issues with some of our tools:
+#  - sanitizers hanging: https://github.com/google/sanitizers/issues/1662 
+#  - valgrind crashing: https://stackoverflow.com/a/75293014
+# This is not be a problem on our CI hosts, but developers who run the image
+# on their machines may run into this (e.g., on Arch Linux), so warn them.
+# (Note that .bashrc is only executed in interactive bash shells.)
+RUN echo 'if [[ $(ulimit -n) -gt 200000 ]]; then echo "WARNING: Very high value reported by \"ulimit -n\". Consider passing \"--ulimit nofile=32768\" to \"docker run\"."; fi' >> /root/.bashrc
 
 RUN dpkg --add-architecture i386 && \
     dpkg --add-architecture s390x && \
@@ -11,27 +24,52 @@ RUN dpkg --add-architecture i386 && \
 RUN apt-get update && apt-get install --no-install-recommends -y \
         git ca-certificates \
         make automake libtool pkg-config dpkg-dev valgrind qemu-user \
-        gcc clang llvm libc6-dbg \
+        gcc clang llvm libclang-rt-dev libc6-dbg \
         g++ \
-        gcc-i686-linux-gnu libc6-dev-i386-cross libc6-dbg:i386 libubsan1:i386 libasan6:i386 \
+        gcc-i686-linux-gnu libc6-dev-i386-cross libc6-dbg:i386 libubsan1:i386 libasan8:i386 \
         gcc-s390x-linux-gnu libc6-dev-s390x-cross libc6-dbg:s390x \
         gcc-arm-linux-gnueabihf libc6-dev-armhf-cross libc6-dbg:armhf \
         gcc-aarch64-linux-gnu libc6-dev-arm64-cross libc6-dbg:arm64 \
         gcc-powerpc64le-linux-gnu libc6-dev-ppc64el-cross libc6-dbg:ppc64el \
         gcc-mingw-w64-x86-64-win32 wine64 wine \
         gcc-mingw-w64-i686-win32 wine32 \
-        sagemath
+        python3
+
+# Build and install gcc snapshot
+ARG GCC_SNAPSHOT_MAJOR=14
+RUN apt-get update && apt-get install --no-install-recommends -y wget libgmp-dev libmpfr-dev libmpc-dev flex && \
+    mkdir gcc && cd gcc && \
+    wget --progress=dot:giga --https-only --recursive --accept '*.tar.xz' --level 1 --no-directories "https://gcc.gnu.org/pub/gcc/snapshots/LATEST-${GCC_SNAPSHOT_MAJOR}" && \
+    wget "https://gcc.gnu.org/pub/gcc/snapshots/LATEST-${GCC_SNAPSHOT_MAJOR}/sha512.sum" && \
+    sha512sum --check --ignore-missing sha512.sum && \
+    # We should have downloaded exactly one tar.xz file
+    ls && \
+    [[ $(ls *.tar.xz | wc -l) -eq "1" ]] && \
+    tar xf *.tar.xz && \
+    mkdir gcc-build && cd gcc-build && \
+    ../*/configure --prefix=/opt/gcc-snapshot --enable-languages=c --disable-bootstrap --disable-multilib --without-isl && \
+    make -j $(nproc) && \
+    make install && \
+    cd ../.. && rm -rf gcc && \
+    ln -s /opt/gcc-snapshot/bin/gcc /usr/bin/gcc-snapshot && \
+    apt-get autoremove -y wget libgmp-dev libmpfr-dev libmpc-dev flex && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# Install clang snapshot, see https://apt.llvm.org/
+RUN \
+    # Setup GPG keys of LLVM repository
+    apt-get update && apt-get install --no-install-recommends -y wget && \
+    wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
+    # Add repository for this Debian release
+    . /etc/os-release && echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME} main" >> /etc/apt/sources.list && \
+    apt-get update && \
+    # Determine the version number of the LLVM development branch
+    LLVM_VERSION=$(apt-cache search --names-only '^clang-[0-9]+$' | sort -V | tail -1 | cut -f1 -d" " | cut -f2 -d"-" ) && \
+    # Install
+    apt-get install --no-install-recommends -y "clang-${LLVM_VERSION}" && \
+    # Create symlink
+    ln -s "/usr/bin/clang-${LLVM_VERSION}" /usr/bin/clang-snapshot && \
+    # Clean up
+    apt-get autoremove -y wget && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /root
-# The "wine" package provides a convience wrapper that we need
-RUN apt-get update && apt-get install --no-install-recommends -y \
-        git ca-certificates wine64 wine python3-simplejson python3-six msitools winbind procps && \
-    git clone https://github.com/mstorsjo/msvc-wine && \
-    mkdir /opt/msvc && \
-    python3 msvc-wine/vsdownload.py --accept-license --dest /opt/msvc Microsoft.VisualStudio.Workload.VCTools && \
-    msvc-wine/install.sh /opt/msvc
-
-# Initialize the wine environment. Wait until the wineserver process has
-# exited before closing the session, to avoid corrupting the wine prefix.
-RUN wine64 wineboot --init && \
-    while (ps -A | grep wineserver) > /dev/null; do sleep 1; done
diff --git a/secp256k1-sys/depend/secp256k1/cmake/CheckArm32Assembly.cmake b/secp256k1-sys/depend/secp256k1/cmake/CheckArm32Assembly.cmake
new file mode 100644
index 000000000..15c44b24b
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/cmake/CheckArm32Assembly.cmake
@@ -0,0 +1,6 @@
+function(check_arm32_assembly)
+  try_compile(HAVE_ARM32_ASM
+    ${CMAKE_BINARY_DIR}/check_arm32_assembly
+    SOURCES ${CMAKE_SOURCE_DIR}/cmake/source_arm32.s
+  )
+endfunction()
diff --git a/secp256k1-sys/depend/secp256k1/cmake/CheckStringOptionValue.cmake b/secp256k1-sys/depend/secp256k1/cmake/CheckStringOptionValue.cmake
new file mode 100644
index 000000000..5a4d939b9
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/cmake/CheckStringOptionValue.cmake
@@ -0,0 +1,10 @@
+function(check_string_option_value option)
+  get_property(expected_values CACHE ${option} PROPERTY STRINGS)
+  if(expected_values)
+    if(${option} IN_LIST expected_values)
+      return()
+    endif()
+    message(FATAL_ERROR "${option} value is \"${${option}}\", but must be one of ${expected_values}.")
+  endif()
+  message(AUTHOR_WARNING "The STRINGS property must be set before invoking `check_string_option_value' function.")
+endfunction()
diff --git a/secp256k1-sys/depend/secp256k1/cmake/CheckX86_64Assembly.cmake b/secp256k1-sys/depend/secp256k1/cmake/CheckX86_64Assembly.cmake
new file mode 100644
index 000000000..ae82cd476
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/cmake/CheckX86_64Assembly.cmake
@@ -0,0 +1,14 @@
+include(CheckCSourceCompiles)
+
+function(check_x86_64_assembly)
+  check_c_source_compiles("
+    #include <stdint.h>
+
+    int main()
+    {
+      uint64_t a = 11, tmp;
+      __asm__ __volatile__(\"movq $0x100000000,%1; mulq %%rsi\" : \"+a\"(a) : \"S\"(tmp) : \"cc\", \"%rdx\");
+    }
+  " HAVE_X86_64_ASM)
+  set(HAVE_X86_64_ASM ${HAVE_X86_64_ASM} PARENT_SCOPE)
+endfunction()
diff --git a/secp256k1-sys/depend/secp256k1/cmake/FindValgrind.cmake b/secp256k1-sys/depend/secp256k1/cmake/FindValgrind.cmake
new file mode 100644
index 000000000..3af5e691e
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/cmake/FindValgrind.cmake
@@ -0,0 +1,41 @@
+if(CMAKE_HOST_APPLE)
+  find_program(BREW_COMMAND brew)
+  execute_process(
+    COMMAND ${BREW_COMMAND} --prefix valgrind
+    OUTPUT_VARIABLE valgrind_brew_prefix
+    ERROR_QUIET
+    OUTPUT_STRIP_TRAILING_WHITESPACE
+  )
+endif()
+
+set(hints_paths)
+if(valgrind_brew_prefix)
+  set(hints_paths ${valgrind_brew_prefix}/include)
+endif()
+
+find_path(Valgrind_INCLUDE_DIR
+  NAMES valgrind/memcheck.h
+  HINTS ${hints_paths}
+)
+
+if(Valgrind_INCLUDE_DIR)
+  include(CheckCSourceCompiles)
+  set(CMAKE_REQUIRED_INCLUDES ${Valgrind_INCLUDE_DIR})
+  check_c_source_compiles("
+    #include <valgrind/memcheck.h>
+    #if defined(NVALGRIND)
+    #  error \"Valgrind does not support this platform.\"
+    #endif
+
+    int main() {}
+  " Valgrind_WORKS)
+endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(Valgrind
+  REQUIRED_VARS Valgrind_INCLUDE_DIR Valgrind_WORKS
+)
+
+mark_as_advanced(
+  Valgrind_INCLUDE_DIR
+)
diff --git a/secp256k1-sys/depend/secp256k1/cmake/TryAppendCFlags.cmake b/secp256k1-sys/depend/secp256k1/cmake/TryAppendCFlags.cmake
new file mode 100644
index 000000000..4ace38ecb
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/cmake/TryAppendCFlags.cmake
@@ -0,0 +1,24 @@
+include(CheckCCompilerFlag)
+
+function(rustsecp256k1_v0_9_0_check_c_flags_internal flags output)
+  string(MAKE_C_IDENTIFIER "${flags}" result)
+  string(TOUPPER "${result}" result)
+  set(result "C_SUPPORTS_${result}")
+  if(NOT MSVC)
+    set(CMAKE_REQUIRED_FLAGS "-Werror")
+  endif()
+
+  # This avoids running a linker.
+  set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY)
+  check_c_compiler_flag("${flags}" ${result})
+
+  set(${output} ${${result}} PARENT_SCOPE)
+endfunction()
+
+# Append flags to the COMPILE_OPTIONS directory property if CC accepts them.
+macro(try_append_c_flags)
+  rustsecp256k1_v0_9_0_check_c_flags_internal("${ARGV}" result)
+  if(result)
+    add_compile_options(${ARGV})
+  endif()
+endmacro()
diff --git a/secp256k1-sys/depend/secp256k1/cmake/arm-linux-gnueabihf.toolchain.cmake b/secp256k1-sys/depend/secp256k1/cmake/arm-linux-gnueabihf.toolchain.cmake
new file mode 100644
index 000000000..0d91912b6
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/cmake/arm-linux-gnueabihf.toolchain.cmake
@@ -0,0 +1,3 @@
+set(CMAKE_SYSTEM_NAME Linux)
+set(CMAKE_SYSTEM_PROCESSOR arm)
+set(CMAKE_C_COMPILER arm-linux-gnueabihf-gcc)
diff --git a/secp256k1-sys/depend/secp256k1/cmake/config.cmake.in b/secp256k1-sys/depend/secp256k1/cmake/config.cmake.in
new file mode 100644
index 000000000..46b180ab1
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/cmake/config.cmake.in
@@ -0,0 +1,5 @@
+@PACKAGE_INIT@
+
+include("${CMAKE_CURRENT_LIST_DIR}/@PROJECT_NAME@-targets.cmake")
+
+check_required_components(@PROJECT_NAME@)
diff --git a/secp256k1-sys/depend/secp256k1/cmake/source_arm32.s b/secp256k1-sys/depend/secp256k1/cmake/source_arm32.s
new file mode 100644
index 000000000..d3d934705
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/cmake/source_arm32.s
@@ -0,0 +1,9 @@
+.syntax unified
+.eabi_attribute 24, 1
+.eabi_attribute 25, 1
+.text
+.global main
+main:
+	ldr	r0, =0x002A
+	mov	r7, #1
+	swi	0   
diff --git a/secp256k1-sys/depend/secp256k1/cmake/x86_64-w64-mingw32.toolchain.cmake b/secp256k1-sys/depend/secp256k1/cmake/x86_64-w64-mingw32.toolchain.cmake
new file mode 100644
index 000000000..96119b72d
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/cmake/x86_64-w64-mingw32.toolchain.cmake
@@ -0,0 +1,3 @@
+set(CMAKE_SYSTEM_NAME Windows)
+set(CMAKE_SYSTEM_PROCESSOR x86_64)
+set(CMAKE_C_COMPILER x86_64-w64-mingw32-gcc)
diff --git a/secp256k1-sys/depend/secp256k1/configure.ac b/secp256k1-sys/depend/secp256k1/configure.ac
index 68f279b17..e3877850d 100644
--- a/secp256k1-sys/depend/secp256k1/configure.ac
+++ b/secp256k1-sys/depend/secp256k1/configure.ac
@@ -4,7 +4,7 @@ AC_PREREQ([2.60])
 # the API. All changes in experimental modules are treated as
 # backwards-compatible and therefore at most increase the minor version.
 define(_PKG_VERSION_MAJOR, 0)
-define(_PKG_VERSION_MINOR, 2)
+define(_PKG_VERSION_MINOR, 4)
 define(_PKG_VERSION_PATCH, 0)
 define(_PKG_VERSION_IS_RELEASE, true)
 
@@ -13,18 +13,15 @@ define(_PKG_VERSION_IS_RELEASE, true)
 # https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
 # All changes in experimental modules are treated as if they don't affect the
 # interface and therefore only increase the revision.
-define(_LIB_VERSION_CURRENT, 1)
+define(_LIB_VERSION_CURRENT, 3)
 define(_LIB_VERSION_REVISION, 0)
-define(_LIB_VERSION_AGE, 0)
+define(_LIB_VERSION_AGE, 1)
 
 AC_INIT([libsecp256k1],m4_join([.], _PKG_VERSION_MAJOR, _PKG_VERSION_MINOR, _PKG_VERSION_PATCH)m4_if(_PKG_VERSION_IS_RELEASE, [true], [], [-dev]),[https://github.com/bitcoin-core/secp256k1/issues],[libsecp256k1],[https://github.com/bitcoin-core/secp256k1])
 
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_MACRO_DIR([build-aux/m4])
 AC_CANONICAL_HOST
-AH_TOP([#ifndef LIBSECP256K1_CONFIG_H])
-AH_TOP([#define LIBSECP256K1_CONFIG_H])
-AH_BOTTOM([#endif /*LIBSECP256K1_CONFIG_H*/])
 
 # Require Automake 1.11.2 for AM_PROG_AR
 AM_INIT_AUTOMAKE([1.11.2 foreign subdir-objects])
@@ -32,6 +29,11 @@ AM_INIT_AUTOMAKE([1.11.2 foreign subdir-objects])
 # Make the compilation flags quiet unless V=1 is used.
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
+if test "${CFLAGS+set}" = "set"; then
+  CFLAGS_overridden=yes
+else
+  CFLAGS_overridden=no
+fi
 AC_PROG_CC
 AM_PROG_AS
 AM_PROG_AR
@@ -91,11 +93,14 @@ esac
 AC_DEFUN([SECP_TRY_APPEND_DEFAULT_CFLAGS], [
     # GCC and compatible (incl. clang)
     if test "x$GCC" = "xyes"; then
-      # Try to append -Werror=unknown-warning-option to CFLAGS temporarily. Otherwise clang will
-      # not error out if it gets unknown warning flags and the checks here will always succeed
-      # no matter if clang knows the flag or not.
+      # Try to append -Werror to CFLAGS temporarily. Otherwise checks for some unsupported
+      # flags will succeed.
+      # Note that failure to append -Werror does not necessarily mean that -Werror is not
+      # supported. The compiler may already be warning about something unrelated, for example
+      # about some path issue. If that is the case, -Werror cannot be used because all
+      # of those warnings would be turned into errors.
       SECP_TRY_APPEND_DEFAULT_CFLAGS_saved_CFLAGS="$CFLAGS"
-      SECP_TRY_APPEND_CFLAGS([-Werror=unknown-warning-option], CFLAGS)
+      SECP_TRY_APPEND_CFLAGS([-Werror], CFLAGS)
 
       SECP_TRY_APPEND_CFLAGS([-std=c89 -pedantic -Wno-long-long -Wnested-externs -Wshadow -Wstrict-prototypes -Wundef], $1) # GCC >= 3.0, -Wlong-long is implied by -pedantic.
       SECP_TRY_APPEND_CFLAGS([-Wno-overlength-strings], $1) # GCC >= 4.2, -Woverlength-strings is implied by -pedantic.
@@ -105,6 +110,7 @@ AC_DEFUN([SECP_TRY_APPEND_DEFAULT_CFLAGS], [
       SECP_TRY_APPEND_CFLAGS([-Wcast-align], $1) # GCC >= 2.95
       SECP_TRY_APPEND_CFLAGS([-Wcast-align=strict], $1) # GCC >= 8.0
       SECP_TRY_APPEND_CFLAGS([-Wconditional-uninitialized], $1) # Clang >= 3.0 only
+      SECP_TRY_APPEND_CFLAGS([-Wreserved-identifier], $1) # Clang >= 13.0 only
       SECP_TRY_APPEND_CFLAGS([-fvisibility=hidden], $1) # GCC >= 4.0
 
       CFLAGS="$SECP_TRY_APPEND_DEFAULT_CFLAGS_saved_CFLAGS"
@@ -115,8 +121,12 @@ AC_DEFUN([SECP_TRY_APPEND_DEFAULT_CFLAGS], [
     # libtool makes the same assumption internally.
     # Note that "/opt" and "-opt" are equivalent for MSVC; we use "-opt" because "/opt" looks like a path.
     if test x"$GCC" != x"yes" && test x"$build_windows" = x"yes"; then
-      SECP_TRY_APPEND_CFLAGS([-W2 -wd4146], $1) # Moderate warning level, disable warning C4146 "unary minus operator applied to unsigned type, result still unsigned"
-      SECP_TRY_APPEND_CFLAGS([-external:anglebrackets -external:W0], $1) # Suppress warnings from #include <...> files
+      SECP_TRY_APPEND_CFLAGS([-W3], $1) # Production quality warning level.
+      SECP_TRY_APPEND_CFLAGS([-wd4146], $1) # Disable warning C4146 "unary minus operator applied to unsigned type, result still unsigned".
+      SECP_TRY_APPEND_CFLAGS([-wd4244], $1) # Disable warning C4244 "'conversion' conversion from 'type1' to 'type2', possible loss of data".
+      SECP_TRY_APPEND_CFLAGS([-wd4267], $1) # Disable warning C4267 "'var' : conversion from 'size_t' to 'type', possible loss of data".
+      # Eliminate deprecation warnings for the older, less secure functions.
+      CPPFLAGS="-D_CRT_SECURE_NO_WARNINGS $CPPFLAGS"
     fi
 ])
 SECP_TRY_APPEND_DEFAULT_CFLAGS(SECP_CFLAGS)
@@ -142,6 +152,10 @@ AC_ARG_ENABLE(tests,
     AS_HELP_STRING([--enable-tests],[compile tests [default=yes]]), [],
     [SECP_SET_DEFAULT([enable_tests], [yes], [yes])])
 
+AC_ARG_ENABLE(ctime_tests,
+    AS_HELP_STRING([--enable-ctime-tests],[compile constant-time tests [default=yes if valgrind enabled]]), [],
+    [SECP_SET_DEFAULT([enable_ctime_tests], [auto], [auto])])
+
 AC_ARG_ENABLE(experimental,
     AS_HELP_STRING([--enable-experimental],[allow experimental configure options [default=no]]), [],
     [SECP_SET_DEFAULT([enable_experimental], [no], [yes])])
@@ -170,6 +184,10 @@ AC_ARG_ENABLE(module_schnorrsig,
     AS_HELP_STRING([--enable-module-schnorrsig],[enable schnorrsig module [default=yes]]), [],
     [SECP_SET_DEFAULT([enable_module_schnorrsig], [yes], [yes])])
 
+AC_ARG_ENABLE(module_ellswift,
+    AS_HELP_STRING([--enable-module-ellswift],[enable ElligatorSwift module [default=yes]]), [],
+    [SECP_SET_DEFAULT([enable_module_ellswift], [yes], [yes])])
+
 AC_ARG_ENABLE(external_default_callbacks,
     AS_HELP_STRING([--enable-external-default-callbacks],[enable external default callback functions [default=no]]), [],
     [SECP_SET_DEFAULT([enable_external_default_callbacks], [no], [no])])
@@ -182,8 +200,8 @@ AC_ARG_ENABLE(external_default_callbacks,
 #  *  and auto (the default).
 AC_ARG_WITH([test-override-wide-multiply], [] ,[set_widemul=$withval], [set_widemul=auto])
 
-AC_ARG_WITH([asm], [AS_HELP_STRING([--with-asm=x86_64|arm|no|auto],
-[assembly optimizations to use (experimental: arm) [default=auto]])],[req_asm=$withval], [req_asm=auto])
+AC_ARG_WITH([asm], [AS_HELP_STRING([--with-asm=x86_64|arm32|no|auto],
+[assembly optimizations to use (experimental: arm32) [default=auto]])],[req_asm=$withval], [req_asm=auto])
 
 AC_ARG_WITH([ecmult-window], [AS_HELP_STRING([--with-ecmult-window=SIZE|auto],
 [window size for ecmult precomputation for verification, specified as integer in range [2..24].]
@@ -225,11 +243,20 @@ else
     enable_valgrind=yes
   fi
 fi
-AM_CONDITIONAL([VALGRIND_ENABLED],[test "$enable_valgrind" = "yes"])
+
+if test x"$enable_ctime_tests" = x"auto"; then
+    enable_ctime_tests=$enable_valgrind
+fi
 
 if test x"$enable_coverage" = x"yes"; then
-    AC_DEFINE(COVERAGE, 1, [Define this symbol to compile out all VERIFY code])
+    SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DCOVERAGE=1"
     SECP_CFLAGS="-O0 --coverage $SECP_CFLAGS"
+    # If coverage is enabled, and the user has not overridden CFLAGS,
+    # override Autoconf's value "-g -O2" with "-g". Otherwise we'd end up
+    # with "-O0 --coverage -g -O2".
+    if test "$CFLAGS_overridden" = "no"; then
+      CFLAGS="-g"
+    fi
     LDFLAGS="--coverage $LDFLAGS"
 else
     # Most likely the CFLAGS already contain -O2 because that is autoconf's default.
@@ -239,8 +266,8 @@ else
 fi
 
 if test x"$req_asm" = x"auto"; then
-  SECP_64BIT_ASM_CHECK
-  if test x"$has_64bit_asm" = x"yes"; then
+  SECP_X86_64_ASM_CHECK
+  if test x"$has_x86_64_asm" = x"yes"; then
     set_asm=x86_64
   fi
   if test x"$set_asm" = x; then
@@ -250,12 +277,16 @@ else
   set_asm=$req_asm
   case $set_asm in
   x86_64)
-    SECP_64BIT_ASM_CHECK
-    if test x"$has_64bit_asm" != x"yes"; then
+    SECP_X86_64_ASM_CHECK
+    if test x"$has_x86_64_asm" != x"yes"; then
       AC_MSG_ERROR([x86_64 assembly optimization requested but not available])
     fi
     ;;
-  arm)
+  arm32)
+    SECP_ARM32_ASM_CHECK
+    if test x"$has_arm32_asm" != x"yes"; then
+      AC_MSG_ERROR([ARM32 assembly optimization requested but not available])
+    fi
     ;;
   no)
     ;;
@@ -270,9 +301,9 @@ enable_external_asm=no
 
 case $set_asm in
 x86_64)
-  AC_DEFINE(USE_ASM_X86_64, 1, [Define this symbol to enable x86_64 assembly optimizations])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DUSE_ASM_X86_64=1"
   ;;
-arm)
+arm32)
   enable_external_asm=yes
   ;;
 no)
@@ -283,20 +314,20 @@ no)
 esac
 
 if test x"$enable_external_asm" = x"yes"; then
-  AC_DEFINE(USE_EXTERNAL_ASM, 1, [Define this symbol if an external (non-inline) assembly implementation is used])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DUSE_EXTERNAL_ASM=1"
 fi
 
 
 # Select wide multiplication implementation
 case $set_widemul in
 int128_struct)
-  AC_DEFINE(USE_FORCE_WIDEMUL_INT128_STRUCT, 1, [Define this symbol to force the use of the structure for simulating (unsigned) int128 based wide multiplication])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DUSE_FORCE_WIDEMUL_INT128_STRUCT=1"
   ;;
 int128)
-  AC_DEFINE(USE_FORCE_WIDEMUL_INT128, 1, [Define this symbol to force the use of the (unsigned) __int128 based wide multiplication implementation])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DUSE_FORCE_WIDEMUL_INT128=1"
   ;;
 int64)
-  AC_DEFINE(USE_FORCE_WIDEMUL_INT64, 1, [Define this symbol to force the use of the (u)int64_t based wide multiplication implementation])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DUSE_FORCE_WIDEMUL_INT64=1"
   ;;
 auto)
   ;;
@@ -323,7 +354,7 @@ case $set_ecmult_window in
     # not in range
     AC_MSG_ERROR($error_window_size)
   fi
-  AC_DEFINE_UNQUOTED(ECMULT_WINDOW_SIZE, $set_ecmult_window, [Set window size for ecmult precomputation])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DECMULT_WINDOW_SIZE=$set_ecmult_window"
   ;;
 esac
 
@@ -336,7 +367,7 @@ fi
 
 case $set_ecmult_gen_precision in
 2|4|8)
-  AC_DEFINE_UNQUOTED(ECMULT_GEN_PREC_BITS, $set_ecmult_gen_precision, [Set ecmult gen precision bits])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DECMULT_GEN_PREC_BITS=$set_ecmult_gen_precision"
   ;;
 *)
   AC_MSG_ERROR(['ecmult gen precision not 2, 4, 8 or "auto"'])
@@ -344,7 +375,7 @@ case $set_ecmult_gen_precision in
 esac
 
 if test x"$enable_valgrind" = x"yes"; then
-  SECP_INCLUDES="$SECP_INCLUDES $VALGRIND_CPPFLAGS"
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES $VALGRIND_CPPFLAGS -DVALGRIND"
 fi
 
 # Add -Werror and similar flags passed from the outside (for testing, e.g., in CI).
@@ -357,26 +388,30 @@ SECP_CFLAGS="$SECP_CFLAGS $WERROR_CFLAGS"
 ###
 
 if test x"$enable_module_ecdh" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_ECDH, 1, [Define this symbol to enable the ECDH module])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_ECDH=1"
 fi
 
 if test x"$enable_module_recovery" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_RECOVERY, 1, [Define this symbol to enable the ECDSA pubkey recovery module])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_RECOVERY=1"
 fi
 
 if test x"$enable_module_schnorrsig" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_SCHNORRSIG, 1, [Define this symbol to enable the schnorrsig module])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_SCHNORRSIG=1"
   enable_module_extrakeys=yes
 fi
 
+if test x"$enable_module_ellswift" = x"yes"; then
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_ELLSWIFT=1"
+fi
+
 # Test if extrakeys is set after the schnorrsig module to allow the schnorrsig
 # module to set enable_module_extrakeys=yes
 if test x"$enable_module_extrakeys" = x"yes"; then
-  AC_DEFINE(ENABLE_MODULE_EXTRAKEYS, 1, [Define this symbol to enable the extrakeys module])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_EXTRAKEYS=1"
 fi
 
 if test x"$enable_external_default_callbacks" = x"yes"; then
-  AC_DEFINE(USE_EXTERNAL_DEFAULT_CALLBACKS, 1, [Define this symbol if an external implementation of the default callbacks is used])
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1"
 fi
 
 ###
@@ -389,8 +424,8 @@ if test x"$enable_experimental" = x"yes"; then
   AC_MSG_NOTICE([Experimental features do not have stable APIs or properties, and may not be safe for production use.])
   AC_MSG_NOTICE([******])
 else
-  if test x"$set_asm" = x"arm"; then
-    AC_MSG_ERROR([ARM assembly optimization is experimental. Use --enable-experimental to allow.])
+  if test x"$set_asm" = x"arm32"; then
+    AC_MSG_ERROR([ARM32 assembly optimization is experimental. Use --enable-experimental to allow.])
   fi
 fi
 
@@ -398,15 +433,12 @@ fi
 ### Generate output
 ###
 
-AC_CONFIG_HEADERS([src/libsecp256k1-config.h])
 AC_CONFIG_FILES([Makefile libsecp256k1.pc])
-AC_SUBST(SECP_INCLUDES)
-AC_SUBST(SECP_LIBS)
-AC_SUBST(SECP_TEST_LIBS)
-AC_SUBST(SECP_TEST_INCLUDES)
 AC_SUBST(SECP_CFLAGS)
+AC_SUBST(SECP_CONFIG_DEFINES)
 AM_CONDITIONAL([ENABLE_COVERAGE], [test x"$enable_coverage" = x"yes"])
 AM_CONDITIONAL([USE_TESTS], [test x"$enable_tests" != x"no"])
+AM_CONDITIONAL([USE_CTIME_TESTS], [test x"$enable_ctime_tests" = x"yes"])
 AM_CONDITIONAL([USE_EXHAUSTIVE_TESTS], [test x"$enable_exhaustive_tests" != x"no"])
 AM_CONDITIONAL([USE_EXAMPLES], [test x"$enable_examples" != x"no"])
 AM_CONDITIONAL([USE_BENCHMARK], [test x"$enable_benchmark" = x"yes"])
@@ -414,8 +446,9 @@ AM_CONDITIONAL([ENABLE_MODULE_ECDH], [test x"$enable_module_ecdh" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_RECOVERY], [test x"$enable_module_recovery" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_EXTRAKEYS], [test x"$enable_module_extrakeys" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG], [test x"$enable_module_schnorrsig" = x"yes"])
+AM_CONDITIONAL([ENABLE_MODULE_ELLSWIFT], [test x"$enable_module_ellswift" = x"yes"])
 AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$enable_external_asm" = x"yes"])
-AM_CONDITIONAL([USE_ASM_ARM], [test x"$set_asm" = x"arm"])
+AM_CONDITIONAL([USE_ASM_ARM], [test x"$set_asm" = x"arm32"])
 AM_CONDITIONAL([BUILD_WINDOWS], [test "$build_windows" = "yes"])
 AC_SUBST(LIB_VERSION_CURRENT, _LIB_VERSION_CURRENT)
 AC_SUBST(LIB_VERSION_REVISION, _LIB_VERSION_REVISION)
@@ -428,12 +461,14 @@ echo "Build Options:"
 echo "  with external callbacks = $enable_external_default_callbacks"
 echo "  with benchmarks         = $enable_benchmark"
 echo "  with tests              = $enable_tests"
+echo "  with ctime tests        = $enable_ctime_tests"
 echo "  with coverage           = $enable_coverage"
 echo "  with examples           = $enable_examples"
 echo "  module ecdh             = $enable_module_ecdh"
 echo "  module recovery         = $enable_module_recovery"
 echo "  module extrakeys        = $enable_module_extrakeys"
 echo "  module schnorrsig       = $enable_module_schnorrsig"
+echo "  module ellswift         = $enable_module_ellswift"
 echo
 echo "  asm                     = $set_asm"
 echo "  ecmult window size      = $set_ecmult_window"
diff --git a/secp256k1-sys/depend/secp256k1/contrib/lax_der_parsing.c b/secp256k1-sys/depend/secp256k1/contrib/lax_der_parsing.c
index 950c71420..bdcf34c50 100644
--- a/secp256k1-sys/depend/secp256k1/contrib/lax_der_parsing.c
+++ b/secp256k1-sys/depend/secp256k1/contrib/lax_der_parsing.c
@@ -7,8 +7,10 @@
 #include <string.h>
 
 #include "lax_der_parsing.h"
-
-int rustsecp256k1_v0_8_1_ecdsa_signature_parse_der_lax(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
+extern int rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(
+        const rustsecp256k1_v0_9_0_context *ctx,
+        rustsecp256k1_v0_9_0_ecdsa_signature *sig, const unsigned char *input64);
+int rustsecp256k1_v0_9_0_ecdsa_signature_parse_der_lax(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
     size_t rpos, rlen, spos, slen;
     size_t pos = 0;
     size_t lenbyte;
@@ -16,7 +18,7 @@ int rustsecp256k1_v0_8_1_ecdsa_signature_parse_der_lax(const rustsecp256k1_v0_8_
     int overflow = 0;
 
     /* Hack to initialize sig with a correctly-parsed but invalid signature. */
-    rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
+    rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
 
     /* Sequence tag byte */
     if (pos == inputlen || input[pos] != 0x30) {
@@ -137,11 +139,11 @@ int rustsecp256k1_v0_8_1_ecdsa_signature_parse_der_lax(const rustsecp256k1_v0_8_
     }
 
     if (!overflow) {
-        overflow = !rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
+        overflow = !rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
     }
     if (overflow) {
         memset(tmpsig, 0, 64);
-        rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
+        rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
     }
     return 1;
 }
diff --git a/secp256k1-sys/depend/secp256k1/contrib/lax_der_parsing.h b/secp256k1-sys/depend/secp256k1/contrib/lax_der_parsing.h
index 548f8f0f8..aa8b31c8a 100644
--- a/secp256k1-sys/depend/secp256k1/contrib/lax_der_parsing.h
+++ b/secp256k1-sys/depend/secp256k1/contrib/lax_der_parsing.h
@@ -26,8 +26,8 @@
  * certain violations are easily supported. You may need to adapt it.
  *
  * Do not use this for new systems. Use well-defined DER or compact signatures
- * instead if you have the choice (see rustsecp256k1_v0_8_1_ecdsa_signature_parse_der and
- * rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact).
+ * instead if you have the choice (see rustsecp256k1_v0_9_0_ecdsa_signature_parse_der and
+ * rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact).
  *
  * The supported violations are:
  * - All numbers are parsed as nonnegative integers, even though X.609-0207
@@ -83,9 +83,9 @@ extern "C" {
  *  encoded numbers are out of range, signature validation with it is
  *  guaranteed to fail for every message and public key.
  */
-int rustsecp256k1_v0_8_1_ecdsa_signature_parse_der_lax(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_ecdsa_signature* sig,
+int rustsecp256k1_v0_9_0_ecdsa_signature_parse_der_lax(
+    const rustsecp256k1_v0_9_0_context* ctx,
+    rustsecp256k1_v0_9_0_ecdsa_signature* sig,
     const unsigned char *input,
     size_t inputlen
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
diff --git a/secp256k1-sys/depend/secp256k1/contrib/lax_der_privatekey_parsing.c b/secp256k1-sys/depend/secp256k1/contrib/lax_der_privatekey_parsing.c
index ed177494a..5528d2468 100644
--- a/secp256k1-sys/depend/secp256k1/contrib/lax_der_privatekey_parsing.c
+++ b/secp256k1-sys/depend/secp256k1/contrib/lax_der_privatekey_parsing.c
@@ -8,7 +8,7 @@
 
 #include "lax_der_privatekey_parsing.h"
 
-int ec_privkey_import_der(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *out32, const unsigned char *privkey, size_t privkeylen) {
+int ec_privkey_import_der(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *out32, const unsigned char *privkey, size_t privkeylen) {
     const unsigned char *end = privkey + privkeylen;
     int lenb = 0;
     int len = 0;
@@ -45,17 +45,17 @@ int ec_privkey_import_der(const rustsecp256k1_v0_8_1_context* ctx, unsigned char
         return 0;
     }
     if (privkey[1]) memcpy(out32 + 32 - privkey[1], privkey + 2, privkey[1]);
-    if (!rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, out32)) {
+    if (!rustsecp256k1_v0_9_0_ec_seckey_verify(ctx, out32)) {
         memset(out32, 0, 32);
         return 0;
     }
     return 1;
 }
 
-int ec_privkey_export_der(const rustsecp256k1_v0_8_1_context *ctx, unsigned char *privkey, size_t *privkeylen, const unsigned char *key32, int compressed) {
-    rustsecp256k1_v0_8_1_pubkey pubkey;
+int ec_privkey_export_der(const rustsecp256k1_v0_9_0_context *ctx, unsigned char *privkey, size_t *privkeylen, const unsigned char *key32, int compressed) {
+    rustsecp256k1_v0_9_0_pubkey pubkey;
     size_t pubkeylen = 0;
-    if (!rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, key32)) {
+    if (!rustsecp256k1_v0_9_0_ec_pubkey_create(ctx, &pubkey, key32)) {
         *privkeylen = 0;
         return 0;
     }
@@ -79,7 +79,7 @@ int ec_privkey_export_der(const rustsecp256k1_v0_8_1_context *ctx, unsigned char
         memcpy(ptr, key32, 32); ptr += 32;
         memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
         pubkeylen = 33;
-        rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED);
+        rustsecp256k1_v0_9_0_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED);
         ptr += pubkeylen;
         *privkeylen = ptr - privkey;
     } else {
@@ -104,7 +104,7 @@ int ec_privkey_export_der(const rustsecp256k1_v0_8_1_context *ctx, unsigned char
         memcpy(ptr, key32, 32); ptr += 32;
         memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
         pubkeylen = 65;
-        rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
+        rustsecp256k1_v0_9_0_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
         ptr += pubkeylen;
         *privkeylen = ptr - privkey;
     }
diff --git a/secp256k1-sys/depend/secp256k1/contrib/lax_der_privatekey_parsing.h b/secp256k1-sys/depend/secp256k1/contrib/lax_der_privatekey_parsing.h
index ff159fb3e..e281e56d3 100644
--- a/secp256k1-sys/depend/secp256k1/contrib/lax_der_privatekey_parsing.h
+++ b/secp256k1-sys/depend/secp256k1/contrib/lax_der_privatekey_parsing.h
@@ -43,7 +43,7 @@ extern "C" {
 /** Export a private key in DER format.
  *
  *  Returns: 1 if the private key was valid.
- *  Args: ctx:        pointer to a context object (not rustsecp256k1_v0_8_1_context_static).
+ *  Args: ctx:        pointer to a context object (not rustsecp256k1_v0_9_0_context_static).
  *  Out: privkey:     pointer to an array for storing the private key in BER.
  *                    Should have space for 279 bytes, and cannot be NULL.
  *       privkeylen:  Pointer to an int where the length of the private key in
@@ -57,10 +57,10 @@ extern "C" {
  *  simple 32-byte private keys are sufficient.
  *
  *  Note that this function does not guarantee correct DER output. It is
- *  guaranteed to be parsable by rustsecp256k1_v0_8_1_ec_privkey_import_der
+ *  guaranteed to be parsable by rustsecp256k1_v0_9_0_ec_privkey_import_der
  */
 SECP256K1_WARN_UNUSED_RESULT int ec_privkey_export_der(
-    const rustsecp256k1_v0_8_1_context* ctx,
+    const rustsecp256k1_v0_9_0_context* ctx,
     unsigned char *privkey,
     size_t *privkeylen,
     const unsigned char *seckey,
@@ -82,7 +82,7 @@ SECP256K1_WARN_UNUSED_RESULT int ec_privkey_export_der(
  * key.
  */
 SECP256K1_WARN_UNUSED_RESULT int ec_privkey_import_der(
-    const rustsecp256k1_v0_8_1_context* ctx,
+    const rustsecp256k1_v0_9_0_context* ctx,
     unsigned char *seckey,
     const unsigned char *privkey,
     size_t privkeylen
diff --git a/secp256k1-sys/depend/secp256k1/doc/ellswift.md b/secp256k1-sys/depend/secp256k1/doc/ellswift.md
new file mode 100644
index 000000000..e3b25ec7a
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/doc/ellswift.md
@@ -0,0 +1,483 @@
+# ElligatorSwift for secp256k1 explained
+
+In this document we explain how the `ellswift` module implementation is related to the
+construction in the
+["SwiftEC: Shallue–van de Woestijne Indifferentiable Function To Elliptic Curves"](https://eprint.iacr.org/2022/759)
+paper by Jorge Chávez-Saab, Francisco Rodríguez-Henríquez, and Mehdi Tibouchi.
+
+* [1. Introduction](#1-introduction)
+* [2. The decoding function](#2-the-decoding-function)
+  + [2.1 Decoding for `secp256k1`](#21-decoding-for-secp256k1)
+* [3. The encoding function](#3-the-encoding-function)
+  + [3.1 Switching to *v, w* coordinates](#31-switching-to-v-w-coordinates)
+  + [3.2 Avoiding computing all inverses](#32-avoiding-computing-all-inverses)
+  + [3.3 Finding the inverse](#33-finding-the-inverse)
+  + [3.4 Dealing with special cases](#34-dealing-with-special-cases)
+  + [3.5 Encoding for `secp256k1`](#35-encoding-for-secp256k1)
+* [4. Encoding and decoding full *(x, y)* coordinates](#4-encoding-and-decoding-full-x-y-coordinates)
+  + [4.1 Full *(x, y)* coordinates for `secp256k1`](#41-full-x-y-coordinates-for-secp256k1)
+
+## 1. Introduction
+
+The `ellswift` module effectively introduces a new 64-byte public key format, with the property
+that (uniformly random) public keys can be encoded as 64-byte arrays which are computationally
+indistinguishable from uniform byte arrays. The module provides functions to convert public keys
+from and to this format, as well as convenience functions for key generation and ECDH that operate
+directly on ellswift-encoded keys.
+
+The encoding consists of the concatenation of two (32-byte big endian) encoded field elements $u$
+and $t.$ Together they encode an x-coordinate on the curve $x$, or (see further) a full point $(x, y)$ on
+the curve.
+
+**Decoding** consists of decoding the field elements $u$ and $t$ (values above the field size $p$
+are taken modulo $p$), and then evaluating $F_u(t)$, which for every $u$ and $t$ results in a valid
+x-coordinate on the curve. The functions $F_u$ will be defined in [Section 2](#2-the-decoding-function).
+
+**Encoding** a given $x$ coordinate is conceptually done as follows:
+* Loop:
+  * Pick a uniformly random field element $u.$
+  * Compute the set $L = F_u^{-1}(x)$ of $t$ values for which $F_u(t) = x$, which may have up to *8* elements.
+  * With probability $1 - \dfrac{\\#L}{8}$, restart the loop.
+  * Select a uniformly random $t \in L$ and return $(u, t).$
+
+This is the *ElligatorSwift* algorithm, here given for just x-coordinates. An extension to full
+$(x, y)$ points will be given in [Section 4](#4-encoding-and-decoding-full-x-y-coordinates).
+The algorithm finds a uniformly random $(u, t)$ among (almost all) those
+for which $F_u(t) = x.$ Section 3.2 in the paper proves that the number of such encodings for
+almost all x-coordinates on the curve (all but at most 39) is close to two times the field size
+(specifically, it lies in the range $2q \pm (22\sqrt{q} + O(1))$, where $q$ is the size of the field).
+
+## 2. The decoding function
+
+First some definitions:
+* $\mathbb{F}$ is the finite field of size $q$, of characteristic 5 or more, and $q \equiv 1 \mod 3.$
+  * For `secp256k1`, $q = 2^{256} - 2^{32} - 977$, which satisfies that requirement.
+* Let $E$ be the elliptic curve of points $(x, y) \in \mathbb{F}^2$ for which $y^2 = x^3 + ax + b$, with $a$ and $b$
+  public constants, for which $\Delta_E = -16(4a^3 + 27b^2)$ is a square, and at least one of $(-b \pm \sqrt{-3 \Delta_E} / 36)/2$ is a square.
+  This implies that the order of $E$ is either odd, or a multiple of *4*.
+  If $a=0$, this condition is always fulfilled.
+  * For `secp256k1`, $a=0$ and $b=7.$
+* Let the function $g(x) = x^3 + ax + b$, so the $E$ curve equation is also $y^2 = g(x).$
+* Let the function $h(x) = 3x^3 + 4a.$
+* Define $V$ as the set of solutions $(x_1, x_2, x_3, z)$ to $z^2 = g(x_1)g(x_2)g(x_3).$
+* Define $S_u$ as the set of solutions $(X, Y)$ to $X^2 + h(u)Y^2 = -g(u)$ and $Y \neq 0.$
+* $P_u$ is a function from $\mathbb{F}$ to $S_u$ that will be defined below.
+* $\psi_u$ is a function from $S_u$ to $V$ that will be defined below.
+
+**Note**: In the paper:
+* $F_u$ corresponds to $F_{0,u}$ there.
+* $P_u(t)$ is called $P$ there.
+* All $S_u$ sets together correspond to $S$ there.
+* All $\psi_u$ functions together (operating on elements of $S$) correspond to $\psi$ there.
+
+Note that for $V$, the left hand side of the equation $z^2$ is square, and thus the right
+hand must also be square. As multiplying non-squares results in a square in $\mathbb{F}$,
+out of the three right-hand side factors an even number must be non-squares.
+This implies that exactly *1* or exactly *3* out of
+$\\{g(x_1), g(x_2), g(x_3)\\}$ must be square, and thus that for any $(x_1,x_2,x_3,z) \in V$,
+at least one of $\\{x_1, x_2, x_3\\}$ must be a valid x-coordinate on $E.$ There is one exception
+to this, namely when $z=0$, but even then one of the three values is a valid x-coordinate.
+
+**Define** the decoding function $F_u(t)$ as:
+* Let $(x_1, x_2, x_3, z) = \psi_u(P_u(t)).$
+* Return the first element $x$ of $(x_3, x_2, x_1)$ which is a valid x-coordinate on $E$ (i.e., $g(x)$ is square).
+
+$P_u(t) = (X(u, t), Y(u, t))$, where:
+
+$$
+\begin{array}{lcl}
+X(u, t) & = & \left\\{\begin{array}{ll}
+  \dfrac{g(u) - t^2}{2t} & a = 0 \\
+  \dfrac{g(u) + h(u)(Y_0(u) - X_0(u)t)^2}{X_0(u)(1 + h(u)t^2)} & a \neq 0
+\end{array}\right. \\
+Y(u, t) & = & \left\\{\begin{array}{ll}
+  \dfrac{X(u, t) + t}{u \sqrt{-3}} = \dfrac{g(u) + t^2}{2tu\sqrt{-3}} & a = 0 \\
+  Y_0(u) + t(X(u, t) - X_0(u)) & a \neq 0
+\end{array}\right.
+\end{array}
+$$
+
+$P_u(t)$ is defined:
+* For $a=0$, unless:
+  * $u = 0$ or $t = 0$ (division by zero)
+  * $g(u) = -t^2$ (would give $Y=0$).
+* For $a \neq 0$, unless:
+  * $X_0(u) = 0$ or $h(u)t^2 = -1$ (division by zero)
+  * $Y_0(u) (1 - h(u)t^2) = 2X_0(u)t$ (would give $Y=0$).
+
+The functions $X_0(u)$ and $Y_0(u)$ are defined in Appendix A of the paper, and depend on various properties of $E.$
+
+The function $\psi_u$ is the same for all curves: $\psi_u(X, Y) = (x_1, x_2, x_3, z)$, where:
+
+$$
+\begin{array}{lcl}
+  x_1 & = & \dfrac{X}{2Y} - \dfrac{u}{2} && \\
+  x_2 & = & -\dfrac{X}{2Y} - \dfrac{u}{2} && \\
+  x_3 & = & u + 4Y^2 && \\
+  z   & = & \dfrac{g(x_3)}{2Y}(u^2 + ux_1 + x_1^2 + a) = \dfrac{-g(u)g(x_3)}{8Y^3}
+\end{array}
+$$
+
+### 2.1 Decoding for `secp256k1`
+
+Put together and specialized for $a=0$ curves, decoding $(u, t)$ to an x-coordinate is:
+
+**Define** $F_u(t)$ as:
+* Let $X = \dfrac{u^3 + b - t^2}{2t}.$
+* Let $Y = \dfrac{X + t}{u\sqrt{-3}}.$
+* Return the first $x$ in $(u + 4Y^2, \dfrac{-X}{2Y} - \dfrac{u}{2}, \dfrac{X}{2Y} - \dfrac{u}{2})$ for which $g(x)$ is square.
+
+To make sure that every input decodes to a valid x-coordinate, we remap the inputs in case
+$P_u$ is not defined (when $u=0$, $t=0$, or $g(u) = -t^2$):
+
+**Define** $F_u(t)$ as:
+* Let $u'=u$ if $u \neq 0$; $1$ otherwise (guaranteeing $u' \neq 0$).
+* Let $t'=t$ if $t \neq 0$; $1$ otherwise (guaranteeing $t' \neq 0$).
+* Let $t''=t'$ if $g(u') \neq -t'^2$; $2t'$ otherwise (guaranteeing $t'' \neq 0$ and $g(u') \neq -t''^2$).
+* Let $X = \dfrac{u'^3 + b - t''^2}{2t''}.$
+* Let $Y = \dfrac{X + t''}{u'\sqrt{-3}}.$
+* Return the first $x$ in $(u' + 4Y^2, \dfrac{-X}{2Y} - \dfrac{u'}{2}, \dfrac{X}{2Y} - \dfrac{u'}{2})$ for which $x^3 + b$ is square.
+
+The choices here are not strictly necessary. Just returning a fixed constant in any of the undefined cases would suffice,
+but the approach here is simple enough and gives fairly uniform output even in these cases.
+
+**Note**: in the paper these conditions result in $\infty$ as output, due to the use of projective coordinates there.
+We wish to avoid the need for callers to deal with this special case.
+
+This is implemented in `rustsecp256k1_v0_9_0_ellswift_xswiftec_frac_var` (which decodes to an x-coordinate represented as a fraction), and
+in `rustsecp256k1_v0_9_0_ellswift_xswiftec_var` (which outputs the actual x-coordinate).
+
+## 3. The encoding function
+
+To implement $F_u^{-1}(x)$, the function to find the set of inverses $t$ for which $F_u(t) = x$, we have to reverse the process:
+* Find all the $(X, Y) \in S_u$ that could have given rise to $x$, through the $x_1$, $x_2$, or $x_3$ formulas in $\psi_u.$
+* Map those $(X, Y)$ solutions to $t$ values using $P_u^{-1}(X, Y).$
+* For each of the found $t$ values, verify that $F_u(t) = x.$
+* Return the remaining $t$ values.
+
+The function $P_u^{-1}$, which finds $t$ given $(X, Y) \in S_u$, is significantly simpler than $P_u:$
+
+$$
+P_u^{-1}(X, Y) = \left\\{\begin{array}{ll}
+Yu\sqrt{-3} - X & a = 0 \\
+\dfrac{Y-Y_0(u)}{X-X_0(u)} & a \neq 0 \land X \neq X_0(u) \\
+\dfrac{-X_0(u)}{h(u)Y_0(u)} & a \neq 0 \land X = X_0(u) \land Y = Y_0(u)
+\end{array}\right.
+$$
+
+The third step above, verifying that $F_u(t) = x$, is necessary because for the $(X, Y)$ values found through the $x_1$ and $x_2$ expressions,
+it is possible that decoding through $\psi_u(X, Y)$ yields a valid $x_3$ on the curve, which would take precedence over the
+$x_1$ or $x_2$ decoding. These $(X, Y)$ solutions must be rejected.
+
+Since we know that exactly one or exactly three out of $\\{x_1, x_2, x_3\\}$ are valid x-coordinates for any $t$,
+the case where either $x_1$ or $x_2$ is valid and in addition also $x_3$ is valid must mean that all three are valid.
+This means that instead of checking whether $x_3$ is on the curve, it is also possible to check whether the other one out of
+$x_1$ and $x_2$ is on the curve. This is significantly simpler, as it turns out.
+
+Observe that $\psi_u$ guarantees that $x_1 + x_2 = -u.$ So given either $x = x_1$ or $x = x_2$, the other one of the two can be computed as
+$-u - x.$ Thus, when encoding $x$ through the $x_1$ or $x_2$ expressions, one can simply check whether $g(-u-x)$ is a square,
+and if so, not include the corresponding $t$ values in the returned set. As this does not need $X$, $Y$, or $t$, this condition can be determined
+before those values are computed.
+
+It is not possible that an encoding found through the $x_1$ expression decodes to a different valid x-coordinate using $x_2$ (which would
+take precedence), for the same reason: if both $x_1$ and $x_2$ decodings were valid, $x_3$ would be valid as well, and thus take
+precedence over both. Because of this, the $g(-u-x)$ being square test for $x_1$ and $x_2$ is the only test necessary to guarantee the found $t$
+values round-trip back to the input $x$ correctly. This is the reason for choosing the $(x_3, x_2, x_1)$ precedence order in the decoder;
+any order which does not place $x_3$ first requires more complicated round-trip checks in the encoder.
+
+### 3.1 Switching to *v, w* coordinates
+
+Before working out the formulas for all this, we switch to different variables for $S_u.$ Let $v = (X/Y - u)/2$, and
+$w = 2Y.$ Or in the other direction, $X = w(u/2 + v)$ and $Y = w/2:$
+* $S_u'$ becomes the set of $(v, w)$ for which $w^2 (u^2 + uv + v^2 + a) = -g(u)$ and $w \neq 0.$
+* For $a=0$ curves, $P_u^{-1}$ can be stated for $(v,w)$ as $P_u^{'-1}(v, w) = w\left(\frac{\sqrt{-3}-1}{2}u - v\right).$
+* $\psi_u$ can be stated for $(v, w)$ as $\psi_u'(v, w) = (x_1, x_2, x_3, z)$, where
+
+$$
+\begin{array}{lcl}
+  x_1 & = & v \\
+  x_2 & = & -u - v \\
+  x_3 & = & u + w^2 \\
+  z   & = & \dfrac{g(x_3)}{w}(u^2 + uv + v^2 + a) = \dfrac{-g(u)g(x_3)}{w^3}
+\end{array}
+$$
+
+We can now write the expressions for finding $(v, w)$ given $x$ explicitly, by solving each of the $\\{x_1, x_2, x_3\\}$
+expressions for $v$ or $w$, and using the $S_u'$ equation to find the other variable:
+* Assuming $x = x_1$, we find $v = x$ and $w = \pm\sqrt{-g(u)/(u^2 + uv + v^2 + a)}$ (two solutions).
+* Assuming $x = x_2$, we find $v = -u-x$ and $w = \pm\sqrt{-g(u)/(u^2 + uv + v^2 + a)}$ (two solutions).
+* Assuming $x = x_3$, we find $w = \pm\sqrt{x-u}$ and $v = -u/2 \pm \sqrt{-w^2(4g(u) + w^2h(u))}/(2w^2)$ (four solutions).
+
+### 3.2 Avoiding computing all inverses
+
+The *ElligatorSwift* algorithm as stated in Section 1 requires the computation of $L = F_u^{-1}(x)$ (the
+set of all $t$ such that $(u, t)$ decode to $x$) in full. This is unnecessary.
+
+Observe that the procedure of restarting with probability $(1 - \frac{\\#L}{8})$ and otherwise returning a
+uniformly random element from $L$ is actually equivalent to always padding $L$ with $\bot$ values up to length 8,
+picking a uniformly random element from that, restarting whenever $\bot$ is picked:
+
+**Define** *ElligatorSwift(x)* as:
+* Loop:
+  * Pick a uniformly random field element $u.$
+  * Compute the set $L = F_u^{-1}(x).$
+  * Let $T$ be the 8-element vector consisting of the elements of $L$, plus $8 - \\#L$ times $\\{\bot\\}.$
+  * Select a uniformly random $t \in T.$
+  * If $t \neq \bot$, return $(u, t)$; restart loop otherwise.
+
+Now notice that the order of elements in $T$ does not matter, as all we do is pick a uniformly
+random element in it, so we do not need to have all $\bot$ values at the end.
+As we have 8 distinct formulas for finding $(v, w)$ (taking the variants due to $\pm$ into account),
+we can associate every index in $T$ with exactly one of those formulas, making sure that:
+* Formulas that yield no solutions (due to division by zero or non-existing square roots) or invalid solutions are made to return $\bot.$
+* For the $x_1$ and $x_2$ cases, if $g(-u-x)$ is a square, $\bot$ is returned instead (the round-trip check).
+* In case multiple formulas would return the same non- $\bot$ result, all but one of those must be turned into $\bot$ to avoid biasing those.
+
+The last condition above only occurs with negligible probability for cryptographically-sized curves, but is interesting
+to take into account as it allows exhaustive testing in small groups. See [Section 3.4](#34-dealing-with-special-cases)
+for an analysis of all the negligible cases.
+
+If we define $T = (G_{0,u}(x), G_{1,u}(x), \ldots, G_{7,u}(x))$, with each $G_{i,u}$ matching one of the formulas,
+the loop can be simplified to only compute one of the inverses instead of all of them:
+
+**Define** *ElligatorSwift(x)* as:
+* Loop:
+  * Pick a uniformly random field element $u.$
+  * Pick a uniformly random integer $c$ in $[0,8).$
+  * Let $t = G_{c,u}(x).$
+  * If $t \neq \bot$, return $(u, t)$; restart loop otherwise.
+
+This is implemented in `rustsecp256k1_v0_9_0_ellswift_xelligatorswift_var`.
+
+### 3.3 Finding the inverse
+
+To implement $G_{c,u}$, we map $c=0$ to the $x_1$ formula, $c=1$ to the $x_2$ formula, and $c=2$ and $c=3$ to the $x_3$ formula.
+Those are then repeated as $c=4$ through $c=7$ for the other sign of $w$ (noting that in each formula, $w$ is a square root of some expression).
+Ignoring the negligible cases, we get:
+
+**Define** $G_{c,u}(x)$ as:
+* If $c \in \\{0, 1, 4, 5\\}$ (for $x_1$ and $x_2$ formulas):
+  * If $g(-u-x)$ is square, return $\bot$ (as $x_3$ would be valid and take precedence).
+  * If $c \in \\{0, 4\\}$ (the $x_1$ formula) let $v = x$, otherwise let $v = -u-x$ (the $x_2$ formula)
+  * Let $s = -g(u)/(u^2 + uv + v^2 + a)$ (using $s = w^2$ in what follows).
+* Otherwise, when $c \in \\{2, 3, 6, 7\\}$ (for $x_3$ formulas):
+  * Let $s = x-u.$
+  * Let $r = \sqrt{-s(4g(u) + sh(u))}.$
+  * Let $v = (r/s - u)/2$ if $c \in \\{3, 7\\}$; $(-r/s - u)/2$ otherwise.
+* Let $w = \sqrt{s}.$
+* Depending on $c:$
+  * If $c \in \\{0, 1, 2, 3\\}:$ return $P_u^{'-1}(v, w).$
+  * If $c \in \\{4, 5, 6, 7\\}:$ return $P_u^{'-1}(v, -w).$
+
+Whenever a square root of a non-square is taken, $\bot$ is returned; for both square roots this happens with roughly
+50% on random inputs. Similarly, when a division by 0 would occur, $\bot$ is returned as well; this will only happen
+with negligible probability. A division by 0 in the first branch in fact cannot occur at all, because $u^2 + uv + v^2 + a = 0$
+implies $g(-u-x) = g(x)$ which would mean the $g(-u-x)$ is square condition has triggered
+and $\bot$ would have been returned already.
+
+**Note**: In the paper, the $case$ variable corresponds roughly to the $c$ above, but only takes on 4 possible values (1 to 4).
+The conditional negation of $w$ at the end is done randomly, which is equivalent, but makes testing harder. We choose to
+have the $G_{c,u}$ be deterministic, and capture all choices in $c.$
+
+Now observe that the $c \in \\{1, 5\\}$ and $c \in \\{3, 7\\}$ conditions effectively perform the same $v \rightarrow -u-v$
+transformation. Furthermore, that transformation has no effect on $s$ in the first branch
+as $u^2 + ux + x^2 + a = u^2 + u(-u-x) + (-u-x)^2 + a.$ Thus we can extract it out and move it down:
+
+**Define** $G_{c,u}(x)$ as:
+* If $c \in \\{0, 1, 4, 5\\}:$
+  * If $g(-u-x)$ is square, return $\bot.$
+  * Let $s = -g(u)/(u^2 + ux + x^2 + a).$
+  * Let $v = x.$
+* Otherwise, when $c \in \\{2, 3, 6, 7\\}:$
+  * Let $s = x-u.$
+  * Let $r = \sqrt{-s(4g(u) + sh(u))}.$
+  * Let $v = (r/s - u)/2.$
+* Let $w = \sqrt{s}.$
+* Depending on $c:$
+  * If $c \in \\{0, 2\\}:$ return $P_u^{'-1}(v, w).$
+  * If $c \in \\{1, 3\\}:$ return $P_u^{'-1}(-u-v, w).$
+  * If $c \in \\{4, 6\\}:$ return $P_u^{'-1}(v, -w).$
+  * If $c \in \\{5, 7\\}:$ return $P_u^{'-1}(-u-v, -w).$
+
+This shows there will always be exactly 0, 4, or 8 $t$ values for a given $(u, x)$ input.
+There can be 0, 1, or 2 $(v, w)$ pairs before invoking $P_u^{'-1}$, and each results in 4 distinct $t$ values.
+
+### 3.4 Dealing with special cases
+
+As mentioned before there are a few cases to deal with which only happen in a negligibly small subset of inputs.
+For cryptographically sized fields, if only random inputs are going to be considered, it is unnecessary to deal with these. Still, for completeness
+we analyse them here. They generally fall into two categories: cases in which the encoder would produce $t$ values that
+do not decode back to $x$ (or at least cannot guarantee that they do), and cases in which the encoder might produce the same
+$t$ value for multiple $c$ inputs (thereby biasing that encoding):
+
+* In the branch for $x_1$ and $x_2$ (where $c \in \\{0, 1, 4, 5\\}$):
+  * When $g(u) = 0$, we would have $s=w=Y=0$, which is not on $S_u.$ This is only possible on even-ordered curves.
+    Excluding this also removes the one condition under which the simplified check for $x_3$ on the curve
+    fails (namely when $g(x_1)=g(x_2)=0$ but $g(x_3)$ is not square).
+    This does exclude some valid encodings: when both $g(u)=0$ and $u^2+ux+x^2+a=0$ (also implying $g(x)=0$),
+    the $S_u'$ equation degenerates to $0 = 0$, and many valid $t$ values may exist. Yet, these cannot be targeted uniformly by the
+    encoder anyway as there will generally be more than 8.
+  * When $g(x) = 0$, the same $t$ would be produced as in the $x_3$ branch (where $c \in \\{2, 3, 6, 7\\}$) which we give precedence
+    as it can deal with $g(u)=0$.
+    This is again only possible on even-ordered curves.
+* In the branch for $x_3$ (where $c \in \\{2, 3, 6, 7\\}$):
+  * When $s=0$, a division by zero would occur.
+  * When $v = -u-v$ and $c \in \\{3, 7\\}$, the same $t$ would be returned as in the $c \in \\{2, 6\\}$ cases.
+    It is equivalent to checking whether $r=0$.
+    This cannot occur in the $x_1$ or $x_2$ branches, as it would trigger the $g(-u-x)$ is square condition.
+    A similar concern for $w = -w$ does not exist, as $w=0$ is already impossible in both branches: in the first
+    it requires $g(u)=0$ which is already outlawed on even-ordered curves and impossible on others; in the second it would trigger division by zero.
+* Curve-specific special cases also exist that need to be rejected, because they result in $(u,t)$ which is invalid to the decoder, or because of division by zero in the encoder:
+  * For $a=0$ curves, when $u=0$ or when $t=0$. The latter can only be reached by the encoder when $g(u)=0$, which requires an even-ordered curve.
+  * For $a \neq 0$ curves, when $X_0(u)=0$, when $h(u)t^2 = -1$, or when $w(u + 2v) = 2X_0(u)$ while also either $w \neq 2Y_0(u)$ or $h(u)=0$.
+
+**Define** a version of $G_{c,u}(x)$ which deals with all these cases:
+* If $a=0$ and $u=0$, return $\bot.$
+* If $a \neq 0$ and $X_0(u)=0$, return $\bot.$
+* If $c \in \\{0, 1, 4, 5\\}:$
+  * If $g(u) = 0$ or $g(x) = 0$, return $\bot$ (even curves only).
+  * If $g(-u-x)$ is square, return $\bot.$
+  * Let $s = -g(u)/(u^2 + ux + x^2 + a)$ (cannot cause division by zero).
+  * Let $v = x.$
+* Otherwise, when $c \in \\{2, 3, 6, 7\\}:$
+  * Let $s = x-u.$
+  * Let $r = \sqrt{-s(4g(u) + sh(u))}$; return $\bot$ if not square.
+  * If $c \in \\{3, 7\\}$ and $r=0$, return $\bot.$
+  * If $s = 0$, return $\bot.$
+  * Let $v = (r/s - u)/2.$
+* Let $w = \sqrt{s}$; return $\bot$ if not square.
+* If $a \neq 0$ and $w(u+2v) = 2X_0(u)$ and either $w \neq 2Y_0(u)$ or $h(u) = 0$, return $\bot.$
+* Depending on $c:$
+  * If $c \in \\{0, 2\\}$, let $t = P_u^{'-1}(v, w).$
+  * If $c \in \\{1, 3\\}$, let $t = P_u^{'-1}(-u-v, w).$
+  * If $c \in \\{4, 6\\}$, let $t = P_u^{'-1}(v, -w).$
+  * If $c \in \\{5, 7\\}$, let $t = P_u^{'-1}(-u-v, -w).$
+* If $a=0$ and $t=0$, return $\bot$ (even curves only).
+* If $a \neq 0$ and $h(u)t^2 = -1$, return $\bot.$
+* Return $t.$
+
+Given any $u$, using this algorithm over all $x$ and $c$ values, every $t$ value will be reached exactly once,
+for an $x$ for which $F_u(t) = x$ holds, except for these cases that will not be reached:
+* All cases where $P_u(t)$ is not defined:
+  * For $a=0$ curves, when $u=0$, $t=0$, or $g(u) = -t^2.$
+  * For $a \neq 0$ curves, when $h(u)t^2 = -1$, $X_0(u) = 0$, or $Y_0(u) (1 - h(u) t^2) = 2X_0(u)t.$
+* When $g(u)=0$, the potentially many $t$ values that decode to an $x$ satisfying $g(x)=0$ using the $x_2$ formula. These were excluded by the $g(u)=0$ condition in the $c \in \\{0, 1, 4, 5\\}$ branch.
+
+These cases form a negligible subset of all $(u, t)$ for cryptographically sized curves.
+
+### 3.5 Encoding for `secp256k1`
+
+Specialized for odd-ordered $a=0$ curves:
+
+**Define** $G_{c,u}(x)$ as:
+* If $u=0$, return $\bot.$
+* If $c \in \\{0, 1, 4, 5\\}:$
+  * If $(-u-x)^3 + b$ is square, return $\bot$
+  * Let $s = -(u^3 + b)/(u^2 + ux + x^2)$ (cannot cause division by 0).
+  * Let $v = x.$
+* Otherwise, when $c \in \\{2, 3, 6, 7\\}:$
+  * Let $s = x-u.$
+  * Let $r = \sqrt{-s(4(u^3 + b) + 3su^2)}$; return $\bot$ if not square.
+  * If $c \in \\{3, 7\\}$ and $r=0$, return $\bot.$
+  * If $s = 0$, return $\bot.$
+  * Let $v = (r/s - u)/2.$
+* Let $w = \sqrt{s}$; return $\bot$ if not square.
+* Depending on $c:$
+  * If $c \in \\{0, 2\\}:$ return $w(\frac{\sqrt{-3}-1}{2}u - v).$
+  * If $c \in \\{1, 3\\}:$ return $w(\frac{\sqrt{-3}+1}{2}u + v).$
+  * If $c \in \\{4, 6\\}:$ return $w(\frac{-\sqrt{-3}+1}{2}u + v).$
+  * If $c \in \\{5, 7\\}:$ return $w(\frac{-\sqrt{-3}-1}{2}u - v).$
+
+This is implemented in `rustsecp256k1_v0_9_0_ellswift_xswiftec_inv_var`.
+
+And the x-only ElligatorSwift encoding algorithm is still:
+
+**Define** *ElligatorSwift(x)* as:
+* Loop:
+  * Pick a uniformly random field element $u.$
+  * Pick a uniformly random integer $c$ in $[0,8).$
+  * Let $t = G_{c,u}(x).$
+  * If $t \neq \bot$, return $(u, t)$; restart loop otherwise.
+
+Note that this logic does not take the remapped $u=0$, $t=0$, and $g(u) = -t^2$ cases into account; it just avoids them.
+While it is not impossible to make the encoder target them, this would increase the maximum number of $t$ values for a given $(u, x)$
+combination beyond 8, and thereby slow down the ElligatorSwift loop proportionally, for a negligible gain in uniformity.
+
+## 4. Encoding and decoding full *(x, y)* coordinates
+
+So far we have only addressed encoding and decoding x-coordinates, but in some cases an encoding
+for full points with $(x, y)$ coordinates is desirable. It is possible to encode this information
+in $t$ as well.
+
+Note that for any $(X, Y) \in S_u$, $(\pm X, \pm Y)$ are all on $S_u.$ Moreover, all of these are
+mapped to the same x-coordinate. Negating $X$ or negating $Y$ just results in $x_1$ and $x_2$
+being swapped, and does not affect $x_3.$ This will not change the outcome x-coordinate as the order
+of $x_1$ and $x_2$ only matters if both were to be valid, and in that case $x_3$ would be used instead.
+
+Still, these four $(X, Y)$ combinations all correspond to distinct $t$ values, so we can encode
+the sign of the y-coordinate in the sign of $X$ or the sign of $Y.$ They correspond to the
+four distinct $P_u^{'-1}$ calls in the definition of $G_{u,c}.$
+
+**Note**: In the paper, the sign of the y coordinate is encoded in a separately-coded bit.
+
+To encode the sign of $y$ in the sign of $Y:$
+
+**Define** *Decode(u, t)* for full $(x, y)$ as:
+* Let $(X, Y) = P_u(t).$
+* Let $x$ be the first value in $(u + 4Y^2, \frac{-X}{2Y} - \frac{u}{2}, \frac{X}{2Y} - \frac{u}{2})$ for which $g(x)$ is square.
+* Let $y = \sqrt{g(x)}.$
+* If $sign(y) = sign(Y)$, return $(x, y)$; otherwise return $(x, -y).$
+
+And encoding would be done using a $G_{c,u}(x, y)$ function defined as:
+
+**Define** $G_{c,u}(x, y)$ as:
+* If $c \in \\{0, 1\\}:$
+  * If $g(u) = 0$ or $g(x) = 0$, return $\bot$ (even curves only).
+  * If $g(-u-x)$ is square, return $\bot.$
+  * Let $s = -g(u)/(u^2 + ux + x^2 + a)$ (cannot cause division by zero).
+  * Let $v = x.$
+* Otherwise, when $c \in \\{2, 3\\}:$
+  * Let $s = x-u.$
+  * Let $r = \sqrt{-s(4g(u) + sh(u))}$; return $\bot$ if not square.
+  * If $c = 3$ and $r = 0$, return $\bot.$
+  * Let $v = (r/s - u)/2.$
+* Let $w = \sqrt{s}$; return $\bot$ if not square.
+* Let $w' = w$ if $sign(w/2) = sign(y)$; $-w$ otherwise.
+* Depending on $c:$
+  * If $c \in \\{0, 2\\}:$ return $P_u^{'-1}(v, w').$
+  * If $c \in \\{1, 3\\}:$ return $P_u^{'-1}(-u-v, w').$
+
+Note that $c$ now only ranges $[0,4)$, as the sign of $w'$ is decided based on that of $y$, rather than on $c.$
+This change makes some valid encodings unreachable: when $y = 0$ and $sign(Y) \neq sign(0)$.
+
+In the above logic, $sign$ can be implemented in several ways, such as parity of the integer representation
+of the input field element (for prime-sized fields) or the quadratic residuosity (for fields where
+$-1$ is not square). The choice does not matter, as long as it only takes on two possible values, and for $x \neq 0$ it holds that $sign(x) \neq sign(-x)$.
+
+### 4.1 Full *(x, y)* coordinates for `secp256k1`
+
+For $a=0$ curves, there is another option. Note that for those,
+the $P_u(t)$ function translates negations of $t$ to negations of (both) $X$ and $Y.$ Thus, we can use $sign(t)$ to
+encode the y-coordinate directly. Combined with the earlier remapping to guarantee all inputs land on the curve, we get
+as decoder:
+
+**Define** *Decode(u, t)* as:
+* Let $u'=u$ if $u \neq 0$; $1$ otherwise.
+* Let $t'=t$ if $t \neq 0$; $1$ otherwise.
+* Let $t''=t'$ if $u'^3 + b + t'^2 \neq 0$; $2t'$ otherwise.
+* Let $X = \dfrac{u'^3 + b - t''^2}{2t''}.$
+* Let $Y = \dfrac{X + t''}{u'\sqrt{-3}}.$
+* Let $x$ be the first element of $(u' + 4Y^2, \frac{-X}{2Y} - \frac{u'}{2}, \frac{X}{2Y} - \frac{u'}{2})$ for which $g(x)$ is square.
+* Let $y = \sqrt{g(x)}.$
+* Return $(x, y)$ if $sign(y) = sign(t)$; $(x, -y)$ otherwise.
+
+This is implemented in `rustsecp256k1_v0_9_0_ellswift_swiftec_var`. The used $sign(x)$ function is the parity of $x$ when represented as in integer in $[0,q).$
+
+The corresponding encoder would invoke the x-only one, but negating the output $t$ if $sign(t) \neq sign(y).$
+
+This is implemented in `rustsecp256k1_v0_9_0_ellswift_elligatorswift_var`.
+
+Note that this is only intended for encoding points where both the x-coordinate and y-coordinate are unpredictable. When encoding x-only points
+where the y-coordinate is implicitly even (or implicitly square, or implicitly in $[0,q/2]$), the encoder in
+[Section 3.5](#35-encoding-for-secp256k1) must be used, or a bias is reintroduced that undoes all the benefit of using ElligatorSwift
+in the first place.
diff --git a/secp256k1-sys/depend/secp256k1/doc/release-process.md b/secp256k1-sys/depend/secp256k1/doc/release-process.md
index 91e361691..ea6087c9f 100644
--- a/secp256k1-sys/depend/secp256k1/doc/release-process.md
+++ b/secp256k1-sys/depend/secp256k1/doc/release-process.md
@@ -12,33 +12,69 @@ It is best if the maintainers are present during the release, so they can help e
 
 This process also assumes that there will be no minor releases for old major releases.
 
+We aim to cut a regular release every 3-4 months, approximately twice as frequent as major Bitcoin Core releases. Every second release should be published one month before the feature freeze of the next major Bitcoin Core release, allowing sufficient time to update the library in Core.
+
+## Sanity Checks
+Perform these checks before creating a release:
+
+1. Ensure `make distcheck` doesn't fail.
+```shell
+./autogen.sh && ./configure --enable-dev-mode && make distcheck
+```
+2. Check installation with autotools:
+```shell
+dir=$(mktemp -d)
+./autogen.sh && ./configure --prefix=$dir && make clean && make install && ls -l $dir/include $dir/lib
+gcc -o ecdsa examples/ecdsa.c $(PKG_CONFIG_PATH=$dir/lib/pkgconfig pkg-config --cflags --libs libsecp256k1) -Wl,-rpath,"$dir/lib" && ./ecdsa
+```
+3. Check installation with CMake:
+```shell
+dir=$(mktemp -d)
+build=$(mktemp -d)
+cmake -B $build -DCMAKE_INSTALL_PREFIX=$dir && cmake --build $build --target install && ls -l $dir/include $dir/lib*
+gcc -o ecdsa examples/ecdsa.c -I $dir/include -L $dir/lib*/ -l secp256k1 -Wl,-rpath,"$dir/lib",-rpath,"$dir/lib64" && ./ecdsa
+```
+
 ## Regular release
 
 1. Open a PR to the master branch with a commit (using message `"release: prepare for $MAJOR.$MINOR.$PATCH"`, for example) that
-   * finalizes the release notes in [CHANGELOG.md](../CHANGELOG.md) (make sure to include an entry for `### ABI Compatibility`) and
-   * updates `_PKG_VERSION_*`, `_LIB_VERSION_*`, and sets `_PKG_VERSION_IS_RELEASE` to `true` in `configure.ac`.
+   * finalizes the release notes in [CHANGELOG.md](../CHANGELOG.md) by
+       * adding a section for the release (make sure that the version number is a link to a diff between the previous and new version),
+       * removing the `[Unreleased]` section header, and
+       * including an entry for `### ABI Compatibility` if it doesn't exist that mentions the library soname of the release,
+   * sets `_PKG_VERSION_IS_RELEASE` to `true` in `configure.ac`, and
+   * if this is not a patch release
+       * updates `_PKG_VERSION_*` and `_LIB_VERSION_*`  in `configure.ac` and
+       * updates `project(libsecp256k1 VERSION ...)` and `${PROJECT_NAME}_LIB_VERSION_*` in `CMakeLists.txt`.
 2. After the PR is merged, tag the commit and push it:
    ```
    RELEASE_COMMIT=<merge commit of step 1>
    git tag -s v$MAJOR.$MINOR.$PATCH -m "libsecp256k1 $MAJOR.$MINOR.$PATCH" $RELEASE_COMMIT
    git push git@github.com:bitcoin-core/secp256k1.git v$MAJOR.$MINOR.$PATCH
    ```
-3. Open a PR to the master branch with a commit (using message `"release: bump version after $MAJOR.$MINOR.$PATCH"`, for example) that sets `_PKG_VERSION_IS_RELEASE` to `false` and `_PKG_VERSION_PATCH` to `$PATCH + 1` and increases `_LIB_VERSION_REVISION`. If other maintainers are not present to approve the PR, it can be merged without ACKs.
+3. Open a PR to the master branch with a commit (using message `"release cleanup: bump version after $MAJOR.$MINOR.$PATCH"`, for example) that
+   * sets `_PKG_VERSION_IS_RELEASE` to `false` and increments `_PKG_VERSION_PATCH` and `_LIB_VERSION_REVISION` in `configure.ac`,
+   * increments the `$PATCH` component of `project(libsecp256k1 VERSION ...)` and `${PROJECT_NAME}_LIB_VERSION_REVISION` in `CMakeLists.txt`, and
+   * adds an `[Unreleased]` section header to the [CHANGELOG.md](../CHANGELOG.md).
+
+   If other maintainers are not present to approve the PR, it can be merged without ACKs.
 4. Create a new GitHub release with a link to the corresponding entry in [CHANGELOG.md](../CHANGELOG.md).
 
 ## Maintenance release
 
 Note that bugfixes only need to be backported to releases for which no compatible release without the bug exists.
 
-1. If `$PATCH = 1`, create maintenance branch `$MAJOR.$MINOR`:
+1. If there's no maintenance branch `$MAJOR.$MINOR`, create one:
    ```
-   git checkout -b $MAJOR.$MINOR v$MAJOR.$MINOR.0
+   git checkout -b $MAJOR.$MINOR v$MAJOR.$MINOR.$((PATCH - 1))
    git push git@github.com:bitcoin-core/secp256k1.git $MAJOR.$MINOR
    ```
 2. Open a pull request to the `$MAJOR.$MINOR` branch that
    * includes the bugfixes,
-   * finalizes the release notes,
-   * bumps `_PKG_VERSION_PATCH` and `_LIB_VERSION_REVISION` in `configure.ac` (with commit message `"release: update PKG_ and LIB_VERSION for $MAJOR.$MINOR.$PATCH"`, for example).
+   * finalizes the release notes similar to a regular release,
+   * increments `_PKG_VERSION_PATCH` and `_LIB_VERSION_REVISION` in `configure.ac`
+     and the `$PATCH` component of `project(libsecp256k1 VERSION ...)` and `${PROJECT_NAME}_LIB_VERSION_REVISION` in `CMakeLists.txt`
+     (with commit message `"release: bump versions for $MAJOR.$MINOR.$PATCH"`, for example).
 3. After the PRs are merged, update the release branch and tag the commit:
    ```
    git checkout $MAJOR.$MINOR && git pull
diff --git a/secp256k1-sys/depend/secp256k1/doc/safegcd_implementation.md b/secp256k1-sys/depend/secp256k1/doc/safegcd_implementation.md
index 063aa8efa..5dbbb7bbd 100644
--- a/secp256k1-sys/depend/secp256k1/doc/safegcd_implementation.md
+++ b/secp256k1-sys/depend/secp256k1/doc/safegcd_implementation.md
@@ -1,7 +1,7 @@
 # The safegcd implementation in libsecp256k1 explained
 
-This document explains the modular inverse implementation in the `src/modinv*.h` files. It is based
-on the paper
+This document explains the modular inverse and Jacobi symbol implementations in the `src/modinv*.h` files.
+It is based on the paper
 ["Fast constant-time gcd computation and modular inversion"](https://gcd.cr.yp.to/papers.html#safegcd)
 by Daniel J. Bernstein and Bo-Yin Yang. The references below are for the Date: 2019.04.13 version.
 
@@ -410,7 +410,7 @@ sufficient even. Given that every loop iteration performs *N* divsteps, it will
 
 To deal with the branches in `divsteps_n_matrix` we will replace them with constant-time bitwise
 operations (and hope the C compiler isn't smart enough to turn them back into branches; see
-`valgrind_ctime_test.c` for automated tests that this isn't the case). To do so, observe that a
+`ctime_tests.c` for automated tests that this isn't the case). To do so, observe that a
 divstep can be written instead as (compare to the inner loop of `gcd` in section 1).
 
 ```python
@@ -769,3 +769,51 @@ def modinv_var(M, Mi, x):
         d, e = update_de(d, e, t, M, Mi)
     return normalize(f, d, Mi)
 ```
+
+## 8. From GCDs to Jacobi symbol
+
+We can also use a similar approach to calculate Jacobi symbol *(x | M)* by keeping track of an
+extra variable *j*, for which at every step *(x | M) = j (g | f)*. As we update *f* and *g*, we
+make corresponding updates to *j* using
+[properties of the Jacobi symbol](https://en.wikipedia.org/wiki/Jacobi_symbol#Properties):
+* *((g/2) | f)* is either *(g | f)* or *-(g | f)*, depending on the value of *f mod 8* (negating if it's *3* or *5*).
+* *(f | g)* is either *(g | f)* or *-(g | f)*, depending on *f mod 4* and *g mod 4* (negating if both are *3*).
+
+These updates depend only on the values of *f* and *g* modulo *4* or *8*, and can thus be applied
+very quickly, as long as we keep track of a few additional bits of *f* and *g*. Overall, this
+calculation is slightly simpler than the one for the modular inverse because we no longer need to
+keep track of *d* and *e*.
+
+However, one difficulty of this approach is that the Jacobi symbol *(a | n)* is only defined for
+positive odd integers *n*, whereas in the original safegcd algorithm, *f, g* can take negative
+values. We resolve this by using the following modified steps:
+
+```python
+        # Before
+        if delta > 0 and g & 1:
+            delta, f, g = 1 - delta, g, (g - f) // 2
+
+        # After
+        if delta > 0 and g & 1:
+            delta, f, g = 1 - delta, g, (g + f) // 2
+```
+
+The algorithm is still correct, since the changed divstep, called a "posdivstep" (see section 8.4
+and E.5 in the paper) preserves *gcd(f, g)*. However, there's no proof that the modified algorithm
+will converge. The justification for posdivsteps is completely empirical: in practice, it appears
+that the vast majority of nonzero inputs converge to *f=g=gcd(f<sub>0</sub>, g<sub>0</sub>)* in a
+number of steps proportional to their logarithm.
+
+Note that:
+- We require inputs to satisfy *gcd(x, M) = 1*, as otherwise *f=1* is not reached.
+- We require inputs *x &neq; 0*, because applying posdivstep with *g=0* has no effect.
+- We need to update the termination condition from *g=0* to *f=1*.
+
+We account for the possibility of nonconvergence by only performing a bounded number of
+posdivsteps, and then falling back to square-root based Jacobi calculation if a solution has not
+yet been found.
+
+The optimizations in sections 3-7 above are described in the context of the original divsteps, but
+in the C implementation we also adapt most of them (not including "avoiding modulus operations",
+since it's not necessary to track *d, e*, and "constant-time operation", since we never calculate
+Jacobi symbols for secret data) to the posdivsteps version.
diff --git a/secp256k1-sys/depend/secp256k1/examples/CMakeLists.txt b/secp256k1-sys/depend/secp256k1/examples/CMakeLists.txt
new file mode 100644
index 000000000..607bb6777
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/examples/CMakeLists.txt
@@ -0,0 +1,30 @@
+function(add_example name)
+  set(target_name ${name}_example)
+  add_executable(${target_name} ${name}.c)
+  target_include_directories(${target_name} PRIVATE
+    ${PROJECT_SOURCE_DIR}/include
+  )
+  target_link_libraries(${target_name}
+    secp256k1
+    $<$<PLATFORM_ID:Windows>:bcrypt>
+  )
+  set(test_name ${name}_example)
+  add_test(NAME ${test_name} COMMAND ${target_name})
+  if(BUILD_SHARED_LIBS AND MSVC)
+    # The DLL must reside either in the same folder where the executable is
+    # or somewhere in PATH. Using the latter option.
+    set_tests_properties(${test_name} PROPERTIES
+      ENVIRONMENT "PATH=$<TARGET_FILE_DIR:secp256k1>;$ENV{PATH}"
+    )
+  endif()
+endfunction()
+
+add_example(ecdsa)
+
+if(SECP256K1_ENABLE_MODULE_ECDH)
+  add_example(ecdh)
+endif()
+
+if(SECP256K1_ENABLE_MODULE_SCHNORRSIG)
+  add_example(schnorr)
+endif()
diff --git a/secp256k1-sys/depend/secp256k1/examples/ecdh.c b/secp256k1-sys/depend/secp256k1/examples/ecdh.c
index 8d70b2a98..6a32e9836 100644
--- a/secp256k1-sys/depend/secp256k1/examples/ecdh.c
+++ b/secp256k1-sys/depend/secp256k1/examples/ecdh.c
@@ -14,8 +14,7 @@
 #include <secp256k1.h>
 #include <secp256k1_ecdh.h>
 
-#include "random.h"
-
+#include "examples_util.h"
 
 int main(void) {
     unsigned char seckey1[32];
@@ -27,19 +26,19 @@ int main(void) {
     unsigned char randomize[32];
     int return_val;
     size_t len;
-    rustsecp256k1_v0_8_1_pubkey pubkey1;
-    rustsecp256k1_v0_8_1_pubkey pubkey2;
+    rustsecp256k1_v0_9_0_pubkey pubkey1;
+    rustsecp256k1_v0_9_0_pubkey pubkey2;
 
     /* Before we can call actual API functions, we need to create a "context". */
-    rustsecp256k1_v0_8_1_context* ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
+    rustsecp256k1_v0_9_0_context* ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
     if (!fill_random(randomize, sizeof(randomize))) {
         printf("Failed to generate randomness\n");
         return 1;
     }
     /* Randomizing the context is recommended to protect against side-channel
-     * leakage See `rustsecp256k1_v0_8_1_context_randomize` in secp256k1.h for more
+     * leakage See `rustsecp256k1_v0_9_0_context_randomize` in secp256k1.h for more
      * information about it. This should never fail. */
-    return_val = rustsecp256k1_v0_8_1_context_randomize(ctx, randomize);
+    return_val = rustsecp256k1_v0_9_0_context_randomize(ctx, randomize);
     assert(return_val);
 
     /*** Key Generation ***/
@@ -52,27 +51,27 @@ int main(void) {
             printf("Failed to generate randomness\n");
             return 1;
         }
-        if (rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, seckey1) && rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, seckey2)) {
+        if (rustsecp256k1_v0_9_0_ec_seckey_verify(ctx, seckey1) && rustsecp256k1_v0_9_0_ec_seckey_verify(ctx, seckey2)) {
             break;
         }
     }
 
     /* Public key creation using a valid context with a verified secret key should never fail */
-    return_val = rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey1, seckey1);
+    return_val = rustsecp256k1_v0_9_0_ec_pubkey_create(ctx, &pubkey1, seckey1);
     assert(return_val);
-    return_val = rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey2, seckey2);
+    return_val = rustsecp256k1_v0_9_0_ec_pubkey_create(ctx, &pubkey2, seckey2);
     assert(return_val);
 
     /* Serialize pubkey1 in a compressed form (33 bytes), should always return 1 */
     len = sizeof(compressed_pubkey1);
-    return_val = rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, compressed_pubkey1, &len, &pubkey1, SECP256K1_EC_COMPRESSED);
+    return_val = rustsecp256k1_v0_9_0_ec_pubkey_serialize(ctx, compressed_pubkey1, &len, &pubkey1, SECP256K1_EC_COMPRESSED);
     assert(return_val);
     /* Should be the same size as the size of the output, because we passed a 33 byte array. */
     assert(len == sizeof(compressed_pubkey1));
 
     /* Serialize pubkey2 in a compressed form (33 bytes) */
     len = sizeof(compressed_pubkey2);
-    return_val = rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, compressed_pubkey2, &len, &pubkey2, SECP256K1_EC_COMPRESSED);
+    return_val = rustsecp256k1_v0_9_0_ec_pubkey_serialize(ctx, compressed_pubkey2, &len, &pubkey2, SECP256K1_EC_COMPRESSED);
     assert(return_val);
     /* Should be the same size as the size of the output, because we passed a 33 byte array. */
     assert(len == sizeof(compressed_pubkey2));
@@ -81,12 +80,12 @@ int main(void) {
 
     /* Perform ECDH with seckey1 and pubkey2. Should never fail with a verified
      * seckey and valid pubkey */
-    return_val = rustsecp256k1_v0_8_1_ecdh(ctx, shared_secret1, &pubkey2, seckey1, NULL, NULL);
+    return_val = rustsecp256k1_v0_9_0_ecdh(ctx, shared_secret1, &pubkey2, seckey1, NULL, NULL);
     assert(return_val);
 
     /* Perform ECDH with seckey2 and pubkey1. Should never fail with a verified
      * seckey and valid pubkey */
-    return_val = rustsecp256k1_v0_8_1_ecdh(ctx, shared_secret2, &pubkey1, seckey2, NULL, NULL);
+    return_val = rustsecp256k1_v0_9_0_ecdh(ctx, shared_secret2, &pubkey1, seckey2, NULL, NULL);
     assert(return_val);
 
     /* Both parties should end up with the same shared secret */
@@ -105,19 +104,19 @@ int main(void) {
     print_hex(shared_secret1, sizeof(shared_secret1));
 
     /* This will clear everything from the context and free the memory */
-    rustsecp256k1_v0_8_1_context_destroy(ctx);
+    rustsecp256k1_v0_9_0_context_destroy(ctx);
 
     /* It's best practice to try to clear secrets from memory after using them.
      * This is done because some bugs can allow an attacker to leak memory, for
      * example through "out of bounds" array access (see Heartbleed), Or the OS
      * swapping them to disk. Hence, we overwrite the secret key buffer with zeros.
      *
-     * TODO: Prevent these writes from being optimized out, as any good compiler
+     * Here we are preventing these writes from being optimized out, as any good compiler
      * will remove any writes that aren't used. */
-    memset(seckey1, 0, sizeof(seckey1));
-    memset(seckey2, 0, sizeof(seckey2));
-    memset(shared_secret1, 0, sizeof(shared_secret1));
-    memset(shared_secret2, 0, sizeof(shared_secret2));
+    secure_erase(seckey1, sizeof(seckey1));
+    secure_erase(seckey2, sizeof(seckey2));
+    secure_erase(shared_secret1, sizeof(shared_secret1));
+    secure_erase(shared_secret2, sizeof(shared_secret2));
 
     return 0;
 }
diff --git a/secp256k1-sys/depend/secp256k1/examples/ecdsa.c b/secp256k1-sys/depend/secp256k1/examples/ecdsa.c
index 8cb725f9c..810faff7f 100644
--- a/secp256k1-sys/depend/secp256k1/examples/ecdsa.c
+++ b/secp256k1-sys/depend/secp256k1/examples/ecdsa.c
@@ -13,9 +13,7 @@
 
 #include <secp256k1.h>
 
-#include "random.h"
-
-
+#include "examples_util.h"
 
 int main(void) {
     /* Instead of signing the message directly, we must sign a 32-byte hash.
@@ -34,20 +32,20 @@ int main(void) {
     unsigned char compressed_pubkey[33];
     unsigned char serialized_signature[64];
     size_t len;
-    int is_signature_valid;
+    int is_signature_valid, is_signature_valid2;
     int return_val;
-    rustsecp256k1_v0_8_1_pubkey pubkey;
-    rustsecp256k1_v0_8_1_ecdsa_signature sig;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
+    rustsecp256k1_v0_9_0_ecdsa_signature sig;
     /* Before we can call actual API functions, we need to create a "context". */
-    rustsecp256k1_v0_8_1_context* ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
+    rustsecp256k1_v0_9_0_context* ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
     if (!fill_random(randomize, sizeof(randomize))) {
         printf("Failed to generate randomness\n");
         return 1;
     }
     /* Randomizing the context is recommended to protect against side-channel
-     * leakage See `rustsecp256k1_v0_8_1_context_randomize` in secp256k1.h for more
+     * leakage See `rustsecp256k1_v0_9_0_context_randomize` in secp256k1.h for more
      * information about it. This should never fail. */
-    return_val = rustsecp256k1_v0_8_1_context_randomize(ctx, randomize);
+    return_val = rustsecp256k1_v0_9_0_context_randomize(ctx, randomize);
     assert(return_val);
 
     /*** Key Generation ***/
@@ -60,18 +58,18 @@ int main(void) {
             printf("Failed to generate randomness\n");
             return 1;
         }
-        if (rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, seckey)) {
+        if (rustsecp256k1_v0_9_0_ec_seckey_verify(ctx, seckey)) {
             break;
         }
     }
 
     /* Public key creation using a valid context with a verified secret key should never fail */
-    return_val = rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, seckey);
+    return_val = rustsecp256k1_v0_9_0_ec_pubkey_create(ctx, &pubkey, seckey);
     assert(return_val);
 
     /* Serialize the pubkey in a compressed form(33 bytes). Should always return 1. */
     len = sizeof(compressed_pubkey);
-    return_val = rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, compressed_pubkey, &len, &pubkey, SECP256K1_EC_COMPRESSED);
+    return_val = rustsecp256k1_v0_9_0_ec_pubkey_serialize(ctx, compressed_pubkey, &len, &pubkey, SECP256K1_EC_COMPRESSED);
     assert(return_val);
     /* Should be the same size as the size of the output, because we passed a 33 byte array. */
     assert(len == sizeof(compressed_pubkey));
@@ -82,31 +80,31 @@ int main(void) {
      * custom nonce function, passing `NULL` will use the RFC-6979 safe default.
      * Signing with a valid context, verified secret key
      * and the default nonce function should never fail. */
-    return_val = rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg_hash, seckey, NULL, NULL);
+    return_val = rustsecp256k1_v0_9_0_ecdsa_sign(ctx, &sig, msg_hash, seckey, NULL, NULL);
     assert(return_val);
 
     /* Serialize the signature in a compact form. Should always return 1
      * according to the documentation in secp256k1.h. */
-    return_val = rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact(ctx, serialized_signature, &sig);
+    return_val = rustsecp256k1_v0_9_0_ecdsa_signature_serialize_compact(ctx, serialized_signature, &sig);
     assert(return_val);
 
 
     /*** Verification ***/
 
     /* Deserialize the signature. This will return 0 if the signature can't be parsed correctly. */
-    if (!rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(ctx, &sig, serialized_signature)) {
+    if (!rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(ctx, &sig, serialized_signature)) {
         printf("Failed parsing the signature\n");
         return 1;
     }
 
     /* Deserialize the public key. This will return 0 if the public key can't be parsed correctly. */
-    if (!rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, compressed_pubkey, sizeof(compressed_pubkey))) {
+    if (!rustsecp256k1_v0_9_0_ec_pubkey_parse(ctx, &pubkey, compressed_pubkey, sizeof(compressed_pubkey))) {
         printf("Failed parsing the public key\n");
         return 1;
     }
 
     /* Verify a signature. This will return 1 if it's valid and 0 if it's not. */
-    is_signature_valid = rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg_hash, &pubkey);
+    is_signature_valid = rustsecp256k1_v0_9_0_ecdsa_verify(ctx, &sig, msg_hash, &pubkey);
 
     printf("Is the signature valid? %s\n", is_signature_valid ? "true" : "false");
     printf("Secret Key: ");
@@ -116,18 +114,26 @@ int main(void) {
     printf("Signature: ");
     print_hex(serialized_signature, sizeof(serialized_signature));
 
-
     /* This will clear everything from the context and free the memory */
-    rustsecp256k1_v0_8_1_context_destroy(ctx);
+    rustsecp256k1_v0_9_0_context_destroy(ctx);
+
+    /* Bonus example: if all we need is signature verification (and no key
+       generation or signing), we don't need to use a context created via
+       rustsecp256k1_v0_9_0_context_create(). We can simply use the static (i.e., global)
+       context rustsecp256k1_v0_9_0_context_static. See its description in
+       include/secp256k1.h for details. */
+    is_signature_valid2 = rustsecp256k1_v0_9_0_ecdsa_verify(rustsecp256k1_v0_9_0_context_static,
+                                                 &sig, msg_hash, &pubkey);
+    assert(is_signature_valid2 == is_signature_valid);
 
     /* It's best practice to try to clear secrets from memory after using them.
      * This is done because some bugs can allow an attacker to leak memory, for
      * example through "out of bounds" array access (see Heartbleed), Or the OS
      * swapping them to disk. Hence, we overwrite the secret key buffer with zeros.
      *
-     * TODO: Prevent these writes from being optimized out, as any good compiler
+     * Here we are preventing these writes from being optimized out, as any good compiler
      * will remove any writes that aren't used. */
-    memset(seckey, 0, sizeof(seckey));
+    secure_erase(seckey, sizeof(seckey));
 
     return 0;
 }
diff --git a/secp256k1-sys/depend/secp256k1/examples/random.h b/secp256k1-sys/depend/secp256k1/examples/examples_util.h
similarity index 66%
rename from secp256k1-sys/depend/secp256k1/examples/random.h
rename to secp256k1-sys/depend/secp256k1/examples/examples_util.h
index 439226f09..3293b6403 100644
--- a/secp256k1-sys/depend/secp256k1/examples/random.h
+++ b/secp256k1-sys/depend/secp256k1/examples/examples_util.h
@@ -17,7 +17,13 @@
  */
 
 #if defined(_WIN32)
+/*
+ * The defined WIN32_NO_STATUS macro disables return code definitions in
+ * windows.h, which avoids "macro redefinition" MSVC warnings in ntstatus.h.
+ */
+#define WIN32_NO_STATUS
 #include <windows.h>
+#undef WIN32_NO_STATUS
 #include <ntstatus.h>
 #include <bcrypt.h>
 #elif defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__)
@@ -71,3 +77,32 @@ static void print_hex(unsigned char* data, size_t size) {
     }
     printf("\n");
 }
+
+#if defined(_MSC_VER)
+// For SecureZeroMemory
+#include <Windows.h>
+#endif
+/* Cleanses memory to prevent leaking sensitive info. Won't be optimized out. */
+static void secure_erase(void *ptr, size_t len) {
+#if defined(_MSC_VER)
+    /* SecureZeroMemory is guaranteed not to be optimized out by MSVC. */
+    SecureZeroMemory(ptr, len);
+#elif defined(__GNUC__)
+    /* We use a memory barrier that scares the compiler away from optimizing out the memset.
+     *
+     * Quoting Adam Langley <agl@google.com> in commit ad1907fe73334d6c696c8539646c21b11178f20f
+     * in BoringSSL (ISC License):
+     *    As best as we can tell, this is sufficient to break any optimisations that
+     *    might try to eliminate "superfluous" memsets.
+     * This method used in memzero_explicit() the Linux kernel, too. Its advantage is that it is
+     * pretty efficient, because the compiler can still implement the memset() efficiently,
+     * just not remove it entirely. See "Dead Store Elimination (Still) Considered Harmful" by
+     * Yang et al. (USENIX Security 2017) for more background.
+     */
+    memset(ptr, 0, len);
+    __asm__ __volatile__("" : : "r"(ptr) : "memory");
+#else
+    void *(*volatile const volatile_memset)(void *, int, size_t) = memset;
+    volatile_memset(ptr, 0, len);
+#endif
+}
diff --git a/secp256k1-sys/depend/secp256k1/examples/schnorr.c b/secp256k1-sys/depend/secp256k1/examples/schnorr.c
index 7ad756378..f36be857d 100644
--- a/secp256k1-sys/depend/secp256k1/examples/schnorr.c
+++ b/secp256k1-sys/depend/secp256k1/examples/schnorr.c
@@ -15,7 +15,7 @@
 #include <secp256k1_extrakeys.h>
 #include <secp256k1_schnorrsig.h>
 
-#include "random.h"
+#include "examples_util.h"
 
 int main(void) {
     unsigned char msg[12] = "Hello World!";
@@ -26,20 +26,20 @@ int main(void) {
     unsigned char auxiliary_rand[32];
     unsigned char serialized_pubkey[32];
     unsigned char signature[64];
-    int is_signature_valid;
+    int is_signature_valid, is_signature_valid2;
     int return_val;
-    rustsecp256k1_v0_8_1_xonly_pubkey pubkey;
-    rustsecp256k1_v0_8_1_keypair keypair;
+    rustsecp256k1_v0_9_0_xonly_pubkey pubkey;
+    rustsecp256k1_v0_9_0_keypair keypair;
     /* Before we can call actual API functions, we need to create a "context". */
-    rustsecp256k1_v0_8_1_context* ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
+    rustsecp256k1_v0_9_0_context* ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
     if (!fill_random(randomize, sizeof(randomize))) {
         printf("Failed to generate randomness\n");
         return 1;
     }
     /* Randomizing the context is recommended to protect against side-channel
-     * leakage See `rustsecp256k1_v0_8_1_context_randomize` in secp256k1.h for more
+     * leakage See `rustsecp256k1_v0_9_0_context_randomize` in secp256k1.h for more
      * information about it. This should never fail. */
-    return_val = rustsecp256k1_v0_8_1_context_randomize(ctx, randomize);
+    return_val = rustsecp256k1_v0_9_0_context_randomize(ctx, randomize);
     assert(return_val);
 
     /*** Key Generation ***/
@@ -54,21 +54,21 @@ int main(void) {
         }
         /* Try to create a keypair with a valid context, it should only fail if
          * the secret key is zero or out of range. */
-        if (rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, seckey)) {
+        if (rustsecp256k1_v0_9_0_keypair_create(ctx, &keypair, seckey)) {
             break;
         }
     }
 
     /* Extract the X-only public key from the keypair. We pass NULL for
      * `pk_parity` as the parity isn't needed for signing or verification.
-     * `rustsecp256k1_v0_8_1_keypair_xonly_pub` supports returning the parity for
+     * `rustsecp256k1_v0_9_0_keypair_xonly_pub` supports returning the parity for
      * other use cases such as tests or verifying Taproot tweaks.
      * This should never fail with a valid context and public key. */
-    return_val = rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &pubkey, NULL, &keypair);
+    return_val = rustsecp256k1_v0_9_0_keypair_xonly_pub(ctx, &pubkey, NULL, &keypair);
     assert(return_val);
 
     /* Serialize the public key. Should always return 1 for a valid public key. */
-    return_val = rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, serialized_pubkey, &pubkey);
+    return_val = rustsecp256k1_v0_9_0_xonly_pubkey_serialize(ctx, serialized_pubkey, &pubkey);
     assert(return_val);
 
     /*** Signing ***/
@@ -76,7 +76,7 @@ int main(void) {
     /* Instead of signing (possibly very long) messages directly, we sign a
      * 32-byte hash of the message in this example.
      *
-     * We use rustsecp256k1_v0_8_1_tagged_sha256 to create this hash. This function expects
+     * We use rustsecp256k1_v0_9_0_tagged_sha256 to create this hash. This function expects
      * a context-specific "tag", which restricts the context in which the signed
      * messages should be considered valid. For example, if protocol A mandates
      * to use the tag "my_fancy_protocol" and protocol B mandates to use the tag
@@ -87,7 +87,7 @@ int main(void) {
      * message that has intended consequences in the intended context (e.g.,
      * protocol A) but would have unintended consequences if it were valid in
      * some other context (e.g., protocol B). */
-    return_val = rustsecp256k1_v0_8_1_tagged_sha256(ctx, msg_hash, tag, sizeof(tag), msg, sizeof(msg));
+    return_val = rustsecp256k1_v0_9_0_tagged_sha256(ctx, msg_hash, tag, sizeof(tag), msg, sizeof(msg));
     assert(return_val);
 
     /* Generate 32 bytes of randomness to use with BIP-340 schnorr signing. */
@@ -98,30 +98,30 @@ int main(void) {
 
     /* Generate a Schnorr signature.
      *
-     * We use the rustsecp256k1_v0_8_1_schnorrsig_sign32 function that provides a simple
+     * We use the rustsecp256k1_v0_9_0_schnorrsig_sign32 function that provides a simple
      * interface for signing 32-byte messages (which in our case is a hash of
      * the actual message). BIP-340 recommends passing 32 bytes of randomness
      * to the signing function to improve security against side-channel attacks.
      * Signing with a valid context, a 32-byte message, a verified keypair, and
      * any 32 bytes of auxiliary random data should never fail. */
-    return_val = rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, signature, msg_hash, &keypair, auxiliary_rand);
+    return_val = rustsecp256k1_v0_9_0_schnorrsig_sign32(ctx, signature, msg_hash, &keypair, auxiliary_rand);
     assert(return_val);
 
     /*** Verification ***/
 
     /* Deserialize the public key. This will return 0 if the public key can't
      * be parsed correctly */
-    if (!rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &pubkey, serialized_pubkey)) {
+    if (!rustsecp256k1_v0_9_0_xonly_pubkey_parse(ctx, &pubkey, serialized_pubkey)) {
         printf("Failed parsing the public key\n");
         return 1;
     }
 
     /* Compute the tagged hash on the received messages using the same tag as the signer. */
-    return_val = rustsecp256k1_v0_8_1_tagged_sha256(ctx, msg_hash, tag, sizeof(tag), msg, sizeof(msg));
+    return_val = rustsecp256k1_v0_9_0_tagged_sha256(ctx, msg_hash, tag, sizeof(tag), msg, sizeof(msg));
     assert(return_val);
 
     /* Verify a signature. This will return 1 if it's valid and 0 if it's not. */
-    is_signature_valid = rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, signature, msg_hash, 32, &pubkey);
+    is_signature_valid = rustsecp256k1_v0_9_0_schnorrsig_verify(ctx, signature, msg_hash, 32, &pubkey);
 
 
     printf("Is the signature valid? %s\n", is_signature_valid ? "true" : "false");
@@ -133,16 +133,24 @@ int main(void) {
     print_hex(signature, sizeof(signature));
 
     /* This will clear everything from the context and free the memory */
-    rustsecp256k1_v0_8_1_context_destroy(ctx);
+    rustsecp256k1_v0_9_0_context_destroy(ctx);
+
+    /* Bonus example: if all we need is signature verification (and no key
+       generation or signing), we don't need to use a context created via
+       rustsecp256k1_v0_9_0_context_create(). We can simply use the static (i.e., global)
+       context rustsecp256k1_v0_9_0_context_static. See its description in
+       include/secp256k1.h for details. */
+    is_signature_valid2 = rustsecp256k1_v0_9_0_schnorrsig_verify(rustsecp256k1_v0_9_0_context_static,
+                                                      signature, msg_hash, 32, &pubkey);
+    assert(is_signature_valid2 == is_signature_valid);
 
     /* It's best practice to try to clear secrets from memory after using them.
      * This is done because some bugs can allow an attacker to leak memory, for
      * example through "out of bounds" array access (see Heartbleed), Or the OS
      * swapping them to disk. Hence, we overwrite the secret key buffer with zeros.
      *
-     * TODO: Prevent these writes from being optimized out, as any good compiler
+     * Here we are preventing these writes from being optimized out, as any good compiler
      * will remove any writes that aren't used. */
-    memset(seckey, 0, sizeof(seckey));
-
+    secure_erase(seckey, sizeof(seckey));
     return 0;
 }
diff --git a/secp256k1-sys/depend/secp256k1/include/secp256k1.h b/secp256k1-sys/depend/secp256k1/include/secp256k1.h
index 03d57bfd4..78dd1ecb1 100644
--- a/secp256k1-sys/depend/secp256k1/include/secp256k1.h
+++ b/secp256k1-sys/depend/secp256k1/include/secp256k1.h
@@ -29,25 +29,25 @@ extern "C" {
  *  The primary purpose of context objects is to store randomization data for
  *  enhanced protection against side-channel leakage. This protection is only
  *  effective if the context is randomized after its creation. See
- *  rustsecp256k1_v0_8_1_context_create for creation of contexts and
- *  rustsecp256k1_v0_8_1_context_randomize for randomization.
+ *  rustsecp256k1_v0_9_0_context_create for creation of contexts and
+ *  rustsecp256k1_v0_9_0_context_randomize for randomization.
  *
  *  A secondary purpose of context objects is to store pointers to callback
  *  functions that the library will call when certain error states arise. See
- *  rustsecp256k1_v0_8_1_context_set_error_callback as well as
- *  rustsecp256k1_v0_8_1_context_set_illegal_callback for details. Future library versions
+ *  rustsecp256k1_v0_9_0_context_set_error_callback as well as
+ *  rustsecp256k1_v0_9_0_context_set_illegal_callback for details. Future library versions
  *  may use context objects for additional purposes.
  *
  *  A constructed context can safely be used from multiple threads
  *  simultaneously, but API calls that take a non-const pointer to a context
  *  need exclusive access to it. In particular this is the case for
- *  rustsecp256k1_v0_8_1_context_destroy, rustsecp256k1_v0_8_1_context_preallocated_destroy,
- *  and rustsecp256k1_v0_8_1_context_randomize.
+ *  rustsecp256k1_v0_9_0_context_destroy, rustsecp256k1_v0_9_0_context_preallocated_destroy,
+ *  and rustsecp256k1_v0_9_0_context_randomize.
  *
  *  Regarding randomization, either do it once at creation time (in which case
  *  you do not need any locking for the other calls), or use a read-write lock.
  */
-typedef struct rustsecp256k1_v0_8_1_context_struct rustsecp256k1_v0_8_1_context;
+typedef struct rustsecp256k1_v0_9_0_context_struct rustsecp256k1_v0_9_0_context;
 
 /** Opaque data structure that holds rewritable "scratch space"
  *
@@ -60,7 +60,7 @@ typedef struct rustsecp256k1_v0_8_1_context_struct rustsecp256k1_v0_8_1_context;
  *  Unlike the context object, this cannot safely be shared between threads
  *  without additional synchronization logic.
  */
-typedef struct rustsecp256k1_v0_8_1_scratch_space_struct rustsecp256k1_v0_8_1_scratch_space;
+typedef struct rustsecp256k1_v0_9_0_scratch_space_struct rustsecp256k1_v0_9_0_scratch_space;
 
 /** Opaque data structure that holds a parsed and valid public key.
  *
@@ -68,12 +68,12 @@ typedef struct rustsecp256k1_v0_8_1_scratch_space_struct rustsecp256k1_v0_8_1_sc
  *  guaranteed to be portable between different platforms or versions. It is
  *  however guaranteed to be 64 bytes in size, and can be safely copied/moved.
  *  If you need to convert to a format suitable for storage or transmission,
- *  use rustsecp256k1_v0_8_1_ec_pubkey_serialize and rustsecp256k1_v0_8_1_ec_pubkey_parse. To
- *  compare keys, use rustsecp256k1_v0_8_1_ec_pubkey_cmp.
+ *  use rustsecp256k1_v0_9_0_ec_pubkey_serialize and rustsecp256k1_v0_9_0_ec_pubkey_parse. To
+ *  compare keys, use rustsecp256k1_v0_9_0_ec_pubkey_cmp.
  */
 typedef struct {
     unsigned char data[64];
-} rustsecp256k1_v0_8_1_pubkey;
+} rustsecp256k1_v0_9_0_pubkey;
 
 /** Opaque data structured that holds a parsed ECDSA signature.
  *
@@ -81,12 +81,12 @@ typedef struct {
  *  guaranteed to be portable between different platforms or versions. It is
  *  however guaranteed to be 64 bytes in size, and can be safely copied/moved.
  *  If you need to convert to a format suitable for storage, transmission, or
- *  comparison, use the rustsecp256k1_v0_8_1_ecdsa_signature_serialize_* and
- *  rustsecp256k1_v0_8_1_ecdsa_signature_parse_* functions.
+ *  comparison, use the rustsecp256k1_v0_9_0_ecdsa_signature_serialize_* and
+ *  rustsecp256k1_v0_9_0_ecdsa_signature_parse_* functions.
  */
 typedef struct {
     unsigned char data[64];
-} rustsecp256k1_v0_8_1_ecdsa_signature;
+} rustsecp256k1_v0_9_0_ecdsa_signature;
 
 /** A pointer to a function to deterministically generate a nonce.
  *
@@ -104,7 +104,7 @@ typedef struct {
  * Except for test cases, this function should compute some cryptographic hash of
  * the message, the algorithm, the key and the attempt.
  */
-typedef int (*rustsecp256k1_v0_8_1_nonce_function)(
+typedef int (*rustsecp256k1_v0_9_0_nonce_function)(
     unsigned char *nonce32,
     const unsigned char *msg32,
     const unsigned char *key32,
@@ -122,18 +122,6 @@ typedef int (*rustsecp256k1_v0_8_1_nonce_function)(
 #  endif
 # endif
 
-# if (!defined(__STDC_VERSION__) || (__STDC_VERSION__ < 199901L) )
-#  if SECP256K1_GNUC_PREREQ(2,7)
-#   define SECP256K1_INLINE __inline__
-#  elif (defined(_MSC_VER))
-#   define SECP256K1_INLINE __inline
-#  else
-#   define SECP256K1_INLINE
-#  endif
-# else
-#  define SECP256K1_INLINE inline
-# endif
-
 /*  When this header is used at build-time the SECP256K1_BUILD define needs to be set
  *  to correctly setup export attributes and nullness checks.  This is normally done
  *  by secp256k1.c but to guard against this header being included before secp256k1.c
@@ -145,21 +133,35 @@ typedef int (*rustsecp256k1_v0_8_1_nonce_function)(
 # define SECP256K1_NO_BUILD
 #endif
 
-/** At secp256k1 build-time DLL_EXPORT is defined when building objects destined
- *  for a shared library, but not for those intended for static libraries.
- */
-
-#ifndef SECP256K1_API
-# if defined(_WIN32)
-#  if defined(SECP256K1_BUILD) && defined(DLL_EXPORT)
-#   define SECP256K1_API __declspec(dllexport)
-#  else
-#   define SECP256K1_API
+/* Symbol visibility. */
+#if defined(_WIN32)
+  /* GCC for Windows (e.g., MinGW) accepts the __declspec syntax
+   * for MSVC compatibility. A __declspec declaration implies (but is not
+   * exactly equivalent to) __attribute__ ((visibility("default"))), and so we
+   * actually want __declspec even on GCC, see "Microsoft Windows Function
+   * Attributes" in the GCC manual and the recommendations in
+   * https://gcc.gnu.org/wiki/Visibility. */
+# if defined(SECP256K1_BUILD)
+#  if defined(DLL_EXPORT) || defined(SECP256K1_DLL_EXPORT)
+    /* Building libsecp256k1 as a DLL.
+     * 1. If using Libtool, it defines DLL_EXPORT automatically.
+     * 2. In other cases, SECP256K1_DLL_EXPORT must be defined. */
+#   define SECP256K1_API extern __declspec (dllexport)
 #  endif
-# elif defined(__GNUC__) && (__GNUC__ >= 4) && defined(SECP256K1_BUILD)
-#  define SECP256K1_API __attribute__ ((visibility ("default")))
+  /* The user must define SECP256K1_STATIC when consuming libsecp256k1 as a static
+   * library on Windows. */
+# elif !defined(SECP256K1_STATIC)
+   /* Consuming libsecp256k1 as a DLL. */
+#  define SECP256K1_API extern __declspec (dllimport)
+# endif
+#endif
+#ifndef SECP256K1_API
+# if defined(__GNUC__) && (__GNUC__ >= 4) && defined(SECP256K1_BUILD)
+   /* Building libsecp256k1 on non-Windows using GCC or compatible. */
+#  define SECP256K1_API extern __attribute__ ((visibility ("default")))
 # else
-#  define SECP256K1_API
+   /* All cases not captured above. */
+#  define SECP256K1_API extern
 # endif
 #endif
 
@@ -198,8 +200,8 @@ typedef int (*rustsecp256k1_v0_8_1_nonce_function)(
 #define SECP256K1_FLAGS_BIT_CONTEXT_DECLASSIFY (1 << 10)
 #define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
 
-/** Context flags to pass to rustsecp256k1_v0_8_1_context_create, rustsecp256k1_v0_8_1_context_preallocated_size, and
- *  rustsecp256k1_v0_8_1_context_preallocated_create. */
+/** Context flags to pass to rustsecp256k1_v0_9_0_context_create, rustsecp256k1_v0_9_0_context_preallocated_size, and
+ *  rustsecp256k1_v0_9_0_context_preallocated_create. */
 #define SECP256K1_CONTEXT_NONE (SECP256K1_FLAGS_TYPE_CONTEXT)
 
 /** Deprecated context flags. These flags are treated equivalent to SECP256K1_CONTEXT_NONE. */
@@ -209,7 +211,7 @@ typedef int (*rustsecp256k1_v0_8_1_nonce_function)(
 /* Testing flag. Do not use. */
 #define SECP256K1_CONTEXT_DECLASSIFY (SECP256K1_FLAGS_TYPE_CONTEXT | SECP256K1_FLAGS_BIT_CONTEXT_DECLASSIFY)
 
-/** Flag to pass to rustsecp256k1_v0_8_1_ec_pubkey_serialize. */
+/** Flag to pass to rustsecp256k1_v0_9_0_ec_pubkey_serialize. */
 #define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
 #define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
 
@@ -221,23 +223,20 @@ typedef int (*rustsecp256k1_v0_8_1_nonce_function)(
 #define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
 
 /** A built-in constant secp256k1 context object with static storage duration, to be
- *  used in conjunction with rustsecp256k1_v0_8_1_selftest.
+ *  used in conjunction with rustsecp256k1_v0_9_0_selftest.
  *
  *  This context object offers *only limited functionality* , i.e., it cannot be used
  *  for API functions that perform computations involving secret keys, e.g., signing
  *  and public key generation. If this restriction applies to a specific API function,
- *  it is mentioned in its documentation. See rustsecp256k1_v0_8_1_context_create if you need a
+ *  it is mentioned in its documentation. See rustsecp256k1_v0_9_0_context_create if you need a
  *  full context object that supports all functionality offered by the library.
  *
- *  It is highly recommended to call rustsecp256k1_v0_8_1_selftest before using this context.
+ *  It is highly recommended to call rustsecp256k1_v0_9_0_selftest before using this context.
  */
-SECP256K1_API extern const rustsecp256k1_v0_8_1_context *rustsecp256k1_v0_8_1_context_static;
 
-/** Deprecated alias for rustsecp256k1_v0_8_1_context_static. */
-SECP256K1_API extern const rustsecp256k1_v0_8_1_context *rustsecp256k1_v0_8_1_context_no_precomp
-SECP256K1_DEPRECATED("Use rustsecp256k1_v0_8_1_context_static instead");
+/** Deprecated alias for rustsecp256k1_v0_9_0_context_static. */
 
-/** Perform basic self tests (to be used in conjunction with rustsecp256k1_v0_8_1_context_static)
+/** Perform basic self tests (to be used in conjunction with rustsecp256k1_v0_9_0_context_static)
  *
  *  This function performs self tests that detect some serious usage errors and
  *  similar conditions, e.g., when the library is compiled for the wrong endianness.
@@ -245,23 +244,23 @@ SECP256K1_DEPRECATED("Use rustsecp256k1_v0_8_1_context_static instead");
  *  very rudimentary and are not intended as a replacement for running the test
  *  binaries.
  *
- *  It is highly recommended to call this before using rustsecp256k1_v0_8_1_context_static.
+ *  It is highly recommended to call this before using rustsecp256k1_v0_9_0_context_static.
  *  It is not necessary to call this function before using a context created with
- *  rustsecp256k1_v0_8_1_context_create (or rustsecp256k1_v0_8_1_context_preallocated_create), which will
+ *  rustsecp256k1_v0_9_0_context_create (or rustsecp256k1_v0_9_0_context_preallocated_create), which will
  *  take care of performing the self tests.
  *
  *  If the tests fail, this function will call the default error handler to abort the
- *  program (see rustsecp256k1_v0_8_1_context_set_error_callback).
+ *  program (see rustsecp256k1_v0_9_0_context_set_error_callback).
  */
-SECP256K1_API void rustsecp256k1_v0_8_1_selftest(void);
+SECP256K1_API void rustsecp256k1_v0_9_0_selftest(void);
 
 
 /** Create a secp256k1 context object (in dynamically allocated memory).
  *
  *  This function uses malloc to allocate memory. It is guaranteed that malloc is
  *  called at most once for every call of this function. If you need to avoid dynamic
- *  memory allocation entirely, see rustsecp256k1_v0_8_1_context_static and the functions in
- *  rustsecp256k1_v0_8_1_preallocated.h.
+ *  memory allocation entirely, see rustsecp256k1_v0_9_0_context_static and the functions in
+ *  rustsecp256k1_v0_9_0_preallocated.h.
  *
  *  Returns: a newly created context object.
  *  In:      flags: Always set to SECP256K1_CONTEXT_NONE (see below).
@@ -274,38 +273,39 @@ SECP256K1_API void rustsecp256k1_v0_8_1_selftest(void);
  *
  *  If the context is intended to be used for API functions that perform computations
  *  involving secret keys, e.g., signing and public key generation, then it is highly
- *  recommended to call rustsecp256k1_v0_8_1_context_randomize on the context before calling
+ *  recommended to call rustsecp256k1_v0_9_0_context_randomize on the context before calling
  *  those API functions. This will provide enhanced protection against side-channel
- *  leakage, see rustsecp256k1_v0_8_1_context_randomize for details.
+ *  leakage, see rustsecp256k1_v0_9_0_context_randomize for details.
  *
  *  Do not create a new context object for each operation, as construction and
  *  randomization can take non-negligible time.
  */
-
 /** Copy a secp256k1 context object (into dynamically allocated memory).
  *
  *  This function uses malloc to allocate memory. It is guaranteed that malloc is
  *  called at most once for every call of this function. If you need to avoid dynamic
- *  memory allocation entirely, see the functions in rustsecp256k1_v0_8_1_preallocated.h.
+ *  memory allocation entirely, see the functions in rustsecp256k1_v0_9_0_preallocated.h.
+ *
+ *  Cloning rustsecp256k1_v0_9_0_context_static is not possible, and should not be emulated by
+ *  the caller (e.g., using memcpy). Create a new context instead.
  *
  *  Returns: a newly created context object.
- *  Args:    ctx: an existing context to copy
+ *  Args:    ctx: an existing context to copy (not rustsecp256k1_v0_9_0_context_static)
  */
-
 /** Destroy a secp256k1 context object (created in dynamically allocated memory).
  *
  *  The context pointer may not be used afterwards.
  *
- *  The context to destroy must have been created using rustsecp256k1_v0_8_1_context_create
- *  or rustsecp256k1_v0_8_1_context_clone. If the context has instead been created using
- *  rustsecp256k1_v0_8_1_context_preallocated_create or rustsecp256k1_v0_8_1_context_preallocated_clone, the
- *  behaviour is undefined. In that case, rustsecp256k1_v0_8_1_context_preallocated_destroy must
+ *  The context to destroy must have been created using rustsecp256k1_v0_9_0_context_create
+ *  or rustsecp256k1_v0_9_0_context_clone. If the context has instead been created using
+ *  rustsecp256k1_v0_9_0_context_preallocated_create or rustsecp256k1_v0_9_0_context_preallocated_clone, the
+ *  behaviour is undefined. In that case, rustsecp256k1_v0_9_0_context_preallocated_destroy must
  *  be used instead.
  *
  *  Args:   ctx: an existing context to destroy, constructed using
- *               rustsecp256k1_v0_8_1_context_create or rustsecp256k1_v0_8_1_context_clone
+ *               rustsecp256k1_v0_9_0_context_create or rustsecp256k1_v0_9_0_context_clone
+ *               (i.e., not rustsecp256k1_v0_9_0_context_static).
  */
-
 /** Set a callback function to be called when an illegal argument is passed to
  *  an API call. It will only trigger for violations that are mentioned
  *  explicitly in the header.
@@ -327,11 +327,11 @@ SECP256K1_API void rustsecp256k1_v0_8_1_selftest(void);
  *  USE_EXTERNAL_DEFAULT_CALLBACKS is defined, which is the case if the build
  *  has been configured with --enable-external-default-callbacks. Then the
  *  following two symbols must be provided to link against:
- *   - void rustsecp256k1_v0_8_1_default_illegal_callback_fn(const char* message, void* data);
- *   - void rustsecp256k1_v0_8_1_default_error_callback_fn(const char* message, void* data);
+ *   - void rustsecp256k1_v0_9_0_default_illegal_callback_fn(const char *message, void *data);
+ *   - void rustsecp256k1_v0_9_0_default_error_callback_fn(const char *message, void *data);
  *  The library can call these default handlers even before a proper callback data
- *  pointer could have been set using rustsecp256k1_v0_8_1_context_set_illegal_callback or
- *  rustsecp256k1_v0_8_1_context_set_error_callback, e.g., when the creation of a context
+ *  pointer could have been set using rustsecp256k1_v0_9_0_context_set_illegal_callback or
+ *  rustsecp256k1_v0_9_0_context_set_error_callback, e.g., when the creation of a context
  *  fails. In this case, the corresponding default handler will be called with
  *  the data pointer argument set to NULL.
  *
@@ -341,12 +341,12 @@ SECP256K1_API void rustsecp256k1_v0_8_1_selftest(void);
  *              (NULL restores the default handler.)
  *        data: the opaque pointer to pass to fun above, must be NULL for the default handler.
  *
- *  See also rustsecp256k1_v0_8_1_context_set_error_callback.
+ *  See also rustsecp256k1_v0_9_0_context_set_error_callback.
  */
-SECP256K1_API void rustsecp256k1_v0_8_1_context_set_illegal_callback(
-    rustsecp256k1_v0_8_1_context* ctx,
-    void (*fun)(const char* message, void* data),
-    const void* data
+SECP256K1_API void rustsecp256k1_v0_9_0_context_set_illegal_callback(
+    rustsecp256k1_v0_9_0_context *ctx,
+    void (*fun)(const char *message, void *data),
+    const void *data
 ) SECP256K1_ARG_NONNULL(1);
 
 /** Set a callback function to be called when an internal consistency check
@@ -358,23 +358,23 @@ SECP256K1_API void rustsecp256k1_v0_8_1_context_set_illegal_callback(
  *  This can only trigger in case of a hardware failure, miscompilation,
  *  memory corruption, serious bug in the library, or other error would can
  *  otherwise result in undefined behaviour. It will not trigger due to mere
- *  incorrect usage of the API (see rustsecp256k1_v0_8_1_context_set_illegal_callback
+ *  incorrect usage of the API (see rustsecp256k1_v0_9_0_context_set_illegal_callback
  *  for that). After this callback returns, anything may happen, including
  *  crashing.
  *
  *  Args: ctx:  an existing context object.
  *  In:   fun:  a pointer to a function to call when an internal error occurs,
  *              taking a message and an opaque pointer (NULL restores the
- *              default handler, see rustsecp256k1_v0_8_1_context_set_illegal_callback
+ *              default handler, see rustsecp256k1_v0_9_0_context_set_illegal_callback
  *              for details).
  *        data: the opaque pointer to pass to fun above, must be NULL for the default handler.
  *
- *  See also rustsecp256k1_v0_8_1_context_set_illegal_callback.
+ *  See also rustsecp256k1_v0_9_0_context_set_illegal_callback.
  */
-SECP256K1_API void rustsecp256k1_v0_8_1_context_set_error_callback(
-    rustsecp256k1_v0_8_1_context* ctx,
-    void (*fun)(const char* message, void* data),
-    const void* data
+SECP256K1_API void rustsecp256k1_v0_9_0_context_set_error_callback(
+    rustsecp256k1_v0_9_0_context *ctx,
+    void (*fun)(const char *message, void *data),
+    const void *data
 ) SECP256K1_ARG_NONNULL(1);
 
 /** Create a secp256k1 scratch space object.
@@ -384,14 +384,12 @@ SECP256K1_API void rustsecp256k1_v0_8_1_context_set_error_callback(
  *  In:   size: amount of memory to be available as scratch space. Some extra
  *              (<100 bytes) will be allocated for extra accounting.
  */
-
 /** Destroy a secp256k1 scratch space.
  *
  *  The pointer may not be used afterwards.
  *  Args:       ctx: a secp256k1 context object.
  *          scratch: space to destroy
  */
-
 /** Parse a variable-length public key into the pubkey object.
  *
  *  Returns: 1 if the public key was fully valid.
@@ -406,9 +404,9 @@ SECP256K1_API void rustsecp256k1_v0_8_1_context_set_error_callback(
  *  0x03), uncompressed (65 bytes, header byte 0x04), or hybrid (65 bytes, header
  *  byte 0x06 or 0x07) format public keys.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_parse(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_pubkey* pubkey,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_pubkey_parse(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *pubkey,
     const unsigned char *input,
     size_t inputlen
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@@ -423,16 +421,16 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_pa
  *  In/Out: outputlen:  a pointer to an integer which is initially set to the
  *                      size of output, and is overwritten with the written
  *                      size.
- *  In:     pubkey:     a pointer to a rustsecp256k1_v0_8_1_pubkey containing an
+ *  In:     pubkey:     a pointer to a rustsecp256k1_v0_9_0_pubkey containing an
  *                      initialized public key.
  *          flags:      SECP256K1_EC_COMPRESSED if serialization should be in
  *                      compressed format, otherwise SECP256K1_EC_UNCOMPRESSED.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ec_pubkey_serialize(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API int rustsecp256k1_v0_9_0_ec_pubkey_serialize(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *output,
     size_t *outputlen,
-    const rustsecp256k1_v0_8_1_pubkey* pubkey,
+    const rustsecp256k1_v0_9_0_pubkey *pubkey,
     unsigned int flags
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
@@ -445,10 +443,10 @@ SECP256K1_API int rustsecp256k1_v0_8_1_ec_pubkey_serialize(
  *  In:   pubkey1:  first public key to compare
  *        pubkey2:  second public key to compare
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_cmp(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    const rustsecp256k1_v0_8_1_pubkey* pubkey1,
-    const rustsecp256k1_v0_8_1_pubkey* pubkey2
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_pubkey_cmp(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    const rustsecp256k1_v0_9_0_pubkey *pubkey1,
+    const rustsecp256k1_v0_9_0_pubkey *pubkey2
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
 /** Parse an ECDSA signature in compact (64 bytes) format.
@@ -466,9 +464,9 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_cm
  *  S are zero, the resulting sig value is guaranteed to fail verification for
  *  any message and public key.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_ecdsa_signature* sig,
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_ecdsa_signature *sig,
     const unsigned char *input64
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
@@ -487,9 +485,9 @@ SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(
  *  encoded numbers are out of range, signature verification with it is
  *  guaranteed to fail for every message and public key.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_ecdsa_signature* sig,
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_ecdsa_signature *sig,
     const unsigned char *input,
     size_t inputlen
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@@ -505,11 +503,11 @@ SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(
  *                     if 0 was returned).
  *  In:     sig:       a pointer to an initialized signature object
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *output,
     size_t *outputlen,
-    const rustsecp256k1_v0_8_1_ecdsa_signature* sig
+    const rustsecp256k1_v0_9_0_ecdsa_signature *sig
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
 /** Serialize an ECDSA signature in compact (64 byte) format.
@@ -519,12 +517,12 @@ SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(
  *  Out:    output64:  a pointer to a 64-byte array to store the compact serialization
  *  In:     sig:       a pointer to an initialized signature object
  *
- *  See rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact for details about the encoding.
+ *  See rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact for details about the encoding.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_signature_serialize_compact(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *output64,
-    const rustsecp256k1_v0_8_1_ecdsa_signature* sig
+    const rustsecp256k1_v0_9_0_ecdsa_signature *sig
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
 /** Verify an ECDSA signature.
@@ -547,16 +545,16 @@ SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact(
  * form are accepted.
  *
  * If you need to accept ECDSA signatures from sources that do not obey this
- * rule, apply rustsecp256k1_v0_8_1_ecdsa_signature_normalize to the signature prior to
+ * rule, apply rustsecp256k1_v0_9_0_ecdsa_signature_normalize to the signature prior to
  * verification, but be aware that doing so results in malleable signatures.
  *
  * For details, see the comments for that function.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ecdsa_verify(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    const rustsecp256k1_v0_8_1_ecdsa_signature *sig,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ecdsa_verify(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    const rustsecp256k1_v0_9_0_ecdsa_signature *sig,
     const unsigned char *msghash32,
-    const rustsecp256k1_v0_8_1_pubkey *pubkey
+    const rustsecp256k1_v0_9_0_pubkey *pubkey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
 /** Convert a signature to a normalized lower-S form.
@@ -595,50 +593,48 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ecdsa_verify
  *  accept various non-unique encodings, so care should be taken when this
  *  property is required for an application.
  *
- *  The rustsecp256k1_v0_8_1_ecdsa_sign function will by default create signatures in the
- *  lower-S form, and rustsecp256k1_v0_8_1_ecdsa_verify will not accept others. In case
+ *  The rustsecp256k1_v0_9_0_ecdsa_sign function will by default create signatures in the
+ *  lower-S form, and rustsecp256k1_v0_9_0_ecdsa_verify will not accept others. In case
  *  signatures come from a system that cannot enforce this property,
- *  rustsecp256k1_v0_8_1_ecdsa_signature_normalize must be called before verification.
+ *  rustsecp256k1_v0_9_0_ecdsa_signature_normalize must be called before verification.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_signature_normalize(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_ecdsa_signature *sigout,
-    const rustsecp256k1_v0_8_1_ecdsa_signature *sigin
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_signature_normalize(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_ecdsa_signature *sigout,
+    const rustsecp256k1_v0_9_0_ecdsa_signature *sigin
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3);
 
 /** An implementation of RFC6979 (using HMAC-SHA256) as nonce generation function.
  * If a data pointer is passed, it is assumed to be a pointer to 32 bytes of
  * extra entropy.
  */
-SECP256K1_API extern const rustsecp256k1_v0_8_1_nonce_function rustsecp256k1_v0_8_1_nonce_function_rfc6979;
 
-/** A default safe nonce generation function (currently equal to rustsecp256k1_v0_8_1_nonce_function_rfc6979). */
-SECP256K1_API extern const rustsecp256k1_v0_8_1_nonce_function rustsecp256k1_v0_8_1_nonce_function_default;
+/** A default safe nonce generation function (currently equal to rustsecp256k1_v0_9_0_nonce_function_rfc6979). */
 
 /** Create an ECDSA signature.
  *
  *  Returns: 1: signature created
  *           0: the nonce generation function failed, or the secret key was invalid.
- *  Args:    ctx:       pointer to a context object (not rustsecp256k1_v0_8_1_context_static).
+ *  Args:    ctx:       pointer to a context object (not rustsecp256k1_v0_9_0_context_static).
  *  Out:     sig:       pointer to an array where the signature will be placed.
  *  In:      msghash32: the 32-byte message hash being signed.
  *           seckey:    pointer to a 32-byte secret key.
  *           noncefp:   pointer to a nonce generation function. If NULL,
- *                      rustsecp256k1_v0_8_1_nonce_function_default is used.
+ *                      rustsecp256k1_v0_9_0_nonce_function_default is used.
  *           ndata:     pointer to arbitrary data used by the nonce generation function
  *                      (can be NULL). If it is non-NULL and
- *                      rustsecp256k1_v0_8_1_nonce_function_default is used, then ndata must be a
+ *                      rustsecp256k1_v0_9_0_nonce_function_default is used, then ndata must be a
  *                      pointer to 32-bytes of additional data.
  *
  * The created signature is always in lower-S form. See
- * rustsecp256k1_v0_8_1_ecdsa_signature_normalize for more details.
+ * rustsecp256k1_v0_9_0_ecdsa_signature_normalize for more details.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_sign(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_ecdsa_signature *sig,
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_sign(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_ecdsa_signature *sig,
     const unsigned char *msghash32,
     const unsigned char *seckey,
-    rustsecp256k1_v0_8_1_nonce_function noncefp,
+    rustsecp256k1_v0_9_0_nonce_function noncefp,
     const void *ndata
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
@@ -654,8 +650,8 @@ SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_sign(
  *  Args:    ctx: pointer to a context object.
  *  In:      seckey: pointer to a 32-byte secret key.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_seckey_verify(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_seckey_verify(
+    const rustsecp256k1_v0_9_0_context *ctx,
     const unsigned char *seckey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2);
 
@@ -663,38 +659,38 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_seckey_ve
  *
  *  Returns: 1: secret was valid, public key stores.
  *           0: secret was invalid, try again.
- *  Args:    ctx:    pointer to a context object (not rustsecp256k1_v0_8_1_context_static).
+ *  Args:    ctx:    pointer to a context object (not rustsecp256k1_v0_9_0_context_static).
  *  Out:     pubkey: pointer to the created public key.
  *  In:      seckey: pointer to a 32-byte secret key.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_create(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_pubkey *pubkey,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_pubkey_create(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *pubkey,
     const unsigned char *seckey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
 /** Negates a secret key in place.
  *
  *  Returns: 0 if the given secret key is invalid according to
- *           rustsecp256k1_v0_8_1_ec_seckey_verify. 1 otherwise
+ *           rustsecp256k1_v0_9_0_ec_seckey_verify. 1 otherwise
  *  Args:   ctx:    pointer to a context object
  *  In/Out: seckey: pointer to the 32-byte secret key to be negated. If the
  *                  secret key is invalid according to
- *                  rustsecp256k1_v0_8_1_ec_seckey_verify, this function returns 0 and
+ *                  rustsecp256k1_v0_9_0_ec_seckey_verify, this function returns 0 and
  *                  seckey will be set to some unspecified value.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_seckey_negate(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_seckey_negate(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *seckey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2);
 
-/** Same as rustsecp256k1_v0_8_1_ec_seckey_negate, but DEPRECATED. Will be removed in
+/** Same as rustsecp256k1_v0_9_0_ec_seckey_negate, but DEPRECATED. Will be removed in
  *  future versions. */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_privkey_negate(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_privkey_negate(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *seckey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
-  SECP256K1_DEPRECATED("Use rustsecp256k1_v0_8_1_ec_seckey_negate instead");
+  SECP256K1_DEPRECATED("Use rustsecp256k1_v0_9_0_ec_seckey_negate instead");
 
 /** Negates a public key in place.
  *
@@ -702,9 +698,9 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_privkey_n
  *  Args:   ctx:        pointer to a context object
  *  In/Out: pubkey:     pointer to the public key to be negated.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_negate(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_pubkey *pubkey
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_pubkey_negate(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *pubkey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2);
 
 /** Tweak a secret key by adding tweak to it.
@@ -714,28 +710,28 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_ne
  *           otherwise.
  *  Args:    ctx:   pointer to a context object.
  *  In/Out: seckey: pointer to a 32-byte secret key. If the secret key is
- *                  invalid according to rustsecp256k1_v0_8_1_ec_seckey_verify, this
+ *                  invalid according to rustsecp256k1_v0_9_0_ec_seckey_verify, this
  *                  function returns 0. seckey will be set to some unspecified
  *                  value if this function returns 0.
- *  In:    tweak32: pointer to a 32-byte tweak. If the tweak is invalid according to
- *                  rustsecp256k1_v0_8_1_ec_seckey_verify, this function returns 0. For
- *                  uniformly random 32-byte arrays the chance of being invalid
- *                  is negligible (around 1 in 2^128).
+ *  In:    tweak32: pointer to a 32-byte tweak, which must be valid according to
+ *                  rustsecp256k1_v0_9_0_ec_seckey_verify or 32 zero bytes. For uniformly
+ *                  random 32-byte tweaks, the chance of being invalid is
+ *                  negligible (around 1 in 2^128).
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_seckey_tweak_add(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_seckey_tweak_add(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *seckey,
     const unsigned char *tweak32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
-/** Same as rustsecp256k1_v0_8_1_ec_seckey_tweak_add, but DEPRECATED. Will be removed in
+/** Same as rustsecp256k1_v0_9_0_ec_seckey_tweak_add, but DEPRECATED. Will be removed in
  *  future versions. */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_privkey_tweak_add(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_privkey_tweak_add(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *seckey,
     const unsigned char *tweak32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
-  SECP256K1_DEPRECATED("Use rustsecp256k1_v0_8_1_ec_seckey_tweak_add instead");
+  SECP256K1_DEPRECATED("Use rustsecp256k1_v0_9_0_ec_seckey_tweak_add instead");
 
 /** Tweak a public key by adding tweak times the generator to it.
  *
@@ -745,14 +741,14 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_privkey_t
  *  Args:    ctx:   pointer to a context object.
  *  In/Out: pubkey: pointer to a public key object. pubkey will be set to an
  *                  invalid value if this function returns 0.
- *  In:    tweak32: pointer to a 32-byte tweak. If the tweak is invalid according to
- *                  rustsecp256k1_v0_8_1_ec_seckey_verify, this function returns 0. For
- *                  uniformly random 32-byte arrays the chance of being invalid
- *                  is negligible (around 1 in 2^128).
- */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_pubkey *pubkey,
+ *  In:    tweak32: pointer to a 32-byte tweak, which must be valid according to
+ *                  rustsecp256k1_v0_9_0_ec_seckey_verify or 32 zero bytes. For uniformly
+ *                  random 32-byte tweaks, the chance of being invalid is
+ *                  negligible (around 1 in 2^128).
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *pubkey,
     const unsigned char *tweak32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
@@ -761,28 +757,28 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_tw
  *  Returns: 0 if the arguments are invalid. 1 otherwise.
  *  Args:   ctx:    pointer to a context object.
  *  In/Out: seckey: pointer to a 32-byte secret key. If the secret key is
- *                  invalid according to rustsecp256k1_v0_8_1_ec_seckey_verify, this
+ *                  invalid according to rustsecp256k1_v0_9_0_ec_seckey_verify, this
  *                  function returns 0. seckey will be set to some unspecified
  *                  value if this function returns 0.
  *  In:    tweak32: pointer to a 32-byte tweak. If the tweak is invalid according to
- *                  rustsecp256k1_v0_8_1_ec_seckey_verify, this function returns 0. For
+ *                  rustsecp256k1_v0_9_0_ec_seckey_verify, this function returns 0. For
  *                  uniformly random 32-byte arrays the chance of being invalid
  *                  is negligible (around 1 in 2^128).
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *seckey,
     const unsigned char *tweak32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
-/** Same as rustsecp256k1_v0_8_1_ec_seckey_tweak_mul, but DEPRECATED. Will be removed in
+/** Same as rustsecp256k1_v0_9_0_ec_seckey_tweak_mul, but DEPRECATED. Will be removed in
  *  future versions. */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_privkey_tweak_mul(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_privkey_tweak_mul(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *seckey,
     const unsigned char *tweak32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
-  SECP256K1_DEPRECATED("Use rustsecp256k1_v0_8_1_ec_seckey_tweak_mul instead");
+  SECP256K1_DEPRECATED("Use rustsecp256k1_v0_9_0_ec_seckey_tweak_mul instead");
 
 /** Tweak a public key by multiplying it by a tweak value.
  *
@@ -791,22 +787,22 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_privkey_t
  *  In/Out: pubkey: pointer to a public key object. pubkey will be set to an
  *                  invalid value if this function returns 0.
  *  In:    tweak32: pointer to a 32-byte tweak. If the tweak is invalid according to
- *                  rustsecp256k1_v0_8_1_ec_seckey_verify, this function returns 0. For
+ *                  rustsecp256k1_v0_9_0_ec_seckey_verify, this function returns 0. For
  *                  uniformly random 32-byte arrays the chance of being invalid
  *                  is negligible (around 1 in 2^128).
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_pubkey *pubkey,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *pubkey,
     const unsigned char *tweak32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
 /** Randomizes the context to provide enhanced protection against side-channel leakage.
  *
- *  Returns: 1: randomization successful (or called on copy of rustsecp256k1_v0_8_1_context_static)
+ *  Returns: 1: randomization successful
  *           0: error
- *  Args:    ctx:       pointer to a context object.
- *  In:      seed32:    pointer to a 32-byte random seed (NULL resets to initial state)
+ *  Args:    ctx:       pointer to a context object (not rustsecp256k1_v0_9_0_context_static).
+ *  In:      seed32:    pointer to a 32-byte random seed (NULL resets to initial state).
  *
  * While secp256k1 code is written and tested to be constant-time no matter what
  * secret values are, it is possible that a compiler may output code which is not,
@@ -816,29 +812,25 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_tw
  * certain computations which involve secret keys.
  *
  * It is highly recommended to call this function on contexts returned from
- * rustsecp256k1_v0_8_1_context_create or rustsecp256k1_v0_8_1_context_clone (or from the corresponding
- * functions in rustsecp256k1_v0_8_1_preallocated.h) before using these contexts to call API
+ * rustsecp256k1_v0_9_0_context_create or rustsecp256k1_v0_9_0_context_clone (or from the corresponding
+ * functions in rustsecp256k1_v0_9_0_preallocated.h) before using these contexts to call API
  * functions that perform computations involving secret keys, e.g., signing and
  * public key generation. It is possible to call this function more than once on
  * the same context, and doing so before every few computations involving secret
- * keys is recommended as a defense-in-depth measure.
+ * keys is recommended as a defense-in-depth measure. Randomization of the static
+ * context rustsecp256k1_v0_9_0_context_static is not supported.
  *
  * Currently, the random seed is mainly used for blinding multiplications of a
  * secret scalar with the elliptic curve base point. Multiplications of this
  * kind are performed by exactly those API functions which are documented to
- * require a context that is not the rustsecp256k1_v0_8_1_context_static. As a rule of thumb,
+ * require a context that is not rustsecp256k1_v0_9_0_context_static. As a rule of thumb,
  * these are all functions which take a secret key (or a keypair) as an input.
  * A notable exception to that rule is the ECDH module, which relies on a different
  * kind of elliptic curve point multiplication and thus does not benefit from
  * enhanced protection against side-channel leakage currently.
- *
- * It is safe call this function on a copy of rustsecp256k1_v0_8_1_context_static in writable
- * memory (e.g., obtained via rustsecp256k1_v0_8_1_context_clone). In that case, this
- * function is guaranteed to return 1, but the call will have no effect because
- * the static context (or a copy thereof) is not meant to be randomized.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_context_randomize(
-    rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_context_randomize(
+    rustsecp256k1_v0_9_0_context *ctx,
     const unsigned char *seed32
 ) SECP256K1_ARG_NONNULL(1);
 
@@ -851,10 +843,10 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_context_rand
  *  In:     ins:        pointer to array of pointers to public keys.
  *          n:          the number of public keys to add together (must be at least 1).
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_combine(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_pubkey *out,
-    const rustsecp256k1_v0_8_1_pubkey * const * ins,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ec_pubkey_combine(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *out,
+    const rustsecp256k1_v0_9_0_pubkey * const *ins,
     size_t n
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
@@ -874,8 +866,8 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ec_pubkey_co
  *           msg: pointer to an array containing the message
  *        msglen: length of the message array
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_tagged_sha256(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_tagged_sha256(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *hash32,
     const unsigned char *tag,
     size_t taglen,
diff --git a/secp256k1-sys/depend/secp256k1/include/secp256k1_ecdh.h b/secp256k1-sys/depend/secp256k1/include/secp256k1_ecdh.h
index 398030638..4bf3e00c0 100644
--- a/secp256k1-sys/depend/secp256k1/include/secp256k1_ecdh.h
+++ b/secp256k1-sys/depend/secp256k1/include/secp256k1_ecdh.h
@@ -10,15 +10,15 @@ extern "C" {
 /** A pointer to a function that hashes an EC point to obtain an ECDH secret
  *
  *  Returns: 1 if the point was successfully hashed.
- *           0 will cause rustsecp256k1_v0_8_1_ecdh to fail and return 0.
+ *           0 will cause rustsecp256k1_v0_9_0_ecdh to fail and return 0.
  *           Other return values are not allowed, and the behaviour of
- *           rustsecp256k1_v0_8_1_ecdh is undefined for other return values.
+ *           rustsecp256k1_v0_9_0_ecdh is undefined for other return values.
  *  Out:     output:     pointer to an array to be filled by the function
  *  In:      x32:        pointer to a 32-byte x coordinate
  *           y32:        pointer to a 32-byte y coordinate
  *           data:       arbitrary data pointer that is passed through
  */
-typedef int (*rustsecp256k1_v0_8_1_ecdh_hash_function)(
+typedef int (*rustsecp256k1_v0_9_0_ecdh_hash_function)(
   unsigned char *output,
   const unsigned char *x32,
   const unsigned char *y32,
@@ -27,11 +27,11 @@ typedef int (*rustsecp256k1_v0_8_1_ecdh_hash_function)(
 
 /** An implementation of SHA256 hash function that applies to compressed public key.
  * Populates the output parameter with 32 bytes. */
-SECP256K1_API extern const rustsecp256k1_v0_8_1_ecdh_hash_function rustsecp256k1_v0_8_1_ecdh_hash_function_sha256;
+SECP256K1_API const rustsecp256k1_v0_9_0_ecdh_hash_function rustsecp256k1_v0_9_0_ecdh_hash_function_sha256;
 
-/** A default ECDH hash function (currently equal to rustsecp256k1_v0_8_1_ecdh_hash_function_sha256).
+/** A default ECDH hash function (currently equal to rustsecp256k1_v0_9_0_ecdh_hash_function_sha256).
  * Populates the output parameter with 32 bytes. */
-SECP256K1_API extern const rustsecp256k1_v0_8_1_ecdh_hash_function rustsecp256k1_v0_8_1_ecdh_hash_function_default;
+SECP256K1_API const rustsecp256k1_v0_9_0_ecdh_hash_function rustsecp256k1_v0_9_0_ecdh_hash_function_default;
 
 /** Compute an EC Diffie-Hellman secret in constant time
  *
@@ -39,20 +39,20 @@ SECP256K1_API extern const rustsecp256k1_v0_8_1_ecdh_hash_function rustsecp256k1
  *           0: scalar was invalid (zero or overflow) or hashfp returned 0
  *  Args:    ctx:        pointer to a context object.
  *  Out:     output:     pointer to an array to be filled by hashfp.
- *  In:      pubkey:     a pointer to a rustsecp256k1_v0_8_1_pubkey containing an initialized public key.
+ *  In:      pubkey:     a pointer to a rustsecp256k1_v0_9_0_pubkey containing an initialized public key.
  *           seckey:     a 32-byte scalar with which to multiply the point.
  *           hashfp:     pointer to a hash function. If NULL,
- *                       rustsecp256k1_v0_8_1_ecdh_hash_function_sha256 is used
+ *                       rustsecp256k1_v0_9_0_ecdh_hash_function_sha256 is used
  *                       (in which case, 32 bytes will be written to output).
  *           data:       arbitrary data pointer that is passed through to hashfp
- *                       (can be NULL for rustsecp256k1_v0_8_1_ecdh_hash_function_sha256).
+ *                       (can be NULL for rustsecp256k1_v0_9_0_ecdh_hash_function_sha256).
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ecdh(
-  const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ecdh(
+  const rustsecp256k1_v0_9_0_context *ctx,
   unsigned char *output,
-  const rustsecp256k1_v0_8_1_pubkey *pubkey,
+  const rustsecp256k1_v0_9_0_pubkey *pubkey,
   const unsigned char *seckey,
-  rustsecp256k1_v0_8_1_ecdh_hash_function hashfp,
+  rustsecp256k1_v0_9_0_ecdh_hash_function hashfp,
   void *data
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
diff --git a/secp256k1-sys/depend/secp256k1/include/secp256k1_ellswift.h b/secp256k1-sys/depend/secp256k1/include/secp256k1_ellswift.h
new file mode 100644
index 000000000..c047e24c2
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/include/secp256k1_ellswift.h
@@ -0,0 +1,200 @@
+#ifndef SECP256K1_ELLSWIFT_H
+#define SECP256K1_ELLSWIFT_H
+
+#include "secp256k1.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* This module provides an implementation of ElligatorSwift as well as a
+ * version of x-only ECDH using it (including compatibility with BIP324).
+ *
+ * ElligatorSwift is described in https://eprint.iacr.org/2022/759 by
+ * Chavez-Saab, Rodriguez-Henriquez, and Tibouchi. It permits encoding
+ * uniformly chosen public keys as 64-byte arrays which are indistinguishable
+ * from uniformly random arrays.
+ *
+ * Let f be the function from pairs of field elements to point X coordinates,
+ * defined as follows (all operations modulo p = 2^256 - 2^32 - 977)
+ * f(u,t):
+ * - Let C = 0xa2d2ba93507f1df233770c2a797962cc61f6d15da14ecd47d8d27ae1cd5f852,
+ *   a square root of -3.
+ * - If u=0, set u=1 instead.
+ * - If t=0, set t=1 instead.
+ * - If u^3 + t^2 + 7 = 0, multiply t by 2.
+ * - Let X = (u^3 + 7 - t^2) / (2 * t)
+ * - Let Y = (X + t) / (C * u)
+ * - Return the first in [u + 4 * Y^2, (-X/Y - u) / 2, (X/Y - u) / 2] that is an
+ *   X coordinate on the curve (at least one of them is, for any u and t).
+ *
+ * Then an ElligatorSwift encoding of x consists of the 32-byte big-endian
+ * encodings of field elements u and t concatenated, where f(u,t) = x.
+ * The encoding algorithm is described in the paper, and effectively picks a
+ * uniformly random pair (u,t) among those which encode x.
+ *
+ * If the Y coordinate is relevant, it is given the same parity as t.
+ *
+ * Changes w.r.t. the the paper:
+ * - The u=0, t=0, and u^3+t^2+7=0 conditions result in decoding to the point
+ *   at infinity in the paper. Here they are remapped to finite points.
+ * - The paper uses an additional encoding bit for the parity of y. Here the
+ *   parity of t is used (negating t does not affect the decoded x coordinate,
+ *   so this is possible).
+ *
+ * For mathematical background about the scheme, see the doc/ellswift.md file.
+ */
+
+/** A pointer to a function used by rustsecp256k1_v0_9_0_ellswift_xdh to hash the shared X
+ *  coordinate along with the encoded public keys to a uniform shared secret.
+ *
+ *  Returns: 1 if a shared secret was successfully computed.
+ *           0 will cause rustsecp256k1_v0_9_0_ellswift_xdh to fail and return 0.
+ *           Other return values are not allowed, and the behaviour of
+ *           rustsecp256k1_v0_9_0_ellswift_xdh is undefined for other return values.
+ *  Out:     output:     pointer to an array to be filled by the function
+ *  In:      x32:        pointer to the 32-byte serialized X coordinate
+ *                       of the resulting shared point (will not be NULL)
+ *           ell_a64:    pointer to the 64-byte encoded public key of party A
+ *                       (will not be NULL)
+ *           ell_b64:    pointer to the 64-byte encoded public key of party B
+ *                       (will not be NULL)
+ *           data:       arbitrary data pointer that is passed through
+ */
+typedef int (*rustsecp256k1_v0_9_0_ellswift_xdh_hash_function)(
+    unsigned char *output,
+    const unsigned char *x32,
+    const unsigned char *ell_a64,
+    const unsigned char *ell_b64,
+    void *data
+);
+
+/** An implementation of an rustsecp256k1_v0_9_0_ellswift_xdh_hash_function which uses
+ *  SHA256(prefix64 || ell_a64 || ell_b64 || x32), where prefix64 is the 64-byte
+ *  array pointed to by data. */
+SECP256K1_API const rustsecp256k1_v0_9_0_ellswift_xdh_hash_function rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_prefix;
+
+/** An implementation of an rustsecp256k1_v0_9_0_ellswift_xdh_hash_function compatible with
+ *  BIP324. It returns H_tag(ell_a64 || ell_b64 || x32), where H_tag is the
+ *  BIP340 tagged hash function with tag "bip324_ellswift_xonly_ecdh". Equivalent
+ *  to rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_prefix with prefix64 set to
+ *  SHA256("bip324_ellswift_xonly_ecdh")||SHA256("bip324_ellswift_xonly_ecdh").
+ *  The data argument is ignored. */
+SECP256K1_API const rustsecp256k1_v0_9_0_ellswift_xdh_hash_function rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_bip324;
+
+/** Construct a 64-byte ElligatorSwift encoding of a given pubkey.
+ *
+ *  Returns: 1 always.
+ *  Args:    ctx:        pointer to a context object
+ *  Out:     ell64:      pointer to a 64-byte array to be filled
+ *  In:      pubkey:     a pointer to a rustsecp256k1_v0_9_0_pubkey containing an
+ *                       initialized public key
+ *           rnd32:      pointer to 32 bytes of randomness
+ *
+ * It is recommended that rnd32 consists of 32 uniformly random bytes, not
+ * known to any adversary trying to detect whether public keys are being
+ * encoded, though 16 bytes of randomness (padded to an array of 32 bytes,
+ * e.g., with zeros) suffice to make the result indistinguishable from
+ * uniform. The randomness in rnd32 must not be a deterministic function of
+ * the pubkey (it can be derived from the private key, though).
+ *
+ * It is not guaranteed that the computed encoding is stable across versions
+ * of the library, even if all arguments to this function (including rnd32)
+ * are the same.
+ *
+ * This function runs in variable time.
+ */
+SECP256K1_API int rustsecp256k1_v0_9_0_ellswift_encode(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    unsigned char *ell64,
+    const rustsecp256k1_v0_9_0_pubkey *pubkey,
+    const unsigned char *rnd32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Decode a 64-bytes ElligatorSwift encoded public key.
+ *
+ *  Returns: always 1
+ *  Args:    ctx:        pointer to a context object
+ *  Out:     pubkey:     pointer to a rustsecp256k1_v0_9_0_pubkey that will be filled
+ *  In:      ell64:      pointer to a 64-byte array to decode
+ *
+ * This function runs in variable time.
+ */
+SECP256K1_API int rustsecp256k1_v0_9_0_ellswift_decode(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *pubkey,
+    const unsigned char *ell64
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Compute an ElligatorSwift public key for a secret key.
+ *
+ *  Returns: 1: secret was valid, public key was stored.
+ *           0: secret was invalid, try again.
+ *  Args:    ctx:        pointer to a context object
+ *  Out:     ell64:      pointer to a 64-byte array to receive the ElligatorSwift
+ *                       public key
+ *  In:      seckey32:   pointer to a 32-byte secret key
+ *           auxrnd32:   (optional) pointer to 32 bytes of randomness
+ *
+ * Constant time in seckey and auxrnd32, but not in the resulting public key.
+ *
+ * It is recommended that auxrnd32 contains 32 uniformly random bytes, though
+ * it is optional (and does result in encodings that are indistinguishable from
+ * uniform even without any auxrnd32). It differs from the (mandatory) rnd32
+ * argument to rustsecp256k1_v0_9_0_ellswift_encode in this regard.
+ *
+ * This function can be used instead of calling rustsecp256k1_v0_9_0_ec_pubkey_create
+ * followed by rustsecp256k1_v0_9_0_ellswift_encode. It is safer, as it uses the secret
+ * key as entropy for the encoding (supplemented with auxrnd32, if provided).
+ *
+ * Like rustsecp256k1_v0_9_0_ellswift_encode, this function does not guarantee that the
+ * computed encoding is stable across versions of the library, even if all
+ * arguments (including auxrnd32) are the same.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ellswift_create(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    unsigned char *ell64,
+    const unsigned char *seckey32,
+    const unsigned char *auxrnd32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Given a private key, and ElligatorSwift public keys sent in both directions,
+ *  compute a shared secret using x-only Elliptic Curve Diffie-Hellman (ECDH).
+ *
+ *  Returns: 1: shared secret was successfully computed
+ *           0: secret was invalid or hashfp returned 0
+ *  Args:    ctx:       pointer to a context object.
+ *  Out:     output:    pointer to an array to be filled by hashfp.
+ *  In:      ell_a64:   pointer to the 64-byte encoded public key of party A
+ *                      (will not be NULL)
+ *           ell_b64:   pointer to the 64-byte encoded public key of party B
+ *                      (will not be NULL)
+ *           seckey32:  a pointer to our 32-byte secret key
+ *           party:     boolean indicating which party we are: zero if we are
+ *                      party A, non-zero if we are party B. seckey32 must be
+ *                      the private key corresponding to that party's ell_?64.
+ *                      This correspondence is not checked.
+ *           hashfp:    pointer to a hash function.
+ *           data:      arbitrary data pointer passed through to hashfp.
+ *
+ * Constant time in seckey32.
+ *
+ * This function is more efficient than decoding the public keys, and performing
+ * ECDH on them.
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ellswift_xdh(
+  const rustsecp256k1_v0_9_0_context *ctx,
+  unsigned char *output,
+  const unsigned char *ell_a64,
+  const unsigned char *ell_b64,
+  const unsigned char *seckey32,
+  int party,
+  rustsecp256k1_v0_9_0_ellswift_xdh_hash_function hashfp,
+  void *data
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(7);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SECP256K1_ELLSWIFT_H */
diff --git a/secp256k1-sys/depend/secp256k1/include/secp256k1_extrakeys.h b/secp256k1-sys/depend/secp256k1/include/secp256k1_extrakeys.h
index 87e4b1f58..b16021d7b 100644
--- a/secp256k1-sys/depend/secp256k1/include/secp256k1_extrakeys.h
+++ b/secp256k1-sys/depend/secp256k1/include/secp256k1_extrakeys.h
@@ -16,12 +16,12 @@ extern "C" {
  *  guaranteed to be portable between different platforms or versions. It is
  *  however guaranteed to be 64 bytes in size, and can be safely copied/moved.
  *  If you need to convert to a format suitable for storage, transmission, use
- *  use rustsecp256k1_v0_8_1_xonly_pubkey_serialize and rustsecp256k1_v0_8_1_xonly_pubkey_parse. To
- *  compare keys, use rustsecp256k1_v0_8_1_xonly_pubkey_cmp.
+ *  use rustsecp256k1_v0_9_0_xonly_pubkey_serialize and rustsecp256k1_v0_9_0_xonly_pubkey_parse. To
+ *  compare keys, use rustsecp256k1_v0_9_0_xonly_pubkey_cmp.
  */
 typedef struct {
     unsigned char data[64];
-} rustsecp256k1_v0_8_1_xonly_pubkey;
+} rustsecp256k1_v0_9_0_xonly_pubkey;
 
 /** Opaque data structure that holds a keypair consisting of a secret and a
  *  public key.
@@ -32,7 +32,7 @@ typedef struct {
  */
 typedef struct {
     unsigned char data[96];
-} rustsecp256k1_v0_8_1_keypair;
+} rustsecp256k1_v0_9_0_keypair;
 
 /** Parse a 32-byte sequence into a xonly_pubkey object.
  *
@@ -44,9 +44,9 @@ typedef struct {
  *               parsed version of input. If not, it's set to an invalid value.
  *  In: input32: pointer to a serialized xonly_pubkey.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_xonly_pubkey_parse(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_xonly_pubkey* pubkey,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_xonly_pubkey_parse(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_xonly_pubkey *pubkey,
     const unsigned char *input32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
@@ -56,12 +56,12 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_xonly_pubkey
  *
  *  Args:     ctx: a secp256k1 context object.
  *  Out: output32: a pointer to a 32-byte array to place the serialized key in.
- *  In:    pubkey: a pointer to a rustsecp256k1_v0_8_1_xonly_pubkey containing an initialized public key.
+ *  In:    pubkey: a pointer to a rustsecp256k1_v0_9_0_xonly_pubkey containing an initialized public key.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_xonly_pubkey_serialize(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API int rustsecp256k1_v0_9_0_xonly_pubkey_serialize(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *output32,
-    const rustsecp256k1_v0_8_1_xonly_pubkey* pubkey
+    const rustsecp256k1_v0_9_0_xonly_pubkey *pubkey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
 /** Compare two x-only public keys using lexicographic order
@@ -73,13 +73,13 @@ SECP256K1_API int rustsecp256k1_v0_8_1_xonly_pubkey_serialize(
  *  In:   pubkey1:  first public key to compare
  *        pubkey2:  second public key to compare
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_xonly_pubkey_cmp(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    const rustsecp256k1_v0_8_1_xonly_pubkey* pk1,
-    const rustsecp256k1_v0_8_1_xonly_pubkey* pk2
+SECP256K1_API int rustsecp256k1_v0_9_0_xonly_pubkey_cmp(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    const rustsecp256k1_v0_9_0_xonly_pubkey *pk1,
+    const rustsecp256k1_v0_9_0_xonly_pubkey *pk2
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
-/** Converts a rustsecp256k1_v0_8_1_pubkey into a rustsecp256k1_v0_8_1_xonly_pubkey.
+/** Converts a rustsecp256k1_v0_9_0_pubkey into a rustsecp256k1_v0_9_0_xonly_pubkey.
  *
  *  Returns: 1 always.
  *
@@ -90,11 +90,11 @@ SECP256K1_API int rustsecp256k1_v0_8_1_xonly_pubkey_cmp(
  *                     the negation of the pubkey and set to 0 otherwise.
  *  In:        pubkey: pointer to a public key that is converted.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_xonly_pubkey *xonly_pubkey,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_xonly_pubkey *xonly_pubkey,
     int *pk_parity,
-    const rustsecp256k1_v0_8_1_pubkey *pubkey
+    const rustsecp256k1_v0_9_0_pubkey *pubkey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
 
 /** Tweak an x-only public key by adding the generator multiplied with tweak32
@@ -102,7 +102,7 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_xonly_pubkey
  *
  *  Note that the resulting point can not in general be represented by an x-only
  *  pubkey because it may have an odd Y coordinate. Instead, the output_pubkey
- *  is a normal rustsecp256k1_v0_8_1_pubkey.
+ *  is a normal rustsecp256k1_v0_9_0_pubkey.
  *
  *  Returns: 0 if the arguments are invalid or the resulting public key would be
  *           invalid (only when the tweak is the negation of the corresponding
@@ -112,24 +112,24 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_xonly_pubkey
  *  Out:  output_pubkey: pointer to a public key to store the result. Will be set
  *                       to an invalid value if this function returns 0.
  *  In: internal_pubkey: pointer to an x-only pubkey to apply the tweak to.
- *              tweak32: pointer to a 32-byte tweak. If the tweak is invalid
- *                       according to rustsecp256k1_v0_8_1_ec_seckey_verify, this function
- *                       returns 0. For uniformly random 32-byte arrays the
- *                       chance of being invalid is negligible (around 1 in 2^128).
+ *              tweak32: pointer to a 32-byte tweak, which must be valid
+ *                       according to rustsecp256k1_v0_9_0_ec_seckey_verify or 32 zero
+ *                       bytes. For uniformly random 32-byte tweaks, the chance of
+ *                       being invalid is negligible (around 1 in 2^128).
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_pubkey *output_pubkey,
-    const rustsecp256k1_v0_8_1_xonly_pubkey *internal_pubkey,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *output_pubkey,
+    const rustsecp256k1_v0_9_0_xonly_pubkey *internal_pubkey,
     const unsigned char *tweak32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
 /** Checks that a tweaked pubkey is the result of calling
- *  rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add with internal_pubkey and tweak32.
+ *  rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add with internal_pubkey and tweak32.
  *
  *  The tweaked pubkey is represented by its 32-byte x-only serialization and
  *  its pk_parity, which can both be obtained by converting the result of
- *  tweak_add to a rustsecp256k1_v0_8_1_xonly_pubkey.
+ *  tweak_add to a rustsecp256k1_v0_9_0_xonly_pubkey.
  *
  *  Note that this alone does _not_ verify that the tweaked pubkey is a
  *  commitment. If the tweak is not chosen in a specific way, the tweaked pubkey
@@ -142,16 +142,16 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_xonly_pubkey
  *     tweaked_pk_parity: the parity of the tweaked pubkey (whose serialization
  *                        is passed in as tweaked_pubkey32). This must match the
  *                        pk_parity value that is returned when calling
- *                        rustsecp256k1_v0_8_1_xonly_pubkey with the tweaked pubkey, or
+ *                        rustsecp256k1_v0_9_0_xonly_pubkey with the tweaked pubkey, or
  *                        this function will fail.
  *       internal_pubkey: pointer to an x-only public key object to apply the tweak to.
  *               tweak32: pointer to a 32-byte tweak.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(
+    const rustsecp256k1_v0_9_0_context *ctx,
     const unsigned char *tweaked_pubkey32,
     int tweaked_pk_parity,
-    const rustsecp256k1_v0_8_1_xonly_pubkey *internal_pubkey,
+    const rustsecp256k1_v0_9_0_xonly_pubkey *internal_pubkey,
     const unsigned char *tweak32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
 
@@ -159,13 +159,13 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_xonly_pubkey
  *
  *  Returns: 1: secret was valid, keypair is ready to use
  *           0: secret was invalid, try again with a different secret
- *  Args:    ctx: pointer to a context object (not rustsecp256k1_v0_8_1_context_static).
+ *  Args:    ctx: pointer to a context object (not rustsecp256k1_v0_9_0_context_static).
  *  Out: keypair: pointer to the created keypair.
  *  In:   seckey: pointer to a 32-byte secret key.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_keypair_create(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_keypair *keypair,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_keypair_create(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_keypair *keypair,
     const unsigned char *seckey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
@@ -176,53 +176,51 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_keypair_crea
  *  Out: seckey: pointer to a 32-byte buffer for the secret key.
  *  In: keypair: pointer to a keypair.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_keypair_sec(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_keypair_sec(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *seckey,
-    const rustsecp256k1_v0_8_1_keypair *keypair
+    const rustsecp256k1_v0_9_0_keypair *keypair
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
 /** Get the public key from a keypair.
  *
  *  Returns: 1 always.
- *  Args:    ctx: pointer to a context object.
- *  Out: pubkey: pointer to a pubkey object. If 1 is returned, it is set to
- *               the keypair public key. If not, it's set to an invalid value.
+ *  Args:   ctx: pointer to a context object.
+ *  Out: pubkey: pointer to a pubkey object, set to the keypair public key.
  *  In: keypair: pointer to a keypair.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_keypair_pub(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_pubkey *pubkey,
-    const rustsecp256k1_v0_8_1_keypair *keypair
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_keypair_pub(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *pubkey,
+    const rustsecp256k1_v0_9_0_keypair *keypair
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
 /** Get the x-only public key from a keypair.
  *
- *  This is the same as calling rustsecp256k1_v0_8_1_keypair_pub and then
- *  rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey.
+ *  This is the same as calling rustsecp256k1_v0_9_0_keypair_pub and then
+ *  rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey.
  *
  *  Returns: 1 always.
  *  Args:   ctx: pointer to a context object.
- *  Out: pubkey: pointer to an xonly_pubkey object. If 1 is returned, it is set
- *               to the keypair public key after converting it to an
- *               xonly_pubkey. If not, it's set to an invalid value.
+ *  Out: pubkey: pointer to an xonly_pubkey object, set to the keypair
+ *               public key after converting it to an xonly_pubkey.
  *    pk_parity: Ignored if NULL. Otherwise, pointer to an integer that will be set to the
- *               pk_parity argument of rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey.
+ *               pk_parity argument of rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey.
  *  In: keypair: pointer to a keypair.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_keypair_xonly_pub(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_xonly_pubkey *pubkey,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_keypair_xonly_pub(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_xonly_pubkey *pubkey,
     int *pk_parity,
-    const rustsecp256k1_v0_8_1_keypair *keypair
+    const rustsecp256k1_v0_9_0_keypair *keypair
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);
 
 /** Tweak a keypair by adding tweak32 to the secret key and updating the public
  *  key accordingly.
  *
- *  Calling this function and then rustsecp256k1_v0_8_1_keypair_pub results in the same
- *  public key as calling rustsecp256k1_v0_8_1_keypair_xonly_pub and then
- *  rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add.
+ *  Calling this function and then rustsecp256k1_v0_9_0_keypair_pub results in the same
+ *  public key as calling rustsecp256k1_v0_9_0_keypair_xonly_pub and then
+ *  rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add.
  *
  *  Returns: 0 if the arguments are invalid or the resulting keypair would be
  *           invalid (only when the tweak is the negation of the keypair's
@@ -231,14 +229,14 @@ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_keypair_xonl
  *  Args:       ctx: pointer to a context object.
  *  In/Out: keypair: pointer to a keypair to apply the tweak to. Will be set to
  *                   an invalid value if this function returns 0.
- *  In:     tweak32: pointer to a 32-byte tweak. If the tweak is invalid according
- *                   to rustsecp256k1_v0_8_1_ec_seckey_verify, this function returns 0. For
- *                   uniformly random 32-byte arrays the chance of being invalid
- *                   is negligible (around 1 in 2^128).
+ *  In:     tweak32: pointer to a 32-byte tweak, which must be valid according to
+ *                   rustsecp256k1_v0_9_0_ec_seckey_verify or 32 zero bytes. For uniformly
+ *                   random 32-byte tweaks, the chance of being invalid is
+ *                   negligible (around 1 in 2^128).
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_keypair *keypair,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_keypair *keypair,
     const unsigned char *tweak32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
diff --git a/secp256k1-sys/depend/secp256k1/include/secp256k1_preallocated.h b/secp256k1-sys/depend/secp256k1/include/secp256k1_preallocated.h
index 2e2105eb2..e63f96c71 100644
--- a/secp256k1-sys/depend/secp256k1/include/secp256k1_preallocated.h
+++ b/secp256k1-sys/depend/secp256k1/include/secp256k1_preallocated.h
@@ -16,8 +16,8 @@ extern "C" {
  * objects created by functions in secp256k1.h, i.e., they can be passed to any
  * API function that expects a context object (see secp256k1.h for details). The
  * only exception is that context objects created by functions in this module
- * must be destroyed using rustsecp256k1_v0_8_1_context_preallocated_destroy (in this
- * module) instead of rustsecp256k1_v0_8_1_context_destroy (in secp256k1.h).
+ * must be destroyed using rustsecp256k1_v0_9_0_context_preallocated_destroy (in this
+ * module) instead of rustsecp256k1_v0_9_0_context_destroy (in secp256k1.h).
  *
  * It is guaranteed that functions in this module will not call malloc or its
  * friends realloc, calloc, and free.
@@ -27,24 +27,24 @@ extern "C" {
  *  caller-provided memory.
  *
  *  The purpose of this function is to determine how much memory must be provided
- *  to rustsecp256k1_v0_8_1_context_preallocated_create.
+ *  to rustsecp256k1_v0_9_0_context_preallocated_create.
  *
  *  Returns: the required size of the caller-provided memory block
  *  In:      flags:    which parts of the context to initialize.
  */
-SECP256K1_API size_t rustsecp256k1_v0_8_1_context_preallocated_size(
+SECP256K1_API size_t rustsecp256k1_v0_9_0_context_preallocated_size(
     unsigned int flags
 ) SECP256K1_WARN_UNUSED_RESULT;
 
 /** Create a secp256k1 context object in caller-provided memory.
  *
  *  The caller must provide a pointer to a rewritable contiguous block of memory
- *  of size at least rustsecp256k1_v0_8_1_context_preallocated_size(flags) bytes, suitably
+ *  of size at least rustsecp256k1_v0_9_0_context_preallocated_size(flags) bytes, suitably
  *  aligned to hold an object of any type.
  *
  *  The block of memory is exclusively owned by the created context object during
  *  the lifetime of this context object, which begins with the call to this
- *  function and ends when a call to rustsecp256k1_v0_8_1_context_preallocated_destroy
+ *  function and ends when a call to rustsecp256k1_v0_9_0_context_preallocated_destroy
  *  (which destroys the context object again) returns. During the lifetime of the
  *  context object, the caller is obligated not to access this block of memory,
  *  i.e., the caller may not read or write the memory, e.g., by copying the memory
@@ -54,17 +54,17 @@ SECP256K1_API size_t rustsecp256k1_v0_8_1_context_preallocated_size(
  *
  *  Returns: a newly created context object.
  *  In:      prealloc: a pointer to a rewritable contiguous block of memory of
- *                     size at least rustsecp256k1_v0_8_1_context_preallocated_size(flags)
+ *                     size at least rustsecp256k1_v0_9_0_context_preallocated_size(flags)
  *                     bytes, as detailed above.
  *           flags:    which parts of the context to initialize.
  *
- *  See rustsecp256k1_v0_8_1_context_create (in secp256k1.h) for further details.
+ *  See rustsecp256k1_v0_9_0_context_create (in secp256k1.h) for further details.
  *
- *  See also rustsecp256k1_v0_8_1_context_randomize (in secp256k1.h)
- *  and rustsecp256k1_v0_8_1_context_preallocated_destroy.
+ *  See also rustsecp256k1_v0_9_0_context_randomize (in secp256k1.h)
+ *  and rustsecp256k1_v0_9_0_context_preallocated_destroy.
  */
-SECP256K1_API rustsecp256k1_v0_8_1_context* rustsecp256k1_v0_8_1_context_preallocated_create(
-    void* prealloc,
+SECP256K1_API rustsecp256k1_v0_9_0_context *rustsecp256k1_v0_9_0_context_preallocated_create(
+    void *prealloc,
     unsigned int flags
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT;
 
@@ -74,29 +74,32 @@ SECP256K1_API rustsecp256k1_v0_8_1_context* rustsecp256k1_v0_8_1_context_preallo
  *  Returns: the required size of the caller-provided memory block.
  *  In:      ctx: an existing context to copy.
  */
-SECP256K1_API size_t rustsecp256k1_v0_8_1_context_preallocated_clone_size(
-    const rustsecp256k1_v0_8_1_context* ctx
+SECP256K1_API size_t rustsecp256k1_v0_9_0_context_preallocated_clone_size(
+    const rustsecp256k1_v0_9_0_context *ctx
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT;
 
 /** Copy a secp256k1 context object into caller-provided memory.
  *
  *  The caller must provide a pointer to a rewritable contiguous block of memory
- *  of size at least rustsecp256k1_v0_8_1_context_preallocated_size(flags) bytes, suitably
+ *  of size at least rustsecp256k1_v0_9_0_context_preallocated_size(flags) bytes, suitably
  *  aligned to hold an object of any type.
  *
  *  The block of memory is exclusively owned by the created context object during
  *  the lifetime of this context object, see the description of
- *  rustsecp256k1_v0_8_1_context_preallocated_create for details.
+ *  rustsecp256k1_v0_9_0_context_preallocated_create for details.
+ *
+ *  Cloning rustsecp256k1_v0_9_0_context_static is not possible, and should not be emulated by
+ *  the caller (e.g., using memcpy). Create a new context instead.
  *
  *  Returns: a newly created context object.
- *  Args:    ctx:      an existing context to copy.
+ *  Args:    ctx:      an existing context to copy (not rustsecp256k1_v0_9_0_context_static).
  *  In:      prealloc: a pointer to a rewritable contiguous block of memory of
- *                     size at least rustsecp256k1_v0_8_1_context_preallocated_size(flags)
+ *                     size at least rustsecp256k1_v0_9_0_context_preallocated_size(flags)
  *                     bytes, as detailed above.
  */
-SECP256K1_API rustsecp256k1_v0_8_1_context* rustsecp256k1_v0_8_1_context_preallocated_clone(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    void* prealloc
+SECP256K1_API rustsecp256k1_v0_9_0_context *rustsecp256k1_v0_9_0_context_preallocated_clone(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    void *prealloc
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_WARN_UNUSED_RESULT;
 
 /** Destroy a secp256k1 context object that has been created in
@@ -105,22 +108,23 @@ SECP256K1_API rustsecp256k1_v0_8_1_context* rustsecp256k1_v0_8_1_context_preallo
  *  The context pointer may not be used afterwards.
  *
  *  The context to destroy must have been created using
- *  rustsecp256k1_v0_8_1_context_preallocated_create or rustsecp256k1_v0_8_1_context_preallocated_clone.
- *  If the context has instead been created using rustsecp256k1_v0_8_1_context_create or
- *  rustsecp256k1_v0_8_1_context_clone, the behaviour is undefined. In that case,
- *  rustsecp256k1_v0_8_1_context_destroy must be used instead.
+ *  rustsecp256k1_v0_9_0_context_preallocated_create or rustsecp256k1_v0_9_0_context_preallocated_clone.
+ *  If the context has instead been created using rustsecp256k1_v0_9_0_context_create or
+ *  rustsecp256k1_v0_9_0_context_clone, the behaviour is undefined. In that case,
+ *  rustsecp256k1_v0_9_0_context_destroy must be used instead.
  *
  *  If required, it is the responsibility of the caller to deallocate the block
  *  of memory properly after this function returns, e.g., by calling free on the
- *  preallocated pointer given to rustsecp256k1_v0_8_1_context_preallocated_create or
- *  rustsecp256k1_v0_8_1_context_preallocated_clone.
+ *  preallocated pointer given to rustsecp256k1_v0_9_0_context_preallocated_create or
+ *  rustsecp256k1_v0_9_0_context_preallocated_clone.
  *
  *  Args:   ctx: an existing context to destroy, constructed using
- *               rustsecp256k1_v0_8_1_context_preallocated_create or
- *               rustsecp256k1_v0_8_1_context_preallocated_clone.
+ *               rustsecp256k1_v0_9_0_context_preallocated_create or
+ *               rustsecp256k1_v0_9_0_context_preallocated_clone
+ *               (i.e., not rustsecp256k1_v0_9_0_context_static).
  */
-SECP256K1_API void rustsecp256k1_v0_8_1_context_preallocated_destroy(
-    rustsecp256k1_v0_8_1_context* ctx
+SECP256K1_API void rustsecp256k1_v0_9_0_context_preallocated_destroy(
+    rustsecp256k1_v0_9_0_context *ctx
 ) SECP256K1_ARG_NONNULL(1);
 
 #ifdef __cplusplus
diff --git a/secp256k1-sys/depend/secp256k1/include/secp256k1_recovery.h b/secp256k1-sys/depend/secp256k1/include/secp256k1_recovery.h
index aecb5a205..6ce5139ee 100644
--- a/secp256k1-sys/depend/secp256k1/include/secp256k1_recovery.h
+++ b/secp256k1-sys/depend/secp256k1/include/secp256k1_recovery.h
@@ -14,8 +14,8 @@ extern "C" {
  *  guaranteed to be portable between different platforms or versions. It is
  *  however guaranteed to be 65 bytes in size, and can be safely copied/moved.
  *  If you need to convert to a format suitable for storage or transmission, use
- *  the rustsecp256k1_v0_8_1_ecdsa_signature_serialize_* and
- *  rustsecp256k1_v0_8_1_ecdsa_signature_parse_* functions.
+ *  the rustsecp256k1_v0_9_0_ecdsa_signature_serialize_* and
+ *  rustsecp256k1_v0_9_0_ecdsa_signature_parse_* functions.
  *
  *  Furthermore, it is guaranteed that identical signatures (including their
  *  recoverability) will have identical representation, so they can be
@@ -23,7 +23,7 @@ extern "C" {
  */
 typedef struct {
     unsigned char data[65];
-} rustsecp256k1_v0_8_1_ecdsa_recoverable_signature;
+} rustsecp256k1_v0_9_0_ecdsa_recoverable_signature;
 
 /** Parse a compact ECDSA signature (64 bytes + recovery id).
  *
@@ -33,9 +33,9 @@ typedef struct {
  *  In:   input64: a pointer to a 64-byte compact signature
  *        recid:   the recovery id (0, 1, 2 or 3)
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature* sig,
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature *sig,
     const unsigned char *input64,
     int recid
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
@@ -47,10 +47,10 @@ SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact
  *  Out:  sig:    a pointer to a normal signature.
  *  In:   sigin:  a pointer to a recoverable signature.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_ecdsa_signature* sig,
-    const rustsecp256k1_v0_8_1_ecdsa_recoverable_signature* sigin
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_ecdsa_signature *sig,
+    const rustsecp256k1_v0_9_0_ecdsa_recoverable_signature *sigin
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
 
 /** Serialize an ECDSA signature in compact format (64 bytes + recovery id).
@@ -61,32 +61,32 @@ SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(
  *        recid:    a pointer to an integer to hold the recovery id.
  *  In:   sig:      a pointer to an initialized signature object.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *output64,
     int *recid,
-    const rustsecp256k1_v0_8_1_ecdsa_recoverable_signature* sig
+    const rustsecp256k1_v0_9_0_ecdsa_recoverable_signature *sig
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
 /** Create a recoverable ECDSA signature.
  *
  *  Returns: 1: signature created
  *           0: the nonce generation function failed, or the secret key was invalid.
- *  Args:    ctx:       pointer to a context object (not rustsecp256k1_v0_8_1_context_static).
+ *  Args:    ctx:       pointer to a context object (not rustsecp256k1_v0_9_0_context_static).
  *  Out:     sig:       pointer to an array where the signature will be placed.
  *  In:      msghash32: the 32-byte message hash being signed.
  *           seckey:    pointer to a 32-byte secret key.
  *           noncefp:   pointer to a nonce generation function. If NULL,
- *                      rustsecp256k1_v0_8_1_nonce_function_default is used.
+ *                      rustsecp256k1_v0_9_0_nonce_function_default is used.
  *           ndata:     pointer to arbitrary data used by the nonce generation function
- *                      (can be NULL for rustsecp256k1_v0_8_1_nonce_function_default).
+ *                      (can be NULL for rustsecp256k1_v0_9_0_nonce_function_default).
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature *sig,
+SECP256K1_API int rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature *sig,
     const unsigned char *msghash32,
     const unsigned char *seckey,
-    rustsecp256k1_v0_8_1_nonce_function noncefp,
+    rustsecp256k1_v0_9_0_nonce_function noncefp,
     const void *ndata
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
@@ -99,10 +99,10 @@ SECP256K1_API int rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(
  *  In:      sig:       pointer to initialized signature that supports pubkey recovery.
  *           msghash32: the 32-byte message hash assumed to be signed.
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_ecdsa_recover(
-    const rustsecp256k1_v0_8_1_context* ctx,
-    rustsecp256k1_v0_8_1_pubkey *pubkey,
-    const rustsecp256k1_v0_8_1_ecdsa_recoverable_signature *sig,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_ecdsa_recover(
+    const rustsecp256k1_v0_9_0_context *ctx,
+    rustsecp256k1_v0_9_0_pubkey *pubkey,
+    const rustsecp256k1_v0_9_0_ecdsa_recoverable_signature *sig,
     const unsigned char *msghash32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
diff --git a/secp256k1-sys/depend/secp256k1/include/secp256k1_schnorrsig.h b/secp256k1-sys/depend/secp256k1/include/secp256k1_schnorrsig.h
index f1e90f2c5..c33caf579 100644
--- a/secp256k1-sys/depend/secp256k1/include/secp256k1_schnorrsig.h
+++ b/secp256k1-sys/depend/secp256k1/include/secp256k1_schnorrsig.h
@@ -15,7 +15,7 @@ extern "C" {
 
 /** A pointer to a function to deterministically generate a nonce.
  *
- *  Same as rustsecp256k1_v0_8_1_nonce function with the exception of accepting an
+ *  Same as rustsecp256k1_v0_9_0_nonce function with the exception of accepting an
  *  additional pubkey argument and not requiring an attempt argument. The pubkey
  *  argument can protect signature schemes with key-prefixed challenge hash
  *  inputs against reusing the nonce when signing with the wrong precomputed
@@ -38,7 +38,7 @@ extern "C" {
  *  Except for test cases, this function should compute some cryptographic hash of
  *  the message, the key, the pubkey, the algorithm description, and data.
  */
-typedef int (*rustsecp256k1_v0_8_1_nonce_function_hardened)(
+typedef int (*rustsecp256k1_v0_9_0_nonce_function_hardened)(
     unsigned char *nonce32,
     const unsigned char *msg,
     size_t msglen,
@@ -61,7 +61,7 @@ typedef int (*rustsecp256k1_v0_8_1_nonce_function_hardened)(
  *  Therefore, to create BIP-340 compliant signatures, algo must be set to
  *  "BIP0340/nonce" and algolen to 13.
  */
-SECP256K1_API extern const rustsecp256k1_v0_8_1_nonce_function_hardened rustsecp256k1_v0_8_1_nonce_function_bip340;
+SECP256K1_API const rustsecp256k1_v0_9_0_nonce_function_hardened rustsecp256k1_v0_9_0_nonce_function_bip340;
 
 /** Data structure that contains additional arguments for schnorrsig_sign_custom.
  *
@@ -73,17 +73,17 @@ SECP256K1_API extern const rustsecp256k1_v0_8_1_nonce_function_hardened rustsecp
  *             and has no other function than making sure the object is
  *             initialized.
  *    noncefp: pointer to a nonce generation function. If NULL,
- *             rustsecp256k1_v0_8_1_nonce_function_bip340 is used
+ *             rustsecp256k1_v0_9_0_nonce_function_bip340 is used
  *      ndata: pointer to arbitrary data used by the nonce generation function
  *             (can be NULL). If it is non-NULL and
- *             rustsecp256k1_v0_8_1_nonce_function_bip340 is used, then ndata must be a
+ *             rustsecp256k1_v0_9_0_nonce_function_bip340 is used, then ndata must be a
  *             pointer to 32-byte auxiliary randomness as per BIP-340.
  */
 typedef struct {
     unsigned char magic[4];
-    rustsecp256k1_v0_8_1_nonce_function_hardened noncefp;
-    void* ndata;
-} rustsecp256k1_v0_8_1_schnorrsig_extraparams;
+    rustsecp256k1_v0_9_0_nonce_function_hardened noncefp;
+    void *ndata;
+} rustsecp256k1_v0_9_0_schnorrsig_extraparams;
 
 #define SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC { 0xda, 0x6f, 0xb3, 0x8c }
 #define SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT {\
@@ -95,18 +95,18 @@ typedef struct {
 /** Create a Schnorr signature.
  *
  *  Does _not_ strictly follow BIP-340 because it does not verify the resulting
- *  signature. Instead, you can manually use rustsecp256k1_v0_8_1_schnorrsig_verify and
+ *  signature. Instead, you can manually use rustsecp256k1_v0_9_0_schnorrsig_verify and
  *  abort if it fails.
  *
  *  This function only signs 32-byte messages. If you have messages of a
  *  different size (or the same size but without a context-specific tag
  *  prefix), it is recommended to create a 32-byte message hash with
- *  rustsecp256k1_v0_8_1_tagged_sha256 and then sign the hash. Tagged hashing allows
+ *  rustsecp256k1_v0_9_0_tagged_sha256 and then sign the hash. Tagged hashing allows
  *  providing an context-specific tag for domain separation. This prevents
  *  signatures from being valid in multiple contexts by accident.
  *
  *  Returns 1 on success, 0 on failure.
- *  Args:    ctx: pointer to a context object (not rustsecp256k1_v0_8_1_context_static).
+ *  Args:    ctx: pointer to a context object (not rustsecp256k1_v0_9_0_context_static).
  *  Out:   sig64: pointer to a 64-byte array to store the serialized signature.
  *  In:    msg32: the 32-byte message being signed.
  *       keypair: pointer to an initialized keypair.
@@ -116,45 +116,53 @@ typedef struct {
  *                BIP-340 "Default Signing" for a full explanation of this
  *                argument and for guidance if randomness is expensive.
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_schnorrsig_sign32(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API int rustsecp256k1_v0_9_0_schnorrsig_sign32(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *sig64,
     const unsigned char *msg32,
-    const rustsecp256k1_v0_8_1_keypair *keypair,
+    const rustsecp256k1_v0_9_0_keypair *keypair,
     const unsigned char *aux_rand32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
 
-/** Same as rustsecp256k1_v0_8_1_schnorrsig_sign32, but DEPRECATED. Will be removed in
+/** Same as rustsecp256k1_v0_9_0_schnorrsig_sign32, but DEPRECATED. Will be removed in
  *  future versions. */
-SECP256K1_API int rustsecp256k1_v0_8_1_schnorrsig_sign(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API int rustsecp256k1_v0_9_0_schnorrsig_sign(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *sig64,
     const unsigned char *msg32,
-    const rustsecp256k1_v0_8_1_keypair *keypair,
+    const rustsecp256k1_v0_9_0_keypair *keypair,
     const unsigned char *aux_rand32
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
-  SECP256K1_DEPRECATED("Use rustsecp256k1_v0_8_1_schnorrsig_sign32 instead");
+  SECP256K1_DEPRECATED("Use rustsecp256k1_v0_9_0_schnorrsig_sign32 instead");
 
 /** Create a Schnorr signature with a more flexible API.
  *
- *  Same arguments as rustsecp256k1_v0_8_1_schnorrsig_sign except that it allows signing
+ *  Same arguments as rustsecp256k1_v0_9_0_schnorrsig_sign except that it allows signing
  *  variable length messages and accepts a pointer to an extraparams object that
  *  allows customizing signing by passing additional arguments.
  *
- *  Creates the same signatures as schnorrsig_sign if msglen is 32 and the
- *  extraparams.ndata is the same as aux_rand32.
+ *  Equivalent to rustsecp256k1_v0_9_0_schnorrsig_sign32(..., aux_rand32) if msglen is 32
+ *  and extraparams is initialized as follows:
+ *  ```
+ *  rustsecp256k1_v0_9_0_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
+ *  extraparams.ndata = (unsigned char*)aux_rand32;
+ *  ```
  *
+ *  Returns 1 on success, 0 on failure.
+ *  Args:   ctx: pointer to a context object (not rustsecp256k1_v0_9_0_context_static).
+ *  Out:  sig64: pointer to a 64-byte array to store the serialized signature.
  *  In:     msg: the message being signed. Can only be NULL if msglen is 0.
- *       msglen: length of the message
- *  extraparams: pointer to a extraparams object (can be NULL)
+ *       msglen: length of the message.
+ *      keypair: pointer to an initialized keypair.
+ *  extraparams: pointer to an extraparams object (can be NULL).
  */
-SECP256K1_API int rustsecp256k1_v0_8_1_schnorrsig_sign_custom(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API int rustsecp256k1_v0_9_0_schnorrsig_sign_custom(
+    const rustsecp256k1_v0_9_0_context *ctx,
     unsigned char *sig64,
     const unsigned char *msg,
     size_t msglen,
-    const rustsecp256k1_v0_8_1_keypair *keypair,
-    rustsecp256k1_v0_8_1_schnorrsig_extraparams *extraparams
+    const rustsecp256k1_v0_9_0_keypair *keypair,
+    rustsecp256k1_v0_9_0_schnorrsig_extraparams *extraparams
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5);
 
 /** Verify a Schnorr signature.
@@ -167,12 +175,12 @@ SECP256K1_API int rustsecp256k1_v0_8_1_schnorrsig_sign_custom(
  *        msglen: length of the message
  *        pubkey: pointer to an x-only public key to verify with (cannot be NULL)
  */
-SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_8_1_schnorrsig_verify(
-    const rustsecp256k1_v0_8_1_context* ctx,
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int rustsecp256k1_v0_9_0_schnorrsig_verify(
+    const rustsecp256k1_v0_9_0_context *ctx,
     const unsigned char *sig64,
     const unsigned char *msg,
     size_t msglen,
-    const rustsecp256k1_v0_8_1_xonly_pubkey *pubkey
+    const rustsecp256k1_v0_9_0_xonly_pubkey *pubkey
 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5);
 
 #ifdef __cplusplus
diff --git a/secp256k1-sys/depend/secp256k1/libsecp256k1.pc.in b/secp256k1-sys/depend/secp256k1/libsecp256k1.pc.in
index 694e98eef..0fb6f48a6 100644
--- a/secp256k1-sys/depend/secp256k1/libsecp256k1.pc.in
+++ b/secp256k1-sys/depend/secp256k1/libsecp256k1.pc.in
@@ -9,5 +9,4 @@ URL: https://github.com/bitcoin-core/secp256k1
 Version: @PACKAGE_VERSION@
 Cflags: -I${includedir}
 Libs: -L${libdir} -lsecp256k1
-Libs.private: @SECP_LIBS@
 
diff --git a/secp256k1-sys/depend/secp256k1/sage/gen_exhaustive_groups.sage b/secp256k1-sys/depend/secp256k1/sage/gen_exhaustive_groups.sage
index 1a7fa36cc..e23996bed 100644
--- a/secp256k1-sys/depend/secp256k1/sage/gen_exhaustive_groups.sage
+++ b/secp256k1-sys/depend/secp256k1/sage/gen_exhaustive_groups.sage
@@ -1,124 +1,156 @@
-load("rustsecp256k1_v0_8_1_params.sage")
+load("rustsecp256k1_v0_9_0_params.sage")
 
+MAX_ORDER = 1000
+
+# Set of (curve) orders we have encountered so far.
 orders_done = set()
-results = {}
-first = True
+
+# Map from (subgroup) orders to [b, int(gen.x), int(gen.y), gen, lambda] for those subgroups.
+solutions = {}
+
+# Iterate over curves of the form y^2 = x^3 + B.
 for b in range(1, P):
-    # There are only 6 curves (up to isomorphism) of the form y^2=x^3+B. Stop once we have tried all.
+    # There are only 6 curves (up to isomorphism) of the form y^2 = x^3 + B. Stop once we have tried all.
     if len(orders_done) == 6:
         break
 
     E = EllipticCurve(F, [0, b])
     print("Analyzing curve y^2 = x^3 + %i" % b)
     n = E.order()
+
     # Skip curves with an order we've already tried
     if n in orders_done:
         print("- Isomorphic to earlier curve")
+        print()
         continue
     orders_done.add(n)
+
     # Skip curves isomorphic to the real secp256k1
     if n.is_pseudoprime():
-        print(" - Isomorphic to secp256k1")
+        assert E.is_isomorphic(C)
+        print("- Isomorphic to secp256k1")
+        print()
         continue
 
-    print("- Finding subgroups")
-
-    # Find what prime subgroups exist
-    for f, _ in n.factor():
-        print("- Analyzing subgroup of order %i" % f)
-        # Skip subgroups of order >1000
-        if f < 4 or f > 1000:
-            print("  - Bad size")
-            continue
-
-        # Iterate over X coordinates until we find one that is on the curve, has order f,
-        # and for which curve isomorphism exists that maps it to X coordinate 1.
-        for x in range(1, P):
-            # Skip X coordinates not on the curve, and construct the full point otherwise.
-            if not E.is_x_coord(x):
-                continue
-            G = E.lift_x(F(x))
+    print("- Finding prime subgroups")
 
-            print("  - Analyzing (multiples of) point with X=%i" % x)
+    # Map from group_order to a set of independent generators for that order.
+    curve_gens = {}
 
-            # Skip points whose order is not a multiple of f. Project the point to have
-            # order f otherwise.
-            if (G.order() % f):
-                print("    - Bad order")
+    for g in E.gens():
+        # Find what prime subgroups of group generated by g exist.
+        g_order = g.order()
+        for f, _ in g.order().factor():
+            # Skip subgroups that have bad size.
+            if f < 4:
+                print(f"  - Subgroup of size {f}: too small")
+                continue
+            if f > MAX_ORDER:
+                print(f"  - Subgroup of size {f}: too large")
                 continue
-            G = G * (G.order() // f)
+
+            # Construct a generator for that subgroup.
+            gen = g * (g_order // f)
+            assert(gen.order() == f)
+
+            # Add to set the minimal multiple of gen.
+            curve_gens.setdefault(f, set()).add(min([j*gen for j in range(1, f)]))
+            print(f"  - Subgroup of size {f}: ok")
+
+    for f in sorted(curve_gens.keys()):
+        print(f"- Constructing group of order {f}")
+        cbrts = sorted([int(c) for c in Integers(f)(1).nth_root(3, all=true) if c != 1])
+        gens = list(curve_gens[f])
+        sol_count = 0
+        no_endo_count = 0
+
+        # Consider all non-zero linear combinations of the independent generators.
+        for j in range(1, f**len(gens)):
+            gen = sum(gens[k] * ((j // f**k) % f) for k in range(len(gens)))
+            assert not gen.is_zero()
+            assert (f*gen).is_zero()
 
             # Find lambda for endomorphism. Skip if none can be found.
             lam = None
-            for l in Integers(f)(1).nth_root(3, all=True):
-                if int(l)*G == E(BETA*G[0], G[1]):
-                    lam = int(l)
+            for l in cbrts:
+                if l*gen == E(BETA*gen[0], gen[1]):
+                    lam = l
                     break
+
             if lam is None:
-                print("    - No endomorphism for this subgroup")
-                break
-
-            # Now look for an isomorphism of the curve that gives this point an X
-            # coordinate equal to 1.
-            # If (x,y) is on y^2 = x^3 + b, then (a^2*x, a^3*y) is on y^2 = x^3 + a^6*b.
-            # So look for m=a^2=1/x.
-            m = F(1)/G[0]
-            if not m.is_square():
-                print("    - No curve isomorphism maps it to a point with X=1")
-                continue
-            a = m.sqrt()
-            rb = a^6*b
-            RE = EllipticCurve(F, [0, rb])
-
-            # Use as generator twice the image of G under the above isormorphism.
-            # This means that generator*(1/2 mod f) will have X coordinate 1.
-            RG = RE(1, a^3*G[1]) * 2
-            # And even Y coordinate.
-            if int(RG[1]) % 2:
-                RG = -RG
-            assert(RG.order() == f)
-            assert(lam*RG == RE(BETA*RG[0], RG[1]))
-
-            # We have found curve RE:y^2=x^3+rb with generator RG of order f. Remember it
-            results[f] = {"b": rb, "G": RG, "lambda": lam}
-            print("    - Found solution")
-            break
-
-    print("")
-
-print("")
-print("")
-print("/* To be put in src/group_impl.h: */")
+                no_endo_count += 1
+            else:
+                sol_count += 1
+                solutions.setdefault(f, []).append((b, int(gen[0]), int(gen[1]), gen, lam))
+
+        print(f"  - Found {sol_count} generators (plus {no_endo_count} without endomorphism)")
+
+    print()
+
+def output_generator(g, name):
+    print(f"#define {name} SECP256K1_GE_CONST(\\")
+    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x,\\" % tuple((int(g[0]) >> (32 * (7 - i))) & 0xffffffff for i in range(4)))
+    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x,\\" % tuple((int(g[0]) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8)))
+    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x,\\" % tuple((int(g[1]) >> (32 * (7 - i))) & 0xffffffff for i in range(4)))
+    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x\\" % tuple((int(g[1]) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8)))
+    print(")")
+
+def output_b(b):
+    print(f"#define SECP256K1_B {int(b)}")
+
+print()
+print("To be put in src/group_impl.h:")
+print()
+print("/* Begin of section generated by sage/gen_exhaustive_groups.sage. */")
+for f in sorted(solutions.keys()):
+    # Use as generator/2 the one with lowest b, and lowest (x, y) generator (interpreted as non-negative integers).
+    b, _, _, HALF_G, lam = min(solutions[f])
+    output_generator(2 * HALF_G, f"SECP256K1_G_ORDER_{f}")
+print("/** Generator for secp256k1, value 'g' defined in")
+print(" *  \"Standards for Efficient Cryptography\" (SEC2) 2.7.1.")
+print(" */")
+output_generator(G, "SECP256K1_G")
+print("/* These exhaustive group test orders and generators are chosen such that:")
+print(" * - The field size is equal to that of secp256k1, so field code is the same.")
+print(" * - The curve equation is of the form y^2=x^3+B for some small constant B.")
+print(" * - The subgroup has a generator 2*P, where P.x is as small as possible.")
+print(f" * - The subgroup has size less than {MAX_ORDER} to permit exhaustive testing.")
+print(" * - The subgroup admits an endomorphism of the form lambda*(x,y) == (beta*x,y).")
+print(" */")
+print("#if defined(EXHAUSTIVE_TEST_ORDER)")
 first = True
-for f in sorted(results.keys()):
-    b = results[f]["b"]
-    G = results[f]["G"]
-    print("#  %s EXHAUSTIVE_TEST_ORDER == %i" % ("if" if first else "elif", f))
+for f in sorted(solutions.keys()):
+    b, _, _, _, lam = min(solutions[f])
+    print(f"#  {'if' if first else 'elif'} EXHAUSTIVE_TEST_ORDER == {f}")
     first = False
-    print("static const rustsecp256k1_v0_8_1_ge rustsecp256k1_v0_8_1_ge_const_g = SECP256K1_GE_CONST(")
-    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(G[0]) >> (32 * (7 - i))) & 0xffffffff for i in range(4)))
-    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(G[0]) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8)))
-    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(G[1]) >> (32 * (7 - i))) & 0xffffffff for i in range(4)))
-    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x" % tuple((int(G[1]) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8)))
-    print(");")
-    print("static const rustsecp256k1_v0_8_1_fe rustsecp256k1_v0_8_1_fe_const_b = SECP256K1_FE_CONST(")
-    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x," % tuple((int(b) >> (32 * (7 - i))) & 0xffffffff for i in range(4)))
-    print("    0x%08x, 0x%08x, 0x%08x, 0x%08x" % tuple((int(b) >> (32 * (7 - i))) & 0xffffffff for i in range(4, 8)))
-    print(");")
+    print()
+    print(f"static const rustsecp256k1_v0_9_0_ge rustsecp256k1_v0_9_0_ge_const_g = SECP256K1_G_ORDER_{f};")
+    output_b(b)
+    print()
 print("#  else")
 print("#    error No known generator for the specified exhaustive test group order.")
 print("#  endif")
+print("#else")
+print()
+print("static const rustsecp256k1_v0_9_0_ge rustsecp256k1_v0_9_0_ge_const_g = SECP256K1_G;")
+output_b(7)
+print()
+print("#endif")
+print("/* End of section generated by sage/gen_exhaustive_groups.sage. */")
+
 
-print("")
-print("")
-print("/* To be put in src/scalar_impl.h: */")
+print()
+print()
+print("To be put in src/scalar_impl.h:")
+print()
+print("/* Begin of section generated by sage/gen_exhaustive_groups.sage. */")
 first = True
-for f in sorted(results.keys()):
-    lam = results[f]["lambda"]
+for f in sorted(solutions.keys()):
+    _, _, _, _, lam = min(solutions[f])
     print("#  %s EXHAUSTIVE_TEST_ORDER == %i" % ("if" if first else "elif", f))
     first = False
     print("#    define EXHAUSTIVE_TEST_LAMBDA %i" % lam)
 print("#  else")
 print("#    error No known lambda for the specified exhaustive test group order.")
 print("#  endif")
-print("")
+print("/* End of section generated by sage/gen_exhaustive_groups.sage. */")
diff --git a/secp256k1-sys/depend/secp256k1/sage/gen_split_lambda_constants.sage b/secp256k1-sys/depend/secp256k1/sage/gen_split_lambda_constants.sage
index b7a176e02..34ed053d6 100644
--- a/secp256k1-sys/depend/secp256k1/sage/gen_split_lambda_constants.sage
+++ b/secp256k1-sys/depend/secp256k1/sage/gen_split_lambda_constants.sage
@@ -1,9 +1,9 @@
-""" Generates the constants used in rustsecp256k1_v0_8_1_scalar_split_lambda.
+""" Generates the constants used in rustsecp256k1_v0_9_0_scalar_split_lambda.
 
-See the comments for rustsecp256k1_v0_8_1_scalar_split_lambda in src/scalar_impl.h for detailed explanations.
+See the comments for rustsecp256k1_v0_9_0_scalar_split_lambda in src/scalar_impl.h for detailed explanations.
 """
 
-load("rustsecp256k1_v0_8_1_params.sage")
+load("rustsecp256k1_v0_9_0_params.sage")
 
 def inf_norm(v):
     """Returns the infinity norm of a vector."""
@@ -24,17 +24,17 @@ def gauss_reduction(i1, i2):
         v2[1] -= m*v1[1]
 
 def find_split_constants_gauss():
-    """Find constants for rustsecp256k1_v0_8_1_scalar_split_lamdba using gauss reduction."""
+    """Find constants for rustsecp256k1_v0_9_0_scalar_split_lamdba using gauss reduction."""
     (v11, v12), (v21, v22) = gauss_reduction([0, N], [1, int(LAMBDA)])
 
-    # We use related vectors in rustsecp256k1_v0_8_1_scalar_split_lambda.
+    # We use related vectors in rustsecp256k1_v0_9_0_scalar_split_lambda.
     A1, B1 = -v21, -v11
     A2, B2 = v22, -v21
 
     return A1, B1, A2, B2
 
 def find_split_constants_explicit_tof():
-    """Find constants for rustsecp256k1_v0_8_1_scalar_split_lamdba using the trace of Frobenius.
+    """Find constants for rustsecp256k1_v0_9_0_scalar_split_lamdba using the trace of Frobenius.
 
     See Benjamin Smith: "Easy scalar decompositions for efficient scalar multiplication on
     elliptic curves and genus 2 Jacobians" (https://eprint.iacr.org/2013/672), Example 2
@@ -51,7 +51,7 @@ def find_split_constants_explicit_tof():
     A2 = Integer((t + c)/2 - 1)
     B2 = Integer(1 - (t - c)/2)
 
-    # We use a negated b values in rustsecp256k1_v0_8_1_scalar_split_lambda.
+    # We use a negated b values in rustsecp256k1_v0_9_0_scalar_split_lambda.
     B1, B2 = -B1, -B2
 
     return A1, B1, A2, B2
@@ -90,7 +90,7 @@ def rnddiv2(v):
     return v >> 1
 
 def scalar_lambda_split(k):
-    """Equivalent to rustsecp256k1_v0_8_1_scalar_lambda_split()."""
+    """Equivalent to rustsecp256k1_v0_9_0_scalar_lambda_split()."""
     c1 = rnddiv2((k * G1) >> 383)
     c2 = rnddiv2((k * G2) >> 383)
     c1 = (c1 * -B1) % N
diff --git a/secp256k1-sys/depend/secp256k1/sage/group_prover.sage b/secp256k1-sys/depend/secp256k1/sage/group_prover.sage
index 9305c215d..bb0929536 100644
--- a/secp256k1-sys/depend/secp256k1/sage/group_prover.sage
+++ b/secp256k1-sys/depend/secp256k1/sage/group_prover.sage
@@ -198,7 +198,7 @@ def normalize_factor(p):
   (8) * (-bx + ax)^3
   ```
   """
-  # Assert p is not 0 and that its non-zero coeffients are coprime.
+  # Assert p is not 0 and that its non-zero coefficients are coprime.
   # (We could just work with the primitive part p/p.content() but we want to be
   # aware if factor() does not return a primitive part in future sage versions.)
   assert p.content() == 1
diff --git a/secp256k1-sys/depend/secp256k1/sage/prove_group_implementations.sage b/secp256k1-sys/depend/secp256k1/sage/prove_group_implementations.sage
index ef7e6a015..1b9666423 100644
--- a/secp256k1-sys/depend/secp256k1/sage/prove_group_implementations.sage
+++ b/secp256k1-sys/depend/secp256k1/sage/prove_group_implementations.sage
@@ -5,8 +5,8 @@ import sys
 load("group_prover.sage")
 load("weierstrass_prover.sage")
 
-def formula_rustsecp256k1_v0_8_1_gej_double_var(a):
-  """libsecp256k1's rustsecp256k1_v0_8_1_gej_double_var, used by various addition functions"""
+def formula_rustsecp256k1_v0_9_0_gej_double_var(a):
+  """libsecp256k1's rustsecp256k1_v0_9_0_gej_double_var, used by various addition functions"""
   rz = a.Z * a.Y
   s = a.Y^2
   l = a.X^2
@@ -24,8 +24,8 @@ def formula_rustsecp256k1_v0_8_1_gej_double_var(a):
   ry = -ry
   return jacobianpoint(rx, ry, rz)
 
-def formula_rustsecp256k1_v0_8_1_gej_add_var(branch, a, b):
-  """libsecp256k1's rustsecp256k1_v0_8_1_gej_add_var"""
+def formula_rustsecp256k1_v0_9_0_gej_add_var(branch, a, b):
+  """libsecp256k1's rustsecp256k1_v0_9_0_gej_add_var"""
   if branch == 0:
     return (constraints(), constraints(nonzero={a.Infinity : 'a_infinite'}), b)
   if branch == 1:
@@ -43,7 +43,7 @@ def formula_rustsecp256k1_v0_8_1_gej_add_var(branch, a, b):
   i = -s2
   i = i + s1
   if branch == 2:
-    r = formula_rustsecp256k1_v0_8_1_gej_double_var(a)
+    r = formula_rustsecp256k1_v0_9_0_gej_double_var(a)
     return (constraints(), constraints(zero={h : 'h=0', i : 'i=0', a.Infinity : 'a_finite', b.Infinity : 'b_finite'}), r)
   if branch == 3:
     return (constraints(), constraints(zero={h : 'h=0', a.Infinity : 'a_finite', b.Infinity : 'b_finite'}, nonzero={i : 'i!=0'}), point_at_infinity())
@@ -63,8 +63,8 @@ def formula_rustsecp256k1_v0_8_1_gej_add_var(branch, a, b):
   ry = ry + h3
   return (constraints(), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite'}, nonzero={h : 'h!=0'}), jacobianpoint(rx, ry, rz))
 
-def formula_rustsecp256k1_v0_8_1_gej_add_ge_var(branch, a, b):
-  """libsecp256k1's rustsecp256k1_v0_8_1_gej_add_ge_var, which assume bz==1"""
+def formula_rustsecp256k1_v0_9_0_gej_add_ge_var(branch, a, b):
+  """libsecp256k1's rustsecp256k1_v0_9_0_gej_add_ge_var, which assume bz==1"""
   if branch == 0:
     return (constraints(zero={b.Z - 1 : 'b.z=1'}), constraints(nonzero={a.Infinity : 'a_infinite'}), b)
   if branch == 1:
@@ -80,7 +80,7 @@ def formula_rustsecp256k1_v0_8_1_gej_add_ge_var(branch, a, b):
   i = -s2
   i = i + s1
   if (branch == 2):
-    r = formula_rustsecp256k1_v0_8_1_gej_double_var(a)
+    r = formula_rustsecp256k1_v0_9_0_gej_double_var(a)
     return (constraints(zero={b.Z - 1 : 'b.z=1'}), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite', h : 'h=0', i : 'i=0'}), r)
   if (branch == 3):
     return (constraints(zero={b.Z - 1 : 'b.z=1'}), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite', h : 'h=0'}, nonzero={i : 'i!=0'}), point_at_infinity())
@@ -99,8 +99,8 @@ def formula_rustsecp256k1_v0_8_1_gej_add_ge_var(branch, a, b):
   ry = ry + h3
   return (constraints(zero={b.Z - 1 : 'b.z=1'}), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite'}, nonzero={h : 'h!=0'}), jacobianpoint(rx, ry, rz))
 
-def formula_rustsecp256k1_v0_8_1_gej_add_zinv_var(branch, a, b):
-  """libsecp256k1's rustsecp256k1_v0_8_1_gej_add_zinv_var"""
+def formula_rustsecp256k1_v0_9_0_gej_add_zinv_var(branch, a, b):
+  """libsecp256k1's rustsecp256k1_v0_9_0_gej_add_zinv_var"""
   bzinv = b.Z^(-1)
   if branch == 0:
     rinf = b.Infinity
@@ -124,7 +124,7 @@ def formula_rustsecp256k1_v0_8_1_gej_add_zinv_var(branch, a, b):
   i = -s2
   i = i + s1
   if branch == 2:
-    r = formula_rustsecp256k1_v0_8_1_gej_double_var(a)
+    r = formula_rustsecp256k1_v0_9_0_gej_double_var(a)
     return (constraints(), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite', h : 'h=0', i : 'i=0'}), r)
   if branch == 3:
     return (constraints(), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite', h : 'h=0'}, nonzero={i : 'i!=0'}), point_at_infinity())
@@ -143,12 +143,12 @@ def formula_rustsecp256k1_v0_8_1_gej_add_zinv_var(branch, a, b):
   ry = ry + h3
   return (constraints(), constraints(zero={a.Infinity : 'a_finite', b.Infinity : 'b_finite'}, nonzero={h : 'h!=0'}), jacobianpoint(rx, ry, rz))
 
-def formula_rustsecp256k1_v0_8_1_gej_add_ge(branch, a, b):
-  """libsecp256k1's rustsecp256k1_v0_8_1_gej_add_ge"""
+def formula_rustsecp256k1_v0_9_0_gej_add_ge(branch, a, b):
+  """libsecp256k1's rustsecp256k1_v0_9_0_gej_add_ge"""
   zeroes = {}
   nonzeroes = {}
   a_infinity = False
-  if (branch & 4) != 0:
+  if (branch & 2) != 0:
     nonzeroes.update({a.Infinity : 'a_infinite'})
     a_infinity = True
   else:
@@ -167,15 +167,11 @@ def formula_rustsecp256k1_v0_8_1_gej_add_ge(branch, a, b):
   m_alt = -u2
   tt = u1 * m_alt
   rr = rr + tt
-  degenerate = (branch & 3) == 3
-  if (branch & 1) != 0:
+  degenerate = (branch & 1) != 0
+  if degenerate:
     zeroes.update({m : 'm_zero'})
   else:
     nonzeroes.update({m : 'm_nonzero'})
-  if (branch & 2) != 0:
-    zeroes.update({rr : 'rr_zero'})
-  else:
-    nonzeroes.update({rr : 'rr_nonzero'})
   rr_alt = s1
   rr_alt = rr_alt * 2
   m_alt = m_alt + u1
@@ -190,13 +186,6 @@ def formula_rustsecp256k1_v0_8_1_gej_add_ge(branch, a, b):
     n = m
   t = rr_alt^2
   rz = a.Z * m_alt
-  infinity = False
-  if (branch & 8) != 0:
-    if not a_infinity:
-      infinity = True
-    zeroes.update({rz : 'r.z=0'})
-  else:
-    nonzeroes.update({rz : 'r.z!=0'})
   t = t + q
   rx = t
   t = t * 2
@@ -209,12 +198,15 @@ def formula_rustsecp256k1_v0_8_1_gej_add_ge(branch, a, b):
     rx = b.X
     ry = b.Y
     rz = 1
-  if infinity:
+  if (branch & 4) != 0:
+    zeroes.update({rz : 'r.z = 0'})
     return (constraints(zero={b.Z - 1 : 'b.z=1', b.Infinity : 'b_finite'}), constraints(zero=zeroes, nonzero=nonzeroes), point_at_infinity())
+  else:
+    nonzeroes.update({rz : 'r.z != 0'})
   return (constraints(zero={b.Z - 1 : 'b.z=1', b.Infinity : 'b_finite'}), constraints(zero=zeroes, nonzero=nonzeroes), jacobianpoint(rx, ry, rz))
 
-def formula_rustsecp256k1_v0_8_1_gej_add_ge_old(branch, a, b):
-  """libsecp256k1's old rustsecp256k1_v0_8_1_gej_add_ge, which fails when ay+by=0 but ax!=bx"""
+def formula_rustsecp256k1_v0_9_0_gej_add_ge_old(branch, a, b):
+  """libsecp256k1's old rustsecp256k1_v0_9_0_gej_add_ge, which fails when ay+by=0 but ax!=bx"""
   a_infinity = (branch & 1) != 0
   zero = {}
   nonzero = {}
@@ -277,17 +269,17 @@ def formula_rustsecp256k1_v0_8_1_gej_add_ge_old(branch, a, b):
 
 if __name__ == "__main__":
   success = True
-  success = success & check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_var", 0, 7, 5, formula_rustsecp256k1_v0_8_1_gej_add_var)
-  success = success & check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_ge_var", 0, 7, 5, formula_rustsecp256k1_v0_8_1_gej_add_ge_var)
-  success = success & check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_zinv_var", 0, 7, 5, formula_rustsecp256k1_v0_8_1_gej_add_zinv_var)
-  success = success & check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_ge", 0, 7, 16, formula_rustsecp256k1_v0_8_1_gej_add_ge)
-  success = success & (not check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_ge_old [should fail]", 0, 7, 4, formula_rustsecp256k1_v0_8_1_gej_add_ge_old))
+  success = success & check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_var", 0, 7, 5, formula_rustsecp256k1_v0_9_0_gej_add_var)
+  success = success & check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_ge_var", 0, 7, 5, formula_rustsecp256k1_v0_9_0_gej_add_ge_var)
+  success = success & check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_zinv_var", 0, 7, 5, formula_rustsecp256k1_v0_9_0_gej_add_zinv_var)
+  success = success & check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_ge", 0, 7, 8, formula_rustsecp256k1_v0_9_0_gej_add_ge)
+  success = success & (not check_symbolic_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_ge_old [should fail]", 0, 7, 4, formula_rustsecp256k1_v0_9_0_gej_add_ge_old))
 
   if len(sys.argv) >= 2 and sys.argv[1] == "--exhaustive":
-    success = success & check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_var", 0, 7, 5, formula_rustsecp256k1_v0_8_1_gej_add_var, 43)
-    success = success & check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_ge_var", 0, 7, 5, formula_rustsecp256k1_v0_8_1_gej_add_ge_var, 43)
-    success = success & check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_zinv_var", 0, 7, 5, formula_rustsecp256k1_v0_8_1_gej_add_zinv_var, 43)
-    success = success & check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_ge", 0, 7, 16, formula_rustsecp256k1_v0_8_1_gej_add_ge, 43)
-    success = success & (not check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_8_1_gej_add_ge_old [should fail]", 0, 7, 4, formula_rustsecp256k1_v0_8_1_gej_add_ge_old, 43))
+    success = success & check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_var", 0, 7, 5, formula_rustsecp256k1_v0_9_0_gej_add_var, 43)
+    success = success & check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_ge_var", 0, 7, 5, formula_rustsecp256k1_v0_9_0_gej_add_ge_var, 43)
+    success = success & check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_zinv_var", 0, 7, 5, formula_rustsecp256k1_v0_9_0_gej_add_zinv_var, 43)
+    success = success & check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_ge", 0, 7, 8, formula_rustsecp256k1_v0_9_0_gej_add_ge, 43)
+    success = success & (not check_exhaustive_jacobian_weierstrass("rustsecp256k1_v0_9_0_gej_add_ge_old [should fail]", 0, 7, 4, formula_rustsecp256k1_v0_9_0_gej_add_ge_old, 43))
 
   sys.exit(int(not success))
diff --git a/secp256k1-sys/depend/secp256k1/src/CMakeLists.txt b/secp256k1-sys/depend/secp256k1/src/CMakeLists.txt
new file mode 100644
index 000000000..f09dc7309
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/CMakeLists.txt
@@ -0,0 +1,165 @@
+# Must be included before CMAKE_INSTALL_INCLUDEDIR is used.
+include(GNUInstallDirs)
+
+add_library(rustsecp256k1_v0_9_0_precomputed OBJECT EXCLUDE_FROM_ALL
+  precomputed_ecmult.c
+  precomputed_ecmult_gen.c
+)
+
+# Add objects explicitly rather than linking to the object libs to keep them
+# from being exported.
+add_library(secp256k1 secp256k1.c $<TARGET_OBJECTS:rustsecp256k1_v0_9_0_precomputed>)
+
+add_library(rustsecp256k1_v0_9_0_asm INTERFACE)
+if(SECP256K1_ASM STREQUAL "arm32")
+  add_library(rustsecp256k1_v0_9_0_asm_arm OBJECT EXCLUDE_FROM_ALL)
+  target_sources(rustsecp256k1_v0_9_0_asm_arm PUBLIC
+    asm/field_10x26_arm.s
+  )
+  target_sources(secp256k1 PRIVATE $<TARGET_OBJECTS:rustsecp256k1_v0_9_0_asm_arm>)
+  target_link_libraries(rustsecp256k1_v0_9_0_asm INTERFACE rustsecp256k1_v0_9_0_asm_arm)
+endif()
+
+if(WIN32)
+  # Define our export symbol only for shared libs.
+  set_target_properties(secp256k1 PROPERTIES DEFINE_SYMBOL SECP256K1_DLL_EXPORT)
+  target_compile_definitions(secp256k1 INTERFACE $<$<NOT:$<BOOL:${BUILD_SHARED_LIBS}>>:SECP256K1_STATIC>)
+endif()
+
+# Object libs don't know if they're being built for a shared or static lib.
+# Grab the PIC property from secp256k1 which knows.
+get_target_property(use_pic secp256k1 POSITION_INDEPENDENT_CODE)
+set_target_properties(rustsecp256k1_v0_9_0_precomputed PROPERTIES POSITION_INDEPENDENT_CODE ${use_pic})
+
+target_include_directories(secp256k1 INTERFACE
+  # Add the include path for parent projects so that they don't have to manually add it.
+  $<BUILD_INTERFACE:$<$<NOT:$<BOOL:${PROJECT_IS_TOP_LEVEL}>>:${PROJECT_SOURCE_DIR}/include>>
+  $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
+)
+
+# This emulates Libtool to make sure Libtool and CMake agree on the ABI version,
+# see below "Calculate the version variables" in build-aux/ltmain.sh.
+math(EXPR ${PROJECT_NAME}_soversion "${${PROJECT_NAME}_LIB_VERSION_CURRENT} - ${${PROJECT_NAME}_LIB_VERSION_AGE}")
+set_target_properties(secp256k1 PROPERTIES
+  SOVERSION ${${PROJECT_NAME}_soversion}
+)
+if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  set_target_properties(secp256k1 PROPERTIES
+    VERSION ${${PROJECT_NAME}_soversion}.${${PROJECT_NAME}_LIB_VERSION_AGE}.${${PROJECT_NAME}_LIB_VERSION_REVISION}
+  )
+elseif(APPLE)
+  if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.17)
+    math(EXPR ${PROJECT_NAME}_compatibility_version "${${PROJECT_NAME}_LIB_VERSION_CURRENT} + 1")
+    set_target_properties(secp256k1 PROPERTIES
+      MACHO_COMPATIBILITY_VERSION ${${PROJECT_NAME}_compatibility_version}
+      MACHO_CURRENT_VERSION ${${PROJECT_NAME}_compatibility_version}.${${PROJECT_NAME}_LIB_VERSION_REVISION}
+    )
+    unset(${PROJECT_NAME}_compatibility_version)
+  elseif(BUILD_SHARED_LIBS)
+    message(WARNING
+      "The 'compatibility version' and 'current version' values of the DYLIB "
+      "will diverge from the values set by the GNU Libtool. To ensure "
+      "compatibility, it is recommended to upgrade CMake to at least version 3.17."
+    )
+  endif()
+elseif(CMAKE_SYSTEM_NAME STREQUAL "Windows")
+  set(${PROJECT_NAME}_windows "secp256k1")
+  if(MSVC)
+    set(${PROJECT_NAME}_windows "${PROJECT_NAME}")
+  endif()
+  set_target_properties(secp256k1 PROPERTIES
+    ARCHIVE_OUTPUT_NAME "${${PROJECT_NAME}_windows}"
+    RUNTIME_OUTPUT_NAME "${${PROJECT_NAME}_windows}-${${PROJECT_NAME}_soversion}"
+  )
+  unset(${PROJECT_NAME}_windows)
+endif()
+unset(${PROJECT_NAME}_soversion)
+
+if(SECP256K1_BUILD_BENCHMARK)
+  add_executable(bench bench.c)
+  target_link_libraries(bench secp256k1)
+  add_executable(bench_internal bench_internal.c)
+  target_link_libraries(bench_internal rustsecp256k1_v0_9_0_precomputed rustsecp256k1_v0_9_0_asm)
+  add_executable(bench_ecmult bench_ecmult.c)
+  target_link_libraries(bench_ecmult rustsecp256k1_v0_9_0_precomputed rustsecp256k1_v0_9_0_asm)
+endif()
+
+if(SECP256K1_BUILD_TESTS)
+  add_executable(noverify_tests tests.c)
+  target_link_libraries(noverify_tests rustsecp256k1_v0_9_0_precomputed rustsecp256k1_v0_9_0_asm)
+  add_test(NAME noverify_tests COMMAND noverify_tests)
+  if(NOT CMAKE_BUILD_TYPE STREQUAL "Coverage")
+    add_executable(tests tests.c)
+    target_compile_definitions(tests PRIVATE VERIFY)
+    target_link_libraries(tests rustsecp256k1_v0_9_0_precomputed rustsecp256k1_v0_9_0_asm)
+    add_test(NAME tests COMMAND tests)
+  endif()
+endif()
+
+if(SECP256K1_BUILD_EXHAUSTIVE_TESTS)
+  # Note: do not include rustsecp256k1_v0_9_0_precomputed in exhaustive_tests (it uses runtime-generated tables).
+  add_executable(exhaustive_tests tests_exhaustive.c)
+  target_link_libraries(exhaustive_tests rustsecp256k1_v0_9_0_asm)
+  target_compile_definitions(exhaustive_tests PRIVATE $<$<NOT:$<CONFIG:Coverage>>:VERIFY>)
+  add_test(NAME exhaustive_tests COMMAND exhaustive_tests)
+endif()
+
+if(SECP256K1_BUILD_CTIME_TESTS)
+  add_executable(ctime_tests ctime_tests.c)
+  target_link_libraries(ctime_tests secp256k1)
+endif()
+
+if(SECP256K1_INSTALL)
+  install(TARGETS secp256k1
+    EXPORT ${PROJECT_NAME}-targets
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+    LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+    ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+  )
+  set(${PROJECT_NAME}_headers
+    "${PROJECT_SOURCE_DIR}/include/secp256k1.h"
+    "${PROJECT_SOURCE_DIR}/include/rustsecp256k1_v0_9_0_preallocated.h"
+  )
+  if(SECP256K1_ENABLE_MODULE_ECDH)
+    list(APPEND ${PROJECT_NAME}_headers "${PROJECT_SOURCE_DIR}/include/rustsecp256k1_v0_9_0_ecdh.h")
+  endif()
+  if(SECP256K1_ENABLE_MODULE_RECOVERY)
+    list(APPEND ${PROJECT_NAME}_headers "${PROJECT_SOURCE_DIR}/include/rustsecp256k1_v0_9_0_recovery.h")
+  endif()
+  if(SECP256K1_ENABLE_MODULE_EXTRAKEYS)
+    list(APPEND ${PROJECT_NAME}_headers "${PROJECT_SOURCE_DIR}/include/rustsecp256k1_v0_9_0_extrakeys.h")
+  endif()
+  if(SECP256K1_ENABLE_MODULE_SCHNORRSIG)
+    list(APPEND ${PROJECT_NAME}_headers "${PROJECT_SOURCE_DIR}/include/rustsecp256k1_v0_9_0_schnorrsig.h")
+  endif()
+  if(SECP256K1_ENABLE_MODULE_ELLSWIFT)
+    list(APPEND ${PROJECT_NAME}_headers "${PROJECT_SOURCE_DIR}/include/rustsecp256k1_v0_9_0_ellswift.h")
+  endif()
+  install(FILES ${${PROJECT_NAME}_headers}
+    DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
+  )
+
+  install(EXPORT ${PROJECT_NAME}-targets
+    FILE ${PROJECT_NAME}-targets.cmake
+    NAMESPACE ${PROJECT_NAME}::
+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}
+  )
+
+  include(CMakePackageConfigHelpers)
+  configure_package_config_file(
+    ${PROJECT_SOURCE_DIR}/cmake/config.cmake.in
+    ${PROJECT_NAME}-config.cmake
+    INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}
+    NO_SET_AND_CHECK_MACRO
+  )
+  write_basic_package_version_file(${PROJECT_NAME}-config-version.cmake
+    COMPATIBILITY SameMinorVersion
+  )
+
+  install(
+    FILES
+      ${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}-config.cmake
+      ${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}-config-version.cmake
+    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}
+)
+endif()
diff --git a/secp256k1-sys/depend/secp256k1/src/asm/field_10x26_arm.s b/secp256k1-sys/depend/secp256k1/src/asm/field_10x26_arm.s
index 67efc3bb4..15069556f 100644
--- a/secp256k1-sys/depend/secp256k1/src/asm/field_10x26_arm.s
+++ b/secp256k1-sys/depend/secp256k1/src/asm/field_10x26_arm.s
@@ -27,8 +27,9 @@ Note:
 	.set field_not_M, 0xfc000000	@ ~M = ~0x3ffffff
 
 	.align	2
-	.global rustsecp256k1_v0_8_1_fe_mul_inner
-	.type	rustsecp256k1_v0_8_1_fe_mul_inner, %function
+	.global rustsecp256k1_v0_9_0_fe_mul_inner
+	.type	rustsecp256k1_v0_9_0_fe_mul_inner, %function
+	.hidden rustsecp256k1_v0_9_0_fe_mul_inner
 	@ Arguments:
 	@  r0  r      Restrict: can overlap with a, not with b
 	@  r1  a
@@ -36,7 +37,7 @@ Note:
 	@ Stack (total 4+10*4 = 44)
 	@  sp + #0        saved 'r' pointer
 	@  sp + #4 + 4*X  t0,t1,t2,t3,t4,t5,t6,t7,u8,t9
-rustsecp256k1_v0_8_1_fe_mul_inner:
+rustsecp256k1_v0_9_0_fe_mul_inner:
 	stmfd	sp!, {r4, r5, r6, r7, r8, r9, r10, r11, r14}
 	sub	sp, sp, #48			@ frame=44 + alignment
 	str     r0, [sp, #0]			@ save result address, we need it only at the end
@@ -511,18 +512,19 @@ rustsecp256k1_v0_8_1_fe_mul_inner:
 
 	add	sp, sp, #48
 	ldmfd	sp!, {r4, r5, r6, r7, r8, r9, r10, r11, pc}
-	.size	rustsecp256k1_v0_8_1_fe_mul_inner, .-rustsecp256k1_v0_8_1_fe_mul_inner
+	.size	rustsecp256k1_v0_9_0_fe_mul_inner, .-rustsecp256k1_v0_9_0_fe_mul_inner
 
 	.align	2
-	.global rustsecp256k1_v0_8_1_fe_sqr_inner
-	.type	rustsecp256k1_v0_8_1_fe_sqr_inner, %function
+	.global rustsecp256k1_v0_9_0_fe_sqr_inner
+	.type	rustsecp256k1_v0_9_0_fe_sqr_inner, %function
+	.hidden rustsecp256k1_v0_9_0_fe_sqr_inner
 	@ Arguments:
 	@  r0  r	 Can overlap with a
 	@  r1  a
 	@ Stack (total 4+10*4 = 44)
 	@  sp + #0        saved 'r' pointer
 	@  sp + #4 + 4*X  t0,t1,t2,t3,t4,t5,t6,t7,u8,t9
-rustsecp256k1_v0_8_1_fe_sqr_inner:
+rustsecp256k1_v0_9_0_fe_sqr_inner:
 	stmfd	sp!, {r4, r5, r6, r7, r8, r9, r10, r11, r14}
 	sub	sp, sp, #48			@ frame=44 + alignment
 	str     r0, [sp, #0]			@ save result address, we need it only at the end
@@ -909,5 +911,5 @@ rustsecp256k1_v0_8_1_fe_sqr_inner:
 
 	add	sp, sp, #48
 	ldmfd	sp!, {r4, r5, r6, r7, r8, r9, r10, r11, pc}
-	.size	rustsecp256k1_v0_8_1_fe_sqr_inner, .-rustsecp256k1_v0_8_1_fe_sqr_inner
+	.size	rustsecp256k1_v0_9_0_fe_sqr_inner, .-rustsecp256k1_v0_9_0_fe_sqr_inner
 
diff --git a/secp256k1-sys/depend/secp256k1/src/assumptions.h b/secp256k1-sys/depend/secp256k1/src/assumptions.h
index 375a47abb..bbeef9913 100644
--- a/secp256k1-sys/depend/secp256k1/src/assumptions.h
+++ b/secp256k1-sys/depend/secp256k1/src/assumptions.h
@@ -19,7 +19,7 @@
    reduce the odds of experiencing an unwelcome surprise.
 */
 
-struct rustsecp256k1_v0_8_1_assumption_checker {
+struct rustsecp256k1_v0_9_0_assumption_checker {
     /* This uses a trick to implement a static assertion in C89: a type with an array of negative size is not
        allowed. */
     int dummy_array[(
diff --git a/secp256k1-sys/depend/secp256k1/src/bench.c b/secp256k1-sys/depend/secp256k1/src/bench.c
index afe477da7..bf3f76d41 100644
--- a/secp256k1-sys/depend/secp256k1/src/bench.c
+++ b/secp256k1-sys/depend/secp256k1/src/bench.c
@@ -11,7 +11,7 @@
 #include "util.h"
 #include "bench.h"
 
-void help(int default_iters) {
+static void help(int default_iters) {
     printf("Benchmarks the following algorithms:\n");
     printf("    - ECDSA signing/verification\n");
 
@@ -38,6 +38,8 @@ void help(int default_iters) {
     printf("    ecdsa             : all ECDSA algorithms--sign, verify, recovery (if enabled)\n");
     printf("    ecdsa_sign        : ECDSA siging algorithm\n");
     printf("    ecdsa_verify      : ECDSA verification algorithm\n");
+    printf("    ec                : all EC public key algorithms (keygen)\n");
+    printf("    ec_keygen         : EC public key generation\n");
 
 #ifdef ENABLE_MODULE_RECOVERY
     printf("    ecdsa_recover     : ECDSA public key recovery algorithm\n");
@@ -53,47 +55,49 @@ void help(int default_iters) {
     printf("    schnorrsig_verify : Schnorr verification algorithm\n");
 #endif
 
+#ifdef ENABLE_MODULE_ELLSWIFT
+    printf("    ellswift          : all ElligatorSwift benchmarks (encode, decode, keygen, ecdh)\n");
+    printf("    ellswift_encode   : ElligatorSwift encoding\n");
+    printf("    ellswift_decode   : ElligatorSwift decoding\n");
+    printf("    ellswift_keygen   : ElligatorSwift key generation\n");
+    printf("    ellswift_ecdh     : ECDH on ElligatorSwift keys\n");
+#endif
+
     printf("\n");
 }
 
 typedef struct {
-    rustsecp256k1_v0_8_1_context *ctx;
+    rustsecp256k1_v0_9_0_context *ctx;
     unsigned char msg[32];
     unsigned char key[32];
     unsigned char sig[72];
     size_t siglen;
     unsigned char pubkey[33];
     size_t pubkeylen;
-} bench_verify_data;
+} bench_data;
 
 static void bench_verify(void* arg, int iters) {
     int i;
-    bench_verify_data* data = (bench_verify_data*)arg;
+    bench_data* data = (bench_data*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_pubkey pubkey;
-        rustsecp256k1_v0_8_1_ecdsa_signature sig;
+        rustsecp256k1_v0_9_0_pubkey pubkey;
+        rustsecp256k1_v0_9_0_ecdsa_signature sig;
         data->sig[data->siglen - 1] ^= (i & 0xFF);
         data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
         data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(data->ctx, &pubkey, data->pubkey, data->pubkeylen) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(data->ctx, &sig, data->sig, data->siglen) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(data->ctx, &sig, data->msg, &pubkey) == (i == 0));
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(data->ctx, &pubkey, data->pubkey, data->pubkeylen) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(data->ctx, &sig, data->sig, data->siglen) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(data->ctx, &sig, data->msg, &pubkey) == (i == 0));
         data->sig[data->siglen - 1] ^= (i & 0xFF);
         data->sig[data->siglen - 2] ^= ((i >> 8) & 0xFF);
         data->sig[data->siglen - 3] ^= ((i >> 16) & 0xFF);
     }
 }
 
-typedef struct {
-    rustsecp256k1_v0_8_1_context* ctx;
-    unsigned char msg[32];
-    unsigned char key[32];
-} bench_sign_data;
-
 static void bench_sign_setup(void* arg) {
     int i;
-    bench_sign_data *data = (bench_sign_data*)arg;
+    bench_data *data = (bench_data*)arg;
 
     for (i = 0; i < 32; i++) {
         data->msg[i] = i + 1;
@@ -105,15 +109,15 @@ static void bench_sign_setup(void* arg) {
 
 static void bench_sign_run(void* arg, int iters) {
     int i;
-    bench_sign_data *data = (bench_sign_data*)arg;
+    bench_data *data = (bench_data*)arg;
 
     unsigned char sig[74];
     for (i = 0; i < iters; i++) {
         size_t siglen = 74;
         int j;
-        rustsecp256k1_v0_8_1_ecdsa_signature signature;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(data->ctx, &signature, data->msg, data->key, NULL, NULL));
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(data->ctx, sig, &siglen, &signature));
+        rustsecp256k1_v0_9_0_ecdsa_signature signature;
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(data->ctx, &signature, data->msg, data->key, NULL, NULL));
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(data->ctx, sig, &siglen, &signature));
         for (j = 0; j < 32; j++) {
             data->msg[j] = sig[j];
             data->key[j] = sig[j + 32];
@@ -121,6 +125,30 @@ static void bench_sign_run(void* arg, int iters) {
     }
 }
 
+static void bench_keygen_setup(void* arg) {
+    int i;
+    bench_data *data = (bench_data*)arg;
+
+    for (i = 0; i < 32; i++) {
+        data->key[i] = i + 65;
+    }
+}
+
+static void bench_keygen_run(void *arg, int iters) {
+    int i;
+    bench_data *data = (bench_data*)arg;
+
+    for (i = 0; i < iters; i++) {
+        unsigned char pub33[33];
+        size_t len = 33;
+        rustsecp256k1_v0_9_0_pubkey pubkey;
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(data->ctx, &pubkey, data->key));
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(data->ctx, pub33, &len, &pubkey, SECP256K1_EC_COMPRESSED));
+        memcpy(data->key, pub33 + 1, 32);
+    }
+}
+
+
 #ifdef ENABLE_MODULE_ECDH
 # include "modules/ecdh/bench_impl.h"
 #endif
@@ -133,11 +161,15 @@ static void bench_sign_run(void* arg, int iters) {
 # include "modules/schnorrsig/bench_impl.h"
 #endif
 
+#ifdef ENABLE_MODULE_ELLSWIFT
+# include "modules/ellswift/bench_impl.h"
+#endif
+
 int main(int argc, char** argv) {
     int i;
-    rustsecp256k1_v0_8_1_pubkey pubkey;
-    rustsecp256k1_v0_8_1_ecdsa_signature sig;
-    bench_verify_data data;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
+    rustsecp256k1_v0_9_0_ecdsa_signature sig;
+    bench_data data;
 
     int d = argc == 1;
     int default_iters = 20000;
@@ -145,7 +177,9 @@ int main(int argc, char** argv) {
 
     /* Check for invalid user arguments */
     char* valid_args[] = {"ecdsa", "verify", "ecdsa_verify", "sign", "ecdsa_sign", "ecdh", "recover",
-                         "ecdsa_recover", "schnorrsig", "schnorrsig_verify", "schnorrsig_sign"};
+                         "ecdsa_recover", "schnorrsig", "schnorrsig_verify", "schnorrsig_sign", "ec",
+                         "keygen", "ec_keygen", "ellswift", "encode", "ellswift_encode", "decode",
+                         "ellswift_decode", "ellswift_keygen", "ellswift_ecdh"};
     size_t valid_args_size = sizeof(valid_args)/sizeof(valid_args[0]);
     int invalid_args = have_invalid_args(argc, argv, valid_args, valid_args_size);
 
@@ -187,8 +221,18 @@ int main(int argc, char** argv) {
     }
 #endif
 
+#ifndef ENABLE_MODULE_ELLSWIFT
+    if (have_flag(argc, argv, "ellswift") || have_flag(argc, argv, "ellswift_encode") || have_flag(argc, argv, "ellswift_decode") ||
+        have_flag(argc, argv, "encode") || have_flag(argc, argv, "decode") || have_flag(argc, argv, "ellswift_keygen") ||
+        have_flag(argc, argv, "ellswift_ecdh")) {
+        fprintf(stderr, "./bench: ElligatorSwift module not enabled.\n");
+        fprintf(stderr, "Use ./configure --enable-module-ellswift.\n\n");
+        return 1;
+    }
+#endif
+
     /* ECDSA benchmark */
-    data.ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
+    data.ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
 
     for (i = 0; i < 32; i++) {
         data.msg[i] = 1 + i;
@@ -197,18 +241,19 @@ int main(int argc, char** argv) {
         data.key[i] = 33 + i;
     }
     data.siglen = 72;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(data.ctx, &sig, data.msg, data.key, NULL, NULL));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(data.ctx, data.sig, &data.siglen, &sig));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(data.ctx, &pubkey, data.key));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(data.ctx, &sig, data.msg, data.key, NULL, NULL));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(data.ctx, data.sig, &data.siglen, &sig));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(data.ctx, &pubkey, data.key));
     data.pubkeylen = 33;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(data.ctx, data.pubkey, &data.pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(data.ctx, data.pubkey, &data.pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
 
     print_output_table_header_row();
     if (d || have_flag(argc, argv, "ecdsa") || have_flag(argc, argv, "verify") || have_flag(argc, argv, "ecdsa_verify")) run_benchmark("ecdsa_verify", bench_verify, NULL, NULL, &data, 10, iters);
 
     if (d || have_flag(argc, argv, "ecdsa") || have_flag(argc, argv, "sign") || have_flag(argc, argv, "ecdsa_sign")) run_benchmark("ecdsa_sign", bench_sign_run, bench_sign_setup, NULL, &data, 10, iters);
+    if (d || have_flag(argc, argv, "ec") || have_flag(argc, argv, "keygen") || have_flag(argc, argv, "ec_keygen")) run_benchmark("ec_keygen", bench_keygen_run, bench_keygen_setup, NULL, &data, 10, iters);
 
-    rustsecp256k1_v0_8_1_context_destroy(data.ctx);
+    rustsecp256k1_v0_9_0_context_destroy(data.ctx);
 
 #ifdef ENABLE_MODULE_ECDH
     /* ECDH benchmarks */
@@ -225,5 +270,10 @@ int main(int argc, char** argv) {
     run_schnorrsig_bench(iters, argc, argv);
 #endif
 
+#ifdef ENABLE_MODULE_ELLSWIFT
+    /* ElligatorSwift benchmarks */
+    run_ellswift_bench(iters, argc, argv);
+#endif
+
     return 0;
 }
diff --git a/secp256k1-sys/depend/secp256k1/src/bench.h b/secp256k1-sys/depend/secp256k1/src/bench.h
index 611ba11f0..1564b1a17 100644
--- a/secp256k1-sys/depend/secp256k1/src/bench.h
+++ b/secp256k1-sys/depend/secp256k1/src/bench.h
@@ -15,7 +15,7 @@
 #if (defined(_MSC_VER) && _MSC_VER >= 1900)
 #  include <time.h>
 #else
-#  include "sys/time.h"
+#  include <sys/time.h>
 #endif
 
 static int64_t gettime_i64(void) {
@@ -38,7 +38,7 @@ static int64_t gettime_i64(void) {
 #define FP_MULT (1000000LL)
 
 /* Format fixed point number. */
-void print_number(const int64_t x) {
+static void print_number(const int64_t x) {
     int64_t x_abs, y;
     int c, i, rounding, g; /* g = integer part size, c = fractional part size */
     size_t ptr;
@@ -95,7 +95,7 @@ void print_number(const int64_t x) {
     printf("%-*s", FP_EXP, &buffer[ptr + g]); /* Prints fractional part */
 }
 
-void run_benchmark(char *name, void (*benchmark)(void*, int), void (*setup)(void*), void (*teardown)(void*, int), void* data, int count, int iter) {
+static void run_benchmark(char *name, void (*benchmark)(void*, int), void (*setup)(void*), void (*teardown)(void*, int), void* data, int count, int iter) {
     int i;
     int64_t min = INT64_MAX;
     int64_t sum = 0;
@@ -129,7 +129,7 @@ void run_benchmark(char *name, void (*benchmark)(void*, int), void (*setup)(void
     printf("\n");
 }
 
-int have_flag(int argc, char** argv, char *flag) {
+static int have_flag(int argc, char** argv, char *flag) {
     char** argm = argv + argc;
     argv++;
     while (argv != argm) {
@@ -145,7 +145,7 @@ int have_flag(int argc, char** argv, char *flag) {
    returns:
       - 1 if the user entered an invalid argument
       - 0 if all the user entered arguments are valid */
-int have_invalid_args(int argc, char** argv, char** valid_args, size_t n) {
+static int have_invalid_args(int argc, char** argv, char** valid_args, size_t n) {
     size_t i;
     int found_valid;
     char** argm = argv + argc;
@@ -167,7 +167,7 @@ int have_invalid_args(int argc, char** argv, char** valid_args, size_t n) {
     return 0;
 }
 
-int get_iters(int default_iters) {
+static int get_iters(int default_iters) {
     char* env = getenv("SECP256K1_BENCH_ITERS");
     if (env) {
         return strtol(env, NULL, 0);
@@ -176,7 +176,7 @@ int get_iters(int default_iters) {
     }
 }
 
-void print_output_table_header_row(void) {
+static void print_output_table_header_row(void) {
     char* bench_str = "Benchmark";     /* left justified */
     char* min_str = "    Min(us)    "; /* center alignment */
     char* avg_str = "    Avg(us)    ";
diff --git a/secp256k1-sys/depend/secp256k1/src/bench_ecmult.c b/secp256k1-sys/depend/secp256k1/src/bench_ecmult.c
index d85bc5b4e..ec2358ed5 100644
--- a/secp256k1-sys/depend/secp256k1/src/bench_ecmult.c
+++ b/secp256k1-sys/depend/secp256k1/src/bench_ecmult.c
@@ -18,7 +18,7 @@
 
 #define POINTS 32768
 
-void help(char **argv) {
+static void help(char **argv) {
     printf("Benchmark EC multiplication algorithms\n");
     printf("\n");
     printf("Usage: %s <help|pippenger_wnaf|strauss_wnaf|simple>\n", argv[0]);
@@ -35,14 +35,14 @@ void help(char **argv) {
 
 typedef struct {
     /* Setup once in advance */
-    rustsecp256k1_v0_8_1_context* ctx;
-    rustsecp256k1_v0_8_1_scratch_space* scratch;
-    rustsecp256k1_v0_8_1_scalar* scalars;
-    rustsecp256k1_v0_8_1_ge* pubkeys;
-    rustsecp256k1_v0_8_1_gej* pubkeys_gej;
-    rustsecp256k1_v0_8_1_scalar* seckeys;
-    rustsecp256k1_v0_8_1_gej* expected_output;
-    rustsecp256k1_v0_8_1_ecmult_multi_func ecmult_multi;
+    rustsecp256k1_v0_9_0_context* ctx;
+    rustsecp256k1_v0_9_0_scratch_space* scratch;
+    rustsecp256k1_v0_9_0_scalar* scalars;
+    rustsecp256k1_v0_9_0_ge* pubkeys;
+    rustsecp256k1_v0_9_0_gej* pubkeys_gej;
+    rustsecp256k1_v0_9_0_scalar* seckeys;
+    rustsecp256k1_v0_9_0_gej* expected_output;
+    rustsecp256k1_v0_9_0_ecmult_multi_func ecmult_multi;
 
     /* Changes per benchmark */
     size_t count;
@@ -54,7 +54,7 @@ typedef struct {
     size_t offset2;
 
     /* Benchmark output. */
-    rustsecp256k1_v0_8_1_gej* output;
+    rustsecp256k1_v0_9_0_gej* output;
 } bench_data;
 
 /* Hashes x into [0, POINTS) twice and store the result in offset1 and offset2. */
@@ -67,24 +67,24 @@ static void hash_into_offset(bench_data* data, size_t x) {
  * sum(outputs) ?= (sum(scalars_gen) + sum(seckeys)*sum(scalars))*G */
 static void bench_ecmult_teardown_helper(bench_data* data, size_t* seckey_offset, size_t* scalar_offset, size_t* scalar_gen_offset, int iters) {
     int i;
-    rustsecp256k1_v0_8_1_gej sum_output, tmp;
-    rustsecp256k1_v0_8_1_scalar sum_scalars;
+    rustsecp256k1_v0_9_0_gej sum_output, tmp;
+    rustsecp256k1_v0_9_0_scalar sum_scalars;
 
-    rustsecp256k1_v0_8_1_gej_set_infinity(&sum_output);
-    rustsecp256k1_v0_8_1_scalar_clear(&sum_scalars);
+    rustsecp256k1_v0_9_0_gej_set_infinity(&sum_output);
+    rustsecp256k1_v0_9_0_scalar_clear(&sum_scalars);
     for (i = 0; i < iters; ++i) {
-        rustsecp256k1_v0_8_1_gej_add_var(&sum_output, &sum_output, &data->output[i], NULL);
+        rustsecp256k1_v0_9_0_gej_add_var(&sum_output, &sum_output, &data->output[i], NULL);
         if (scalar_gen_offset != NULL) {
-            rustsecp256k1_v0_8_1_scalar_add(&sum_scalars, &sum_scalars, &data->scalars[(*scalar_gen_offset+i) % POINTS]);
+            rustsecp256k1_v0_9_0_scalar_add(&sum_scalars, &sum_scalars, &data->scalars[(*scalar_gen_offset+i) % POINTS]);
         }
         if (seckey_offset != NULL) {
-            rustsecp256k1_v0_8_1_scalar s = data->seckeys[(*seckey_offset+i) % POINTS];
-            rustsecp256k1_v0_8_1_scalar_mul(&s, &s, &data->scalars[(*scalar_offset+i) % POINTS]);
-            rustsecp256k1_v0_8_1_scalar_add(&sum_scalars, &sum_scalars, &s);
+            rustsecp256k1_v0_9_0_scalar s = data->seckeys[(*seckey_offset+i) % POINTS];
+            rustsecp256k1_v0_9_0_scalar_mul(&s, &s, &data->scalars[(*scalar_offset+i) % POINTS]);
+            rustsecp256k1_v0_9_0_scalar_add(&sum_scalars, &sum_scalars, &s);
         }
     }
-    rustsecp256k1_v0_8_1_ecmult_gen(&data->ctx->ecmult_gen_ctx, &tmp, &sum_scalars);
-    CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&tmp, &sum_output));
+    rustsecp256k1_v0_9_0_ecmult_gen(&data->ctx->ecmult_gen_ctx, &tmp, &sum_scalars);
+    CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&tmp, &sum_output));
 }
 
 static void bench_ecmult_setup(void* arg) {
@@ -99,7 +99,7 @@ static void bench_ecmult_gen(void* arg, int iters) {
     int i;
 
     for (i = 0; i < iters; ++i) {
-        rustsecp256k1_v0_8_1_ecmult_gen(&data->ctx->ecmult_gen_ctx, &data->output[i], &data->scalars[(data->offset1+i) % POINTS]);
+        rustsecp256k1_v0_9_0_ecmult_gen(&data->ctx->ecmult_gen_ctx, &data->output[i], &data->scalars[(data->offset1+i) % POINTS]);
     }
 }
 
@@ -113,7 +113,7 @@ static void bench_ecmult_const(void* arg, int iters) {
     int i;
 
     for (i = 0; i < iters; ++i) {
-        rustsecp256k1_v0_8_1_ecmult_const(&data->output[i], &data->pubkeys[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], 256);
+        rustsecp256k1_v0_9_0_ecmult_const(&data->output[i], &data->pubkeys[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS]);
     }
 }
 
@@ -127,7 +127,7 @@ static void bench_ecmult_1p(void* arg, int iters) {
     int i;
 
     for (i = 0; i < iters; ++i) {
-        rustsecp256k1_v0_8_1_ecmult(&data->output[i], &data->pubkeys_gej[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], NULL);
+        rustsecp256k1_v0_9_0_ecmult(&data->output[i], &data->pubkeys_gej[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], NULL);
     }
 }
 
@@ -138,12 +138,10 @@ static void bench_ecmult_1p_teardown(void* arg, int iters) {
 
 static void bench_ecmult_0p_g(void* arg, int iters) {
     bench_data* data = (bench_data*)arg;
-    rustsecp256k1_v0_8_1_scalar zero;
     int i;
 
-    rustsecp256k1_v0_8_1_scalar_set_int(&zero, 0);
     for (i = 0; i < iters; ++i) {
-        rustsecp256k1_v0_8_1_ecmult(&data->output[i], NULL, &zero, &data->scalars[(data->offset1+i) % POINTS]);
+        rustsecp256k1_v0_9_0_ecmult(&data->output[i], NULL, &rustsecp256k1_v0_9_0_scalar_zero, &data->scalars[(data->offset1+i) % POINTS]);
     }
 }
 
@@ -157,7 +155,7 @@ static void bench_ecmult_1p_g(void* arg, int iters) {
     int i;
 
     for (i = 0; i < iters/2; ++i) {
-        rustsecp256k1_v0_8_1_ecmult(&data->output[i], &data->pubkeys_gej[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], &data->scalars[(data->offset1+i) % POINTS]);
+        rustsecp256k1_v0_9_0_ecmult(&data->output[i], &data->pubkeys_gej[(data->offset1+i) % POINTS], &data->scalars[(data->offset2+i) % POINTS], &data->scalars[(data->offset1+i) % POINTS]);
     }
 }
 
@@ -183,12 +181,12 @@ static void run_ecmult_bench(bench_data* data, int iters) {
     run_benchmark(str, bench_ecmult_1p_g, bench_ecmult_setup, bench_ecmult_1p_g_teardown, data, 10, 2*iters);
 }
 
-static int bench_ecmult_multi_callback(rustsecp256k1_v0_8_1_scalar* sc, rustsecp256k1_v0_8_1_ge* ge, size_t idx, void* arg) {
+static int bench_ecmult_multi_callback(rustsecp256k1_v0_9_0_scalar* sc, rustsecp256k1_v0_9_0_ge* ge, size_t idx, void* arg) {
     bench_data* data = (bench_data*)arg;
     if (data->includes_g) ++idx;
     if (idx == 0) {
         *sc = data->scalars[data->offset1];
-        *ge = rustsecp256k1_v0_8_1_ge_const_g;
+        *ge = rustsecp256k1_v0_9_0_ge_const_g;
     } else {
         *sc = data->scalars[(data->offset1 + idx) % POINTS];
         *ge = data->pubkeys[(data->offset2 + idx - 1) % POINTS];
@@ -222,14 +220,14 @@ static void bench_ecmult_multi_teardown(void* arg, int iters) {
     iters = iters / data->count;
     /* Verify the results in teardown, to avoid doing comparisons while benchmarking. */
     for (iter = 0; iter < iters; ++iter) {
-        rustsecp256k1_v0_8_1_gej tmp;
-        rustsecp256k1_v0_8_1_gej_add_var(&tmp, &data->output[iter], &data->expected_output[iter], NULL);
-        CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&tmp));
+        rustsecp256k1_v0_9_0_gej tmp;
+        rustsecp256k1_v0_9_0_gej_add_var(&tmp, &data->output[iter], &data->expected_output[iter], NULL);
+        CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&tmp));
     }
 }
 
-static void generate_scalar(uint32_t num, rustsecp256k1_v0_8_1_scalar* scalar) {
-    rustsecp256k1_v0_8_1_sha256 sha256;
+static void generate_scalar(uint32_t num, rustsecp256k1_v0_9_0_scalar* scalar) {
+    rustsecp256k1_v0_9_0_sha256 sha256;
     unsigned char c[10] = {'e', 'c', 'm', 'u', 'l', 't', 0, 0, 0, 0};
     unsigned char buf[32];
     int overflow = 0;
@@ -237,16 +235,15 @@ static void generate_scalar(uint32_t num, rustsecp256k1_v0_8_1_scalar* scalar) {
     c[7] = num >> 8;
     c[8] = num >> 16;
     c[9] = num >> 24;
-    rustsecp256k1_v0_8_1_sha256_initialize(&sha256);
-    rustsecp256k1_v0_8_1_sha256_write(&sha256, c, sizeof(c));
-    rustsecp256k1_v0_8_1_sha256_finalize(&sha256, buf);
-    rustsecp256k1_v0_8_1_scalar_set_b32(scalar, buf, &overflow);
+    rustsecp256k1_v0_9_0_sha256_initialize(&sha256);
+    rustsecp256k1_v0_9_0_sha256_write(&sha256, c, sizeof(c));
+    rustsecp256k1_v0_9_0_sha256_finalize(&sha256, buf);
+    rustsecp256k1_v0_9_0_scalar_set_b32(scalar, buf, &overflow);
     CHECK(!overflow);
 }
 
 static void run_ecmult_multi_bench(bench_data* data, size_t count, int includes_g, int num_iters) {
     char str[32];
-    static const rustsecp256k1_v0_8_1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
     size_t iters = 1 + num_iters / count;
     size_t iter;
 
@@ -256,15 +253,15 @@ static void run_ecmult_multi_bench(bench_data* data, size_t count, int includes_
     /* Compute (the negation of) the expected results directly. */
     hash_into_offset(data, data->count);
     for (iter = 0; iter < iters; ++iter) {
-        rustsecp256k1_v0_8_1_scalar tmp;
-        rustsecp256k1_v0_8_1_scalar total = data->scalars[(data->offset1++) % POINTS];
+        rustsecp256k1_v0_9_0_scalar tmp;
+        rustsecp256k1_v0_9_0_scalar total = data->scalars[(data->offset1++) % POINTS];
         size_t i = 0;
         for (i = 0; i + 1 < count; ++i) {
-            rustsecp256k1_v0_8_1_scalar_mul(&tmp, &data->seckeys[(data->offset2++) % POINTS], &data->scalars[(data->offset1++) % POINTS]);
-            rustsecp256k1_v0_8_1_scalar_add(&total, &total, &tmp);
+            rustsecp256k1_v0_9_0_scalar_mul(&tmp, &data->seckeys[(data->offset2++) % POINTS], &data->scalars[(data->offset1++) % POINTS]);
+            rustsecp256k1_v0_9_0_scalar_add(&total, &total, &tmp);
         }
-        rustsecp256k1_v0_8_1_scalar_negate(&total, &total);
-        rustsecp256k1_v0_8_1_ecmult(&data->expected_output[iter], NULL, &zero, &total);
+        rustsecp256k1_v0_9_0_scalar_negate(&total, &total);
+        rustsecp256k1_v0_9_0_ecmult(&data->expected_output[iter], NULL, &rustsecp256k1_v0_9_0_scalar_zero, &total);
     }
 
     /* Run the benchmark. */
@@ -283,7 +280,7 @@ int main(int argc, char **argv) {
 
     int iters = get_iters(10000);
 
-    data.ecmult_multi = rustsecp256k1_v0_8_1_ecmult_multi_var;
+    data.ecmult_multi = rustsecp256k1_v0_9_0_ecmult_multi_var;
 
     if (argc > 1) {
         if(have_flag(argc, argv, "-h")
@@ -293,10 +290,10 @@ int main(int argc, char **argv) {
             return 0;
         } else if(have_flag(argc, argv, "pippenger_wnaf")) {
             printf("Using pippenger_wnaf:\n");
-            data.ecmult_multi = rustsecp256k1_v0_8_1_ecmult_pippenger_batch_single;
+            data.ecmult_multi = rustsecp256k1_v0_9_0_ecmult_pippenger_batch_single;
         } else if(have_flag(argc, argv, "strauss_wnaf")) {
             printf("Using strauss_wnaf:\n");
-            data.ecmult_multi = rustsecp256k1_v0_8_1_ecmult_strauss_batch_single;
+            data.ecmult_multi = rustsecp256k1_v0_9_0_ecmult_strauss_batch_single;
         } else if(have_flag(argc, argv, "simple")) {
             printf("Using simple algorithm:\n");
         } else {
@@ -306,33 +303,33 @@ int main(int argc, char **argv) {
         }
     }
 
-    data.ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
-    scratch_size = rustsecp256k1_v0_8_1_strauss_scratch_size(POINTS) + STRAUSS_SCRATCH_OBJECTS*16;
+    data.ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
+    scratch_size = rustsecp256k1_v0_9_0_strauss_scratch_size(POINTS) + STRAUSS_SCRATCH_OBJECTS*16;
     if (!have_flag(argc, argv, "simple")) {
-        data.scratch = rustsecp256k1_v0_8_1_scratch_space_create(data.ctx, scratch_size);
+        data.scratch = rustsecp256k1_v0_9_0_scratch_space_create(data.ctx, scratch_size);
     } else {
         data.scratch = NULL;
     }
 
     /* Allocate stuff */
-    data.scalars = malloc(sizeof(rustsecp256k1_v0_8_1_scalar) * POINTS);
-    data.seckeys = malloc(sizeof(rustsecp256k1_v0_8_1_scalar) * POINTS);
-    data.pubkeys = malloc(sizeof(rustsecp256k1_v0_8_1_ge) * POINTS);
-    data.pubkeys_gej = malloc(sizeof(rustsecp256k1_v0_8_1_gej) * POINTS);
-    data.expected_output = malloc(sizeof(rustsecp256k1_v0_8_1_gej) * (iters + 1));
-    data.output = malloc(sizeof(rustsecp256k1_v0_8_1_gej) * (iters + 1));
+    data.scalars = malloc(sizeof(rustsecp256k1_v0_9_0_scalar) * POINTS);
+    data.seckeys = malloc(sizeof(rustsecp256k1_v0_9_0_scalar) * POINTS);
+    data.pubkeys = malloc(sizeof(rustsecp256k1_v0_9_0_ge) * POINTS);
+    data.pubkeys_gej = malloc(sizeof(rustsecp256k1_v0_9_0_gej) * POINTS);
+    data.expected_output = malloc(sizeof(rustsecp256k1_v0_9_0_gej) * (iters + 1));
+    data.output = malloc(sizeof(rustsecp256k1_v0_9_0_gej) * (iters + 1));
 
     /* Generate a set of scalars, and private/public keypairs. */
-    rustsecp256k1_v0_8_1_gej_set_ge(&data.pubkeys_gej[0], &rustsecp256k1_v0_8_1_ge_const_g);
-    rustsecp256k1_v0_8_1_scalar_set_int(&data.seckeys[0], 1);
+    rustsecp256k1_v0_9_0_gej_set_ge(&data.pubkeys_gej[0], &rustsecp256k1_v0_9_0_ge_const_g);
+    rustsecp256k1_v0_9_0_scalar_set_int(&data.seckeys[0], 1);
     for (i = 0; i < POINTS; ++i) {
         generate_scalar(i, &data.scalars[i]);
         if (i) {
-            rustsecp256k1_v0_8_1_gej_double_var(&data.pubkeys_gej[i], &data.pubkeys_gej[i - 1], NULL);
-            rustsecp256k1_v0_8_1_scalar_add(&data.seckeys[i], &data.seckeys[i - 1], &data.seckeys[i - 1]);
+            rustsecp256k1_v0_9_0_gej_double_var(&data.pubkeys_gej[i], &data.pubkeys_gej[i - 1], NULL);
+            rustsecp256k1_v0_9_0_scalar_add(&data.seckeys[i], &data.seckeys[i - 1], &data.seckeys[i - 1]);
         }
     }
-    rustsecp256k1_v0_8_1_ge_set_all_gej_var(data.pubkeys, data.pubkeys_gej, POINTS);
+    rustsecp256k1_v0_9_0_ge_set_all_gej_var(data.pubkeys, data.pubkeys_gej, POINTS);
 
 
     print_output_table_header_row();
@@ -356,9 +353,9 @@ int main(int argc, char **argv) {
     }
 
     if (data.scratch != NULL) {
-        rustsecp256k1_v0_8_1_scratch_space_destroy(data.ctx, data.scratch);
+        rustsecp256k1_v0_9_0_scratch_space_destroy(data.ctx, data.scratch);
     }
-    rustsecp256k1_v0_8_1_context_destroy(data.ctx);
+    rustsecp256k1_v0_9_0_context_destroy(data.ctx);
     free(data.scalars);
     free(data.pubkeys);
     free(data.pubkeys_gej);
diff --git a/secp256k1-sys/depend/secp256k1/src/bench_internal.c b/secp256k1-sys/depend/secp256k1/src/bench_internal.c
index 611e66c8c..a8f94c124 100644
--- a/secp256k1-sys/depend/secp256k1/src/bench_internal.c
+++ b/secp256k1-sys/depend/secp256k1/src/bench_internal.c
@@ -19,15 +19,15 @@
 #include "bench.h"
 
 typedef struct {
-    rustsecp256k1_v0_8_1_scalar scalar[2];
-    rustsecp256k1_v0_8_1_fe fe[4];
-    rustsecp256k1_v0_8_1_ge ge[2];
-    rustsecp256k1_v0_8_1_gej gej[2];
+    rustsecp256k1_v0_9_0_scalar scalar[2];
+    rustsecp256k1_v0_9_0_fe fe[4];
+    rustsecp256k1_v0_9_0_ge ge[2];
+    rustsecp256k1_v0_9_0_gej gej[2];
     unsigned char data[64];
     int wnaf[256];
 } bench_inv;
 
-void bench_setup(void* arg) {
+static void bench_setup(void* arg) {
     bench_inv *data = (bench_inv*)arg;
 
     static const unsigned char init[4][32] = {
@@ -63,291 +63,304 @@ void bench_setup(void* arg) {
         }
     };
 
-    rustsecp256k1_v0_8_1_scalar_set_b32(&data->scalar[0], init[0], NULL);
-    rustsecp256k1_v0_8_1_scalar_set_b32(&data->scalar[1], init[1], NULL);
-    rustsecp256k1_v0_8_1_fe_set_b32(&data->fe[0], init[0]);
-    rustsecp256k1_v0_8_1_fe_set_b32(&data->fe[1], init[1]);
-    rustsecp256k1_v0_8_1_fe_set_b32(&data->fe[2], init[2]);
-    rustsecp256k1_v0_8_1_fe_set_b32(&data->fe[3], init[3]);
-    CHECK(rustsecp256k1_v0_8_1_ge_set_xo_var(&data->ge[0], &data->fe[0], 0));
-    CHECK(rustsecp256k1_v0_8_1_ge_set_xo_var(&data->ge[1], &data->fe[1], 1));
-    rustsecp256k1_v0_8_1_gej_set_ge(&data->gej[0], &data->ge[0]);
-    rustsecp256k1_v0_8_1_gej_rescale(&data->gej[0], &data->fe[2]);
-    rustsecp256k1_v0_8_1_gej_set_ge(&data->gej[1], &data->ge[1]);
-    rustsecp256k1_v0_8_1_gej_rescale(&data->gej[1], &data->fe[3]);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&data->scalar[0], init[0], NULL);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&data->scalar[1], init[1], NULL);
+    rustsecp256k1_v0_9_0_fe_set_b32_limit(&data->fe[0], init[0]);
+    rustsecp256k1_v0_9_0_fe_set_b32_limit(&data->fe[1], init[1]);
+    rustsecp256k1_v0_9_0_fe_set_b32_limit(&data->fe[2], init[2]);
+    rustsecp256k1_v0_9_0_fe_set_b32_limit(&data->fe[3], init[3]);
+    CHECK(rustsecp256k1_v0_9_0_ge_set_xo_var(&data->ge[0], &data->fe[0], 0));
+    CHECK(rustsecp256k1_v0_9_0_ge_set_xo_var(&data->ge[1], &data->fe[1], 1));
+    rustsecp256k1_v0_9_0_gej_set_ge(&data->gej[0], &data->ge[0]);
+    rustsecp256k1_v0_9_0_gej_rescale(&data->gej[0], &data->fe[2]);
+    rustsecp256k1_v0_9_0_gej_set_ge(&data->gej[1], &data->ge[1]);
+    rustsecp256k1_v0_9_0_gej_rescale(&data->gej[1], &data->fe[3]);
     memcpy(data->data, init[0], 32);
     memcpy(data->data + 32, init[1], 32);
 }
 
-void bench_scalar_add(void* arg, int iters) {
+static void bench_scalar_add(void* arg, int iters) {
     int i, j = 0;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        j += rustsecp256k1_v0_8_1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        j += rustsecp256k1_v0_9_0_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
     }
     CHECK(j <= iters);
 }
 
-void bench_scalar_negate(void* arg, int iters) {
+static void bench_scalar_negate(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_scalar_negate(&data->scalar[0], &data->scalar[0]);
+        rustsecp256k1_v0_9_0_scalar_negate(&data->scalar[0], &data->scalar[0]);
     }
 }
 
-void bench_scalar_mul(void* arg, int iters) {
+static void bench_scalar_mul(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_scalar_mul(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        rustsecp256k1_v0_9_0_scalar_mul(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
     }
 }
 
-void bench_scalar_split(void* arg, int iters) {
+static void bench_scalar_split(void* arg, int iters) {
     int i, j = 0;
     bench_inv *data = (bench_inv*)arg;
+    rustsecp256k1_v0_9_0_scalar tmp;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_scalar_split_lambda(&data->scalar[0], &data->scalar[1], &data->scalar[0]);
-        j += rustsecp256k1_v0_8_1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        rustsecp256k1_v0_9_0_scalar_split_lambda(&tmp, &data->scalar[1], &data->scalar[0]);
+        j += rustsecp256k1_v0_9_0_scalar_add(&data->scalar[0], &tmp, &data->scalar[1]);
     }
     CHECK(j <= iters);
 }
 
-void bench_scalar_inverse(void* arg, int iters) {
+static void bench_scalar_inverse(void* arg, int iters) {
     int i, j = 0;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_scalar_inverse(&data->scalar[0], &data->scalar[0]);
-        j += rustsecp256k1_v0_8_1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        rustsecp256k1_v0_9_0_scalar_inverse(&data->scalar[0], &data->scalar[0]);
+        j += rustsecp256k1_v0_9_0_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
     }
     CHECK(j <= iters);
 }
 
-void bench_scalar_inverse_var(void* arg, int iters) {
+static void bench_scalar_inverse_var(void* arg, int iters) {
     int i, j = 0;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_scalar_inverse_var(&data->scalar[0], &data->scalar[0]);
-        j += rustsecp256k1_v0_8_1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        rustsecp256k1_v0_9_0_scalar_inverse_var(&data->scalar[0], &data->scalar[0]);
+        j += rustsecp256k1_v0_9_0_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
     }
     CHECK(j <= iters);
 }
 
-void bench_field_half(void* arg, int iters) {
+static void bench_field_half(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_fe_half(&data->fe[0]);
+        rustsecp256k1_v0_9_0_fe_half(&data->fe[0]);
     }
 }
 
-void bench_field_normalize(void* arg, int iters) {
+static void bench_field_normalize(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_fe_normalize(&data->fe[0]);
+        rustsecp256k1_v0_9_0_fe_normalize(&data->fe[0]);
     }
 }
 
-void bench_field_normalize_weak(void* arg, int iters) {
+static void bench_field_normalize_weak(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_fe_normalize_weak(&data->fe[0]);
+        rustsecp256k1_v0_9_0_fe_normalize_weak(&data->fe[0]);
     }
 }
 
-void bench_field_mul(void* arg, int iters) {
+static void bench_field_mul(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_fe_mul(&data->fe[0], &data->fe[0], &data->fe[1]);
+        rustsecp256k1_v0_9_0_fe_mul(&data->fe[0], &data->fe[0], &data->fe[1]);
     }
 }
 
-void bench_field_sqr(void* arg, int iters) {
+static void bench_field_sqr(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&data->fe[0], &data->fe[0]);
+        rustsecp256k1_v0_9_0_fe_sqr(&data->fe[0], &data->fe[0]);
     }
 }
 
-void bench_field_inverse(void* arg, int iters) {
+static void bench_field_inverse(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_fe_inv(&data->fe[0], &data->fe[0]);
-        rustsecp256k1_v0_8_1_fe_add(&data->fe[0], &data->fe[1]);
+        rustsecp256k1_v0_9_0_fe_inv(&data->fe[0], &data->fe[0]);
+        rustsecp256k1_v0_9_0_fe_add(&data->fe[0], &data->fe[1]);
     }
 }
 
-void bench_field_inverse_var(void* arg, int iters) {
+static void bench_field_inverse_var(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_fe_inv_var(&data->fe[0], &data->fe[0]);
-        rustsecp256k1_v0_8_1_fe_add(&data->fe[0], &data->fe[1]);
+        rustsecp256k1_v0_9_0_fe_inv_var(&data->fe[0], &data->fe[0]);
+        rustsecp256k1_v0_9_0_fe_add(&data->fe[0], &data->fe[1]);
     }
 }
 
-void bench_field_sqrt(void* arg, int iters) {
+static void bench_field_sqrt(void* arg, int iters) {
     int i, j = 0;
     bench_inv *data = (bench_inv*)arg;
-    rustsecp256k1_v0_8_1_fe t;
+    rustsecp256k1_v0_9_0_fe t;
 
     for (i = 0; i < iters; i++) {
         t = data->fe[0];
-        j += rustsecp256k1_v0_8_1_fe_sqrt(&data->fe[0], &t);
-        rustsecp256k1_v0_8_1_fe_add(&data->fe[0], &data->fe[1]);
+        j += rustsecp256k1_v0_9_0_fe_sqrt(&data->fe[0], &t);
+        rustsecp256k1_v0_9_0_fe_add(&data->fe[0], &data->fe[1]);
     }
     CHECK(j <= iters);
 }
 
-void bench_group_double_var(void* arg, int iters) {
+static void bench_field_is_square_var(void* arg, int iters) {
+    int i, j = 0;
+    bench_inv *data = (bench_inv*)arg;
+    rustsecp256k1_v0_9_0_fe t = data->fe[0];
+
+    for (i = 0; i < iters; i++) {
+        j += rustsecp256k1_v0_9_0_fe_is_square_var(&t);
+        rustsecp256k1_v0_9_0_fe_add(&t, &data->fe[1]);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&t);
+    }
+    CHECK(j <= iters);
+}
+
+static void bench_group_double_var(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_gej_double_var(&data->gej[0], &data->gej[0], NULL);
+        rustsecp256k1_v0_9_0_gej_double_var(&data->gej[0], &data->gej[0], NULL);
     }
 }
 
-void bench_group_add_var(void* arg, int iters) {
+static void bench_group_add_var(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_gej_add_var(&data->gej[0], &data->gej[0], &data->gej[1], NULL);
+        rustsecp256k1_v0_9_0_gej_add_var(&data->gej[0], &data->gej[0], &data->gej[1], NULL);
     }
 }
 
-void bench_group_add_affine(void* arg, int iters) {
+static void bench_group_add_affine(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_gej_add_ge(&data->gej[0], &data->gej[0], &data->ge[1]);
+        rustsecp256k1_v0_9_0_gej_add_ge(&data->gej[0], &data->gej[0], &data->ge[1]);
     }
 }
 
-void bench_group_add_affine_var(void* arg, int iters) {
+static void bench_group_add_affine_var(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_gej_add_ge_var(&data->gej[0], &data->gej[0], &data->ge[1], NULL);
+        rustsecp256k1_v0_9_0_gej_add_ge_var(&data->gej[0], &data->gej[0], &data->ge[1], NULL);
     }
 }
 
-void bench_group_add_zinv_var(void* arg, int iters) {
+static void bench_group_add_zinv_var(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_gej_add_zinv_var(&data->gej[0], &data->gej[0], &data->ge[1], &data->gej[0].y);
+        rustsecp256k1_v0_9_0_gej_add_zinv_var(&data->gej[0], &data->gej[0], &data->ge[1], &data->gej[0].y);
     }
 }
 
-void bench_group_to_affine_var(void* arg, int iters) {
+static void bench_group_to_affine_var(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; ++i) {
-        rustsecp256k1_v0_8_1_ge_set_gej_var(&data->ge[1], &data->gej[0]);
+        rustsecp256k1_v0_9_0_ge_set_gej_var(&data->ge[1], &data->gej[0]);
         /* Use the output affine X/Y coordinates to vary the input X/Y/Z coordinates.
            Note that the resulting coordinates will generally not correspond to a point
            on the curve, but this is not a problem for the code being benchmarked here.
            Adding and normalizing have less overhead than EC operations (which could
            guarantee the point remains on the curve). */
-        rustsecp256k1_v0_8_1_fe_add(&data->gej[0].x, &data->ge[1].y);
-        rustsecp256k1_v0_8_1_fe_add(&data->gej[0].y, &data->fe[2]);
-        rustsecp256k1_v0_8_1_fe_add(&data->gej[0].z, &data->ge[1].x);
-        rustsecp256k1_v0_8_1_fe_normalize_var(&data->gej[0].x);
-        rustsecp256k1_v0_8_1_fe_normalize_var(&data->gej[0].y);
-        rustsecp256k1_v0_8_1_fe_normalize_var(&data->gej[0].z);
+        rustsecp256k1_v0_9_0_fe_add(&data->gej[0].x, &data->ge[1].y);
+        rustsecp256k1_v0_9_0_fe_add(&data->gej[0].y, &data->fe[2]);
+        rustsecp256k1_v0_9_0_fe_add(&data->gej[0].z, &data->ge[1].x);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&data->gej[0].x);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&data->gej[0].y);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&data->gej[0].z);
     }
 }
 
-void bench_ecmult_wnaf(void* arg, int iters) {
+static void bench_ecmult_wnaf(void* arg, int iters) {
     int i, bits = 0, overflow = 0;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        bits += rustsecp256k1_v0_8_1_ecmult_wnaf(data->wnaf, 256, &data->scalar[0], WINDOW_A);
-        overflow += rustsecp256k1_v0_8_1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        bits += rustsecp256k1_v0_9_0_ecmult_wnaf(data->wnaf, 256, &data->scalar[0], WINDOW_A);
+        overflow += rustsecp256k1_v0_9_0_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
     }
     CHECK(overflow >= 0);
     CHECK(bits <= 256*iters);
 }
 
-void bench_wnaf_const(void* arg, int iters) {
+static void bench_wnaf_const(void* arg, int iters) {
     int i, bits = 0, overflow = 0;
     bench_inv *data = (bench_inv*)arg;
 
     for (i = 0; i < iters; i++) {
-        bits += rustsecp256k1_v0_8_1_wnaf_const(data->wnaf, &data->scalar[0], WINDOW_A, 256);
-        overflow += rustsecp256k1_v0_8_1_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
+        bits += rustsecp256k1_v0_9_0_wnaf_const(data->wnaf, &data->scalar[0], WINDOW_A, 256);
+        overflow += rustsecp256k1_v0_9_0_scalar_add(&data->scalar[0], &data->scalar[0], &data->scalar[1]);
     }
     CHECK(overflow >= 0);
     CHECK(bits <= 256*iters);
 }
 
-
-void bench_sha256(void* arg, int iters) {
+static void bench_sha256(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
-    rustsecp256k1_v0_8_1_sha256 sha;
+    rustsecp256k1_v0_9_0_sha256 sha;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_sha256_initialize(&sha);
-        rustsecp256k1_v0_8_1_sha256_write(&sha, data->data, 32);
-        rustsecp256k1_v0_8_1_sha256_finalize(&sha, data->data);
+        rustsecp256k1_v0_9_0_sha256_initialize(&sha);
+        rustsecp256k1_v0_9_0_sha256_write(&sha, data->data, 32);
+        rustsecp256k1_v0_9_0_sha256_finalize(&sha, data->data);
     }
 }
 
-void bench_hmac_sha256(void* arg, int iters) {
+static void bench_hmac_sha256(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
-    rustsecp256k1_v0_8_1_hmac_sha256 hmac;
+    rustsecp256k1_v0_9_0_hmac_sha256 hmac;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hmac, data->data, 32);
-        rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, data->data, 32);
-        rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hmac, data->data);
+        rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hmac, data->data, 32);
+        rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, data->data, 32);
+        rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hmac, data->data);
     }
 }
 
-void bench_rfc6979_hmac_sha256(void* arg, int iters) {
+static void bench_rfc6979_hmac_sha256(void* arg, int iters) {
     int i;
     bench_inv *data = (bench_inv*)arg;
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 rng;
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 rng;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_initialize(&rng, data->data, 64);
-        rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(&rng, data->data, 32);
+        rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_initialize(&rng, data->data, 64);
+        rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_generate(&rng, data->data, 32);
     }
 }
 
-void bench_context(void* arg, int iters) {
+static void bench_context(void* arg, int iters) {
     int i;
     (void)arg;
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_context_destroy(rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE));
+        rustsecp256k1_v0_9_0_context_destroy(rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE));
     }
 }
 
@@ -371,6 +384,7 @@ int main(int argc, char **argv) {
     if (d || have_flag(argc, argv, "field") || have_flag(argc, argv, "mul")) run_benchmark("field_mul", bench_field_mul, bench_setup, NULL, &data, 10, iters*10);
     if (d || have_flag(argc, argv, "field") || have_flag(argc, argv, "inverse")) run_benchmark("field_inverse", bench_field_inverse, bench_setup, NULL, &data, 10, iters);
     if (d || have_flag(argc, argv, "field") || have_flag(argc, argv, "inverse")) run_benchmark("field_inverse_var", bench_field_inverse_var, bench_setup, NULL, &data, 10, iters);
+    if (d || have_flag(argc, argv, "field") || have_flag(argc, argv, "issquare")) run_benchmark("field_is_square_var", bench_field_is_square_var, bench_setup, NULL, &data, 10, iters);
     if (d || have_flag(argc, argv, "field") || have_flag(argc, argv, "sqrt")) run_benchmark("field_sqrt", bench_field_sqrt, bench_setup, NULL, &data, 10, iters);
 
     if (d || have_flag(argc, argv, "group") || have_flag(argc, argv, "double")) run_benchmark("group_double_var", bench_group_double_var, bench_setup, NULL, &data, 10, iters*10);
diff --git a/secp256k1-sys/depend/secp256k1/src/checkmem.h b/secp256k1-sys/depend/secp256k1/src/checkmem.h
new file mode 100644
index 000000000..f2169decf
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/checkmem.h
@@ -0,0 +1,95 @@
+/***********************************************************************
+ * Copyright (c) 2022 Pieter Wuille                                    *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+/* The code here is inspired by Kris Kwiatkowski's approach in
+ * https://github.com/kriskwiatkowski/pqc/blob/main/src/common/ct_check.h
+ * to provide a general interface for memory-checking mechanisms, primarily
+ * for constant-time checking.
+ */
+
+/* These macros are defined by this header file:
+ *
+ * - SECP256K1_CHECKMEM_ENABLED:
+ *   - 1 if memory-checking integration is available, 0 otherwise.
+ *     This is just a compile-time macro. Use the next macro to check it is actually
+ *     available at runtime.
+ * - SECP256K1_CHECKMEM_RUNNING():
+ *   - Acts like a function call, returning 1 if memory checking is available
+ *     at runtime.
+ * - SECP256K1_CHECKMEM_CHECK(p, len):
+ *   - Assert or otherwise fail in case the len-byte memory block pointed to by p is
+ *     not considered entirely defined.
+ * - SECP256K1_CHECKMEM_CHECK_VERIFY(p, len):
+ *   - Like SECP256K1_CHECKMEM_CHECK, but only works in VERIFY mode.
+ * - SECP256K1_CHECKMEM_UNDEFINE(p, len):
+ *   - marks the len-byte memory block pointed to by p as undefined data (secret data,
+ *     in the context of constant-time checking).
+ * - SECP256K1_CHECKMEM_DEFINE(p, len):
+ *   - marks the len-byte memory pointed to by p as defined data (public data, in the
+ *     context of constant-time checking).
+ *
+ */
+
+#ifndef SECP256K1_CHECKMEM_H
+#define SECP256K1_CHECKMEM_H
+
+/* Define a statement-like macro that ignores the arguments. */
+#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
+
+/* If compiling under msan, map the SECP256K1_CHECKMEM_* functionality to msan.
+ * Choose this preferentially, even when VALGRIND is defined, as msan-compiled
+ * binaries can't be run under valgrind anyway. */
+#if defined(__has_feature)
+#  if __has_feature(memory_sanitizer)
+#    include <sanitizer/msan_interface.h>
+#    define SECP256K1_CHECKMEM_ENABLED 1
+#    define SECP256K1_CHECKMEM_UNDEFINE(p, len) __msan_allocated_memory((p), (len))
+#    define SECP256K1_CHECKMEM_DEFINE(p, len) __msan_unpoison((p), (len))
+#    define SECP256K1_CHECKMEM_CHECK(p, len) __msan_check_mem_is_initialized((p), (len))
+#    define SECP256K1_CHECKMEM_RUNNING() (1)
+#  endif
+#endif
+
+/* If valgrind integration is desired (through the VALGRIND define), implement the
+ * SECP256K1_CHECKMEM_* macros using valgrind. */
+#if !defined SECP256K1_CHECKMEM_ENABLED
+#  if defined VALGRIND
+#    include <stddef.h>
+#  if defined(__clang__) && defined(__APPLE__)
+#    pragma clang diagnostic push
+#    pragma clang diagnostic ignored "-Wreserved-identifier"
+#  endif
+#    include <valgrind/memcheck.h>
+#  if defined(__clang__) && defined(__APPLE__)
+#    pragma clang diagnostic pop
+#  endif
+#    define SECP256K1_CHECKMEM_ENABLED 1
+#    define SECP256K1_CHECKMEM_UNDEFINE(p, len) VALGRIND_MAKE_MEM_UNDEFINED((p), (len))
+#    define SECP256K1_CHECKMEM_DEFINE(p, len) VALGRIND_MAKE_MEM_DEFINED((p), (len))
+#    define SECP256K1_CHECKMEM_CHECK(p, len) VALGRIND_CHECK_MEM_IS_DEFINED((p), (len))
+     /* VALGRIND_MAKE_MEM_DEFINED returns 0 iff not running on memcheck.
+      * This is more precise than the RUNNING_ON_VALGRIND macro, which
+      * checks for valgrind in general instead of memcheck specifically. */
+#    define SECP256K1_CHECKMEM_RUNNING() (VALGRIND_MAKE_MEM_DEFINED(NULL, 0) != 0)
+#  endif
+#endif
+
+/* As a fall-back, map these macros to dummy statements. */
+#if !defined SECP256K1_CHECKMEM_ENABLED
+#  define SECP256K1_CHECKMEM_ENABLED 0
+#  define SECP256K1_CHECKMEM_UNDEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
+#  define SECP256K1_CHECKMEM_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
+#  define SECP256K1_CHECKMEM_CHECK(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
+#  define SECP256K1_CHECKMEM_RUNNING() (0)
+#endif
+
+#if defined VERIFY
+#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_CHECK((p), (len))
+#else
+#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
+#endif
+
+#endif /* SECP256K1_CHECKMEM_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ctime_tests.c b/secp256k1-sys/depend/secp256k1/src/ctime_tests.c
new file mode 100644
index 000000000..9ebf2a9d7
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/ctime_tests.c
@@ -0,0 +1,209 @@
+/***********************************************************************
+ * Copyright (c) 2020 Gregory Maxwell                                  *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#include <stdio.h>
+
+#include "../include/secp256k1.h"
+#include "assumptions.h"
+#include "checkmem.h"
+
+#if !SECP256K1_CHECKMEM_ENABLED
+#  error "This tool cannot be compiled without memory-checking interface (valgrind or msan)"
+#endif
+
+#ifdef ENABLE_MODULE_ECDH
+# include "../include/rustsecp256k1_v0_9_0_ecdh.h"
+#endif
+
+#ifdef ENABLE_MODULE_RECOVERY
+# include "../include/rustsecp256k1_v0_9_0_recovery.h"
+#endif
+
+#ifdef ENABLE_MODULE_EXTRAKEYS
+# include "../include/rustsecp256k1_v0_9_0_extrakeys.h"
+#endif
+
+#ifdef ENABLE_MODULE_SCHNORRSIG
+#include "../include/secp256k1_schnorrsig.h"
+#endif
+
+#ifdef ENABLE_MODULE_ELLSWIFT
+#include "../include/secp256k1_ellswift.h"
+#endif
+
+static void run_tests(rustsecp256k1_v0_9_0_context *ctx, unsigned char *key);
+
+int main(void) {
+    rustsecp256k1_v0_9_0_context* ctx;
+    unsigned char key[32];
+    int ret, i;
+
+    if (!SECP256K1_CHECKMEM_RUNNING()) {
+        fprintf(stderr, "This test can only usefully be run inside valgrind because it was not compiled under msan.\n");
+        fprintf(stderr, "Usage: libtool --mode=execute valgrind ./ctime_tests\n");
+        return 1;
+    }
+    ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_DECLASSIFY);
+    /** In theory, testing with a single secret input should be sufficient:
+     *  If control flow depended on secrets the tool would generate an error.
+     */
+    for (i = 0; i < 32; i++) {
+        key[i] = i + 65;
+    }
+
+    run_tests(ctx, key);
+
+    /* Test context randomisation. Do this last because it leaves the context
+     * tainted. */
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_context_randomize(ctx, key);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret);
+
+    rustsecp256k1_v0_9_0_context_destroy(ctx);
+    return 0;
+}
+
+static void run_tests(rustsecp256k1_v0_9_0_context *ctx, unsigned char *key) {
+    rustsecp256k1_v0_9_0_ecdsa_signature signature;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
+    size_t siglen = 74;
+    size_t outputlen = 33;
+    int i;
+    int ret;
+    unsigned char msg[32];
+    unsigned char sig[74];
+    unsigned char spubkey[33];
+#ifdef ENABLE_MODULE_RECOVERY
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature recoverable_signature;
+    int recid;
+#endif
+#ifdef ENABLE_MODULE_EXTRAKEYS
+    rustsecp256k1_v0_9_0_keypair keypair;
+#endif
+#ifdef ENABLE_MODULE_ELLSWIFT
+    unsigned char ellswift[64];
+    static const unsigned char prefix[64] = {'t', 'e', 's', 't'};
+#endif
+
+    for (i = 0; i < 32; i++) {
+        msg[i] = i + 1;
+    }
+
+    /* Test keygen. */
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_ec_pubkey_create(ctx, &pubkey, key);
+    SECP256K1_CHECKMEM_DEFINE(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(ctx, spubkey, &outputlen, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
+
+    /* Test signing. */
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_ecdsa_sign(ctx, &signature, msg, key, NULL, NULL);
+    SECP256K1_CHECKMEM_DEFINE(&signature, sizeof(rustsecp256k1_v0_9_0_ecdsa_signature));
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(ctx, sig, &siglen, &signature));
+
+#ifdef ENABLE_MODULE_ECDH
+    /* Test ECDH. */
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_ecdh(ctx, msg, &pubkey, key, NULL, NULL);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+#endif
+
+#ifdef ENABLE_MODULE_RECOVERY
+    /* Test signing a recoverable signature. */
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(ctx, &recoverable_signature, msg, key, NULL, NULL);
+    SECP256K1_CHECKMEM_DEFINE(&recoverable_signature, sizeof(recoverable_signature));
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, &recoverable_signature));
+    CHECK(recid >= 0 && recid <= 3);
+#endif
+
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_ec_seckey_verify(ctx, key);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_ec_seckey_negate(ctx, key);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    SECP256K1_CHECKMEM_UNDEFINE(msg, 32);
+    ret = rustsecp256k1_v0_9_0_ec_seckey_tweak_add(ctx, key, msg);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    SECP256K1_CHECKMEM_UNDEFINE(msg, 32);
+    ret = rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(ctx, key, msg);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+
+    /* Test keypair_create and keypair_xonly_tweak_add. */
+#ifdef ENABLE_MODULE_EXTRAKEYS
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_keypair_create(ctx, &keypair, key);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+
+    /* The tweak is not treated as a secret in keypair_tweak_add */
+    SECP256K1_CHECKMEM_DEFINE(msg, 32);
+    ret = rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(ctx, &keypair, msg);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    SECP256K1_CHECKMEM_UNDEFINE(&keypair, sizeof(keypair));
+    ret = rustsecp256k1_v0_9_0_keypair_sec(ctx, key, &keypair);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+#endif
+
+#ifdef ENABLE_MODULE_SCHNORRSIG
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_keypair_create(ctx, &keypair, key);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+    ret = rustsecp256k1_v0_9_0_schnorrsig_sign32(ctx, sig, msg, &keypair, NULL);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+#endif
+
+#ifdef ENABLE_MODULE_ELLSWIFT
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_ellswift_create(ctx, ellswift, key, NULL);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+
+    SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+    ret = rustsecp256k1_v0_9_0_ellswift_create(ctx, ellswift, key, ellswift);
+    SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+    CHECK(ret == 1);
+
+    for (i = 0; i < 2; i++) {
+        SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+        SECP256K1_CHECKMEM_DEFINE(&ellswift, sizeof(ellswift));
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(ctx, msg, ellswift, ellswift, key, i, rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_bip324, NULL);
+        SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+        CHECK(ret == 1);
+
+        SECP256K1_CHECKMEM_UNDEFINE(key, 32);
+        SECP256K1_CHECKMEM_DEFINE(&ellswift, sizeof(ellswift));
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(ctx, msg, ellswift, ellswift, key, i, rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_prefix, (void *)prefix);
+        SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+        CHECK(ret == 1);
+    }
+
+#endif
+}
diff --git a/secp256k1-sys/depend/secp256k1/src/ecdsa.h b/secp256k1-sys/depend/secp256k1/src/ecdsa.h
index a45291ca6..21312c667 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecdsa.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecdsa.h
@@ -13,9 +13,9 @@
 #include "group.h"
 #include "ecmult.h"
 
-static int rustsecp256k1_v0_8_1_ecdsa_sig_parse(rustsecp256k1_v0_8_1_scalar *r, rustsecp256k1_v0_8_1_scalar *s, const unsigned char *sig, size_t size);
-static int rustsecp256k1_v0_8_1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *s);
-static int rustsecp256k1_v0_8_1_ecdsa_sig_verify(const rustsecp256k1_v0_8_1_scalar* r, const rustsecp256k1_v0_8_1_scalar* s, const rustsecp256k1_v0_8_1_ge *pubkey, const rustsecp256k1_v0_8_1_scalar *message);
-static int rustsecp256k1_v0_8_1_ecdsa_sig_sign(const rustsecp256k1_v0_8_1_ecmult_gen_context *ctx, rustsecp256k1_v0_8_1_scalar* r, rustsecp256k1_v0_8_1_scalar* s, const rustsecp256k1_v0_8_1_scalar *seckey, const rustsecp256k1_v0_8_1_scalar *message, const rustsecp256k1_v0_8_1_scalar *nonce, int *recid);
+static int rustsecp256k1_v0_9_0_ecdsa_sig_parse(rustsecp256k1_v0_9_0_scalar *r, rustsecp256k1_v0_9_0_scalar *s, const unsigned char *sig, size_t size);
+static int rustsecp256k1_v0_9_0_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *s);
+static int rustsecp256k1_v0_9_0_ecdsa_sig_verify(const rustsecp256k1_v0_9_0_scalar* r, const rustsecp256k1_v0_9_0_scalar* s, const rustsecp256k1_v0_9_0_ge *pubkey, const rustsecp256k1_v0_9_0_scalar *message);
+static int rustsecp256k1_v0_9_0_ecdsa_sig_sign(const rustsecp256k1_v0_9_0_ecmult_gen_context *ctx, rustsecp256k1_v0_9_0_scalar* r, rustsecp256k1_v0_9_0_scalar* s, const rustsecp256k1_v0_9_0_scalar *seckey, const rustsecp256k1_v0_9_0_scalar *message, const rustsecp256k1_v0_9_0_scalar *nonce, int *recid);
 
 #endif /* SECP256K1_ECDSA_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ecdsa_impl.h b/secp256k1-sys/depend/secp256k1/src/ecdsa_impl.h
index b6561ee75..5f5726b74 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecdsa_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecdsa_impl.h
@@ -16,37 +16,24 @@
 #include "ecdsa.h"
 
 /** Group order for secp256k1 defined as 'n' in "Standards for Efficient Cryptography" (SEC2) 2.7.1
- *  sage: for t in xrange(1023, -1, -1):
- *     ..   p = 2**256 - 2**32 - t
- *     ..   if p.is_prime():
- *     ..     print '%x'%p
- *     ..     break
- *   'fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'
- *  sage: a = 0
- *  sage: b = 7
- *  sage: F = FiniteField (p)
- *  sage: '%x' % (EllipticCurve ([F (a), F (b)]).order())
- *   'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'
+ *  $ sage -c 'load("rustsecp256k1_v0_9_0_params.sage"); print(hex(N))'
+ *  0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
  */
-static const rustsecp256k1_v0_8_1_fe rustsecp256k1_v0_8_1_ecdsa_const_order_as_fe = SECP256K1_FE_CONST(
+static const rustsecp256k1_v0_9_0_fe rustsecp256k1_v0_9_0_ecdsa_const_order_as_fe = SECP256K1_FE_CONST(
     0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
     0xBAAEDCE6UL, 0xAF48A03BUL, 0xBFD25E8CUL, 0xD0364141UL
 );
 
 /** Difference between field and order, values 'p' and 'n' values defined in
  *  "Standards for Efficient Cryptography" (SEC2) 2.7.1.
- *  sage: p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
- *  sage: a = 0
- *  sage: b = 7
- *  sage: F = FiniteField (p)
- *  sage: '%x' % (p - EllipticCurve ([F (a), F (b)]).order())
- *   '14551231950b75fc4402da1722fc9baee'
+ *  $ sage -c 'load("rustsecp256k1_v0_9_0_params.sage"); print(hex(P-N))'
+ *  0x14551231950b75fc4402da1722fc9baee
  */
-static const rustsecp256k1_v0_8_1_fe rustsecp256k1_v0_8_1_ecdsa_const_p_minus_order = SECP256K1_FE_CONST(
+static const rustsecp256k1_v0_9_0_fe rustsecp256k1_v0_9_0_ecdsa_const_p_minus_order = SECP256K1_FE_CONST(
     0, 0, 0, 1, 0x45512319UL, 0x50B75FC4UL, 0x402DA172UL, 0x2FC9BAEEUL
 );
 
-static int rustsecp256k1_v0_8_1_der_read_len(size_t *len, const unsigned char **sigp, const unsigned char *sigend) {
+static int rustsecp256k1_v0_9_0_der_read_len(size_t *len, const unsigned char **sigp, const unsigned char *sigend) {
     size_t lenleft;
     unsigned char b1;
     VERIFY_CHECK(len != NULL);
@@ -99,7 +86,7 @@ static int rustsecp256k1_v0_8_1_der_read_len(size_t *len, const unsigned char **
     return 1;
 }
 
-static int rustsecp256k1_v0_8_1_der_parse_integer(rustsecp256k1_v0_8_1_scalar *r, const unsigned char **sig, const unsigned char *sigend) {
+static int rustsecp256k1_v0_9_0_der_parse_integer(rustsecp256k1_v0_9_0_scalar *r, const unsigned char **sig, const unsigned char *sigend) {
     int overflow = 0;
     unsigned char ra[32] = {0};
     size_t rlen;
@@ -109,7 +96,7 @@ static int rustsecp256k1_v0_8_1_der_parse_integer(rustsecp256k1_v0_8_1_scalar *r
         return 0;
     }
     (*sig)++;
-    if (rustsecp256k1_v0_8_1_der_read_len(&rlen, sig, sigend) == 0) {
+    if (rustsecp256k1_v0_9_0_der_read_len(&rlen, sig, sigend) == 0) {
         return 0;
     }
     if (rlen == 0 || rlen > (size_t)(sigend - *sig)) {
@@ -141,23 +128,23 @@ static int rustsecp256k1_v0_8_1_der_parse_integer(rustsecp256k1_v0_8_1_scalar *r
     }
     if (!overflow) {
         if (rlen) memcpy(ra + 32 - rlen, *sig, rlen);
-        rustsecp256k1_v0_8_1_scalar_set_b32(r, ra, &overflow);
+        rustsecp256k1_v0_9_0_scalar_set_b32(r, ra, &overflow);
     }
     if (overflow) {
-        rustsecp256k1_v0_8_1_scalar_set_int(r, 0);
+        rustsecp256k1_v0_9_0_scalar_set_int(r, 0);
     }
     (*sig) += rlen;
     return 1;
 }
 
-static int rustsecp256k1_v0_8_1_ecdsa_sig_parse(rustsecp256k1_v0_8_1_scalar *rr, rustsecp256k1_v0_8_1_scalar *rs, const unsigned char *sig, size_t size) {
+static int rustsecp256k1_v0_9_0_ecdsa_sig_parse(rustsecp256k1_v0_9_0_scalar *rr, rustsecp256k1_v0_9_0_scalar *rs, const unsigned char *sig, size_t size) {
     const unsigned char *sigend = sig + size;
     size_t rlen;
     if (sig == sigend || *(sig++) != 0x30) {
         /* The encoding doesn't start with a constructed sequence (X.690-0207 8.9.1). */
         return 0;
     }
-    if (rustsecp256k1_v0_8_1_der_read_len(&rlen, &sig, sigend) == 0) {
+    if (rustsecp256k1_v0_9_0_der_read_len(&rlen, &sig, sigend) == 0) {
         return 0;
     }
     if (rlen != (size_t)(sigend - sig)) {
@@ -165,10 +152,10 @@ static int rustsecp256k1_v0_8_1_ecdsa_sig_parse(rustsecp256k1_v0_8_1_scalar *rr,
         return 0;
     }
 
-    if (!rustsecp256k1_v0_8_1_der_parse_integer(rr, &sig, sigend)) {
+    if (!rustsecp256k1_v0_9_0_der_parse_integer(rr, &sig, sigend)) {
         return 0;
     }
-    if (!rustsecp256k1_v0_8_1_der_parse_integer(rs, &sig, sigend)) {
+    if (!rustsecp256k1_v0_9_0_der_parse_integer(rs, &sig, sigend)) {
         return 0;
     }
 
@@ -180,12 +167,12 @@ static int rustsecp256k1_v0_8_1_ecdsa_sig_parse(rustsecp256k1_v0_8_1_scalar *rr,
     return 1;
 }
 
-static int rustsecp256k1_v0_8_1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const rustsecp256k1_v0_8_1_scalar* ar, const rustsecp256k1_v0_8_1_scalar* as) {
+static int rustsecp256k1_v0_9_0_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const rustsecp256k1_v0_9_0_scalar* ar, const rustsecp256k1_v0_9_0_scalar* as) {
     unsigned char r[33] = {0}, s[33] = {0};
     unsigned char *rp = r, *sp = s;
     size_t lenR = 33, lenS = 33;
-    rustsecp256k1_v0_8_1_scalar_get_b32(&r[1], ar);
-    rustsecp256k1_v0_8_1_scalar_get_b32(&s[1], as);
+    rustsecp256k1_v0_9_0_scalar_get_b32(&r[1], ar);
+    rustsecp256k1_v0_9_0_scalar_get_b32(&s[1], as);
     while (lenR > 1 && rp[0] == 0 && rp[1] < 0x80) { lenR--; rp++; }
     while (lenS > 1 && sp[0] == 0 && sp[1] < 0x80) { lenS--; sp++; }
     if (*size < 6+lenS+lenR) {
@@ -204,42 +191,43 @@ static int rustsecp256k1_v0_8_1_ecdsa_sig_serialize(unsigned char *sig, size_t *
     return 1;
 }
 
-static int rustsecp256k1_v0_8_1_ecdsa_sig_verify(const rustsecp256k1_v0_8_1_scalar *sigr, const rustsecp256k1_v0_8_1_scalar *sigs, const rustsecp256k1_v0_8_1_ge *pubkey, const rustsecp256k1_v0_8_1_scalar *message) {
+static int rustsecp256k1_v0_9_0_ecdsa_sig_verify(const rustsecp256k1_v0_9_0_scalar *sigr, const rustsecp256k1_v0_9_0_scalar *sigs, const rustsecp256k1_v0_9_0_ge *pubkey, const rustsecp256k1_v0_9_0_scalar *message) {
     unsigned char c[32];
-    rustsecp256k1_v0_8_1_scalar sn, u1, u2;
+    rustsecp256k1_v0_9_0_scalar sn, u1, u2;
 #if !defined(EXHAUSTIVE_TEST_ORDER)
-    rustsecp256k1_v0_8_1_fe xr;
+    rustsecp256k1_v0_9_0_fe xr;
 #endif
-    rustsecp256k1_v0_8_1_gej pubkeyj;
-    rustsecp256k1_v0_8_1_gej pr;
+    rustsecp256k1_v0_9_0_gej pubkeyj;
+    rustsecp256k1_v0_9_0_gej pr;
 
-    if (rustsecp256k1_v0_8_1_scalar_is_zero(sigr) || rustsecp256k1_v0_8_1_scalar_is_zero(sigs)) {
+    if (rustsecp256k1_v0_9_0_scalar_is_zero(sigr) || rustsecp256k1_v0_9_0_scalar_is_zero(sigs)) {
         return 0;
     }
 
-    rustsecp256k1_v0_8_1_scalar_inverse_var(&sn, sigs);
-    rustsecp256k1_v0_8_1_scalar_mul(&u1, &sn, message);
-    rustsecp256k1_v0_8_1_scalar_mul(&u2, &sn, sigr);
-    rustsecp256k1_v0_8_1_gej_set_ge(&pubkeyj, pubkey);
-    rustsecp256k1_v0_8_1_ecmult(&pr, &pubkeyj, &u2, &u1);
-    if (rustsecp256k1_v0_8_1_gej_is_infinity(&pr)) {
+    rustsecp256k1_v0_9_0_scalar_inverse_var(&sn, sigs);
+    rustsecp256k1_v0_9_0_scalar_mul(&u1, &sn, message);
+    rustsecp256k1_v0_9_0_scalar_mul(&u2, &sn, sigr);
+    rustsecp256k1_v0_9_0_gej_set_ge(&pubkeyj, pubkey);
+    rustsecp256k1_v0_9_0_ecmult(&pr, &pubkeyj, &u2, &u1);
+    if (rustsecp256k1_v0_9_0_gej_is_infinity(&pr)) {
         return 0;
     }
 
 #if defined(EXHAUSTIVE_TEST_ORDER)
 {
-    rustsecp256k1_v0_8_1_scalar computed_r;
-    rustsecp256k1_v0_8_1_ge pr_ge;
-    rustsecp256k1_v0_8_1_ge_set_gej(&pr_ge, &pr);
-    rustsecp256k1_v0_8_1_fe_normalize(&pr_ge.x);
+    rustsecp256k1_v0_9_0_scalar computed_r;
+    rustsecp256k1_v0_9_0_ge pr_ge;
+    rustsecp256k1_v0_9_0_ge_set_gej(&pr_ge, &pr);
+    rustsecp256k1_v0_9_0_fe_normalize(&pr_ge.x);
 
-    rustsecp256k1_v0_8_1_fe_get_b32(c, &pr_ge.x);
-    rustsecp256k1_v0_8_1_scalar_set_b32(&computed_r, c, NULL);
-    return rustsecp256k1_v0_8_1_scalar_eq(sigr, &computed_r);
+    rustsecp256k1_v0_9_0_fe_get_b32(c, &pr_ge.x);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&computed_r, c, NULL);
+    return rustsecp256k1_v0_9_0_scalar_eq(sigr, &computed_r);
 }
 #else
-    rustsecp256k1_v0_8_1_scalar_get_b32(c, sigr);
-    rustsecp256k1_v0_8_1_fe_set_b32(&xr, c);
+    rustsecp256k1_v0_9_0_scalar_get_b32(c, sigr);
+    /* we can ignore the fe_set_b32_limit return value, because we know the input is in range */
+    (void)rustsecp256k1_v0_9_0_fe_set_b32_limit(&xr, c);
 
     /** We now have the recomputed R point in pr, and its claimed x coordinate (modulo n)
      *  in xr. Naively, we would extract the x coordinate from pr (requiring a inversion modulo p),
@@ -255,18 +243,18 @@ static int rustsecp256k1_v0_8_1_ecdsa_sig_verify(const rustsecp256k1_v0_8_1_scal
      *    <=> (xr * pr.z^2 mod p == pr.x) || (xr + n < p && (xr + n) * pr.z^2 mod p == pr.x)
      *
      *  Thus, we can avoid the inversion, but we have to check both cases separately.
-     *  rustsecp256k1_v0_8_1_gej_eq_x implements the (xr * pr.z^2 mod p == pr.x) test.
+     *  rustsecp256k1_v0_9_0_gej_eq_x implements the (xr * pr.z^2 mod p == pr.x) test.
      */
-    if (rustsecp256k1_v0_8_1_gej_eq_x_var(&xr, &pr)) {
+    if (rustsecp256k1_v0_9_0_gej_eq_x_var(&xr, &pr)) {
         /* xr * pr.z^2 mod p == pr.x, so the signature is valid. */
         return 1;
     }
-    if (rustsecp256k1_v0_8_1_fe_cmp_var(&xr, &rustsecp256k1_v0_8_1_ecdsa_const_p_minus_order) >= 0) {
+    if (rustsecp256k1_v0_9_0_fe_cmp_var(&xr, &rustsecp256k1_v0_9_0_ecdsa_const_p_minus_order) >= 0) {
         /* xr + n >= p, so we can skip testing the second case. */
         return 0;
     }
-    rustsecp256k1_v0_8_1_fe_add(&xr, &rustsecp256k1_v0_8_1_ecdsa_const_order_as_fe);
-    if (rustsecp256k1_v0_8_1_gej_eq_x_var(&xr, &pr)) {
+    rustsecp256k1_v0_9_0_fe_add(&xr, &rustsecp256k1_v0_9_0_ecdsa_const_order_as_fe);
+    if (rustsecp256k1_v0_9_0_gej_eq_x_var(&xr, &pr)) {
         /* (xr + n) * pr.z^2 mod p == pr.x, so the signature is valid. */
         return 1;
     }
@@ -274,42 +262,42 @@ static int rustsecp256k1_v0_8_1_ecdsa_sig_verify(const rustsecp256k1_v0_8_1_scal
 #endif
 }
 
-static int rustsecp256k1_v0_8_1_ecdsa_sig_sign(const rustsecp256k1_v0_8_1_ecmult_gen_context *ctx, rustsecp256k1_v0_8_1_scalar *sigr, rustsecp256k1_v0_8_1_scalar *sigs, const rustsecp256k1_v0_8_1_scalar *seckey, const rustsecp256k1_v0_8_1_scalar *message, const rustsecp256k1_v0_8_1_scalar *nonce, int *recid) {
+static int rustsecp256k1_v0_9_0_ecdsa_sig_sign(const rustsecp256k1_v0_9_0_ecmult_gen_context *ctx, rustsecp256k1_v0_9_0_scalar *sigr, rustsecp256k1_v0_9_0_scalar *sigs, const rustsecp256k1_v0_9_0_scalar *seckey, const rustsecp256k1_v0_9_0_scalar *message, const rustsecp256k1_v0_9_0_scalar *nonce, int *recid) {
     unsigned char b[32];
-    rustsecp256k1_v0_8_1_gej rp;
-    rustsecp256k1_v0_8_1_ge r;
-    rustsecp256k1_v0_8_1_scalar n;
+    rustsecp256k1_v0_9_0_gej rp;
+    rustsecp256k1_v0_9_0_ge r;
+    rustsecp256k1_v0_9_0_scalar n;
     int overflow = 0;
     int high;
 
-    rustsecp256k1_v0_8_1_ecmult_gen(ctx, &rp, nonce);
-    rustsecp256k1_v0_8_1_ge_set_gej(&r, &rp);
-    rustsecp256k1_v0_8_1_fe_normalize(&r.x);
-    rustsecp256k1_v0_8_1_fe_normalize(&r.y);
-    rustsecp256k1_v0_8_1_fe_get_b32(b, &r.x);
-    rustsecp256k1_v0_8_1_scalar_set_b32(sigr, b, &overflow);
+    rustsecp256k1_v0_9_0_ecmult_gen(ctx, &rp, nonce);
+    rustsecp256k1_v0_9_0_ge_set_gej(&r, &rp);
+    rustsecp256k1_v0_9_0_fe_normalize(&r.x);
+    rustsecp256k1_v0_9_0_fe_normalize(&r.y);
+    rustsecp256k1_v0_9_0_fe_get_b32(b, &r.x);
+    rustsecp256k1_v0_9_0_scalar_set_b32(sigr, b, &overflow);
     if (recid) {
         /* The overflow condition is cryptographically unreachable as hitting it requires finding the discrete log
          * of some P where P.x >= order, and only 1 in about 2^127 points meet this criteria.
          */
-        *recid = (overflow << 1) | rustsecp256k1_v0_8_1_fe_is_odd(&r.y);
-    }
-    rustsecp256k1_v0_8_1_scalar_mul(&n, sigr, seckey);
-    rustsecp256k1_v0_8_1_scalar_add(&n, &n, message);
-    rustsecp256k1_v0_8_1_scalar_inverse(sigs, nonce);
-    rustsecp256k1_v0_8_1_scalar_mul(sigs, sigs, &n);
-    rustsecp256k1_v0_8_1_scalar_clear(&n);
-    rustsecp256k1_v0_8_1_gej_clear(&rp);
-    rustsecp256k1_v0_8_1_ge_clear(&r);
-    high = rustsecp256k1_v0_8_1_scalar_is_high(sigs);
-    rustsecp256k1_v0_8_1_scalar_cond_negate(sigs, high);
+        *recid = (overflow << 1) | rustsecp256k1_v0_9_0_fe_is_odd(&r.y);
+    }
+    rustsecp256k1_v0_9_0_scalar_mul(&n, sigr, seckey);
+    rustsecp256k1_v0_9_0_scalar_add(&n, &n, message);
+    rustsecp256k1_v0_9_0_scalar_inverse(sigs, nonce);
+    rustsecp256k1_v0_9_0_scalar_mul(sigs, sigs, &n);
+    rustsecp256k1_v0_9_0_scalar_clear(&n);
+    rustsecp256k1_v0_9_0_gej_clear(&rp);
+    rustsecp256k1_v0_9_0_ge_clear(&r);
+    high = rustsecp256k1_v0_9_0_scalar_is_high(sigs);
+    rustsecp256k1_v0_9_0_scalar_cond_negate(sigs, high);
     if (recid) {
         *recid ^= high;
     }
     /* P.x = order is on the curve, so technically sig->r could end up being zero, which would be an invalid signature.
      * This is cryptographically unreachable as hitting it requires finding the discrete log of P.x = N.
      */
-    return (int)(!rustsecp256k1_v0_8_1_scalar_is_zero(sigr)) & (int)(!rustsecp256k1_v0_8_1_scalar_is_zero(sigs));
+    return (int)(!rustsecp256k1_v0_9_0_scalar_is_zero(sigr)) & (int)(!rustsecp256k1_v0_9_0_scalar_is_zero(sigs));
 }
 
 #endif /* SECP256K1_ECDSA_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/eckey.h b/secp256k1-sys/depend/secp256k1/src/eckey.h
index ca69d0a56..bb992a117 100644
--- a/secp256k1-sys/depend/secp256k1/src/eckey.h
+++ b/secp256k1-sys/depend/secp256k1/src/eckey.h
@@ -14,12 +14,12 @@
 #include "ecmult.h"
 #include "ecmult_gen.h"
 
-static int rustsecp256k1_v0_8_1_eckey_pubkey_parse(rustsecp256k1_v0_8_1_ge *elem, const unsigned char *pub, size_t size);
-static int rustsecp256k1_v0_8_1_eckey_pubkey_serialize(rustsecp256k1_v0_8_1_ge *elem, unsigned char *pub, size_t *size, int compressed);
+static int rustsecp256k1_v0_9_0_eckey_pubkey_parse(rustsecp256k1_v0_9_0_ge *elem, const unsigned char *pub, size_t size);
+static int rustsecp256k1_v0_9_0_eckey_pubkey_serialize(rustsecp256k1_v0_9_0_ge *elem, unsigned char *pub, size_t *size, int compressed);
 
-static int rustsecp256k1_v0_8_1_eckey_privkey_tweak_add(rustsecp256k1_v0_8_1_scalar *key, const rustsecp256k1_v0_8_1_scalar *tweak);
-static int rustsecp256k1_v0_8_1_eckey_pubkey_tweak_add(rustsecp256k1_v0_8_1_ge *key, const rustsecp256k1_v0_8_1_scalar *tweak);
-static int rustsecp256k1_v0_8_1_eckey_privkey_tweak_mul(rustsecp256k1_v0_8_1_scalar *key, const rustsecp256k1_v0_8_1_scalar *tweak);
-static int rustsecp256k1_v0_8_1_eckey_pubkey_tweak_mul(rustsecp256k1_v0_8_1_ge *key, const rustsecp256k1_v0_8_1_scalar *tweak);
+static int rustsecp256k1_v0_9_0_eckey_privkey_tweak_add(rustsecp256k1_v0_9_0_scalar *key, const rustsecp256k1_v0_9_0_scalar *tweak);
+static int rustsecp256k1_v0_9_0_eckey_pubkey_tweak_add(rustsecp256k1_v0_9_0_ge *key, const rustsecp256k1_v0_9_0_scalar *tweak);
+static int rustsecp256k1_v0_9_0_eckey_privkey_tweak_mul(rustsecp256k1_v0_9_0_scalar *key, const rustsecp256k1_v0_9_0_scalar *tweak);
+static int rustsecp256k1_v0_9_0_eckey_pubkey_tweak_mul(rustsecp256k1_v0_9_0_ge *key, const rustsecp256k1_v0_9_0_scalar *tweak);
 
 #endif /* SECP256K1_ECKEY_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/eckey_impl.h b/secp256k1-sys/depend/secp256k1/src/eckey_impl.h
index 51bed8780..2ea03e301 100644
--- a/secp256k1-sys/depend/secp256k1/src/eckey_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/eckey_impl.h
@@ -14,82 +14,78 @@
 #include "group.h"
 #include "ecmult_gen.h"
 
-static int rustsecp256k1_v0_8_1_eckey_pubkey_parse(rustsecp256k1_v0_8_1_ge *elem, const unsigned char *pub, size_t size) {
+static int rustsecp256k1_v0_9_0_eckey_pubkey_parse(rustsecp256k1_v0_9_0_ge *elem, const unsigned char *pub, size_t size) {
     if (size == 33 && (pub[0] == SECP256K1_TAG_PUBKEY_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_ODD)) {
-        rustsecp256k1_v0_8_1_fe x;
-        return rustsecp256k1_v0_8_1_fe_set_b32(&x, pub+1) && rustsecp256k1_v0_8_1_ge_set_xo_var(elem, &x, pub[0] == SECP256K1_TAG_PUBKEY_ODD);
+        rustsecp256k1_v0_9_0_fe x;
+        return rustsecp256k1_v0_9_0_fe_set_b32_limit(&x, pub+1) && rustsecp256k1_v0_9_0_ge_set_xo_var(elem, &x, pub[0] == SECP256K1_TAG_PUBKEY_ODD);
     } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
-        rustsecp256k1_v0_8_1_fe x, y;
-        if (!rustsecp256k1_v0_8_1_fe_set_b32(&x, pub+1) || !rustsecp256k1_v0_8_1_fe_set_b32(&y, pub+33)) {
+        rustsecp256k1_v0_9_0_fe x, y;
+        if (!rustsecp256k1_v0_9_0_fe_set_b32_limit(&x, pub+1) || !rustsecp256k1_v0_9_0_fe_set_b32_limit(&y, pub+33)) {
             return 0;
         }
-        rustsecp256k1_v0_8_1_ge_set_xy(elem, &x, &y);
+        rustsecp256k1_v0_9_0_ge_set_xy(elem, &x, &y);
         if ((pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD) &&
-            rustsecp256k1_v0_8_1_fe_is_odd(&y) != (pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
+            rustsecp256k1_v0_9_0_fe_is_odd(&y) != (pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
             return 0;
         }
-        return rustsecp256k1_v0_8_1_ge_is_valid_var(elem);
+        return rustsecp256k1_v0_9_0_ge_is_valid_var(elem);
     } else {
         return 0;
     }
 }
 
-static int rustsecp256k1_v0_8_1_eckey_pubkey_serialize(rustsecp256k1_v0_8_1_ge *elem, unsigned char *pub, size_t *size, int compressed) {
-    if (rustsecp256k1_v0_8_1_ge_is_infinity(elem)) {
+static int rustsecp256k1_v0_9_0_eckey_pubkey_serialize(rustsecp256k1_v0_9_0_ge *elem, unsigned char *pub, size_t *size, int compressed) {
+    if (rustsecp256k1_v0_9_0_ge_is_infinity(elem)) {
         return 0;
     }
-    rustsecp256k1_v0_8_1_fe_normalize_var(&elem->x);
-    rustsecp256k1_v0_8_1_fe_normalize_var(&elem->y);
-    rustsecp256k1_v0_8_1_fe_get_b32(&pub[1], &elem->x);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&elem->x);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&elem->y);
+    rustsecp256k1_v0_9_0_fe_get_b32(&pub[1], &elem->x);
     if (compressed) {
         *size = 33;
-        pub[0] = rustsecp256k1_v0_8_1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
+        pub[0] = rustsecp256k1_v0_9_0_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
     } else {
         *size = 65;
         pub[0] = SECP256K1_TAG_PUBKEY_UNCOMPRESSED;
-        rustsecp256k1_v0_8_1_fe_get_b32(&pub[33], &elem->y);
+        rustsecp256k1_v0_9_0_fe_get_b32(&pub[33], &elem->y);
     }
     return 1;
 }
 
-static int rustsecp256k1_v0_8_1_eckey_privkey_tweak_add(rustsecp256k1_v0_8_1_scalar *key, const rustsecp256k1_v0_8_1_scalar *tweak) {
-    rustsecp256k1_v0_8_1_scalar_add(key, key, tweak);
-    return !rustsecp256k1_v0_8_1_scalar_is_zero(key);
+static int rustsecp256k1_v0_9_0_eckey_privkey_tweak_add(rustsecp256k1_v0_9_0_scalar *key, const rustsecp256k1_v0_9_0_scalar *tweak) {
+    rustsecp256k1_v0_9_0_scalar_add(key, key, tweak);
+    return !rustsecp256k1_v0_9_0_scalar_is_zero(key);
 }
 
-static int rustsecp256k1_v0_8_1_eckey_pubkey_tweak_add(rustsecp256k1_v0_8_1_ge *key, const rustsecp256k1_v0_8_1_scalar *tweak) {
-    rustsecp256k1_v0_8_1_gej pt;
-    rustsecp256k1_v0_8_1_scalar one;
-    rustsecp256k1_v0_8_1_gej_set_ge(&pt, key);
-    rustsecp256k1_v0_8_1_scalar_set_int(&one, 1);
-    rustsecp256k1_v0_8_1_ecmult(&pt, &pt, &one, tweak);
+static int rustsecp256k1_v0_9_0_eckey_pubkey_tweak_add(rustsecp256k1_v0_9_0_ge *key, const rustsecp256k1_v0_9_0_scalar *tweak) {
+    rustsecp256k1_v0_9_0_gej pt;
+    rustsecp256k1_v0_9_0_gej_set_ge(&pt, key);
+    rustsecp256k1_v0_9_0_ecmult(&pt, &pt, &rustsecp256k1_v0_9_0_scalar_one, tweak);
 
-    if (rustsecp256k1_v0_8_1_gej_is_infinity(&pt)) {
+    if (rustsecp256k1_v0_9_0_gej_is_infinity(&pt)) {
         return 0;
     }
-    rustsecp256k1_v0_8_1_ge_set_gej(key, &pt);
+    rustsecp256k1_v0_9_0_ge_set_gej(key, &pt);
     return 1;
 }
 
-static int rustsecp256k1_v0_8_1_eckey_privkey_tweak_mul(rustsecp256k1_v0_8_1_scalar *key, const rustsecp256k1_v0_8_1_scalar *tweak) {
+static int rustsecp256k1_v0_9_0_eckey_privkey_tweak_mul(rustsecp256k1_v0_9_0_scalar *key, const rustsecp256k1_v0_9_0_scalar *tweak) {
     int ret;
-    ret = !rustsecp256k1_v0_8_1_scalar_is_zero(tweak);
+    ret = !rustsecp256k1_v0_9_0_scalar_is_zero(tweak);
 
-    rustsecp256k1_v0_8_1_scalar_mul(key, key, tweak);
+    rustsecp256k1_v0_9_0_scalar_mul(key, key, tweak);
     return ret;
 }
 
-static int rustsecp256k1_v0_8_1_eckey_pubkey_tweak_mul(rustsecp256k1_v0_8_1_ge *key, const rustsecp256k1_v0_8_1_scalar *tweak) {
-    rustsecp256k1_v0_8_1_scalar zero;
-    rustsecp256k1_v0_8_1_gej pt;
-    if (rustsecp256k1_v0_8_1_scalar_is_zero(tweak)) {
+static int rustsecp256k1_v0_9_0_eckey_pubkey_tweak_mul(rustsecp256k1_v0_9_0_ge *key, const rustsecp256k1_v0_9_0_scalar *tweak) {
+    rustsecp256k1_v0_9_0_gej pt;
+    if (rustsecp256k1_v0_9_0_scalar_is_zero(tweak)) {
         return 0;
     }
 
-    rustsecp256k1_v0_8_1_scalar_set_int(&zero, 0);
-    rustsecp256k1_v0_8_1_gej_set_ge(&pt, key);
-    rustsecp256k1_v0_8_1_ecmult(&pt, &pt, tweak, &zero);
-    rustsecp256k1_v0_8_1_ge_set_gej(key, &pt);
+    rustsecp256k1_v0_9_0_gej_set_ge(&pt, key);
+    rustsecp256k1_v0_9_0_ecmult(&pt, &pt, tweak, &rustsecp256k1_v0_9_0_scalar_zero);
+    rustsecp256k1_v0_9_0_ge_set_gej(key, &pt);
     return 1;
 }
 
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult.h b/secp256k1-sys/depend/secp256k1/src/ecmult.h
index 5d0f360a5..326933561 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult.h
@@ -22,7 +22,7 @@
 #  pragma message DEBUG_CONFIG_DEF(ECMULT_WINDOW_SIZE)
 #endif
 
-/* Noone will ever need more than a window size of 24. The code might
+/* No one will ever need more than a window size of 24. The code might
  * be correct for larger values of ECMULT_WINDOW_SIZE but this is not
  * tested.
  *
@@ -41,9 +41,9 @@
 #define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
 
 /** Double multiply: R = na*A + ng*G */
-static void rustsecp256k1_v0_8_1_ecmult(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_scalar *na, const rustsecp256k1_v0_8_1_scalar *ng);
+static void rustsecp256k1_v0_9_0_ecmult(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_scalar *na, const rustsecp256k1_v0_9_0_scalar *ng);
 
-typedef int (rustsecp256k1_v0_8_1_ecmult_multi_callback)(rustsecp256k1_v0_8_1_scalar *sc, rustsecp256k1_v0_8_1_ge *pt, size_t idx, void *data);
+typedef int (rustsecp256k1_v0_9_0_ecmult_multi_callback)(rustsecp256k1_v0_9_0_scalar *sc, rustsecp256k1_v0_9_0_ge *pt, size_t idx, void *data);
 
 /**
  * Multi-multiply: R = inp_g_sc * G + sum_i ni * Ai.
@@ -56,6 +56,6 @@ typedef int (rustsecp256k1_v0_8_1_ecmult_multi_callback)(rustsecp256k1_v0_8_1_sc
  *          0 if there is not enough scratch space for a single point or
  *          callback returns 0
  */
-static int rustsecp256k1_v0_8_1_ecmult_multi_var(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *inp_g_sc, rustsecp256k1_v0_8_1_ecmult_multi_callback cb, void *cbdata, size_t n);
+static int rustsecp256k1_v0_9_0_ecmult_multi_var(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch *scratch, rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *inp_g_sc, rustsecp256k1_v0_9_0_ecmult_multi_callback cb, void *cbdata, size_t n);
 
 #endif /* SECP256K1_ECMULT_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult_compute_table.h b/secp256k1-sys/depend/secp256k1/src/ecmult_compute_table.h
index 364390d16..aa15616b0 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult_compute_table.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult_compute_table.h
@@ -8,9 +8,9 @@
 #define SECP256K1_ECMULT_COMPUTE_TABLE_H
 
 /* Construct table of all odd multiples of gen in range 1..(2**(window_g-1)-1). */
-static void rustsecp256k1_v0_8_1_ecmult_compute_table(rustsecp256k1_v0_8_1_ge_storage* table, int window_g, const rustsecp256k1_v0_8_1_gej* gen);
+static void rustsecp256k1_v0_9_0_ecmult_compute_table(rustsecp256k1_v0_9_0_ge_storage* table, int window_g, const rustsecp256k1_v0_9_0_gej* gen);
 
-/* Like rustsecp256k1_v0_8_1_ecmult_compute_table, but one for both gen and gen*2^128. */
-static void rustsecp256k1_v0_8_1_ecmult_compute_two_tables(rustsecp256k1_v0_8_1_ge_storage* table, rustsecp256k1_v0_8_1_ge_storage* table_128, int window_g, const rustsecp256k1_v0_8_1_ge* gen);
+/* Like rustsecp256k1_v0_9_0_ecmult_compute_table, but one for both gen and gen*2^128. */
+static void rustsecp256k1_v0_9_0_ecmult_compute_two_tables(rustsecp256k1_v0_9_0_ge_storage* table, rustsecp256k1_v0_9_0_ge_storage* table_128, int window_g, const rustsecp256k1_v0_9_0_ge* gen);
 
 #endif /* SECP256K1_ECMULT_COMPUTE_TABLE_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult_compute_table_impl.h b/secp256k1-sys/depend/secp256k1/src/ecmult_compute_table_impl.h
index b31f5d4eb..c6d9dfd7a 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult_compute_table_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult_compute_table_impl.h
@@ -13,37 +13,37 @@
 #include "ecmult.h"
 #include "util.h"
 
-static void rustsecp256k1_v0_8_1_ecmult_compute_table(rustsecp256k1_v0_8_1_ge_storage* table, int window_g, const rustsecp256k1_v0_8_1_gej* gen) {
-    rustsecp256k1_v0_8_1_gej gj;
-    rustsecp256k1_v0_8_1_ge ge, dgen;
+static void rustsecp256k1_v0_9_0_ecmult_compute_table(rustsecp256k1_v0_9_0_ge_storage* table, int window_g, const rustsecp256k1_v0_9_0_gej* gen) {
+    rustsecp256k1_v0_9_0_gej gj;
+    rustsecp256k1_v0_9_0_ge ge, dgen;
     int j;
 
     gj = *gen;
-    rustsecp256k1_v0_8_1_ge_set_gej_var(&ge, &gj);
-    rustsecp256k1_v0_8_1_ge_to_storage(&table[0], &ge);
+    rustsecp256k1_v0_9_0_ge_set_gej_var(&ge, &gj);
+    rustsecp256k1_v0_9_0_ge_to_storage(&table[0], &ge);
 
-    rustsecp256k1_v0_8_1_gej_double_var(&gj, gen, NULL);
-    rustsecp256k1_v0_8_1_ge_set_gej_var(&dgen, &gj);
+    rustsecp256k1_v0_9_0_gej_double_var(&gj, gen, NULL);
+    rustsecp256k1_v0_9_0_ge_set_gej_var(&dgen, &gj);
 
     for (j = 1; j < ECMULT_TABLE_SIZE(window_g); ++j) {
-        rustsecp256k1_v0_8_1_gej_set_ge(&gj, &ge);
-        rustsecp256k1_v0_8_1_gej_add_ge_var(&gj, &gj, &dgen, NULL);
-        rustsecp256k1_v0_8_1_ge_set_gej_var(&ge, &gj);
-        rustsecp256k1_v0_8_1_ge_to_storage(&table[j], &ge);
+        rustsecp256k1_v0_9_0_gej_set_ge(&gj, &ge);
+        rustsecp256k1_v0_9_0_gej_add_ge_var(&gj, &gj, &dgen, NULL);
+        rustsecp256k1_v0_9_0_ge_set_gej_var(&ge, &gj);
+        rustsecp256k1_v0_9_0_ge_to_storage(&table[j], &ge);
     }
 }
 
-/* Like rustsecp256k1_v0_8_1_ecmult_compute_table, but one for both gen and gen*2^128. */
-static void rustsecp256k1_v0_8_1_ecmult_compute_two_tables(rustsecp256k1_v0_8_1_ge_storage* table, rustsecp256k1_v0_8_1_ge_storage* table_128, int window_g, const rustsecp256k1_v0_8_1_ge* gen) {
-    rustsecp256k1_v0_8_1_gej gj;
+/* Like rustsecp256k1_v0_9_0_ecmult_compute_table, but one for both gen and gen*2^128. */
+static void rustsecp256k1_v0_9_0_ecmult_compute_two_tables(rustsecp256k1_v0_9_0_ge_storage* table, rustsecp256k1_v0_9_0_ge_storage* table_128, int window_g, const rustsecp256k1_v0_9_0_ge* gen) {
+    rustsecp256k1_v0_9_0_gej gj;
     int i;
 
-    rustsecp256k1_v0_8_1_gej_set_ge(&gj, gen);
-    rustsecp256k1_v0_8_1_ecmult_compute_table(table, window_g, &gj);
+    rustsecp256k1_v0_9_0_gej_set_ge(&gj, gen);
+    rustsecp256k1_v0_9_0_ecmult_compute_table(table, window_g, &gj);
     for (i = 0; i < 128; ++i) {
-        rustsecp256k1_v0_8_1_gej_double_var(&gj, &gj, NULL);
+        rustsecp256k1_v0_9_0_gej_double_var(&gj, &gj, NULL);
     }
-    rustsecp256k1_v0_8_1_ecmult_compute_table(table_128, window_g, &gj);
+    rustsecp256k1_v0_9_0_ecmult_compute_table(table_128, window_g, &gj);
 }
 
 #endif /* SECP256K1_ECMULT_COMPUTE_TABLE_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult_const.h b/secp256k1-sys/depend/secp256k1/src/ecmult_const.h
index f25a8942b..1fec12665 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult_const.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult_const.h
@@ -11,11 +11,28 @@
 #include "group.h"
 
 /**
- * Multiply: R = q*A (in constant-time)
- * Here `bits` should be set to the maximum bitlength of the _absolute value_ of `q`, plus
- * one because we internally sometimes add 2 to the number during the WNAF conversion.
- * A must not be infinity.
+ * Multiply: R = q*A (in constant-time for q)
  */
-static void rustsecp256k1_v0_8_1_ecmult_const(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_ge *a, const rustsecp256k1_v0_8_1_scalar *q, int bits);
+static void rustsecp256k1_v0_9_0_ecmult_const(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_ge *a, const rustsecp256k1_v0_9_0_scalar *q);
+
+/**
+ * Same as rustsecp256k1_v0_9_0_ecmult_const, but takes in an x coordinate of the base point
+ * only, specified as fraction n/d (numerator/denominator). Only the x coordinate of the result is
+ * returned.
+ *
+ * If known_on_curve is 0, a verification is performed that n/d is a valid X
+ * coordinate, and 0 is returned if not. Otherwise, 1 is returned.
+ *
+ * d being NULL is interpreted as d=1. If non-NULL, d must not be zero. q must not be zero.
+ *
+ * Constant time in the value of q, but not any other inputs.
+ */
+static int rustsecp256k1_v0_9_0_ecmult_const_xonly(
+    rustsecp256k1_v0_9_0_fe *r,
+    const rustsecp256k1_v0_9_0_fe *n,
+    const rustsecp256k1_v0_9_0_fe *d,
+    const rustsecp256k1_v0_9_0_scalar *q,
+    int known_on_curve
+);
 
 #endif /* SECP256K1_ECMULT_CONST_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult_const_impl.h b/secp256k1-sys/depend/secp256k1/src/ecmult_const_impl.h
index cacd6409b..fa2dbe115 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult_const_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult_const_impl.h
@@ -18,26 +18,26 @@
  *  coordinates as ge_storage points in pre, and stores the global Z in globalz.
  *  It only operates on tables sized for WINDOW_A wnaf multiples.
  */
-static void rustsecp256k1_v0_8_1_ecmult_odd_multiples_table_globalz_windowa(rustsecp256k1_v0_8_1_ge *pre, rustsecp256k1_v0_8_1_fe *globalz, const rustsecp256k1_v0_8_1_gej *a) {
-    rustsecp256k1_v0_8_1_fe zr[ECMULT_TABLE_SIZE(WINDOW_A)];
+static void rustsecp256k1_v0_9_0_ecmult_odd_multiples_table_globalz_windowa(rustsecp256k1_v0_9_0_ge *pre, rustsecp256k1_v0_9_0_fe *globalz, const rustsecp256k1_v0_9_0_gej *a) {
+    rustsecp256k1_v0_9_0_fe zr[ECMULT_TABLE_SIZE(WINDOW_A)];
 
-    rustsecp256k1_v0_8_1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), pre, zr, globalz, a);
-    rustsecp256k1_v0_8_1_ge_table_set_globalz(ECMULT_TABLE_SIZE(WINDOW_A), pre, zr);
+    rustsecp256k1_v0_9_0_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), pre, zr, globalz, a);
+    rustsecp256k1_v0_9_0_ge_table_set_globalz(ECMULT_TABLE_SIZE(WINDOW_A), pre, zr);
 }
 
 /* This is like `ECMULT_TABLE_GET_GE` but is constant time */
 #define ECMULT_CONST_TABLE_GET_GE(r,pre,n,w) do { \
     int m = 0; \
     /* Extract the sign-bit for a constant time absolute-value. */ \
-    int mask = (n) >> (sizeof(n) * CHAR_BIT - 1); \
+    int volatile mask = (n) >> (sizeof(n) * CHAR_BIT - 1); \
     int abs_n = ((n) + mask) ^ mask; \
     int idx_n = abs_n >> 1; \
-    rustsecp256k1_v0_8_1_fe neg_y; \
+    rustsecp256k1_v0_9_0_fe neg_y; \
     VERIFY_CHECK(((n) & 1) == 1); \
     VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \
     VERIFY_CHECK((n) <=  ((1 << ((w)-1)) - 1)); \
-    VERIFY_SETUP(rustsecp256k1_v0_8_1_fe_clear(&(r)->x)); \
-    VERIFY_SETUP(rustsecp256k1_v0_8_1_fe_clear(&(r)->y)); \
+    VERIFY_SETUP(rustsecp256k1_v0_9_0_fe_clear(&(r)->x)); \
+    VERIFY_SETUP(rustsecp256k1_v0_9_0_fe_clear(&(r)->y)); \
     /* Unconditionally set r->x = (pre)[m].x. r->y = (pre)[m].y. because it's either the correct one \
      * or will get replaced in the later iterations, this is needed to make sure `r` is initialized. */ \
     (r)->x = (pre)[m].x; \
@@ -45,12 +45,12 @@ static void rustsecp256k1_v0_8_1_ecmult_odd_multiples_table_globalz_windowa(rust
     for (m = 1; m < ECMULT_TABLE_SIZE(w); m++) { \
         /* This loop is used to avoid secret data in array indices. See
          * the comment in ecmult_gen_impl.h for rationale. */ \
-        rustsecp256k1_v0_8_1_fe_cmov(&(r)->x, &(pre)[m].x, m == idx_n); \
-        rustsecp256k1_v0_8_1_fe_cmov(&(r)->y, &(pre)[m].y, m == idx_n); \
+        rustsecp256k1_v0_9_0_fe_cmov(&(r)->x, &(pre)[m].x, m == idx_n); \
+        rustsecp256k1_v0_9_0_fe_cmov(&(r)->y, &(pre)[m].y, m == idx_n); \
     } \
     (r)->infinity = 0; \
-    rustsecp256k1_v0_8_1_fe_negate(&neg_y, &(r)->y, 1); \
-    rustsecp256k1_v0_8_1_fe_cmov(&(r)->y, &neg_y, (n) != abs_n); \
+    rustsecp256k1_v0_9_0_fe_negate(&neg_y, &(r)->y, 1); \
+    rustsecp256k1_v0_9_0_fe_cmov(&(r)->y, &neg_y, (n) != abs_n); \
 } while(0)
 
 /** Convert a number to WNAF notation.
@@ -66,7 +66,7 @@ static void rustsecp256k1_v0_8_1_ecmult_odd_multiples_table_globalz_windowa(rust
  *
  *  Numbers reference steps of `Algorithm SPA-resistant Width-w NAF with Odd Scalar` on pp. 335
  */
-static int rustsecp256k1_v0_8_1_wnaf_const(int *wnaf, const rustsecp256k1_v0_8_1_scalar *scalar, int w, int size) {
+static int rustsecp256k1_v0_9_0_wnaf_const(int *wnaf, const rustsecp256k1_v0_9_0_scalar *scalar, int w, int size) {
     int global_sign;
     int skew;
     int word = 0;
@@ -76,7 +76,7 @@ static int rustsecp256k1_v0_8_1_wnaf_const(int *wnaf, const rustsecp256k1_v0_8_1
     int u;
 
     int flip;
-    rustsecp256k1_v0_8_1_scalar s = *scalar;
+    rustsecp256k1_v0_9_0_scalar s = *scalar;
 
     VERIFY_CHECK(w > 0);
     VERIFY_CHECK(size > 0);
@@ -93,18 +93,18 @@ static int rustsecp256k1_v0_8_1_wnaf_const(int *wnaf, const rustsecp256k1_v0_8_1
      * particular, to ensure that the outputs from the endomorphism-split fit into
      * 128 bits). If we negate, the parity of our number flips, affecting whether
      * we want to add to the scalar to ensure that it's odd. */
-    flip = rustsecp256k1_v0_8_1_scalar_is_high(&s);
-    skew = flip ^ rustsecp256k1_v0_8_1_scalar_is_even(&s);
-    rustsecp256k1_v0_8_1_scalar_cadd_bit(&s, 0, skew);
-    global_sign = rustsecp256k1_v0_8_1_scalar_cond_negate(&s, flip);
+    flip = rustsecp256k1_v0_9_0_scalar_is_high(&s);
+    skew = flip ^ rustsecp256k1_v0_9_0_scalar_is_even(&s);
+    rustsecp256k1_v0_9_0_scalar_cadd_bit(&s, 0, skew);
+    global_sign = rustsecp256k1_v0_9_0_scalar_cond_negate(&s, flip);
 
     /* 4 */
-    u_last = rustsecp256k1_v0_8_1_scalar_shr_int(&s, w);
+    u_last = rustsecp256k1_v0_9_0_scalar_shr_int(&s, w);
     do {
         int even;
 
         /* 4.1 4.4 */
-        u = rustsecp256k1_v0_8_1_scalar_shr_int(&s, w);
+        u = rustsecp256k1_v0_9_0_scalar_shr_int(&s, w);
         /* 4.2 */
         even = ((u & 1) == 0);
         /* In contrast to the original algorithm, u_last is always > 0 and
@@ -125,39 +125,36 @@ static int rustsecp256k1_v0_8_1_wnaf_const(int *wnaf, const rustsecp256k1_v0_8_1
     } while (word * w < size);
     wnaf[word] = u * global_sign;
 
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(&s));
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(&s));
     VERIFY_CHECK(word == WNAF_SIZE_BITS(size, w));
     return skew;
 }
 
-static void rustsecp256k1_v0_8_1_ecmult_const(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_ge *a, const rustsecp256k1_v0_8_1_scalar *scalar, int size) {
-    rustsecp256k1_v0_8_1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
-    rustsecp256k1_v0_8_1_ge tmpa;
-    rustsecp256k1_v0_8_1_fe Z;
+static void rustsecp256k1_v0_9_0_ecmult_const(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_ge *a, const rustsecp256k1_v0_9_0_scalar *scalar) {
+    rustsecp256k1_v0_9_0_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
+    rustsecp256k1_v0_9_0_ge tmpa;
+    rustsecp256k1_v0_9_0_fe Z;
 
     int skew_1;
-    rustsecp256k1_v0_8_1_ge pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)];
+    rustsecp256k1_v0_9_0_ge pre_a_lam[ECMULT_TABLE_SIZE(WINDOW_A)];
     int wnaf_lam[1 + WNAF_SIZE(WINDOW_A - 1)];
     int skew_lam;
-    rustsecp256k1_v0_8_1_scalar q_1, q_lam;
+    rustsecp256k1_v0_9_0_scalar q_1, q_lam;
     int wnaf_1[1 + WNAF_SIZE(WINDOW_A - 1)];
 
     int i;
 
-    /* build wnaf representation for q. */
-    int rsize = size;
-    if (size > 128) {
-        rsize = 128;
-        /* split q into q_1 and q_lam (where q = q_1 + q_lam*lambda, and q_1 and q_lam are ~128 bit) */
-        rustsecp256k1_v0_8_1_scalar_split_lambda(&q_1, &q_lam, scalar);
-        skew_1   = rustsecp256k1_v0_8_1_wnaf_const(wnaf_1,   &q_1,   WINDOW_A - 1, 128);
-        skew_lam = rustsecp256k1_v0_8_1_wnaf_const(wnaf_lam, &q_lam, WINDOW_A - 1, 128);
-    } else
-    {
-        skew_1   = rustsecp256k1_v0_8_1_wnaf_const(wnaf_1, scalar, WINDOW_A - 1, size);
-        skew_lam = 0;
+    if (rustsecp256k1_v0_9_0_ge_is_infinity(a)) {
+        rustsecp256k1_v0_9_0_gej_set_infinity(r);
+        return;
     }
 
+    /* build wnaf representation for q. */
+    /* split q into q_1 and q_lam (where q = q_1 + q_lam*lambda, and q_1 and q_lam are ~128 bit) */
+    rustsecp256k1_v0_9_0_scalar_split_lambda(&q_1, &q_lam, scalar);
+    skew_1   = rustsecp256k1_v0_9_0_wnaf_const(wnaf_1,   &q_1,   WINDOW_A - 1, 128);
+    skew_lam = rustsecp256k1_v0_9_0_wnaf_const(wnaf_lam, &q_lam, WINDOW_A - 1, 128);
+
     /* Calculate odd multiples of a.
      * All multiples are brought to the same Z 'denominator', which is stored
      * in Z. Due to secp256k1' isomorphism we can do all operations pretending
@@ -165,67 +162,193 @@ static void rustsecp256k1_v0_8_1_ecmult_const(rustsecp256k1_v0_8_1_gej *r, const
      * the Z coordinate of the result once at the end.
      */
     VERIFY_CHECK(!a->infinity);
-    rustsecp256k1_v0_8_1_gej_set_ge(r, a);
-    rustsecp256k1_v0_8_1_ecmult_odd_multiples_table_globalz_windowa(pre_a, &Z, r);
+    rustsecp256k1_v0_9_0_gej_set_ge(r, a);
+    rustsecp256k1_v0_9_0_ecmult_odd_multiples_table_globalz_windowa(pre_a, &Z, r);
     for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
-        rustsecp256k1_v0_8_1_fe_normalize_weak(&pre_a[i].y);
+        rustsecp256k1_v0_9_0_fe_normalize_weak(&pre_a[i].y);
     }
-    if (size > 128) {
-        for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
-            rustsecp256k1_v0_8_1_ge_mul_lambda(&pre_a_lam[i], &pre_a[i]);
-        }
-
+    for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
+        rustsecp256k1_v0_9_0_ge_mul_lambda(&pre_a_lam[i], &pre_a[i]);
     }
 
     /* first loop iteration (separated out so we can directly set r, rather
      * than having it start at infinity, get doubled several times, then have
      * its new value added to it) */
-    i = wnaf_1[WNAF_SIZE_BITS(rsize, WINDOW_A - 1)];
+    i = wnaf_1[WNAF_SIZE_BITS(128, WINDOW_A - 1)];
     VERIFY_CHECK(i != 0);
     ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a, i, WINDOW_A);
-    rustsecp256k1_v0_8_1_gej_set_ge(r, &tmpa);
-    if (size > 128) {
-        i = wnaf_lam[WNAF_SIZE_BITS(rsize, WINDOW_A - 1)];
-        VERIFY_CHECK(i != 0);
-        ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, i, WINDOW_A);
-        rustsecp256k1_v0_8_1_gej_add_ge(r, r, &tmpa);
-    }
+    rustsecp256k1_v0_9_0_gej_set_ge(r, &tmpa);
+    i = wnaf_lam[WNAF_SIZE_BITS(128, WINDOW_A - 1)];
+    VERIFY_CHECK(i != 0);
+    ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, i, WINDOW_A);
+    rustsecp256k1_v0_9_0_gej_add_ge(r, r, &tmpa);
     /* remaining loop iterations */
-    for (i = WNAF_SIZE_BITS(rsize, WINDOW_A - 1) - 1; i >= 0; i--) {
+    for (i = WNAF_SIZE_BITS(128, WINDOW_A - 1) - 1; i >= 0; i--) {
         int n;
         int j;
         for (j = 0; j < WINDOW_A - 1; ++j) {
-            rustsecp256k1_v0_8_1_gej_double(r, r);
+            rustsecp256k1_v0_9_0_gej_double(r, r);
         }
 
         n = wnaf_1[i];
         ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a, n, WINDOW_A);
         VERIFY_CHECK(n != 0);
-        rustsecp256k1_v0_8_1_gej_add_ge(r, r, &tmpa);
-        if (size > 128) {
-            n = wnaf_lam[i];
-            ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, n, WINDOW_A);
-            VERIFY_CHECK(n != 0);
-            rustsecp256k1_v0_8_1_gej_add_ge(r, r, &tmpa);
-        }
+        rustsecp256k1_v0_9_0_gej_add_ge(r, r, &tmpa);
+        n = wnaf_lam[i];
+        ECMULT_CONST_TABLE_GET_GE(&tmpa, pre_a_lam, n, WINDOW_A);
+        VERIFY_CHECK(n != 0);
+        rustsecp256k1_v0_9_0_gej_add_ge(r, r, &tmpa);
     }
 
     {
         /* Correct for wNAF skew */
-        rustsecp256k1_v0_8_1_gej tmpj;
+        rustsecp256k1_v0_9_0_gej tmpj;
+
+        rustsecp256k1_v0_9_0_ge_neg(&tmpa, &pre_a[0]);
+        rustsecp256k1_v0_9_0_gej_add_ge(&tmpj, r, &tmpa);
+        rustsecp256k1_v0_9_0_gej_cmov(r, &tmpj, skew_1);
+
+        rustsecp256k1_v0_9_0_ge_neg(&tmpa, &pre_a_lam[0]);
+        rustsecp256k1_v0_9_0_gej_add_ge(&tmpj, r, &tmpa);
+        rustsecp256k1_v0_9_0_gej_cmov(r, &tmpj, skew_lam);
+    }
+
+    rustsecp256k1_v0_9_0_fe_mul(&r->z, &r->z, &Z);
+}
 
-        rustsecp256k1_v0_8_1_ge_neg(&tmpa, &pre_a[0]);
-        rustsecp256k1_v0_8_1_gej_add_ge(&tmpj, r, &tmpa);
-        rustsecp256k1_v0_8_1_gej_cmov(r, &tmpj, skew_1);
+static int rustsecp256k1_v0_9_0_ecmult_const_xonly(rustsecp256k1_v0_9_0_fe* r, const rustsecp256k1_v0_9_0_fe *n, const rustsecp256k1_v0_9_0_fe *d, const rustsecp256k1_v0_9_0_scalar *q, int known_on_curve) {
 
-        if (size > 128) {
-            rustsecp256k1_v0_8_1_ge_neg(&tmpa, &pre_a_lam[0]);
-            rustsecp256k1_v0_8_1_gej_add_ge(&tmpj, r, &tmpa);
-            rustsecp256k1_v0_8_1_gej_cmov(r, &tmpj, skew_lam);
+    /* This algorithm is a generalization of Peter Dettman's technique for
+     * avoiding the square root in a random-basepoint x-only multiplication
+     * on a Weierstrass curve:
+     * https://mailarchive.ietf.org/arch/msg/cfrg/7DyYY6gg32wDgHAhgSb6XxMDlJA/
+     *
+     *
+     * === Background: the effective affine technique ===
+     *
+     * Let phi_u be the isomorphism that maps (x, y) on secp256k1 curve y^2 = x^3 + 7 to
+     * x' = u^2*x, y' = u^3*y on curve y'^2 = x'^3 + u^6*7. This new curve has the same order as
+     * the original (it is isomorphic), but moreover, has the same addition/doubling formulas, as
+     * the curve b=7 coefficient does not appear in those formulas (or at least does not appear in
+     * the formulas implemented in this codebase, both affine and Jacobian). See also Example 9.5.2
+     * in https://www.math.auckland.ac.nz/~sgal018/crypto-book/ch9.pdf.
+     *
+     * This means any linear combination of secp256k1 points can be computed by applying phi_u
+     * (with non-zero u) on all input points (including the generator, if used), computing the
+     * linear combination on the isomorphic curve (using the same group laws), and then applying
+     * phi_u^{-1} to get back to secp256k1.
+     *
+     * Switching to Jacobian coordinates, note that phi_u applied to (X, Y, Z) is simply
+     * (X, Y, Z/u). Thus, if we want to compute (X1, Y1, Z) + (X2, Y2, Z), with identical Z
+     * coordinates, we can use phi_Z to transform it to (X1, Y1, 1) + (X2, Y2, 1) on an isomorphic
+     * curve where the affine addition formula can be used instead.
+     * If (X3, Y3, Z3) = (X1, Y1) + (X2, Y2) on that curve, then our answer on secp256k1 is
+     * (X3, Y3, Z3*Z).
+     *
+     * This is the effective affine technique: if we have a linear combination of group elements
+     * to compute, and all those group elements have the same Z coordinate, we can simply pretend
+     * that all those Z coordinates are 1, perform the computation that way, and then multiply the
+     * original Z coordinate back in.
+     *
+     * The technique works on any a=0 short Weierstrass curve. It is possible to generalize it to
+     * other curves too, but there the isomorphic curves will have different 'a' coefficients,
+     * which typically does affect the group laws.
+     *
+     *
+     * === Avoiding the square root for x-only point multiplication ===
+     *
+     * In this function, we want to compute the X coordinate of q*(n/d, y), for
+     * y = sqrt((n/d)^3 + 7). Its negation would also be a valid Y coordinate, but by convention
+     * we pick whatever sqrt returns (which we assume to be a deterministic function).
+     *
+     * Let g = y^2*d^3 = n^3 + 7*d^3. This also means y = sqrt(g/d^3).
+     * Further let v = sqrt(d*g), which must exist as d*g = y^2*d^4 = (y*d^2)^2.
+     *
+     * The input point (n/d, y) also has Jacobian coordinates:
+     *
+     *     (n/d, y, 1)
+     *   = (n/d * v^2, y * v^3, v)
+     *   = (n/d * d*g, y * sqrt(d^3*g^3), v)
+     *   = (n/d * d*g, sqrt(y^2 * d^3*g^3), v)
+     *   = (n*g, sqrt(g/d^3 * d^3*g^3), v)
+     *   = (n*g, sqrt(g^4), v)
+     *   = (n*g, g^2, v)
+     *
+     * It is easy to verify that both (n*g, g^2, v) and its negation (n*g, -g^2, v) have affine X
+     * coordinate n/d, and this holds even when the square root function doesn't have a
+     * deterministic sign. We choose the (n*g, g^2, v) version.
+     *
+     * Now switch to the effective affine curve using phi_v, where the input point has coordinates
+     * (n*g, g^2). Compute (X, Y, Z) = q * (n*g, g^2) there.
+     *
+     * Back on secp256k1, that means q * (n*g, g^2, v) = (X, Y, v*Z). This last point has affine X
+     * coordinate X / (v^2*Z^2) = X / (d*g*Z^2). Determining the affine Y coordinate would involve
+     * a square root, but as long as we only care about the resulting X coordinate, no square root
+     * is needed anywhere in this computation.
+     */
+
+    rustsecp256k1_v0_9_0_fe g, i;
+    rustsecp256k1_v0_9_0_ge p;
+    rustsecp256k1_v0_9_0_gej rj;
+
+    /* Compute g = (n^3 + B*d^3). */
+    rustsecp256k1_v0_9_0_fe_sqr(&g, n);
+    rustsecp256k1_v0_9_0_fe_mul(&g, &g, n);
+    if (d) {
+        rustsecp256k1_v0_9_0_fe b;
+#ifdef VERIFY
+        VERIFY_CHECK(!rustsecp256k1_v0_9_0_fe_normalizes_to_zero(d));
+#endif
+        rustsecp256k1_v0_9_0_fe_sqr(&b, d);
+        VERIFY_CHECK(SECP256K1_B <= 8); /* magnitude of b will be <= 8 after the next call */
+        rustsecp256k1_v0_9_0_fe_mul_int(&b, SECP256K1_B);
+        rustsecp256k1_v0_9_0_fe_mul(&b, &b, d);
+        rustsecp256k1_v0_9_0_fe_add(&g, &b);
+        if (!known_on_curve) {
+            /* We need to determine whether (n/d)^3 + 7 is square.
+             *
+             *     is_square((n/d)^3 + 7)
+             * <=> is_square(((n/d)^3 + 7) * d^4)
+             * <=> is_square((n^3 + 7*d^3) * d)
+             * <=> is_square(g * d)
+             */
+            rustsecp256k1_v0_9_0_fe c;
+            rustsecp256k1_v0_9_0_fe_mul(&c, &g, d);
+            if (!rustsecp256k1_v0_9_0_fe_is_square_var(&c)) return 0;
+        }
+    } else {
+        rustsecp256k1_v0_9_0_fe_add_int(&g, SECP256K1_B);
+        if (!known_on_curve) {
+            /* g at this point equals x^3 + 7. Test if it is square. */
+            if (!rustsecp256k1_v0_9_0_fe_is_square_var(&g)) return 0;
         }
     }
 
-    rustsecp256k1_v0_8_1_fe_mul(&r->z, &r->z, &Z);
+    /* Compute base point P = (n*g, g^2), the effective affine version of (n*g, g^2, v), which has
+     * corresponding affine X coordinate n/d. */
+    rustsecp256k1_v0_9_0_fe_mul(&p.x, &g, n);
+    rustsecp256k1_v0_9_0_fe_sqr(&p.y, &g);
+    p.infinity = 0;
+
+    /* Perform x-only EC multiplication of P with q. */
+#ifdef VERIFY
+    VERIFY_CHECK(!rustsecp256k1_v0_9_0_scalar_is_zero(q));
+#endif
+    rustsecp256k1_v0_9_0_ecmult_const(&rj, &p, q);
+#ifdef VERIFY
+    VERIFY_CHECK(!rustsecp256k1_v0_9_0_gej_is_infinity(&rj));
+#endif
+
+    /* The resulting (X, Y, Z) point on the effective-affine isomorphic curve corresponds to
+     * (X, Y, Z*v) on the secp256k1 curve. The affine version of that has X coordinate
+     * (X / (Z^2*d*g)). */
+    rustsecp256k1_v0_9_0_fe_sqr(&i, &rj.z);
+    rustsecp256k1_v0_9_0_fe_mul(&i, &i, &g);
+    if (d) rustsecp256k1_v0_9_0_fe_mul(&i, &i, d);
+    rustsecp256k1_v0_9_0_fe_inv(&i, &i);
+    rustsecp256k1_v0_9_0_fe_mul(r, &rj.x, &i);
+
+    return 1;
 }
 
 #endif /* SECP256K1_ECMULT_CONST_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult_gen.h b/secp256k1-sys/depend/secp256k1/src/ecmult_gen.h
index 5eb021d6c..8d91b2a8d 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult_gen.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult_gen.h
@@ -33,16 +33,16 @@ typedef struct {
     int built;
 
     /* Blinding values used when computing (n-b)G + bG. */
-    rustsecp256k1_v0_8_1_scalar blind; /* -b */
-    rustsecp256k1_v0_8_1_gej initial;  /* bG */
-} rustsecp256k1_v0_8_1_ecmult_gen_context;
+    rustsecp256k1_v0_9_0_scalar blind; /* -b */
+    rustsecp256k1_v0_9_0_gej initial;  /* bG */
+} rustsecp256k1_v0_9_0_ecmult_gen_context;
 
-static void rustsecp256k1_v0_8_1_ecmult_gen_context_build(rustsecp256k1_v0_8_1_ecmult_gen_context* ctx);
-static void rustsecp256k1_v0_8_1_ecmult_gen_context_clear(rustsecp256k1_v0_8_1_ecmult_gen_context* ctx);
+static void rustsecp256k1_v0_9_0_ecmult_gen_context_build(rustsecp256k1_v0_9_0_ecmult_gen_context* ctx);
+static void rustsecp256k1_v0_9_0_ecmult_gen_context_clear(rustsecp256k1_v0_9_0_ecmult_gen_context* ctx);
 
 /** Multiply with the generator: R = a*G */
-static void rustsecp256k1_v0_8_1_ecmult_gen(const rustsecp256k1_v0_8_1_ecmult_gen_context* ctx, rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *a);
+static void rustsecp256k1_v0_9_0_ecmult_gen(const rustsecp256k1_v0_9_0_ecmult_gen_context* ctx, rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *a);
 
-static void rustsecp256k1_v0_8_1_ecmult_gen_blind(rustsecp256k1_v0_8_1_ecmult_gen_context *ctx, const unsigned char *seed32);
+static void rustsecp256k1_v0_9_0_ecmult_gen_blind(rustsecp256k1_v0_9_0_ecmult_gen_context *ctx, const unsigned char *seed32);
 
 #endif /* SECP256K1_ECMULT_GEN_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult_gen_compute_table.h b/secp256k1-sys/depend/secp256k1/src/ecmult_gen_compute_table.h
index 2a4a026c4..0756dad6f 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult_gen_compute_table.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult_gen_compute_table.h
@@ -9,6 +9,6 @@
 
 #include "ecmult_gen.h"
 
-static void rustsecp256k1_v0_8_1_ecmult_gen_compute_table(rustsecp256k1_v0_8_1_ge_storage* table, const rustsecp256k1_v0_8_1_ge* gen, int bits);
+static void rustsecp256k1_v0_9_0_ecmult_gen_compute_table(rustsecp256k1_v0_9_0_ge_storage* table, const rustsecp256k1_v0_9_0_ge* gen, int bits);
 
 #endif /* SECP256K1_ECMULT_GEN_COMPUTE_TABLE_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult_gen_compute_table_impl.h b/secp256k1-sys/depend/secp256k1/src/ecmult_gen_compute_table_impl.h
index 93b7fa759..de9c02fa6 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult_gen_compute_table_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult_gen_compute_table_impl.h
@@ -13,66 +13,69 @@
 #include "ecmult_gen.h"
 #include "util.h"
 
-static void rustsecp256k1_v0_8_1_ecmult_gen_compute_table(rustsecp256k1_v0_8_1_ge_storage* table, const rustsecp256k1_v0_8_1_ge* gen, int bits) {
+static void rustsecp256k1_v0_9_0_ecmult_gen_compute_table(rustsecp256k1_v0_9_0_ge_storage* table, const rustsecp256k1_v0_9_0_ge* gen, int bits) {
     int g = ECMULT_GEN_PREC_G(bits);
     int n = ECMULT_GEN_PREC_N(bits);
 
-    rustsecp256k1_v0_8_1_ge* prec = checked_malloc(&default_error_callback, n * g * sizeof(*prec));
-    rustsecp256k1_v0_8_1_gej gj;
-    rustsecp256k1_v0_8_1_gej nums_gej;
+    rustsecp256k1_v0_9_0_ge* prec = checked_malloc(&default_error_callback, n * g * sizeof(*prec));
+    rustsecp256k1_v0_9_0_gej gj;
+    rustsecp256k1_v0_9_0_gej nums_gej;
     int i, j;
 
+    VERIFY_CHECK(g > 0);
+    VERIFY_CHECK(n > 0);
+
     /* get the generator */
-    rustsecp256k1_v0_8_1_gej_set_ge(&gj, gen);
+    rustsecp256k1_v0_9_0_gej_set_ge(&gj, gen);
 
     /* Construct a group element with no known corresponding scalar (nothing up my sleeve). */
     {
         static const unsigned char nums_b32[33] = "The scalar for this x is unknown";
-        rustsecp256k1_v0_8_1_fe nums_x;
-        rustsecp256k1_v0_8_1_ge nums_ge;
+        rustsecp256k1_v0_9_0_fe nums_x;
+        rustsecp256k1_v0_9_0_ge nums_ge;
         int r;
-        r = rustsecp256k1_v0_8_1_fe_set_b32(&nums_x, nums_b32);
+        r = rustsecp256k1_v0_9_0_fe_set_b32_limit(&nums_x, nums_b32);
         (void)r;
         VERIFY_CHECK(r);
-        r = rustsecp256k1_v0_8_1_ge_set_xo_var(&nums_ge, &nums_x, 0);
+        r = rustsecp256k1_v0_9_0_ge_set_xo_var(&nums_ge, &nums_x, 0);
         (void)r;
         VERIFY_CHECK(r);
-        rustsecp256k1_v0_8_1_gej_set_ge(&nums_gej, &nums_ge);
+        rustsecp256k1_v0_9_0_gej_set_ge(&nums_gej, &nums_ge);
         /* Add G to make the bits in x uniformly distributed. */
-        rustsecp256k1_v0_8_1_gej_add_ge_var(&nums_gej, &nums_gej, gen, NULL);
+        rustsecp256k1_v0_9_0_gej_add_ge_var(&nums_gej, &nums_gej, gen, NULL);
     }
 
     /* compute prec. */
     {
-        rustsecp256k1_v0_8_1_gej gbase;
-        rustsecp256k1_v0_8_1_gej numsbase;
-        rustsecp256k1_v0_8_1_gej* precj = checked_malloc(&default_error_callback, n * g * sizeof(*precj));  /* Jacobian versions of prec. */
+        rustsecp256k1_v0_9_0_gej gbase;
+        rustsecp256k1_v0_9_0_gej numsbase;
+        rustsecp256k1_v0_9_0_gej* precj = checked_malloc(&default_error_callback, n * g * sizeof(*precj));  /* Jacobian versions of prec. */
         gbase = gj; /* PREC_G^j * G */
         numsbase = nums_gej; /* 2^j * nums. */
         for (j = 0; j < n; j++) {
             /* Set precj[j*PREC_G .. j*PREC_G+(PREC_G-1)] to (numsbase, numsbase + gbase, ..., numsbase + (PREC_G-1)*gbase). */
             precj[j*g] = numsbase;
             for (i = 1; i < g; i++) {
-                rustsecp256k1_v0_8_1_gej_add_var(&precj[j*g + i], &precj[j*g + i - 1], &gbase, NULL);
+                rustsecp256k1_v0_9_0_gej_add_var(&precj[j*g + i], &precj[j*g + i - 1], &gbase, NULL);
             }
             /* Multiply gbase by PREC_G. */
             for (i = 0; i < bits; i++) {
-                rustsecp256k1_v0_8_1_gej_double_var(&gbase, &gbase, NULL);
+                rustsecp256k1_v0_9_0_gej_double_var(&gbase, &gbase, NULL);
             }
             /* Multiply numbase by 2. */
-            rustsecp256k1_v0_8_1_gej_double_var(&numsbase, &numsbase, NULL);
+            rustsecp256k1_v0_9_0_gej_double_var(&numsbase, &numsbase, NULL);
             if (j == n - 2) {
                 /* In the last iteration, numsbase is (1 - 2^j) * nums instead. */
-                rustsecp256k1_v0_8_1_gej_neg(&numsbase, &numsbase);
-                rustsecp256k1_v0_8_1_gej_add_var(&numsbase, &numsbase, &nums_gej, NULL);
+                rustsecp256k1_v0_9_0_gej_neg(&numsbase, &numsbase);
+                rustsecp256k1_v0_9_0_gej_add_var(&numsbase, &numsbase, &nums_gej, NULL);
             }
         }
-        rustsecp256k1_v0_8_1_ge_set_all_gej_var(prec, precj, n * g);
+        rustsecp256k1_v0_9_0_ge_set_all_gej_var(prec, precj, n * g);
         free(precj);
     }
     for (j = 0; j < n; j++) {
         for (i = 0; i < g; i++) {
-            rustsecp256k1_v0_8_1_ge_to_storage(&table[j*g + i], &prec[j*g + i]);
+            rustsecp256k1_v0_9_0_ge_to_storage(&table[j*g + i], &prec[j*g + i]);
         }
     }
     free(prec);
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult_gen_impl.h b/secp256k1-sys/depend/secp256k1/src/ecmult_gen_impl.h
index f94ebf1f5..8b1f29473 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult_gen_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult_gen_impl.h
@@ -14,19 +14,19 @@
 #include "hash_impl.h"
 #include "precomputed_ecmult_gen.h"
 
-static void rustsecp256k1_v0_8_1_ecmult_gen_context_build(rustsecp256k1_v0_8_1_ecmult_gen_context *ctx) {
-    rustsecp256k1_v0_8_1_ecmult_gen_blind(ctx, NULL);
+static void rustsecp256k1_v0_9_0_ecmult_gen_context_build(rustsecp256k1_v0_9_0_ecmult_gen_context *ctx) {
+    rustsecp256k1_v0_9_0_ecmult_gen_blind(ctx, NULL);
     ctx->built = 1;
 }
 
-static int rustsecp256k1_v0_8_1_ecmult_gen_context_is_built(const rustsecp256k1_v0_8_1_ecmult_gen_context* ctx) {
+static int rustsecp256k1_v0_9_0_ecmult_gen_context_is_built(const rustsecp256k1_v0_9_0_ecmult_gen_context* ctx) {
     return ctx->built;
 }
 
-static void rustsecp256k1_v0_8_1_ecmult_gen_context_clear(rustsecp256k1_v0_8_1_ecmult_gen_context *ctx) {
+static void rustsecp256k1_v0_9_0_ecmult_gen_context_clear(rustsecp256k1_v0_9_0_ecmult_gen_context *ctx) {
     ctx->built = 0;
-    rustsecp256k1_v0_8_1_scalar_clear(&ctx->blind);
-    rustsecp256k1_v0_8_1_gej_clear(&ctx->initial);
+    rustsecp256k1_v0_9_0_scalar_clear(&ctx->blind);
+    rustsecp256k1_v0_9_0_gej_clear(&ctx->initial);
 }
 
 /* For accelerating the computation of a*G:
@@ -40,25 +40,25 @@ static void rustsecp256k1_v0_8_1_ecmult_gen_context_clear(rustsecp256k1_v0_8_1_e
  * precomputed (call it prec(i, n_i)). The formula now becomes sum(prec(i, n_i), i=0 ... PREC_N-1).
  * None of the resulting prec group elements have a known scalar, and neither do any of
  * the intermediate sums while computing a*G.
- * The prec values are stored in rustsecp256k1_v0_8_1_ecmult_gen_prec_table[i][n_i] = n_i * (PREC_G)^i * G + U_i.
+ * The prec values are stored in rustsecp256k1_v0_9_0_ecmult_gen_prec_table[i][n_i] = n_i * (PREC_G)^i * G + U_i.
  */
-static void rustsecp256k1_v0_8_1_ecmult_gen(const rustsecp256k1_v0_8_1_ecmult_gen_context *ctx, rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *gn) {
+static void rustsecp256k1_v0_9_0_ecmult_gen(const rustsecp256k1_v0_9_0_ecmult_gen_context *ctx, rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *gn) {
     int bits = ECMULT_GEN_PREC_BITS;
     int g = ECMULT_GEN_PREC_G(bits);
     int n = ECMULT_GEN_PREC_N(bits);
 
-    rustsecp256k1_v0_8_1_ge add;
-    rustsecp256k1_v0_8_1_ge_storage adds;
-    rustsecp256k1_v0_8_1_scalar gnb;
+    rustsecp256k1_v0_9_0_ge add;
+    rustsecp256k1_v0_9_0_ge_storage adds;
+    rustsecp256k1_v0_9_0_scalar gnb;
     int i, j, n_i;
     
     memset(&adds, 0, sizeof(adds));
     *r = ctx->initial;
     /* Blind scalar/point multiplication by computing (n-b)G + bG instead of nG. */
-    rustsecp256k1_v0_8_1_scalar_add(&gnb, gn, &ctx->blind);
+    rustsecp256k1_v0_9_0_scalar_add(&gnb, gn, &ctx->blind);
     add.infinity = 0;
     for (i = 0; i < n; i++) {
-        n_i = rustsecp256k1_v0_8_1_scalar_get_bits(&gnb, i * bits, bits);
+        n_i = rustsecp256k1_v0_9_0_scalar_get_bits(&gnb, i * bits, bits);
         for (j = 0; j < g; j++) {
             /** This uses a conditional move to avoid any secret data in array indexes.
              *   _Any_ use of secret indexes has been demonstrated to result in timing
@@ -70,64 +70,61 @@ static void rustsecp256k1_v0_8_1_ecmult_gen(const rustsecp256k1_v0_8_1_ecmult_ge
              *    by Dag Arne Osvik, Adi Shamir, and Eran Tromer
              *    (https://www.tau.ac.il/~tromer/papers/cache.pdf)
              */
-            rustsecp256k1_v0_8_1_ge_storage_cmov(&adds, &rustsecp256k1_v0_8_1_ecmult_gen_prec_table[i][j], j == n_i);
+            rustsecp256k1_v0_9_0_ge_storage_cmov(&adds, &rustsecp256k1_v0_9_0_ecmult_gen_prec_table[i][j], j == n_i);
         }
-        rustsecp256k1_v0_8_1_ge_from_storage(&add, &adds);
-        rustsecp256k1_v0_8_1_gej_add_ge(r, r, &add);
+        rustsecp256k1_v0_9_0_ge_from_storage(&add, &adds);
+        rustsecp256k1_v0_9_0_gej_add_ge(r, r, &add);
     }
     n_i = 0;
-    rustsecp256k1_v0_8_1_ge_clear(&add);
-    rustsecp256k1_v0_8_1_scalar_clear(&gnb);
+    rustsecp256k1_v0_9_0_ge_clear(&add);
+    rustsecp256k1_v0_9_0_scalar_clear(&gnb);
 }
 
-/* Setup blinding values for rustsecp256k1_v0_8_1_ecmult_gen. */
-static void rustsecp256k1_v0_8_1_ecmult_gen_blind(rustsecp256k1_v0_8_1_ecmult_gen_context *ctx, const unsigned char *seed32) {
-    rustsecp256k1_v0_8_1_scalar b;
-    rustsecp256k1_v0_8_1_gej gb;
-    rustsecp256k1_v0_8_1_fe s;
+/* Setup blinding values for rustsecp256k1_v0_9_0_ecmult_gen. */
+static void rustsecp256k1_v0_9_0_ecmult_gen_blind(rustsecp256k1_v0_9_0_ecmult_gen_context *ctx, const unsigned char *seed32) {
+    rustsecp256k1_v0_9_0_scalar b;
+    rustsecp256k1_v0_9_0_gej gb;
+    rustsecp256k1_v0_9_0_fe s;
     unsigned char nonce32[32];
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 rng;
-    int overflow;
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 rng;
     unsigned char keydata[64];
     if (seed32 == NULL) {
         /* When seed is NULL, reset the initial point and blinding value. */
-        rustsecp256k1_v0_8_1_gej_set_ge(&ctx->initial, &rustsecp256k1_v0_8_1_ge_const_g);
-        rustsecp256k1_v0_8_1_gej_neg(&ctx->initial, &ctx->initial);
-        rustsecp256k1_v0_8_1_scalar_set_int(&ctx->blind, 1);
+        rustsecp256k1_v0_9_0_gej_set_ge(&ctx->initial, &rustsecp256k1_v0_9_0_ge_const_g);
+        rustsecp256k1_v0_9_0_gej_neg(&ctx->initial, &ctx->initial);
+        rustsecp256k1_v0_9_0_scalar_set_int(&ctx->blind, 1);
         return;
     }
     /* The prior blinding value (if not reset) is chained forward by including it in the hash. */
-    rustsecp256k1_v0_8_1_scalar_get_b32(keydata, &ctx->blind);
+    rustsecp256k1_v0_9_0_scalar_get_b32(keydata, &ctx->blind);
     /** Using a CSPRNG allows a failure free interface, avoids needing large amounts of random data,
      *   and guards against weak or adversarial seeds.  This is a simpler and safer interface than
      *   asking the caller for blinding values directly and expecting them to retry on failure.
      */
     VERIFY_CHECK(seed32 != NULL);
     memcpy(keydata + 32, seed32, 32);
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_initialize(&rng, keydata, 64);
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_initialize(&rng, keydata, 64);
     memset(keydata, 0, sizeof(keydata));
-    /* Accept unobservably small non-uniformity. */
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
-    overflow = !rustsecp256k1_v0_8_1_fe_set_b32(&s, nonce32);
-    overflow |= rustsecp256k1_v0_8_1_fe_is_zero(&s);
-    rustsecp256k1_v0_8_1_fe_cmov(&s, &rustsecp256k1_v0_8_1_fe_one, overflow);
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
+    rustsecp256k1_v0_9_0_fe_set_b32_mod(&s, nonce32);
+    rustsecp256k1_v0_9_0_fe_cmov(&s, &rustsecp256k1_v0_9_0_fe_one, rustsecp256k1_v0_9_0_fe_normalizes_to_zero(&s));
     /* Randomize the projection to defend against multiplier sidechannels.
-       Do this before our own call to rustsecp256k1_v0_8_1_ecmult_gen below. */
-    rustsecp256k1_v0_8_1_gej_rescale(&ctx->initial, &s);
-    rustsecp256k1_v0_8_1_fe_clear(&s);
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
-    rustsecp256k1_v0_8_1_scalar_set_b32(&b, nonce32, NULL);
+       Do this before our own call to rustsecp256k1_v0_9_0_ecmult_gen below. */
+    rustsecp256k1_v0_9_0_gej_rescale(&ctx->initial, &s);
+    rustsecp256k1_v0_9_0_fe_clear(&s);
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&b, nonce32, NULL);
     /* A blinding value of 0 works, but would undermine the projection hardening. */
-    rustsecp256k1_v0_8_1_scalar_cmov(&b, &rustsecp256k1_v0_8_1_scalar_one, rustsecp256k1_v0_8_1_scalar_is_zero(&b));
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_finalize(&rng);
+    rustsecp256k1_v0_9_0_scalar_cmov(&b, &rustsecp256k1_v0_9_0_scalar_one, rustsecp256k1_v0_9_0_scalar_is_zero(&b));
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_finalize(&rng);
     memset(nonce32, 0, 32);
     /* The random projection in ctx->initial ensures that gb will have a random projection. */
-    rustsecp256k1_v0_8_1_ecmult_gen(ctx, &gb, &b);
-    rustsecp256k1_v0_8_1_scalar_negate(&b, &b);
+    rustsecp256k1_v0_9_0_ecmult_gen(ctx, &gb, &b);
+    rustsecp256k1_v0_9_0_scalar_negate(&b, &b);
     ctx->blind = b;
     ctx->initial = gb;
-    rustsecp256k1_v0_8_1_scalar_clear(&b);
-    rustsecp256k1_v0_8_1_gej_clear(&gb);
+    rustsecp256k1_v0_9_0_scalar_clear(&b);
+    rustsecp256k1_v0_9_0_gej_clear(&gb);
 }
 
 #endif /* SECP256K1_ECMULT_GEN_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/ecmult_impl.h b/secp256k1-sys/depend/secp256k1/src/ecmult_impl.h
index 636cbe470..dda532939 100644
--- a/secp256k1-sys/depend/secp256k1/src/ecmult_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/ecmult_impl.h
@@ -33,8 +33,8 @@
 /** Larger values for ECMULT_WINDOW_SIZE result in possibly better
  *  performance at the cost of an exponentially larger precomputed
  *  table. The exact table size is
- *      (1 << (WINDOW_G - 2)) * sizeof(rustsecp256k1_v0_8_1_ge_storage)  bytes,
- *  where sizeof(rustsecp256k1_v0_8_1_ge_storage) is typically 64 bytes but can
+ *      (1 << (WINDOW_G - 2)) * sizeof(rustsecp256k1_v0_9_0_ge_storage)  bytes,
+ *  where sizeof(rustsecp256k1_v0_9_0_ge_storage) is typically 64 bytes but can
  *  be larger due to platform-specific padding and alignment.
  *  Two tables of this size are used (due to the endomorphism
  *  optimization).
@@ -70,14 +70,14 @@
  *  Lastly the zr[0] value, which isn't used above, is set so that:
  *  - a.z = z(pre_a[0]) / zr[0]
  */
-static void rustsecp256k1_v0_8_1_ecmult_odd_multiples_table(int n, rustsecp256k1_v0_8_1_ge *pre_a, rustsecp256k1_v0_8_1_fe *zr, rustsecp256k1_v0_8_1_fe *z, const rustsecp256k1_v0_8_1_gej *a) {
-    rustsecp256k1_v0_8_1_gej d, ai;
-    rustsecp256k1_v0_8_1_ge d_ge;
+static void rustsecp256k1_v0_9_0_ecmult_odd_multiples_table(int n, rustsecp256k1_v0_9_0_ge *pre_a, rustsecp256k1_v0_9_0_fe *zr, rustsecp256k1_v0_9_0_fe *z, const rustsecp256k1_v0_9_0_gej *a) {
+    rustsecp256k1_v0_9_0_gej d, ai;
+    rustsecp256k1_v0_9_0_ge d_ge;
     int i;
 
     VERIFY_CHECK(!a->infinity);
 
-    rustsecp256k1_v0_8_1_gej_double_var(&d, a, NULL);
+    rustsecp256k1_v0_9_0_gej_double_var(&d, a, NULL);
 
     /*
      * Perform the additions using an isomorphic curve Y^2 = X^3 + 7*C^6 where C := d.z.
@@ -90,62 +90,65 @@ static void rustsecp256k1_v0_8_1_ecmult_odd_multiples_table(int n, rustsecp256k1
      *
      * The group addition functions work correctly on these isomorphic curves.
      * In particular phi(d) is easy to represent in affine coordinates under this isomorphism.
-     * This lets us use the faster rustsecp256k1_v0_8_1_gej_add_ge_var group addition function that we wouldn't be able to use otherwise.
+     * This lets us use the faster rustsecp256k1_v0_9_0_gej_add_ge_var group addition function that we wouldn't be able to use otherwise.
      */
-    rustsecp256k1_v0_8_1_ge_set_xy(&d_ge, &d.x, &d.y);
-    rustsecp256k1_v0_8_1_ge_set_gej_zinv(&pre_a[0], a, &d.z);
-    rustsecp256k1_v0_8_1_gej_set_ge(&ai, &pre_a[0]);
+    rustsecp256k1_v0_9_0_ge_set_xy(&d_ge, &d.x, &d.y);
+    rustsecp256k1_v0_9_0_ge_set_gej_zinv(&pre_a[0], a, &d.z);
+    rustsecp256k1_v0_9_0_gej_set_ge(&ai, &pre_a[0]);
     ai.z = a->z;
 
-    /* pre_a[0] is the point (a.x*C^2, a.y*C^3, a.z*C) which is equvalent to a.
+    /* pre_a[0] is the point (a.x*C^2, a.y*C^3, a.z*C) which is equivalent to a.
      * Set zr[0] to C, which is the ratio between the omitted z(pre_a[0]) value and a.z.
      */
     zr[0] = d.z;
 
     for (i = 1; i < n; i++) {
-        rustsecp256k1_v0_8_1_gej_add_ge_var(&ai, &ai, &d_ge, &zr[i]);
-        rustsecp256k1_v0_8_1_ge_set_xy(&pre_a[i], &ai.x, &ai.y);
+        rustsecp256k1_v0_9_0_gej_add_ge_var(&ai, &ai, &d_ge, &zr[i]);
+        rustsecp256k1_v0_9_0_ge_set_xy(&pre_a[i], &ai.x, &ai.y);
     }
 
     /* Multiply the last z-coordinate by C to undo the isomorphism.
      * Since the z-coordinates of the pre_a values are implied by the zr array of z-coordinate ratios,
      * undoing the isomorphism here undoes the isomorphism for all pre_a values.
      */
-    rustsecp256k1_v0_8_1_fe_mul(z, &ai.z, &d.z);
+    rustsecp256k1_v0_9_0_fe_mul(z, &ai.z, &d.z);
 }
 
-#define SECP256K1_ECMULT_TABLE_VERIFY(n,w) \
-    VERIFY_CHECK(((n) & 1) == 1); \
-    VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1)); \
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_ecmult_table_verify(int n, int w) {
+    (void)n;
+    (void)w;
+    VERIFY_CHECK(((n) & 1) == 1);
+    VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1));
     VERIFY_CHECK((n) <=  ((1 << ((w)-1)) - 1));
+}
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_ecmult_table_get_ge(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_ge *pre, int n, int w) {
-    SECP256K1_ECMULT_TABLE_VERIFY(n,w)
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_ecmult_table_get_ge(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge *pre, int n, int w) {
+    rustsecp256k1_v0_9_0_ecmult_table_verify(n,w);
     if (n > 0) {
         *r = pre[(n-1)/2];
     } else {
         *r = pre[(-n-1)/2];
-        rustsecp256k1_v0_8_1_fe_negate(&(r->y), &(r->y), 1);
+        rustsecp256k1_v0_9_0_fe_negate(&(r->y), &(r->y), 1);
     }
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_ecmult_table_get_ge_lambda(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_ge *pre, const rustsecp256k1_v0_8_1_fe *x, int n, int w) {
-    SECP256K1_ECMULT_TABLE_VERIFY(n,w)
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_ecmult_table_get_ge_lambda(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge *pre, const rustsecp256k1_v0_9_0_fe *x, int n, int w) {
+    rustsecp256k1_v0_9_0_ecmult_table_verify(n,w);
     if (n > 0) {
-        rustsecp256k1_v0_8_1_ge_set_xy(r, &x[(n-1)/2], &pre[(n-1)/2].y);
+        rustsecp256k1_v0_9_0_ge_set_xy(r, &x[(n-1)/2], &pre[(n-1)/2].y);
     } else {
-        rustsecp256k1_v0_8_1_ge_set_xy(r, &x[(-n-1)/2], &pre[(-n-1)/2].y);
-        rustsecp256k1_v0_8_1_fe_negate(&(r->y), &(r->y), 1);
+        rustsecp256k1_v0_9_0_ge_set_xy(r, &x[(-n-1)/2], &pre[(-n-1)/2].y);
+        rustsecp256k1_v0_9_0_fe_negate(&(r->y), &(r->y), 1);
     }
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_ecmult_table_get_ge_storage(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_ge_storage *pre, int n, int w) {
-    SECP256K1_ECMULT_TABLE_VERIFY(n,w)
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_ecmult_table_get_ge_storage(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge_storage *pre, int n, int w) {
+    rustsecp256k1_v0_9_0_ecmult_table_verify(n,w);
     if (n > 0) {
-        rustsecp256k1_v0_8_1_ge_from_storage(r, &pre[(n-1)/2]);
+        rustsecp256k1_v0_9_0_ge_from_storage(r, &pre[(n-1)/2]);
     } else {
-        rustsecp256k1_v0_8_1_ge_from_storage(r, &pre[(-n-1)/2]);
-        rustsecp256k1_v0_8_1_fe_negate(&(r->y), &(r->y), 1);
+        rustsecp256k1_v0_9_0_ge_from_storage(r, &pre[(-n-1)/2]);
+        rustsecp256k1_v0_9_0_fe_negate(&(r->y), &(r->y), 1);
     }
 }
 
@@ -156,8 +159,8 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_ecmult_table_get_ge_storage(ru
  *  - the number of set values in wnaf is returned. This number is at most 256, and at most one more
  *    than the number of bits in the (absolute value) of the input.
  */
-static int rustsecp256k1_v0_8_1_ecmult_wnaf(int *wnaf, int len, const rustsecp256k1_v0_8_1_scalar *a, int w) {
-    rustsecp256k1_v0_8_1_scalar s;
+static int rustsecp256k1_v0_9_0_ecmult_wnaf(int *wnaf, int len, const rustsecp256k1_v0_9_0_scalar *a, int w) {
+    rustsecp256k1_v0_9_0_scalar s;
     int last_set_bit = -1;
     int bit = 0;
     int sign = 1;
@@ -171,15 +174,15 @@ static int rustsecp256k1_v0_8_1_ecmult_wnaf(int *wnaf, int len, const rustsecp25
     memset(wnaf, 0, len * sizeof(wnaf[0]));
 
     s = *a;
-    if (rustsecp256k1_v0_8_1_scalar_get_bits(&s, 255, 1)) {
-        rustsecp256k1_v0_8_1_scalar_negate(&s, &s);
+    if (rustsecp256k1_v0_9_0_scalar_get_bits(&s, 255, 1)) {
+        rustsecp256k1_v0_9_0_scalar_negate(&s, &s);
         sign = -1;
     }
 
     while (bit < len) {
         int now;
         int word;
-        if (rustsecp256k1_v0_8_1_scalar_get_bits(&s, bit, 1) == (unsigned int)carry) {
+        if (rustsecp256k1_v0_9_0_scalar_get_bits(&s, bit, 1) == (unsigned int)carry) {
             bit++;
             continue;
         }
@@ -189,7 +192,7 @@ static int rustsecp256k1_v0_8_1_ecmult_wnaf(int *wnaf, int len, const rustsecp25
             now = len - bit;
         }
 
-        word = rustsecp256k1_v0_8_1_scalar_get_bits_var(&s, bit, now) + carry;
+        word = rustsecp256k1_v0_9_0_scalar_get_bits_var(&s, bit, now) + carry;
 
         carry = (word >> (w-1)) & 1;
         word -= carry << w;
@@ -206,7 +209,7 @@ static int rustsecp256k1_v0_8_1_ecmult_wnaf(int *wnaf, int len, const rustsecp25
         VERIFY_CHECK(carry == 0);
 
         while (verify_bit < 256) {
-            VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_get_bits(&s, verify_bit, 1) == 0);
+            VERIFY_CHECK(rustsecp256k1_v0_9_0_scalar_get_bits(&s, verify_bit, 1) == 0);
             verify_bit++;
         }
     }
@@ -214,25 +217,25 @@ static int rustsecp256k1_v0_8_1_ecmult_wnaf(int *wnaf, int len, const rustsecp25
     return last_set_bit + 1;
 }
 
-struct rustsecp256k1_v0_8_1_strauss_point_state {
+struct rustsecp256k1_v0_9_0_strauss_point_state {
     int wnaf_na_1[129];
     int wnaf_na_lam[129];
     int bits_na_1;
     int bits_na_lam;
 };
 
-struct rustsecp256k1_v0_8_1_strauss_state {
+struct rustsecp256k1_v0_9_0_strauss_state {
     /* aux is used to hold z-ratios, and then used to hold pre_a[i].x * BETA values. */
-    rustsecp256k1_v0_8_1_fe* aux;
-    rustsecp256k1_v0_8_1_ge* pre_a;
-    struct rustsecp256k1_v0_8_1_strauss_point_state* ps;
+    rustsecp256k1_v0_9_0_fe* aux;
+    rustsecp256k1_v0_9_0_ge* pre_a;
+    struct rustsecp256k1_v0_9_0_strauss_point_state* ps;
 };
 
-static void rustsecp256k1_v0_8_1_ecmult_strauss_wnaf(const struct rustsecp256k1_v0_8_1_strauss_state *state, rustsecp256k1_v0_8_1_gej *r, size_t num, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_scalar *na, const rustsecp256k1_v0_8_1_scalar *ng) {
-    rustsecp256k1_v0_8_1_ge tmpa;
-    rustsecp256k1_v0_8_1_fe Z;
+static void rustsecp256k1_v0_9_0_ecmult_strauss_wnaf(const struct rustsecp256k1_v0_9_0_strauss_state *state, rustsecp256k1_v0_9_0_gej *r, size_t num, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_scalar *na, const rustsecp256k1_v0_9_0_scalar *ng) {
+    rustsecp256k1_v0_9_0_ge tmpa;
+    rustsecp256k1_v0_9_0_fe Z;
     /* Split G factors. */
-    rustsecp256k1_v0_8_1_scalar ng_1, ng_128;
+    rustsecp256k1_v0_9_0_scalar ng_1, ng_128;
     int wnaf_ng_1[129];
     int bits_ng_1 = 0;
     int wnaf_ng_128[129];
@@ -242,19 +245,19 @@ static void rustsecp256k1_v0_8_1_ecmult_strauss_wnaf(const struct rustsecp256k1_
     size_t np;
     size_t no = 0;
 
-    rustsecp256k1_v0_8_1_fe_set_int(&Z, 1);
+    rustsecp256k1_v0_9_0_fe_set_int(&Z, 1);
     for (np = 0; np < num; ++np) {
-        rustsecp256k1_v0_8_1_gej tmp;
-        rustsecp256k1_v0_8_1_scalar na_1, na_lam;
-        if (rustsecp256k1_v0_8_1_scalar_is_zero(&na[np]) || rustsecp256k1_v0_8_1_gej_is_infinity(&a[np])) {
+        rustsecp256k1_v0_9_0_gej tmp;
+        rustsecp256k1_v0_9_0_scalar na_1, na_lam;
+        if (rustsecp256k1_v0_9_0_scalar_is_zero(&na[np]) || rustsecp256k1_v0_9_0_gej_is_infinity(&a[np])) {
             continue;
         }
         /* split na into na_1 and na_lam (where na = na_1 + na_lam*lambda, and na_1 and na_lam are ~128 bit) */
-        rustsecp256k1_v0_8_1_scalar_split_lambda(&na_1, &na_lam, &na[np]);
+        rustsecp256k1_v0_9_0_scalar_split_lambda(&na_1, &na_lam, &na[np]);
 
         /* build wnaf representation for na_1 and na_lam. */
-        state->ps[no].bits_na_1   = rustsecp256k1_v0_8_1_ecmult_wnaf(state->ps[no].wnaf_na_1,   129, &na_1,   WINDOW_A);
-        state->ps[no].bits_na_lam = rustsecp256k1_v0_8_1_ecmult_wnaf(state->ps[no].wnaf_na_lam, 129, &na_lam, WINDOW_A);
+        state->ps[no].bits_na_1   = rustsecp256k1_v0_9_0_ecmult_wnaf(state->ps[no].wnaf_na_1,   129, &na_1,   WINDOW_A);
+        state->ps[no].bits_na_lam = rustsecp256k1_v0_9_0_ecmult_wnaf(state->ps[no].wnaf_na_lam, 129, &na_lam, WINDOW_A);
         VERIFY_CHECK(state->ps[no].bits_na_1 <= 129);
         VERIFY_CHECK(state->ps[no].bits_na_lam <= 129);
         if (state->ps[no].bits_na_1 > bits) {
@@ -271,38 +274,37 @@ static void rustsecp256k1_v0_8_1_ecmult_strauss_wnaf(const struct rustsecp256k1_
          * the Z coordinate of the result once at the end.
          * The exception is the precomputed G table points, which are actually
          * affine. Compared to the base used for other points, they have a Z ratio
-         * of 1/Z, so we can use rustsecp256k1_v0_8_1_gej_add_zinv_var, which uses the same
+         * of 1/Z, so we can use rustsecp256k1_v0_9_0_gej_add_zinv_var, which uses the same
          * isomorphism to efficiently add with a known Z inverse.
          */
         tmp = a[np];
         if (no) {
-#ifdef VERIFY
-            rustsecp256k1_v0_8_1_fe_normalize_var(&Z);
-#endif
-            rustsecp256k1_v0_8_1_gej_rescale(&tmp, &Z);
+            rustsecp256k1_v0_9_0_gej_rescale(&tmp, &Z);
         }
-        rustsecp256k1_v0_8_1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
-        if (no) rustsecp256k1_v0_8_1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
+        rustsecp256k1_v0_9_0_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
+        if (no) rustsecp256k1_v0_9_0_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
 
         ++no;
     }
 
     /* Bring them to the same Z denominator. */
-    rustsecp256k1_v0_8_1_ge_table_set_globalz(ECMULT_TABLE_SIZE(WINDOW_A) * no, state->pre_a, state->aux);
+    if (no) {
+        rustsecp256k1_v0_9_0_ge_table_set_globalz(ECMULT_TABLE_SIZE(WINDOW_A) * no, state->pre_a, state->aux);
+    }
 
     for (np = 0; np < no; ++np) {
         for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
-            rustsecp256k1_v0_8_1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + i], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + i].x, &rustsecp256k1_v0_8_1_const_beta);
+            rustsecp256k1_v0_9_0_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + i], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + i].x, &rustsecp256k1_v0_9_0_const_beta);
         }
     }
 
     if (ng) {
         /* split ng into ng_1 and ng_128 (where gn = gn_1 + gn_128*2^128, and gn_1 and gn_128 are ~128 bit) */
-        rustsecp256k1_v0_8_1_scalar_split_128(&ng_1, &ng_128, ng);
+        rustsecp256k1_v0_9_0_scalar_split_128(&ng_1, &ng_128, ng);
 
         /* Build wnaf representation for ng_1 and ng_128 */
-        bits_ng_1   = rustsecp256k1_v0_8_1_ecmult_wnaf(wnaf_ng_1,   129, &ng_1,   WINDOW_G);
-        bits_ng_128 = rustsecp256k1_v0_8_1_ecmult_wnaf(wnaf_ng_128, 129, &ng_128, WINDOW_G);
+        bits_ng_1   = rustsecp256k1_v0_9_0_ecmult_wnaf(wnaf_ng_1,   129, &ng_1,   WINDOW_G);
+        bits_ng_128 = rustsecp256k1_v0_9_0_ecmult_wnaf(wnaf_ng_128, 129, &ng_128, WINDOW_G);
         if (bits_ng_1 > bits) {
             bits = bits_ng_1;
         }
@@ -311,61 +313,61 @@ static void rustsecp256k1_v0_8_1_ecmult_strauss_wnaf(const struct rustsecp256k1_
         }
     }
 
-    rustsecp256k1_v0_8_1_gej_set_infinity(r);
+    rustsecp256k1_v0_9_0_gej_set_infinity(r);
 
     for (i = bits - 1; i >= 0; i--) {
         int n;
-        rustsecp256k1_v0_8_1_gej_double_var(r, r, NULL);
+        rustsecp256k1_v0_9_0_gej_double_var(r, r, NULL);
         for (np = 0; np < no; ++np) {
             if (i < state->ps[np].bits_na_1 && (n = state->ps[np].wnaf_na_1[i])) {
-                rustsecp256k1_v0_8_1_ecmult_table_get_ge(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
-                rustsecp256k1_v0_8_1_gej_add_ge_var(r, r, &tmpa, NULL);
+                rustsecp256k1_v0_9_0_ecmult_table_get_ge(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
+                rustsecp256k1_v0_9_0_gej_add_ge_var(r, r, &tmpa, NULL);
             }
             if (i < state->ps[np].bits_na_lam && (n = state->ps[np].wnaf_na_lam[i])) {
-                rustsecp256k1_v0_8_1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
-                rustsecp256k1_v0_8_1_gej_add_ge_var(r, r, &tmpa, NULL);
+                rustsecp256k1_v0_9_0_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
+                rustsecp256k1_v0_9_0_gej_add_ge_var(r, r, &tmpa, NULL);
             }
         }
         if (i < bits_ng_1 && (n = wnaf_ng_1[i])) {
-            rustsecp256k1_v0_8_1_ecmult_table_get_ge_storage(&tmpa, rustsecp256k1_v0_8_1_pre_g, n, WINDOW_G);
-            rustsecp256k1_v0_8_1_gej_add_zinv_var(r, r, &tmpa, &Z);
+            rustsecp256k1_v0_9_0_ecmult_table_get_ge_storage(&tmpa, rustsecp256k1_v0_9_0_pre_g, n, WINDOW_G);
+            rustsecp256k1_v0_9_0_gej_add_zinv_var(r, r, &tmpa, &Z);
         }
         if (i < bits_ng_128 && (n = wnaf_ng_128[i])) {
-            rustsecp256k1_v0_8_1_ecmult_table_get_ge_storage(&tmpa, rustsecp256k1_v0_8_1_pre_g_128, n, WINDOW_G);
-            rustsecp256k1_v0_8_1_gej_add_zinv_var(r, r, &tmpa, &Z);
+            rustsecp256k1_v0_9_0_ecmult_table_get_ge_storage(&tmpa, rustsecp256k1_v0_9_0_pre_g_128, n, WINDOW_G);
+            rustsecp256k1_v0_9_0_gej_add_zinv_var(r, r, &tmpa, &Z);
         }
     }
 
     if (!r->infinity) {
-        rustsecp256k1_v0_8_1_fe_mul(&r->z, &r->z, &Z);
+        rustsecp256k1_v0_9_0_fe_mul(&r->z, &r->z, &Z);
     }
 }
 
-static void rustsecp256k1_v0_8_1_ecmult(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_scalar *na, const rustsecp256k1_v0_8_1_scalar *ng) {
-    rustsecp256k1_v0_8_1_fe aux[ECMULT_TABLE_SIZE(WINDOW_A)];
-    rustsecp256k1_v0_8_1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
-    struct rustsecp256k1_v0_8_1_strauss_point_state ps[1];
-    struct rustsecp256k1_v0_8_1_strauss_state state;
+static void rustsecp256k1_v0_9_0_ecmult(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_scalar *na, const rustsecp256k1_v0_9_0_scalar *ng) {
+    rustsecp256k1_v0_9_0_fe aux[ECMULT_TABLE_SIZE(WINDOW_A)];
+    rustsecp256k1_v0_9_0_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
+    struct rustsecp256k1_v0_9_0_strauss_point_state ps[1];
+    struct rustsecp256k1_v0_9_0_strauss_state state;
 
     state.aux = aux;
     state.pre_a = pre_a;
     state.ps = ps;
-    rustsecp256k1_v0_8_1_ecmult_strauss_wnaf(&state, r, 1, a, na, ng);
+    rustsecp256k1_v0_9_0_ecmult_strauss_wnaf(&state, r, 1, a, na, ng);
 }
 
-static size_t rustsecp256k1_v0_8_1_strauss_scratch_size(size_t n_points) {
-    static const size_t point_size = (sizeof(rustsecp256k1_v0_8_1_ge) + sizeof(rustsecp256k1_v0_8_1_fe)) * ECMULT_TABLE_SIZE(WINDOW_A) + sizeof(struct rustsecp256k1_v0_8_1_strauss_point_state) + sizeof(rustsecp256k1_v0_8_1_gej) + sizeof(rustsecp256k1_v0_8_1_scalar);
+static size_t rustsecp256k1_v0_9_0_strauss_scratch_size(size_t n_points) {
+    static const size_t point_size = (sizeof(rustsecp256k1_v0_9_0_ge) + sizeof(rustsecp256k1_v0_9_0_fe)) * ECMULT_TABLE_SIZE(WINDOW_A) + sizeof(struct rustsecp256k1_v0_9_0_strauss_point_state) + sizeof(rustsecp256k1_v0_9_0_gej) + sizeof(rustsecp256k1_v0_9_0_scalar);
     return n_points*point_size;
 }
 
-static int rustsecp256k1_v0_8_1_ecmult_strauss_batch(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *inp_g_sc, rustsecp256k1_v0_8_1_ecmult_multi_callback cb, void *cbdata, size_t n_points, size_t cb_offset) {
-    rustsecp256k1_v0_8_1_gej* points;
-    rustsecp256k1_v0_8_1_scalar* scalars;
-    struct rustsecp256k1_v0_8_1_strauss_state state;
+static int rustsecp256k1_v0_9_0_ecmult_strauss_batch(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch *scratch, rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *inp_g_sc, rustsecp256k1_v0_9_0_ecmult_multi_callback cb, void *cbdata, size_t n_points, size_t cb_offset) {
+    rustsecp256k1_v0_9_0_gej* points;
+    rustsecp256k1_v0_9_0_scalar* scalars;
+    struct rustsecp256k1_v0_9_0_strauss_state state;
     size_t i;
-    const size_t scratch_checkpoint = rustsecp256k1_v0_8_1_scratch_checkpoint(error_callback, scratch);
+    const size_t scratch_checkpoint = rustsecp256k1_v0_9_0_scratch_checkpoint(error_callback, scratch);
 
-    rustsecp256k1_v0_8_1_gej_set_infinity(r);
+    rustsecp256k1_v0_9_0_gej_set_infinity(r);
     if (inp_g_sc == NULL && n_points == 0) {
         return 1;
     }
@@ -373,37 +375,37 @@ static int rustsecp256k1_v0_8_1_ecmult_strauss_batch(const rustsecp256k1_v0_8_1_
     /* We allocate STRAUSS_SCRATCH_OBJECTS objects on the scratch space. If these
      * allocations change, make sure to update the STRAUSS_SCRATCH_OBJECTS
      * constant and strauss_scratch_size accordingly. */
-    points = (rustsecp256k1_v0_8_1_gej*)rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, n_points * sizeof(rustsecp256k1_v0_8_1_gej));
-    scalars = (rustsecp256k1_v0_8_1_scalar*)rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, n_points * sizeof(rustsecp256k1_v0_8_1_scalar));
-    state.aux = (rustsecp256k1_v0_8_1_fe*)rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, n_points * ECMULT_TABLE_SIZE(WINDOW_A) * sizeof(rustsecp256k1_v0_8_1_fe));
-    state.pre_a = (rustsecp256k1_v0_8_1_ge*)rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, n_points * ECMULT_TABLE_SIZE(WINDOW_A) * sizeof(rustsecp256k1_v0_8_1_ge));
-    state.ps = (struct rustsecp256k1_v0_8_1_strauss_point_state*)rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, n_points * sizeof(struct rustsecp256k1_v0_8_1_strauss_point_state));
+    points = (rustsecp256k1_v0_9_0_gej*)rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, n_points * sizeof(rustsecp256k1_v0_9_0_gej));
+    scalars = (rustsecp256k1_v0_9_0_scalar*)rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, n_points * sizeof(rustsecp256k1_v0_9_0_scalar));
+    state.aux = (rustsecp256k1_v0_9_0_fe*)rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, n_points * ECMULT_TABLE_SIZE(WINDOW_A) * sizeof(rustsecp256k1_v0_9_0_fe));
+    state.pre_a = (rustsecp256k1_v0_9_0_ge*)rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, n_points * ECMULT_TABLE_SIZE(WINDOW_A) * sizeof(rustsecp256k1_v0_9_0_ge));
+    state.ps = (struct rustsecp256k1_v0_9_0_strauss_point_state*)rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, n_points * sizeof(struct rustsecp256k1_v0_9_0_strauss_point_state));
 
     if (points == NULL || scalars == NULL || state.aux == NULL || state.pre_a == NULL || state.ps == NULL) {
-        rustsecp256k1_v0_8_1_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
+        rustsecp256k1_v0_9_0_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
         return 0;
     }
 
     for (i = 0; i < n_points; i++) {
-        rustsecp256k1_v0_8_1_ge point;
+        rustsecp256k1_v0_9_0_ge point;
         if (!cb(&scalars[i], &point, i+cb_offset, cbdata)) {
-            rustsecp256k1_v0_8_1_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
+            rustsecp256k1_v0_9_0_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
             return 0;
         }
-        rustsecp256k1_v0_8_1_gej_set_ge(&points[i], &point);
+        rustsecp256k1_v0_9_0_gej_set_ge(&points[i], &point);
     }
-    rustsecp256k1_v0_8_1_ecmult_strauss_wnaf(&state, r, n_points, points, scalars, inp_g_sc);
-    rustsecp256k1_v0_8_1_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
+    rustsecp256k1_v0_9_0_ecmult_strauss_wnaf(&state, r, n_points, points, scalars, inp_g_sc);
+    rustsecp256k1_v0_9_0_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
     return 1;
 }
 
-/* Wrapper for rustsecp256k1_v0_8_1_ecmult_multi_func interface */
-static int rustsecp256k1_v0_8_1_ecmult_strauss_batch_single(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *inp_g_sc, rustsecp256k1_v0_8_1_ecmult_multi_callback cb, void *cbdata, size_t n) {
-    return rustsecp256k1_v0_8_1_ecmult_strauss_batch(error_callback, scratch, r, inp_g_sc, cb, cbdata, n, 0);
+/* Wrapper for rustsecp256k1_v0_9_0_ecmult_multi_func interface */
+static int rustsecp256k1_v0_9_0_ecmult_strauss_batch_single(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch *scratch, rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *inp_g_sc, rustsecp256k1_v0_9_0_ecmult_multi_callback cb, void *cbdata, size_t n) {
+    return rustsecp256k1_v0_9_0_ecmult_strauss_batch(error_callback, scratch, r, inp_g_sc, cb, cbdata, n, 0);
 }
 
-static size_t rustsecp256k1_v0_8_1_strauss_max_points(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch *scratch) {
-    return rustsecp256k1_v0_8_1_scratch_max_allocation(error_callback, scratch, STRAUSS_SCRATCH_OBJECTS) / rustsecp256k1_v0_8_1_strauss_scratch_size(1);
+static size_t rustsecp256k1_v0_9_0_strauss_max_points(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch *scratch) {
+    return rustsecp256k1_v0_9_0_scratch_max_allocation(error_callback, scratch, STRAUSS_SCRATCH_OBJECTS) / rustsecp256k1_v0_9_0_strauss_scratch_size(1);
 }
 
 /** Convert a number to WNAF notation.
@@ -413,25 +415,25 @@ static size_t rustsecp256k1_v0_8_1_strauss_max_points(const rustsecp256k1_v0_8_1
  *  - the number of words set is always WNAF_SIZE(w)
  *  - the returned skew is 0 or 1
  */
-static int rustsecp256k1_v0_8_1_wnaf_fixed(int *wnaf, const rustsecp256k1_v0_8_1_scalar *s, int w) {
+static int rustsecp256k1_v0_9_0_wnaf_fixed(int *wnaf, const rustsecp256k1_v0_9_0_scalar *s, int w) {
     int skew = 0;
     int pos;
     int max_pos;
     int last_w;
-    const rustsecp256k1_v0_8_1_scalar *work = s;
+    const rustsecp256k1_v0_9_0_scalar *work = s;
 
-    if (rustsecp256k1_v0_8_1_scalar_is_zero(s)) {
+    if (rustsecp256k1_v0_9_0_scalar_is_zero(s)) {
         for (pos = 0; pos < WNAF_SIZE(w); pos++) {
             wnaf[pos] = 0;
         }
         return 0;
     }
 
-    if (rustsecp256k1_v0_8_1_scalar_is_even(s)) {
+    if (rustsecp256k1_v0_9_0_scalar_is_even(s)) {
         skew = 1;
     }
 
-    wnaf[0] = rustsecp256k1_v0_8_1_scalar_get_bits_var(work, 0, w) + skew;
+    wnaf[0] = rustsecp256k1_v0_9_0_scalar_get_bits_var(work, 0, w) + skew;
     /* Compute last window size. Relevant when window size doesn't divide the
      * number of bits in the scalar */
     last_w = WNAF_BITS - (WNAF_SIZE(w) - 1) * w;
@@ -439,7 +441,7 @@ static int rustsecp256k1_v0_8_1_wnaf_fixed(int *wnaf, const rustsecp256k1_v0_8_1
     /* Store the position of the first nonzero word in max_pos to allow
      * skipping leading zeros when calculating the wnaf. */
     for (pos = WNAF_SIZE(w) - 1; pos > 0; pos--) {
-        int val = rustsecp256k1_v0_8_1_scalar_get_bits_var(work, pos * w, pos == WNAF_SIZE(w)-1 ? last_w : w);
+        int val = rustsecp256k1_v0_9_0_scalar_get_bits_var(work, pos * w, pos == WNAF_SIZE(w)-1 ? last_w : w);
         if(val != 0) {
             break;
         }
@@ -449,7 +451,7 @@ static int rustsecp256k1_v0_8_1_wnaf_fixed(int *wnaf, const rustsecp256k1_v0_8_1
     pos = 1;
 
     while (pos <= max_pos) {
-        int val = rustsecp256k1_v0_8_1_scalar_get_bits_var(work, pos * w, pos == WNAF_SIZE(w)-1 ? last_w : w);
+        int val = rustsecp256k1_v0_9_0_scalar_get_bits_var(work, pos * w, pos == WNAF_SIZE(w)-1 ? last_w : w);
         if ((val & 1) == 0) {
             wnaf[pos - 1] -= (1 << w);
             wnaf[pos] = (val + 1);
@@ -475,14 +477,14 @@ static int rustsecp256k1_v0_8_1_wnaf_fixed(int *wnaf, const rustsecp256k1_v0_8_1
     return skew;
 }
 
-struct rustsecp256k1_v0_8_1_pippenger_point_state {
+struct rustsecp256k1_v0_9_0_pippenger_point_state {
     int skew_na;
     size_t input_pos;
 };
 
-struct rustsecp256k1_v0_8_1_pippenger_state {
+struct rustsecp256k1_v0_9_0_pippenger_state {
     int *wnaf_na;
-    struct rustsecp256k1_v0_8_1_pippenger_point_state* ps;
+    struct rustsecp256k1_v0_9_0_pippenger_point_state* ps;
 };
 
 /*
@@ -492,7 +494,7 @@ struct rustsecp256k1_v0_8_1_pippenger_state {
  * to the point's wnaf[i]. Second, the buckets are added together such that
  * r += 1*bucket[0] + 3*bucket[1] + 5*bucket[2] + ...
  */
-static int rustsecp256k1_v0_8_1_ecmult_pippenger_wnaf(rustsecp256k1_v0_8_1_gej *buckets, int bucket_window, struct rustsecp256k1_v0_8_1_pippenger_state *state, rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *sc, const rustsecp256k1_v0_8_1_ge *pt, size_t num) {
+static int rustsecp256k1_v0_9_0_ecmult_pippenger_wnaf(rustsecp256k1_v0_9_0_gej *buckets, int bucket_window, struct rustsecp256k1_v0_9_0_pippenger_state *state, rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *sc, const rustsecp256k1_v0_9_0_ge *pt, size_t num) {
     size_t n_wnaf = WNAF_SIZE(bucket_window+1);
     size_t np;
     size_t no = 0;
@@ -500,55 +502,55 @@ static int rustsecp256k1_v0_8_1_ecmult_pippenger_wnaf(rustsecp256k1_v0_8_1_gej *
     int j;
 
     for (np = 0; np < num; ++np) {
-        if (rustsecp256k1_v0_8_1_scalar_is_zero(&sc[np]) || rustsecp256k1_v0_8_1_ge_is_infinity(&pt[np])) {
+        if (rustsecp256k1_v0_9_0_scalar_is_zero(&sc[np]) || rustsecp256k1_v0_9_0_ge_is_infinity(&pt[np])) {
             continue;
         }
         state->ps[no].input_pos = np;
-        state->ps[no].skew_na = rustsecp256k1_v0_8_1_wnaf_fixed(&state->wnaf_na[no*n_wnaf], &sc[np], bucket_window+1);
+        state->ps[no].skew_na = rustsecp256k1_v0_9_0_wnaf_fixed(&state->wnaf_na[no*n_wnaf], &sc[np], bucket_window+1);
         no++;
     }
-    rustsecp256k1_v0_8_1_gej_set_infinity(r);
+    rustsecp256k1_v0_9_0_gej_set_infinity(r);
 
     if (no == 0) {
         return 1;
     }
 
     for (i = n_wnaf - 1; i >= 0; i--) {
-        rustsecp256k1_v0_8_1_gej running_sum;
+        rustsecp256k1_v0_9_0_gej running_sum;
 
         for(j = 0; j < ECMULT_TABLE_SIZE(bucket_window+2); j++) {
-            rustsecp256k1_v0_8_1_gej_set_infinity(&buckets[j]);
+            rustsecp256k1_v0_9_0_gej_set_infinity(&buckets[j]);
         }
 
         for (np = 0; np < no; ++np) {
             int n = state->wnaf_na[np*n_wnaf + i];
-            struct rustsecp256k1_v0_8_1_pippenger_point_state point_state = state->ps[np];
-            rustsecp256k1_v0_8_1_ge tmp;
+            struct rustsecp256k1_v0_9_0_pippenger_point_state point_state = state->ps[np];
+            rustsecp256k1_v0_9_0_ge tmp;
             int idx;
 
             if (i == 0) {
                 /* correct for wnaf skew */
                 int skew = point_state.skew_na;
                 if (skew) {
-                    rustsecp256k1_v0_8_1_ge_neg(&tmp, &pt[point_state.input_pos]);
-                    rustsecp256k1_v0_8_1_gej_add_ge_var(&buckets[0], &buckets[0], &tmp, NULL);
+                    rustsecp256k1_v0_9_0_ge_neg(&tmp, &pt[point_state.input_pos]);
+                    rustsecp256k1_v0_9_0_gej_add_ge_var(&buckets[0], &buckets[0], &tmp, NULL);
                 }
             }
             if (n > 0) {
                 idx = (n - 1)/2;
-                rustsecp256k1_v0_8_1_gej_add_ge_var(&buckets[idx], &buckets[idx], &pt[point_state.input_pos], NULL);
+                rustsecp256k1_v0_9_0_gej_add_ge_var(&buckets[idx], &buckets[idx], &pt[point_state.input_pos], NULL);
             } else if (n < 0) {
                 idx = -(n + 1)/2;
-                rustsecp256k1_v0_8_1_ge_neg(&tmp, &pt[point_state.input_pos]);
-                rustsecp256k1_v0_8_1_gej_add_ge_var(&buckets[idx], &buckets[idx], &tmp, NULL);
+                rustsecp256k1_v0_9_0_ge_neg(&tmp, &pt[point_state.input_pos]);
+                rustsecp256k1_v0_9_0_gej_add_ge_var(&buckets[idx], &buckets[idx], &tmp, NULL);
             }
         }
 
         for(j = 0; j < bucket_window; j++) {
-            rustsecp256k1_v0_8_1_gej_double_var(r, r, NULL);
+            rustsecp256k1_v0_9_0_gej_double_var(r, r, NULL);
         }
 
-        rustsecp256k1_v0_8_1_gej_set_infinity(&running_sum);
+        rustsecp256k1_v0_9_0_gej_set_infinity(&running_sum);
         /* Accumulate the sum: bucket[0] + 3*bucket[1] + 5*bucket[2] + 7*bucket[3] + ...
          *                   = bucket[0] +   bucket[1] +   bucket[2] +   bucket[3] + ...
          *                   +         2 *  (bucket[1] + 2*bucket[2] + 3*bucket[3] + ...)
@@ -558,13 +560,13 @@ static int rustsecp256k1_v0_8_1_ecmult_pippenger_wnaf(rustsecp256k1_v0_8_1_gej *
          * The doubling is done implicitly by deferring the final window doubling (of 'r').
          */
         for(j = ECMULT_TABLE_SIZE(bucket_window+2) - 1; j > 0; j--) {
-            rustsecp256k1_v0_8_1_gej_add_var(&running_sum, &running_sum, &buckets[j], NULL);
-            rustsecp256k1_v0_8_1_gej_add_var(r, r, &running_sum, NULL);
+            rustsecp256k1_v0_9_0_gej_add_var(&running_sum, &running_sum, &buckets[j], NULL);
+            rustsecp256k1_v0_9_0_gej_add_var(r, r, &running_sum, NULL);
         }
 
-        rustsecp256k1_v0_8_1_gej_add_var(&running_sum, &running_sum, &buckets[0], NULL);
-        rustsecp256k1_v0_8_1_gej_double_var(r, r, NULL);
-        rustsecp256k1_v0_8_1_gej_add_var(r, r, &running_sum, NULL);
+        rustsecp256k1_v0_9_0_gej_add_var(&running_sum, &running_sum, &buckets[0], NULL);
+        rustsecp256k1_v0_9_0_gej_double_var(r, r, NULL);
+        rustsecp256k1_v0_9_0_gej_add_var(r, r, &running_sum, NULL);
     }
     return 1;
 }
@@ -573,7 +575,7 @@ static int rustsecp256k1_v0_8_1_ecmult_pippenger_wnaf(rustsecp256k1_v0_8_1_gej *
  * Returns optimal bucket_window (number of bits of a scalar represented by a
  * set of buckets) for a given number of points.
  */
-static int rustsecp256k1_v0_8_1_pippenger_bucket_window(size_t n) {
+static int rustsecp256k1_v0_9_0_pippenger_bucket_window(size_t n) {
     if (n <= 1) {
         return 1;
     } else if (n <= 4) {
@@ -602,7 +604,7 @@ static int rustsecp256k1_v0_8_1_pippenger_bucket_window(size_t n) {
 /**
  * Returns the maximum optimal number of points for a bucket_window.
  */
-static size_t rustsecp256k1_v0_8_1_pippenger_bucket_window_inv(int bucket_window) {
+static size_t rustsecp256k1_v0_9_0_pippenger_bucket_window_inv(int bucket_window) {
     switch(bucket_window) {
         case 1: return 1;
         case 2: return 4;
@@ -621,18 +623,18 @@ static size_t rustsecp256k1_v0_8_1_pippenger_bucket_window_inv(int bucket_window
 }
 
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_ecmult_endo_split(rustsecp256k1_v0_8_1_scalar *s1, rustsecp256k1_v0_8_1_scalar *s2, rustsecp256k1_v0_8_1_ge *p1, rustsecp256k1_v0_8_1_ge *p2) {
-    rustsecp256k1_v0_8_1_scalar tmp = *s1;
-    rustsecp256k1_v0_8_1_scalar_split_lambda(s1, s2, &tmp);
-    rustsecp256k1_v0_8_1_ge_mul_lambda(p2, p1);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_ecmult_endo_split(rustsecp256k1_v0_9_0_scalar *s1, rustsecp256k1_v0_9_0_scalar *s2, rustsecp256k1_v0_9_0_ge *p1, rustsecp256k1_v0_9_0_ge *p2) {
+    rustsecp256k1_v0_9_0_scalar tmp = *s1;
+    rustsecp256k1_v0_9_0_scalar_split_lambda(s1, s2, &tmp);
+    rustsecp256k1_v0_9_0_ge_mul_lambda(p2, p1);
 
-    if (rustsecp256k1_v0_8_1_scalar_is_high(s1)) {
-        rustsecp256k1_v0_8_1_scalar_negate(s1, s1);
-        rustsecp256k1_v0_8_1_ge_neg(p1, p1);
+    if (rustsecp256k1_v0_9_0_scalar_is_high(s1)) {
+        rustsecp256k1_v0_9_0_scalar_negate(s1, s1);
+        rustsecp256k1_v0_9_0_ge_neg(p1, p1);
     }
-    if (rustsecp256k1_v0_8_1_scalar_is_high(s2)) {
-        rustsecp256k1_v0_8_1_scalar_negate(s2, s2);
-        rustsecp256k1_v0_8_1_ge_neg(p2, p2);
+    if (rustsecp256k1_v0_9_0_scalar_is_high(s2)) {
+        rustsecp256k1_v0_9_0_scalar_negate(s2, s2);
+        rustsecp256k1_v0_9_0_ge_neg(p2, p2);
     }
 }
 
@@ -640,91 +642,91 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_ecmult_endo_split(rustsecp256k
  * Returns the scratch size required for a given number of points (excluding
  * base point G) without considering alignment.
  */
-static size_t rustsecp256k1_v0_8_1_pippenger_scratch_size(size_t n_points, int bucket_window) {
+static size_t rustsecp256k1_v0_9_0_pippenger_scratch_size(size_t n_points, int bucket_window) {
     size_t entries = 2*n_points + 2;
-    size_t entry_size = sizeof(rustsecp256k1_v0_8_1_ge) + sizeof(rustsecp256k1_v0_8_1_scalar) + sizeof(struct rustsecp256k1_v0_8_1_pippenger_point_state) + (WNAF_SIZE(bucket_window+1)+1)*sizeof(int);
-    return (sizeof(rustsecp256k1_v0_8_1_gej) << bucket_window) + sizeof(struct rustsecp256k1_v0_8_1_pippenger_state) + entries * entry_size;
+    size_t entry_size = sizeof(rustsecp256k1_v0_9_0_ge) + sizeof(rustsecp256k1_v0_9_0_scalar) + sizeof(struct rustsecp256k1_v0_9_0_pippenger_point_state) + (WNAF_SIZE(bucket_window+1)+1)*sizeof(int);
+    return (sizeof(rustsecp256k1_v0_9_0_gej) << bucket_window) + sizeof(struct rustsecp256k1_v0_9_0_pippenger_state) + entries * entry_size;
 }
 
-static int rustsecp256k1_v0_8_1_ecmult_pippenger_batch(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *inp_g_sc, rustsecp256k1_v0_8_1_ecmult_multi_callback cb, void *cbdata, size_t n_points, size_t cb_offset) {
-    const size_t scratch_checkpoint = rustsecp256k1_v0_8_1_scratch_checkpoint(error_callback, scratch);
+static int rustsecp256k1_v0_9_0_ecmult_pippenger_batch(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch *scratch, rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *inp_g_sc, rustsecp256k1_v0_9_0_ecmult_multi_callback cb, void *cbdata, size_t n_points, size_t cb_offset) {
+    const size_t scratch_checkpoint = rustsecp256k1_v0_9_0_scratch_checkpoint(error_callback, scratch);
     /* Use 2(n+1) with the endomorphism, when calculating batch
      * sizes. The reason for +1 is that we add the G scalar to the list of
      * other scalars. */
     size_t entries = 2*n_points + 2;
-    rustsecp256k1_v0_8_1_ge *points;
-    rustsecp256k1_v0_8_1_scalar *scalars;
-    rustsecp256k1_v0_8_1_gej *buckets;
-    struct rustsecp256k1_v0_8_1_pippenger_state *state_space;
+    rustsecp256k1_v0_9_0_ge *points;
+    rustsecp256k1_v0_9_0_scalar *scalars;
+    rustsecp256k1_v0_9_0_gej *buckets;
+    struct rustsecp256k1_v0_9_0_pippenger_state *state_space;
     size_t idx = 0;
     size_t point_idx = 0;
     int i, j;
     int bucket_window;
 
-    rustsecp256k1_v0_8_1_gej_set_infinity(r);
+    rustsecp256k1_v0_9_0_gej_set_infinity(r);
     if (inp_g_sc == NULL && n_points == 0) {
         return 1;
     }
-    bucket_window = rustsecp256k1_v0_8_1_pippenger_bucket_window(n_points);
+    bucket_window = rustsecp256k1_v0_9_0_pippenger_bucket_window(n_points);
 
     /* We allocate PIPPENGER_SCRATCH_OBJECTS objects on the scratch space. If
      * these allocations change, make sure to update the
      * PIPPENGER_SCRATCH_OBJECTS constant and pippenger_scratch_size
      * accordingly. */
-    points = (rustsecp256k1_v0_8_1_ge *) rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, entries * sizeof(*points));
-    scalars = (rustsecp256k1_v0_8_1_scalar *) rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, entries * sizeof(*scalars));
-    state_space = (struct rustsecp256k1_v0_8_1_pippenger_state *) rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, sizeof(*state_space));
+    points = (rustsecp256k1_v0_9_0_ge *) rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, entries * sizeof(*points));
+    scalars = (rustsecp256k1_v0_9_0_scalar *) rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, entries * sizeof(*scalars));
+    state_space = (struct rustsecp256k1_v0_9_0_pippenger_state *) rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, sizeof(*state_space));
     if (points == NULL || scalars == NULL || state_space == NULL) {
-        rustsecp256k1_v0_8_1_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
+        rustsecp256k1_v0_9_0_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
         return 0;
     }
-    state_space->ps = (struct rustsecp256k1_v0_8_1_pippenger_point_state *) rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, entries * sizeof(*state_space->ps));
-    state_space->wnaf_na = (int *) rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, entries*(WNAF_SIZE(bucket_window+1)) * sizeof(int));
-    buckets = (rustsecp256k1_v0_8_1_gej *) rustsecp256k1_v0_8_1_scratch_alloc(error_callback, scratch, (1<<bucket_window) * sizeof(*buckets));
+    state_space->ps = (struct rustsecp256k1_v0_9_0_pippenger_point_state *) rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, entries * sizeof(*state_space->ps));
+    state_space->wnaf_na = (int *) rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, entries*(WNAF_SIZE(bucket_window+1)) * sizeof(int));
+    buckets = (rustsecp256k1_v0_9_0_gej *) rustsecp256k1_v0_9_0_scratch_alloc(error_callback, scratch, ((size_t)1 << bucket_window) * sizeof(*buckets));
     if (state_space->ps == NULL || state_space->wnaf_na == NULL || buckets == NULL) {
-        rustsecp256k1_v0_8_1_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
+        rustsecp256k1_v0_9_0_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
         return 0;
     }
 
     if (inp_g_sc != NULL) {
         scalars[0] = *inp_g_sc;
-        points[0] = rustsecp256k1_v0_8_1_ge_const_g;
+        points[0] = rustsecp256k1_v0_9_0_ge_const_g;
         idx++;
-        rustsecp256k1_v0_8_1_ecmult_endo_split(&scalars[0], &scalars[1], &points[0], &points[1]);
+        rustsecp256k1_v0_9_0_ecmult_endo_split(&scalars[0], &scalars[1], &points[0], &points[1]);
         idx++;
     }
 
     while (point_idx < n_points) {
         if (!cb(&scalars[idx], &points[idx], point_idx + cb_offset, cbdata)) {
-            rustsecp256k1_v0_8_1_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
+            rustsecp256k1_v0_9_0_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
             return 0;
         }
         idx++;
-        rustsecp256k1_v0_8_1_ecmult_endo_split(&scalars[idx - 1], &scalars[idx], &points[idx - 1], &points[idx]);
+        rustsecp256k1_v0_9_0_ecmult_endo_split(&scalars[idx - 1], &scalars[idx], &points[idx - 1], &points[idx]);
         idx++;
         point_idx++;
     }
 
-    rustsecp256k1_v0_8_1_ecmult_pippenger_wnaf(buckets, bucket_window, state_space, r, scalars, points, idx);
+    rustsecp256k1_v0_9_0_ecmult_pippenger_wnaf(buckets, bucket_window, state_space, r, scalars, points, idx);
 
     /* Clear data */
     for(i = 0; (size_t)i < idx; i++) {
-        rustsecp256k1_v0_8_1_scalar_clear(&scalars[i]);
+        rustsecp256k1_v0_9_0_scalar_clear(&scalars[i]);
         state_space->ps[i].skew_na = 0;
         for(j = 0; j < WNAF_SIZE(bucket_window+1); j++) {
             state_space->wnaf_na[i * WNAF_SIZE(bucket_window+1) + j] = 0;
         }
     }
     for(i = 0; i < 1<<bucket_window; i++) {
-        rustsecp256k1_v0_8_1_gej_clear(&buckets[i]);
+        rustsecp256k1_v0_9_0_gej_clear(&buckets[i]);
     }
-    rustsecp256k1_v0_8_1_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
+    rustsecp256k1_v0_9_0_scratch_apply_checkpoint(error_callback, scratch, scratch_checkpoint);
     return 1;
 }
 
-/* Wrapper for rustsecp256k1_v0_8_1_ecmult_multi_func interface */
-static int rustsecp256k1_v0_8_1_ecmult_pippenger_batch_single(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *inp_g_sc, rustsecp256k1_v0_8_1_ecmult_multi_callback cb, void *cbdata, size_t n) {
-    return rustsecp256k1_v0_8_1_ecmult_pippenger_batch(error_callback, scratch, r, inp_g_sc, cb, cbdata, n, 0);
+/* Wrapper for rustsecp256k1_v0_9_0_ecmult_multi_func interface */
+static int rustsecp256k1_v0_9_0_ecmult_pippenger_batch_single(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch *scratch, rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *inp_g_sc, rustsecp256k1_v0_9_0_ecmult_multi_callback cb, void *cbdata, size_t n) {
+    return rustsecp256k1_v0_9_0_ecmult_pippenger_batch(error_callback, scratch, r, inp_g_sc, cb, cbdata, n, 0);
 }
 
 /**
@@ -732,20 +734,20 @@ static int rustsecp256k1_v0_8_1_ecmult_pippenger_batch_single(const rustsecp256k
  * a given scratch space. The function ensures that fewer points may also be
  * used.
  */
-static size_t rustsecp256k1_v0_8_1_pippenger_max_points(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch *scratch) {
-    size_t max_alloc = rustsecp256k1_v0_8_1_scratch_max_allocation(error_callback, scratch, PIPPENGER_SCRATCH_OBJECTS);
+static size_t rustsecp256k1_v0_9_0_pippenger_max_points(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch *scratch) {
+    size_t max_alloc = rustsecp256k1_v0_9_0_scratch_max_allocation(error_callback, scratch, PIPPENGER_SCRATCH_OBJECTS);
     int bucket_window;
     size_t res = 0;
 
     for (bucket_window = 1; bucket_window <= PIPPENGER_MAX_BUCKET_WINDOW; bucket_window++) {
         size_t n_points;
-        size_t max_points = rustsecp256k1_v0_8_1_pippenger_bucket_window_inv(bucket_window);
+        size_t max_points = rustsecp256k1_v0_9_0_pippenger_bucket_window_inv(bucket_window);
         size_t space_for_points;
         size_t space_overhead;
-        size_t entry_size = sizeof(rustsecp256k1_v0_8_1_ge) + sizeof(rustsecp256k1_v0_8_1_scalar) + sizeof(struct rustsecp256k1_v0_8_1_pippenger_point_state) + (WNAF_SIZE(bucket_window+1)+1)*sizeof(int);
+        size_t entry_size = sizeof(rustsecp256k1_v0_9_0_ge) + sizeof(rustsecp256k1_v0_9_0_scalar) + sizeof(struct rustsecp256k1_v0_9_0_pippenger_point_state) + (WNAF_SIZE(bucket_window+1)+1)*sizeof(int);
 
         entry_size = 2*entry_size;
-        space_overhead = (sizeof(rustsecp256k1_v0_8_1_gej) << bucket_window) + entry_size + sizeof(struct rustsecp256k1_v0_8_1_pippenger_state);
+        space_overhead = (sizeof(rustsecp256k1_v0_9_0_gej) << bucket_window) + entry_size + sizeof(struct rustsecp256k1_v0_9_0_pippenger_state);
         if (space_overhead > max_alloc) {
             break;
         }
@@ -768,34 +770,32 @@ static size_t rustsecp256k1_v0_8_1_pippenger_max_points(const rustsecp256k1_v0_8
 
 /* Computes ecmult_multi by simply multiplying and adding each point. Does not
  * require a scratch space */
-static int rustsecp256k1_v0_8_1_ecmult_multi_simple_var(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *inp_g_sc, rustsecp256k1_v0_8_1_ecmult_multi_callback cb, void *cbdata, size_t n_points) {
+static int rustsecp256k1_v0_9_0_ecmult_multi_simple_var(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *inp_g_sc, rustsecp256k1_v0_9_0_ecmult_multi_callback cb, void *cbdata, size_t n_points) {
     size_t point_idx;
-    rustsecp256k1_v0_8_1_scalar szero;
-    rustsecp256k1_v0_8_1_gej tmpj;
+    rustsecp256k1_v0_9_0_gej tmpj;
 
-    rustsecp256k1_v0_8_1_scalar_set_int(&szero, 0);
-    rustsecp256k1_v0_8_1_gej_set_infinity(r);
-    rustsecp256k1_v0_8_1_gej_set_infinity(&tmpj);
+    rustsecp256k1_v0_9_0_gej_set_infinity(r);
+    rustsecp256k1_v0_9_0_gej_set_infinity(&tmpj);
     /* r = inp_g_sc*G */
-    rustsecp256k1_v0_8_1_ecmult(r, &tmpj, &szero, inp_g_sc);
+    rustsecp256k1_v0_9_0_ecmult(r, &tmpj, &rustsecp256k1_v0_9_0_scalar_zero, inp_g_sc);
     for (point_idx = 0; point_idx < n_points; point_idx++) {
-        rustsecp256k1_v0_8_1_ge point;
-        rustsecp256k1_v0_8_1_gej pointj;
-        rustsecp256k1_v0_8_1_scalar scalar;
+        rustsecp256k1_v0_9_0_ge point;
+        rustsecp256k1_v0_9_0_gej pointj;
+        rustsecp256k1_v0_9_0_scalar scalar;
         if (!cb(&scalar, &point, point_idx, cbdata)) {
             return 0;
         }
         /* r += scalar*point */
-        rustsecp256k1_v0_8_1_gej_set_ge(&pointj, &point);
-        rustsecp256k1_v0_8_1_ecmult(&tmpj, &pointj, &scalar, NULL);
-        rustsecp256k1_v0_8_1_gej_add_var(r, r, &tmpj, NULL);
+        rustsecp256k1_v0_9_0_gej_set_ge(&pointj, &point);
+        rustsecp256k1_v0_9_0_ecmult(&tmpj, &pointj, &scalar, NULL);
+        rustsecp256k1_v0_9_0_gej_add_var(r, r, &tmpj, NULL);
     }
     return 1;
 }
 
 /* Compute the number of batches and the batch size given the maximum batch size and the
  * total number of points */
-static int rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(size_t *n_batches, size_t *n_batch_points, size_t max_n_batch_points, size_t n) {
+static int rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(size_t *n_batches, size_t *n_batch_points, size_t max_n_batch_points, size_t n) {
     if (max_n_batch_points == 0) {
         return 0;
     }
@@ -813,50 +813,48 @@ static int rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(size_t *n_batches
     return 1;
 }
 
-typedef int (*rustsecp256k1_v0_8_1_ecmult_multi_func)(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch*, rustsecp256k1_v0_8_1_gej*, const rustsecp256k1_v0_8_1_scalar*, rustsecp256k1_v0_8_1_ecmult_multi_callback cb, void*, size_t);
-static int rustsecp256k1_v0_8_1_ecmult_multi_var(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_scalar *inp_g_sc, rustsecp256k1_v0_8_1_ecmult_multi_callback cb, void *cbdata, size_t n) {
+typedef int (*rustsecp256k1_v0_9_0_ecmult_multi_func)(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch*, rustsecp256k1_v0_9_0_gej*, const rustsecp256k1_v0_9_0_scalar*, rustsecp256k1_v0_9_0_ecmult_multi_callback cb, void*, size_t);
+static int rustsecp256k1_v0_9_0_ecmult_multi_var(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch *scratch, rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_scalar *inp_g_sc, rustsecp256k1_v0_9_0_ecmult_multi_callback cb, void *cbdata, size_t n) {
     size_t i;
 
-    int (*f)(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch*, rustsecp256k1_v0_8_1_gej*, const rustsecp256k1_v0_8_1_scalar*, rustsecp256k1_v0_8_1_ecmult_multi_callback cb, void*, size_t, size_t);
+    int (*f)(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch*, rustsecp256k1_v0_9_0_gej*, const rustsecp256k1_v0_9_0_scalar*, rustsecp256k1_v0_9_0_ecmult_multi_callback cb, void*, size_t, size_t);
     size_t n_batches;
     size_t n_batch_points;
 
-    rustsecp256k1_v0_8_1_gej_set_infinity(r);
+    rustsecp256k1_v0_9_0_gej_set_infinity(r);
     if (inp_g_sc == NULL && n == 0) {
         return 1;
     } else if (n == 0) {
-        rustsecp256k1_v0_8_1_scalar szero;
-        rustsecp256k1_v0_8_1_scalar_set_int(&szero, 0);
-        rustsecp256k1_v0_8_1_ecmult(r, r, &szero, inp_g_sc);
+        rustsecp256k1_v0_9_0_ecmult(r, r, &rustsecp256k1_v0_9_0_scalar_zero, inp_g_sc);
         return 1;
     }
     if (scratch == NULL) {
-        return rustsecp256k1_v0_8_1_ecmult_multi_simple_var(r, inp_g_sc, cb, cbdata, n);
+        return rustsecp256k1_v0_9_0_ecmult_multi_simple_var(r, inp_g_sc, cb, cbdata, n);
     }
 
     /* Compute the batch sizes for Pippenger's algorithm given a scratch space. If it's greater than
      * a threshold use Pippenger's algorithm. Otherwise use Strauss' algorithm.
      * As a first step check if there's enough space for Pippenger's algo (which requires less space
      * than Strauss' algo) and if not, use the simple algorithm. */
-    if (!rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, rustsecp256k1_v0_8_1_pippenger_max_points(error_callback, scratch), n)) {
-        return rustsecp256k1_v0_8_1_ecmult_multi_simple_var(r, inp_g_sc, cb, cbdata, n);
+    if (!rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, rustsecp256k1_v0_9_0_pippenger_max_points(error_callback, scratch), n)) {
+        return rustsecp256k1_v0_9_0_ecmult_multi_simple_var(r, inp_g_sc, cb, cbdata, n);
     }
     if (n_batch_points >= ECMULT_PIPPENGER_THRESHOLD) {
-        f = rustsecp256k1_v0_8_1_ecmult_pippenger_batch;
+        f = rustsecp256k1_v0_9_0_ecmult_pippenger_batch;
     } else {
-        if (!rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, rustsecp256k1_v0_8_1_strauss_max_points(error_callback, scratch), n)) {
-            return rustsecp256k1_v0_8_1_ecmult_multi_simple_var(r, inp_g_sc, cb, cbdata, n);
+        if (!rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, rustsecp256k1_v0_9_0_strauss_max_points(error_callback, scratch), n)) {
+            return rustsecp256k1_v0_9_0_ecmult_multi_simple_var(r, inp_g_sc, cb, cbdata, n);
         }
-        f = rustsecp256k1_v0_8_1_ecmult_strauss_batch;
+        f = rustsecp256k1_v0_9_0_ecmult_strauss_batch;
     }
     for(i = 0; i < n_batches; i++) {
         size_t nbp = n < n_batch_points ? n : n_batch_points;
         size_t offset = n_batch_points*i;
-        rustsecp256k1_v0_8_1_gej tmp;
+        rustsecp256k1_v0_9_0_gej tmp;
         if (!f(error_callback, scratch, &tmp, i == 0 ? inp_g_sc : NULL, cb, cbdata, nbp, offset)) {
             return 0;
         }
-        rustsecp256k1_v0_8_1_gej_add_var(r, r, &tmp, NULL);
+        rustsecp256k1_v0_9_0_gej_add_var(r, r, &tmp, NULL);
         n -= nbp;
     }
     return 1;
diff --git a/secp256k1-sys/depend/secp256k1/src/field.h b/secp256k1-sys/depend/secp256k1/src/field.h
index 8eea36b38..dfa5c1199 100644
--- a/secp256k1-sys/depend/secp256k1/src/field.h
+++ b/secp256k1-sys/depend/secp256k1/src/field.h
@@ -7,23 +7,36 @@
 #ifndef SECP256K1_FIELD_H
 #define SECP256K1_FIELD_H
 
-/** Field element module.
- *
- *  Field elements can be represented in several ways, but code accessing
- *  it (and implementations) need to take certain properties into account:
- *  - Each field element can be normalized or not.
- *  - Each field element has a magnitude, which represents how far away
- *    its representation is away from normalization. Normalized elements
- *    always have a magnitude of 0 or 1, but a magnitude of 1 doesn't
- *    imply normality.
- */
+#include "util.h"
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
+/* This file defines the generic interface for working with rustsecp256k1_v0_9_0_fe
+ * objects, which represent field elements (integers modulo 2^256 - 2^32 - 977).
+ *
+ * The actual definition of the rustsecp256k1_v0_9_0_fe type depends on the chosen field
+ * implementation; see the field_5x52.h and field_10x26.h files for details.
+ *
+ * All rustsecp256k1_v0_9_0_fe objects have implicit properties that determine what
+ * operations are permitted on it. These are purely a function of what
+ * rustsecp256k1_v0_9_0_fe_ operations are applied on it, generally (implicitly) fixed at
+ * compile time, and do not depend on the chosen field implementation. Despite
+ * that, what these properties actually entail for the field representation
+ * values depends on the chosen field implementation. These properties are:
+ * - magnitude: an integer in [0,32]
+ * - normalized: 0 or 1; normalized=1 implies magnitude <= 1.
+ *
+ * In VERIFY mode, they are materialized explicitly as fields in the struct,
+ * allowing run-time verification of these properties. In that case, the field
+ * implementation also provides a rustsecp256k1_v0_9_0_fe_verify routine to verify that
+ * these fields match the run-time value and perform internal consistency
+ * checks. */
+#ifdef VERIFY
+#  define SECP256K1_FE_VERIFY_FIELDS \
+    int magnitude; \
+    int normalized;
+#else
+#  define SECP256K1_FE_VERIFY_FIELDS
 #endif
 
-#include "util.h"
-
 #if defined(SECP256K1_WIDEMUL_INT128)
 #include "field_5x52.h"
 #elif defined(SECP256K1_WIDEMUL_INT64)
@@ -32,111 +45,308 @@
 #error "Please select wide multiplication implementation"
 #endif
 
-static const rustsecp256k1_v0_8_1_fe rustsecp256k1_v0_8_1_fe_one = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
-static const rustsecp256k1_v0_8_1_fe rustsecp256k1_v0_8_1_const_beta = SECP256K1_FE_CONST(
+#ifdef VERIFY
+/* Magnitude and normalized value for constants. */
+#define SECP256K1_FE_VERIFY_CONST(d7, d6, d5, d4, d3, d2, d1, d0) \
+    /* Magnitude is 0 for constant 0; 1 otherwise. */ \
+    , (((d7) | (d6) | (d5) | (d4) | (d3) | (d2) | (d1) | (d0)) != 0) \
+    /* Normalized is 1 unless sum(d_i<<(32*i) for i=0..7) exceeds field modulus. */ \
+    , (!(((d7) & (d6) & (d5) & (d4) & (d3) & (d2)) == 0xfffffffful && ((d1) == 0xfffffffful || ((d1) == 0xfffffffe && (d0 >= 0xfffffc2f)))))
+#else
+#define SECP256K1_FE_VERIFY_CONST(d7, d6, d5, d4, d3, d2, d1, d0)
+#endif
+
+/** This expands to an initializer for a rustsecp256k1_v0_9_0_fe valued sum((i*32) * d_i, i=0..7) mod p.
+ *
+ * It has magnitude 1, unless d_i are all 0, in which case the magnitude is 0.
+ * It is normalized, unless sum(2^(i*32) * d_i, i=0..7) >= p.
+ *
+ * SECP256K1_FE_CONST_INNER is provided by the implementation.
+ */
+#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {SECP256K1_FE_CONST_INNER((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0)) SECP256K1_FE_VERIFY_CONST((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0)) }
+
+static const rustsecp256k1_v0_9_0_fe rustsecp256k1_v0_9_0_fe_one = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
+static const rustsecp256k1_v0_9_0_fe rustsecp256k1_v0_9_0_const_beta = SECP256K1_FE_CONST(
     0x7ae96a2bul, 0x657c0710ul, 0x6e64479eul, 0xac3434e9ul,
     0x9cf04975ul, 0x12f58995ul, 0xc1396c28ul, 0x719501eeul
 );
 
-/** Normalize a field element. This brings the field element to a canonical representation, reduces
- *  its magnitude to 1, and reduces it modulo field size `p`.
+#ifndef VERIFY
+/* In non-VERIFY mode, we #define the fe operations to be identical to their
+ * internal field implementation, to avoid the potential overhead of a
+ * function call (even though presumably inlinable). */
+#  define rustsecp256k1_v0_9_0_fe_normalize rustsecp256k1_v0_9_0_fe_impl_normalize
+#  define rustsecp256k1_v0_9_0_fe_normalize_weak rustsecp256k1_v0_9_0_fe_impl_normalize_weak
+#  define rustsecp256k1_v0_9_0_fe_normalize_var rustsecp256k1_v0_9_0_fe_impl_normalize_var
+#  define rustsecp256k1_v0_9_0_fe_normalizes_to_zero rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero
+#  define rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero_var
+#  define rustsecp256k1_v0_9_0_fe_set_int rustsecp256k1_v0_9_0_fe_impl_set_int
+#  define rustsecp256k1_v0_9_0_fe_clear rustsecp256k1_v0_9_0_fe_impl_clear
+#  define rustsecp256k1_v0_9_0_fe_is_zero rustsecp256k1_v0_9_0_fe_impl_is_zero
+#  define rustsecp256k1_v0_9_0_fe_is_odd rustsecp256k1_v0_9_0_fe_impl_is_odd
+#  define rustsecp256k1_v0_9_0_fe_cmp_var rustsecp256k1_v0_9_0_fe_impl_cmp_var
+#  define rustsecp256k1_v0_9_0_fe_set_b32_mod rustsecp256k1_v0_9_0_fe_impl_set_b32_mod
+#  define rustsecp256k1_v0_9_0_fe_set_b32_limit rustsecp256k1_v0_9_0_fe_impl_set_b32_limit
+#  define rustsecp256k1_v0_9_0_fe_get_b32 rustsecp256k1_v0_9_0_fe_impl_get_b32
+#  define rustsecp256k1_v0_9_0_fe_negate_unchecked rustsecp256k1_v0_9_0_fe_impl_negate_unchecked
+#  define rustsecp256k1_v0_9_0_fe_mul_int_unchecked rustsecp256k1_v0_9_0_fe_impl_mul_int_unchecked
+#  define rustsecp256k1_v0_9_0_fe_add rustsecp256k1_v0_9_0_fe_impl_add
+#  define rustsecp256k1_v0_9_0_fe_mul rustsecp256k1_v0_9_0_fe_impl_mul
+#  define rustsecp256k1_v0_9_0_fe_sqr rustsecp256k1_v0_9_0_fe_impl_sqr
+#  define rustsecp256k1_v0_9_0_fe_cmov rustsecp256k1_v0_9_0_fe_impl_cmov
+#  define rustsecp256k1_v0_9_0_fe_to_storage rustsecp256k1_v0_9_0_fe_impl_to_storage
+#  define rustsecp256k1_v0_9_0_fe_from_storage rustsecp256k1_v0_9_0_fe_impl_from_storage
+#  define rustsecp256k1_v0_9_0_fe_inv rustsecp256k1_v0_9_0_fe_impl_inv
+#  define rustsecp256k1_v0_9_0_fe_inv_var rustsecp256k1_v0_9_0_fe_impl_inv_var
+#  define rustsecp256k1_v0_9_0_fe_get_bounds rustsecp256k1_v0_9_0_fe_impl_get_bounds
+#  define rustsecp256k1_v0_9_0_fe_half rustsecp256k1_v0_9_0_fe_impl_half
+#  define rustsecp256k1_v0_9_0_fe_add_int rustsecp256k1_v0_9_0_fe_impl_add_int
+#  define rustsecp256k1_v0_9_0_fe_is_square_var rustsecp256k1_v0_9_0_fe_impl_is_square_var
+#endif /* !defined(VERIFY) */
+
+/** Normalize a field element.
+ *
+ * On input, r must be a valid field element.
+ * On output, r represents the same value but has normalized=1 and magnitude=1.
  */
-static void rustsecp256k1_v0_8_1_fe_normalize(rustsecp256k1_v0_8_1_fe *r);
+static void rustsecp256k1_v0_9_0_fe_normalize(rustsecp256k1_v0_9_0_fe *r);
 
-/** Weakly normalize a field element: reduce its magnitude to 1, but don't fully normalize. */
-static void rustsecp256k1_v0_8_1_fe_normalize_weak(rustsecp256k1_v0_8_1_fe *r);
+/** Give a field element magnitude 1.
+ *
+ * On input, r must be a valid field element.
+ * On output, r represents the same value but has magnitude=1. Normalized is unchanged.
+ */
+static void rustsecp256k1_v0_9_0_fe_normalize_weak(rustsecp256k1_v0_9_0_fe *r);
 
-/** Normalize a field element, without constant-time guarantee. */
-static void rustsecp256k1_v0_8_1_fe_normalize_var(rustsecp256k1_v0_8_1_fe *r);
+/** Normalize a field element, without constant-time guarantee.
+ *
+ * Identical in behavior to rustsecp256k1_v0_9_0_fe_normalize, but not constant time in r.
+ */
+static void rustsecp256k1_v0_9_0_fe_normalize_var(rustsecp256k1_v0_9_0_fe *r);
 
-/** Verify whether a field element represents zero i.e. would normalize to a zero value. */
-static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero(const rustsecp256k1_v0_8_1_fe *r);
+/** Determine whether r represents field element 0.
+ *
+ * On input, r must be a valid field element.
+ * Returns whether r = 0 (mod p).
+ */
+static int rustsecp256k1_v0_9_0_fe_normalizes_to_zero(const rustsecp256k1_v0_9_0_fe *r);
 
-/** Verify whether a field element represents zero i.e. would normalize to a zero value,
- *  without constant-time guarantee. */
-static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(const rustsecp256k1_v0_8_1_fe *r);
+/** Determine whether r represents field element 0, without constant-time guarantee.
+ *
+ * Identical in behavior to rustsecp256k1_v0_9_0_normalizes_to_zero, but not constant time in r.
+ */
+static int rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(const rustsecp256k1_v0_9_0_fe *r);
 
-/** Set a field element equal to a small (not greater than 0x7FFF), non-negative integer.
- *  Resulting field element is normalized; it has magnitude 0 if a == 0, and magnitude 1 otherwise.
+/** Set a field element to an integer in range [0,0x7FFF].
+ *
+ * On input, r does not need to be initialized, a must be in [0,0x7FFF].
+ * On output, r represents value a, is normalized and has magnitude (a!=0).
  */
-static void rustsecp256k1_v0_8_1_fe_set_int(rustsecp256k1_v0_8_1_fe *r, int a);
+static void rustsecp256k1_v0_9_0_fe_set_int(rustsecp256k1_v0_9_0_fe *r, int a);
 
-/** Sets a field element equal to zero, initializing all fields. */
-static void rustsecp256k1_v0_8_1_fe_clear(rustsecp256k1_v0_8_1_fe *a);
+/** Set a field element to 0.
+ *
+ * On input, a does not need to be initialized.
+ * On output, a represents 0, is normalized and has magnitude 0.
+ */
+static void rustsecp256k1_v0_9_0_fe_clear(rustsecp256k1_v0_9_0_fe *a);
 
-/** Verify whether a field element is zero. Requires the input to be normalized. */
-static int rustsecp256k1_v0_8_1_fe_is_zero(const rustsecp256k1_v0_8_1_fe *a);
+/** Determine whether a represents field element 0.
+ *
+ * On input, a must be a valid normalized field element.
+ * Returns whether a = 0 (mod p).
+ *
+ * This behaves identical to rustsecp256k1_v0_9_0_normalizes_to_zero{,_var}, but requires
+ * normalized input (and is much faster).
+ */
+static int rustsecp256k1_v0_9_0_fe_is_zero(const rustsecp256k1_v0_9_0_fe *a);
 
-/** Check the "oddness" of a field element. Requires the input to be normalized. */
-static int rustsecp256k1_v0_8_1_fe_is_odd(const rustsecp256k1_v0_8_1_fe *a);
+/** Determine whether a (mod p) is odd.
+ *
+ * On input, a must be a valid normalized field element.
+ * Returns (int(a) mod p) & 1.
+ */
+static int rustsecp256k1_v0_9_0_fe_is_odd(const rustsecp256k1_v0_9_0_fe *a);
 
-/** Compare two field elements. Requires magnitude-1 inputs. */
-static int rustsecp256k1_v0_8_1_fe_equal(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *b);
+/** Determine whether two field elements are equal.
+ *
+ * On input, a and b must be valid field elements with magnitudes not exceeding
+ * 1 and 31, respectively.
+ * Returns a = b (mod p).
+ */
+static int rustsecp256k1_v0_9_0_fe_equal(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *b);
 
-/** Same as rustsecp256k1_v0_8_1_fe_equal, but may be variable time. */
-static int rustsecp256k1_v0_8_1_fe_equal_var(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *b);
+/** Compare the values represented by 2 field elements, without constant-time guarantee.
+ *
+ * On input, a and b must be valid normalized field elements.
+ * Returns 1 if a > b, -1 if a < b, and 0 if a = b (comparisons are done as integers
+ * in range 0..p-1).
+ */
+static int rustsecp256k1_v0_9_0_fe_cmp_var(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *b);
 
-/** Compare two field elements. Requires both inputs to be normalized */
-static int rustsecp256k1_v0_8_1_fe_cmp_var(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *b);
+/** Set a field element equal to a provided 32-byte big endian value, reducing it.
+ *
+ * On input, r does not need to be initialized. a must be a pointer to an initialized 32-byte array.
+ * On output, r = a (mod p). It will have magnitude 1, and not be normalized.
+ */
+static void rustsecp256k1_v0_9_0_fe_set_b32_mod(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a);
 
-/** Set a field element equal to 32-byte big endian value. If successful, the resulting field element is normalized. */
-static int rustsecp256k1_v0_8_1_fe_set_b32(rustsecp256k1_v0_8_1_fe *r, const unsigned char *a);
+/** Set a field element equal to a provided 32-byte big endian value, checking for overflow.
+ *
+ * On input, r does not need to be initialized. a must be a pointer to an initialized 32-byte array.
+ * On output, r = a if (a < p), it will be normalized with magnitude 1, and 1 is returned.
+ * If a >= p, 0 is returned, and r will be made invalid (and must not be used without overwriting).
+ */
+static int rustsecp256k1_v0_9_0_fe_set_b32_limit(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a);
 
-/** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */
-static void rustsecp256k1_v0_8_1_fe_get_b32(unsigned char *r, const rustsecp256k1_v0_8_1_fe *a);
+/** Convert a field element to 32-byte big endian byte array.
+ * On input, a must be a valid normalized field element, and r a pointer to a 32-byte array.
+ * On output, r = a (mod p).
+ */
+static void rustsecp256k1_v0_9_0_fe_get_b32(unsigned char *r, const rustsecp256k1_v0_9_0_fe *a);
+
+/** Negate a field element.
+ *
+ * On input, r does not need to be initialized. a must be a valid field element with
+ * magnitude not exceeding m. m must be an integer constant expression in [0,31].
+ * Performs {r = -a}.
+ * On output, r will not be normalized, and will have magnitude m+1.
+ */
+#define rustsecp256k1_v0_9_0_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, rustsecp256k1_v0_9_0_fe_negate_unchecked(r, a, m))
+
+/** Like rustsecp256k1_v0_9_0_fe_negate_unchecked but m is not checked to be an integer constant expression.
+ *
+ * Should not be called directly outside of tests.
+ */
+static void rustsecp256k1_v0_9_0_fe_negate_unchecked(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int m);
+
+/** Add a small integer to a field element.
+ *
+ * Performs {r += a}. The magnitude of r increases by 1, and normalized is cleared.
+ * a must be in range [0,0x7FFF].
+ */
+static void rustsecp256k1_v0_9_0_fe_add_int(rustsecp256k1_v0_9_0_fe *r, int a);
 
-/** Set a field element equal to the additive inverse of another. Takes a maximum magnitude of the input
- *  as an argument. The magnitude of the output is one higher. */
-static void rustsecp256k1_v0_8_1_fe_negate(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a, int m);
+/** Multiply a field element with a small integer.
+ *
+ * On input, r must be a valid field element. a must be an integer constant expression in [0,32].
+ * The magnitude of r times a must not exceed 32.
+ * Performs {r *= a}.
+ * On output, r's magnitude is multiplied by a, and r will not be normalized.
+ */
+#define rustsecp256k1_v0_9_0_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, rustsecp256k1_v0_9_0_fe_mul_int_unchecked(r, a))
 
-/** Multiplies the passed field element with a small integer constant. Multiplies the magnitude by that
- *  small integer. */
-static void rustsecp256k1_v0_8_1_fe_mul_int(rustsecp256k1_v0_8_1_fe *r, int a);
+/** Like rustsecp256k1_v0_9_0_fe_mul_int but a is not checked to be an integer constant expression.
+ * 
+ * Should not be called directly outside of tests.
+ */
+static void rustsecp256k1_v0_9_0_fe_mul_int_unchecked(rustsecp256k1_v0_9_0_fe *r, int a);
 
-/** Adds a field element to another. The result has the sum of the inputs' magnitudes as magnitude. */
-static void rustsecp256k1_v0_8_1_fe_add(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a);
+/** Increment a field element by another.
+ *
+ * On input, r and a must be valid field elements, not necessarily normalized.
+ * The sum of their magnitudes must not exceed 32.
+ * Performs {r += a}.
+ * On output, r will not be normalized, and will have magnitude incremented by a's.
+ */
+static void rustsecp256k1_v0_9_0_fe_add(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a);
 
-/** Sets a field element to be the product of two others. Requires the inputs' magnitudes to be at most 8.
- *  The output magnitude is 1 (but not guaranteed to be normalized). */
-static void rustsecp256k1_v0_8_1_fe_mul(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe * SECP256K1_RESTRICT b);
+/** Multiply two field elements.
+ *
+ * On input, a and b must be valid field elements; r does not need to be initialized.
+ * r and a may point to the same object, but neither can be equal to b. The magnitudes
+ * of a and b must not exceed 8.
+ * Performs {r = a * b}
+ * On output, r will have magnitude 1, but won't be normalized.
+ */
+static void rustsecp256k1_v0_9_0_fe_mul(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe * SECP256K1_RESTRICT b);
 
-/** Sets a field element to be the square of another. Requires the input's magnitude to be at most 8.
- *  The output magnitude is 1 (but not guaranteed to be normalized). */
-static void rustsecp256k1_v0_8_1_fe_sqr(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a);
+/** Square a field element.
+ *
+ * On input, a must be a valid field element; r does not need to be initialized. The magnitude
+ * of a must not exceed 8.
+ * Performs {r = a**2}
+ * On output, r will have magnitude 1, but won't be normalized.
+ */
+static void rustsecp256k1_v0_9_0_fe_sqr(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a);
 
-/** If a has a square root, it is computed in r and 1 is returned. If a does not
- *  have a square root, the root of its negation is computed and 0 is returned.
- *  The input's magnitude can be at most 8. The output magnitude is 1 (but not
- *  guaranteed to be normalized). The result in r will always be a square
- *  itself. */
-static int rustsecp256k1_v0_8_1_fe_sqrt(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a);
+/** Compute a square root of a field element.
+ *
+ * On input, a must be a valid field element with magnitude<=8; r need not be initialized.
+ * If sqrt(a) exists, performs {r = sqrt(a)} and returns 1.
+ * Otherwise, sqrt(-a) exists. The function performs {r = sqrt(-a)} and returns 0.
+ * The resulting value represented by r will be a square itself.
+ * Variables r and a must not point to the same object.
+ * On output, r will have magnitude 1 but will not be normalized.
+ */
+static int rustsecp256k1_v0_9_0_fe_sqrt(rustsecp256k1_v0_9_0_fe * SECP256K1_RESTRICT r, const rustsecp256k1_v0_9_0_fe * SECP256K1_RESTRICT a);
 
-/** Sets a field element to be the (modular) inverse of another. Requires the input's magnitude to be
- *  at most 8. The output magnitude is 1 (but not guaranteed to be normalized). */
-static void rustsecp256k1_v0_8_1_fe_inv(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a);
+/** Compute the modular inverse of a field element.
+ *
+ * On input, a must be a valid field element; r need not be initialized.
+ * Performs {r = a**(p-2)} (which maps 0 to 0, and every other element to its
+ * inverse).
+ * On output, r will have magnitude (a.magnitude != 0) and be normalized.
+ */
+static void rustsecp256k1_v0_9_0_fe_inv(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a);
 
-/** Potentially faster version of rustsecp256k1_v0_8_1_fe_inv, without constant-time guarantee. */
-static void rustsecp256k1_v0_8_1_fe_inv_var(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a);
+/** Compute the modular inverse of a field element, without constant-time guarantee.
+ *
+ * Behaves identically to rustsecp256k1_v0_9_0_fe_inv, but is not constant-time in a.
+ */
+static void rustsecp256k1_v0_9_0_fe_inv_var(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a);
 
-/** Convert a field element to the storage type. */
-static void rustsecp256k1_v0_8_1_fe_to_storage(rustsecp256k1_v0_8_1_fe_storage *r, const rustsecp256k1_v0_8_1_fe *a);
+/** Convert a field element to rustsecp256k1_v0_9_0_fe_storage.
+ *
+ * On input, a must be a valid normalized field element.
+ * Performs {r = a}.
+ */
+static void rustsecp256k1_v0_9_0_fe_to_storage(rustsecp256k1_v0_9_0_fe_storage *r, const rustsecp256k1_v0_9_0_fe *a);
 
-/** Convert a field element back from the storage type. */
-static void rustsecp256k1_v0_8_1_fe_from_storage(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe_storage *a);
+/** Convert a field element back from rustsecp256k1_v0_9_0_fe_storage.
+ *
+ * On input, r need not be initialized.
+ * Performs {r = a}.
+ * On output, r will be normalized and will have magnitude 1.
+ */
+static void rustsecp256k1_v0_9_0_fe_from_storage(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe_storage *a);
 
 /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time.  Both *r and *a must be initialized.*/
-static void rustsecp256k1_v0_8_1_fe_storage_cmov(rustsecp256k1_v0_8_1_fe_storage *r, const rustsecp256k1_v0_8_1_fe_storage *a, int flag);
+static void rustsecp256k1_v0_9_0_fe_storage_cmov(rustsecp256k1_v0_9_0_fe_storage *r, const rustsecp256k1_v0_9_0_fe_storage *a, int flag);
 
-/** If flag is true, set *r equal to *a; otherwise leave it. Constant-time.  Both *r and *a must be initialized.*/
-static void rustsecp256k1_v0_8_1_fe_cmov(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a, int flag);
+/** Conditionally move a field element in constant time.
+ *
+ * On input, both r and a must be valid field elements. Flag must be 0 or 1.
+ * Performs {r = flag ? a : r}.
+ *
+ * On output, r's magnitude will be the maximum of both input magnitudes.
+ * It will be normalized if and only if both inputs were normalized.
+ */
+static void rustsecp256k1_v0_9_0_fe_cmov(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int flag);
+
+/** Halve the value of a field element modulo the field prime in constant-time.
+ *
+ * On input, r must be a valid field element.
+ * On output, r will be normalized and have magnitude floor(m/2) + 1 where m is
+ * the magnitude of r on input.
+ */
+static void rustsecp256k1_v0_9_0_fe_half(rustsecp256k1_v0_9_0_fe *r);
+
+/** Sets r to a field element with magnitude m, normalized if (and only if) m==0.
+ *  The value is chosen so that it is likely to trigger edge cases related to
+ *  internal overflows. */
+static void rustsecp256k1_v0_9_0_fe_get_bounds(rustsecp256k1_v0_9_0_fe *r, int m);
+
+/** Determine whether a is a square (modulo p).
+ *
+ * On input, a must be a valid field element.
+ */
+static int rustsecp256k1_v0_9_0_fe_is_square_var(const rustsecp256k1_v0_9_0_fe *a);
 
-/** Halves the value of a field element modulo the field prime. Constant-time.
- *  For an input magnitude 'm', the output magnitude is set to 'floor(m/2) + 1'.
- *  The output is not guaranteed to be normalized, regardless of the input. */
-static void rustsecp256k1_v0_8_1_fe_half(rustsecp256k1_v0_8_1_fe *r);
+/** Check invariants on a field element (no-op unless VERIFY is enabled). */
+static void rustsecp256k1_v0_9_0_fe_verify(const rustsecp256k1_v0_9_0_fe *a);
 
-/** Sets each limb of 'r' to its upper bound at magnitude 'm'. The output will also have its
- *  magnitude set to 'm' and is normalized if (and only if) 'm' is zero. */
-static void rustsecp256k1_v0_8_1_fe_get_bounds(rustsecp256k1_v0_8_1_fe *r, int m);
+/** Check that magnitude of a is at most m (no-op unless VERIFY is enabled). */
+static void rustsecp256k1_v0_9_0_fe_verify_magnitude(const rustsecp256k1_v0_9_0_fe *a, int m);
 
 #endif /* SECP256K1_FIELD_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/field_10x26.h b/secp256k1-sys/depend/secp256k1/src/field_10x26.h
index c075e39fe..af0377bd1 100644
--- a/secp256k1-sys/depend/secp256k1/src/field_10x26.h
+++ b/secp256k1-sys/depend/secp256k1/src/field_10x26.h
@@ -9,16 +9,29 @@
 
 #include <stdint.h>
 
+/** This field implementation represents the value as 10 uint32_t limbs in base
+ *  2^26. */
 typedef struct {
-    /* X = sum(i=0..9, n[i]*2^(i*26)) mod p
-     * where p = 2^256 - 0x1000003D1
-     */
+   /* A field element f represents the sum(i=0..9, f.n[i] << (i*26)) mod p,
+    * where p is the field modulus, 2^256 - 2^32 - 977.
+    *
+    * The individual limbs f.n[i] can exceed 2^26; the field's magnitude roughly
+    * corresponds to how much excess is allowed. The value
+    * sum(i=0..9, f.n[i] << (i*26)) may exceed p, unless the field element is
+    * normalized. */
     uint32_t n[10];
-#ifdef VERIFY
-    int magnitude;
-    int normalized;
-#endif
-} rustsecp256k1_v0_8_1_fe;
+    /*
+     * Magnitude m requires:
+     *     n[i] <= 2 * m * (2^26 - 1) for i=0..8
+     *     n[9] <= 2 * m * (2^22 - 1)
+     *
+     * Normalized requires:
+     *     n[i] <= (2^26 - 1) for i=0..8
+     *     sum(i=0..9, n[i] << (i*26)) < p
+     *     (together these imply n[9] <= 2^22 - 1)
+     */
+    SECP256K1_FE_VERIFY_FIELDS
+} rustsecp256k1_v0_9_0_fe;
 
 /* Unpacks a constant into a overlapping multi-limbed FE element. */
 #define SECP256K1_FE_CONST_INNER(d7, d6, d5, d4, d3, d2, d1, d0) { \
@@ -34,15 +47,9 @@ typedef struct {
     (((uint32_t)d7) >> 10) \
 }
 
-#ifdef VERIFY
-#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {SECP256K1_FE_CONST_INNER((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0)), 1, 1}
-#else
-#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {SECP256K1_FE_CONST_INNER((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0))}
-#endif
-
 typedef struct {
     uint32_t n[8];
-} rustsecp256k1_v0_8_1_fe_storage;
+} rustsecp256k1_v0_9_0_fe_storage;
 
 #define SECP256K1_FE_STORAGE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{ (d0), (d1), (d2), (d3), (d4), (d5), (d6), (d7) }}
 #define SECP256K1_FE_STORAGE_CONST_GET(d) d.n[7], d.n[6], d.n[5], d.n[4],d.n[3], d.n[2], d.n[1], d.n[0]
diff --git a/secp256k1-sys/depend/secp256k1/src/field_10x26_impl.h b/secp256k1-sys/depend/secp256k1/src/field_10x26_impl.h
index 7aa73c2bd..0eb0db4bf 100644
--- a/secp256k1-sys/depend/secp256k1/src/field_10x26_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/field_10x26_impl.h
@@ -7,51 +7,37 @@
 #ifndef SECP256K1_FIELD_REPR_IMPL_H
 #define SECP256K1_FIELD_REPR_IMPL_H
 
+#include "checkmem.h"
 #include "util.h"
 #include "field.h"
 #include "modinv32_impl.h"
 
-/** See the comment at the top of field_5x52_impl.h for more details.
- *
- *  Here, we represent field elements as 10 uint32_t's in base 2^26, least significant first,
- *  where limbs can contain >26 bits.
- *  A magnitude M means:
- *  - 2*M*(2^22-1) is the max (inclusive) of the most significant limb
- *  - 2*M*(2^26-1) is the max (inclusive) of the remaining limbs
- */
-
 #ifdef VERIFY
-static void rustsecp256k1_v0_8_1_fe_verify(const rustsecp256k1_v0_8_1_fe *a) {
+static void rustsecp256k1_v0_9_0_fe_impl_verify(const rustsecp256k1_v0_9_0_fe *a) {
     const uint32_t *d = a->n;
-    int m = a->normalized ? 1 : 2 * a->magnitude, r = 1;
-    r &= (d[0] <= 0x3FFFFFFUL * m);
-    r &= (d[1] <= 0x3FFFFFFUL * m);
-    r &= (d[2] <= 0x3FFFFFFUL * m);
-    r &= (d[3] <= 0x3FFFFFFUL * m);
-    r &= (d[4] <= 0x3FFFFFFUL * m);
-    r &= (d[5] <= 0x3FFFFFFUL * m);
-    r &= (d[6] <= 0x3FFFFFFUL * m);
-    r &= (d[7] <= 0x3FFFFFFUL * m);
-    r &= (d[8] <= 0x3FFFFFFUL * m);
-    r &= (d[9] <= 0x03FFFFFUL * m);
-    r &= (a->magnitude >= 0);
-    r &= (a->magnitude <= 32);
+    int m = a->normalized ? 1 : 2 * a->magnitude;
+    VERIFY_CHECK(d[0] <= 0x3FFFFFFUL * m);
+    VERIFY_CHECK(d[1] <= 0x3FFFFFFUL * m);
+    VERIFY_CHECK(d[2] <= 0x3FFFFFFUL * m);
+    VERIFY_CHECK(d[3] <= 0x3FFFFFFUL * m);
+    VERIFY_CHECK(d[4] <= 0x3FFFFFFUL * m);
+    VERIFY_CHECK(d[5] <= 0x3FFFFFFUL * m);
+    VERIFY_CHECK(d[6] <= 0x3FFFFFFUL * m);
+    VERIFY_CHECK(d[7] <= 0x3FFFFFFUL * m);
+    VERIFY_CHECK(d[8] <= 0x3FFFFFFUL * m);
+    VERIFY_CHECK(d[9] <= 0x03FFFFFUL * m);
     if (a->normalized) {
-        r &= (a->magnitude <= 1);
-        if (r && (d[9] == 0x03FFFFFUL)) {
+        if (d[9] == 0x03FFFFFUL) {
             uint32_t mid = d[8] & d[7] & d[6] & d[5] & d[4] & d[3] & d[2];
             if (mid == 0x3FFFFFFUL) {
-                r &= ((d[1] + 0x40UL + ((d[0] + 0x3D1UL) >> 26)) <= 0x3FFFFFFUL);
+                VERIFY_CHECK((d[1] + 0x40UL + ((d[0] + 0x3D1UL) >> 26)) <= 0x3FFFFFFUL);
             }
         }
     }
-    VERIFY_CHECK(r == 1);
 }
 #endif
 
-static void rustsecp256k1_v0_8_1_fe_get_bounds(rustsecp256k1_v0_8_1_fe *r, int m) {
-    VERIFY_CHECK(m >= 0);
-    VERIFY_CHECK(m <= 2048);
+static void rustsecp256k1_v0_9_0_fe_impl_get_bounds(rustsecp256k1_v0_9_0_fe *r, int m) {
     r->n[0] = 0x3FFFFFFUL * 2 * m;
     r->n[1] = 0x3FFFFFFUL * 2 * m;
     r->n[2] = 0x3FFFFFFUL * 2 * m;
@@ -62,14 +48,9 @@ static void rustsecp256k1_v0_8_1_fe_get_bounds(rustsecp256k1_v0_8_1_fe *r, int m
     r->n[7] = 0x3FFFFFFUL * 2 * m;
     r->n[8] = 0x3FFFFFFUL * 2 * m;
     r->n[9] = 0x03FFFFFUL * 2 * m;
-#ifdef VERIFY
-    r->magnitude = m;
-    r->normalized = (m == 0);
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_normalize(rustsecp256k1_v0_8_1_fe *r) {
+static void rustsecp256k1_v0_9_0_fe_impl_normalize(rustsecp256k1_v0_9_0_fe *r) {
     uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4],
              t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9];
 
@@ -116,15 +97,9 @@ static void rustsecp256k1_v0_8_1_fe_normalize(rustsecp256k1_v0_8_1_fe *r) {
 
     r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
     r->n[5] = t5; r->n[6] = t6; r->n[7] = t7; r->n[8] = t8; r->n[9] = t9;
-
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_normalize_weak(rustsecp256k1_v0_8_1_fe *r) {
+static void rustsecp256k1_v0_9_0_fe_impl_normalize_weak(rustsecp256k1_v0_9_0_fe *r) {
     uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4],
              t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9];
 
@@ -148,14 +123,9 @@ static void rustsecp256k1_v0_8_1_fe_normalize_weak(rustsecp256k1_v0_8_1_fe *r) {
 
     r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
     r->n[5] = t5; r->n[6] = t6; r->n[7] = t7; r->n[8] = t8; r->n[9] = t9;
-
-#ifdef VERIFY
-    r->magnitude = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_normalize_var(rustsecp256k1_v0_8_1_fe *r) {
+static void rustsecp256k1_v0_9_0_fe_impl_normalize_var(rustsecp256k1_v0_9_0_fe *r) {
     uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4],
              t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9];
 
@@ -203,15 +173,9 @@ static void rustsecp256k1_v0_8_1_fe_normalize_var(rustsecp256k1_v0_8_1_fe *r) {
 
     r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
     r->n[5] = t5; r->n[6] = t6; r->n[7] = t7; r->n[8] = t8; r->n[9] = t9;
-
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero(const rustsecp256k1_v0_8_1_fe *r) {
+static int rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero(const rustsecp256k1_v0_9_0_fe *r) {
     uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4],
              t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9];
 
@@ -240,7 +204,7 @@ static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero(const rustsecp256k1_v0_8_1
     return (z0 == 0) | (z1 == 0x3FFFFFFUL);
 }
 
-static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(const rustsecp256k1_v0_8_1_fe *r) {
+static int rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero_var(const rustsecp256k1_v0_9_0_fe *r) {
     uint32_t t0, t1, t2, t3, t4, t5, t6, t7, t8, t9;
     uint32_t z0, z1;
     uint32_t x;
@@ -292,53 +256,29 @@ static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(const rustsecp256k1_v0
     return (z0 == 0) | (z1 == 0x3FFFFFFUL);
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_set_int(rustsecp256k1_v0_8_1_fe *r, int a) {
-    VERIFY_CHECK(0 <= a && a <= 0x7FFF);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_set_int(rustsecp256k1_v0_9_0_fe *r, int a) {
     r->n[0] = a;
     r->n[1] = r->n[2] = r->n[3] = r->n[4] = r->n[5] = r->n[6] = r->n[7] = r->n[8] = r->n[9] = 0;
-#ifdef VERIFY
-    r->magnitude = (a != 0);
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_fe_is_zero(const rustsecp256k1_v0_8_1_fe *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_impl_is_zero(const rustsecp256k1_v0_9_0_fe *a) {
     const uint32_t *t = a->n;
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
     return (t[0] | t[1] | t[2] | t[3] | t[4] | t[5] | t[6] | t[7] | t[8] | t[9]) == 0;
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_fe_is_odd(const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_impl_is_odd(const rustsecp256k1_v0_9_0_fe *a) {
     return a->n[0] & 1;
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_clear(rustsecp256k1_v0_8_1_fe *a) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_clear(rustsecp256k1_v0_9_0_fe *a) {
     int i;
-#ifdef VERIFY
-    a->magnitude = 0;
-    a->normalized = 1;
-#endif
     for (i=0; i<10; i++) {
         a->n[i] = 0;
     }
 }
 
-static int rustsecp256k1_v0_8_1_fe_cmp_var(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *b) {
+static int rustsecp256k1_v0_9_0_fe_impl_cmp_var(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *b) {
     int i;
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-    VERIFY_CHECK(b->normalized);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-    rustsecp256k1_v0_8_1_fe_verify(b);
-#endif
     for (i = 9; i >= 0; i--) {
         if (a->n[i] > b->n[i]) {
             return 1;
@@ -350,8 +290,7 @@ static int rustsecp256k1_v0_8_1_fe_cmp_var(const rustsecp256k1_v0_8_1_fe *a, con
     return 0;
 }
 
-static int rustsecp256k1_v0_8_1_fe_set_b32(rustsecp256k1_v0_8_1_fe *r, const unsigned char *a) {
-    int ret;
+static void rustsecp256k1_v0_9_0_fe_impl_set_b32_mod(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a) {
     r->n[0] = (uint32_t)a[31] | ((uint32_t)a[30] << 8) | ((uint32_t)a[29] << 16) | ((uint32_t)(a[28] & 0x3) << 24);
     r->n[1] = (uint32_t)((a[28] >> 2) & 0x3f) | ((uint32_t)a[27] << 6) | ((uint32_t)a[26] << 14) | ((uint32_t)(a[25] & 0xf) << 22);
     r->n[2] = (uint32_t)((a[25] >> 4) & 0xf) | ((uint32_t)a[24] << 4) | ((uint32_t)a[23] << 12) | ((uint32_t)(a[22] & 0x3f) << 20);
@@ -362,26 +301,15 @@ static int rustsecp256k1_v0_8_1_fe_set_b32(rustsecp256k1_v0_8_1_fe *r, const uns
     r->n[7] = (uint32_t)((a[9] >> 6) & 0x3) | ((uint32_t)a[8] << 2) | ((uint32_t)a[7] << 10) | ((uint32_t)a[6] << 18);
     r->n[8] = (uint32_t)a[5] | ((uint32_t)a[4] << 8) | ((uint32_t)a[3] << 16) | ((uint32_t)(a[2] & 0x3) << 24);
     r->n[9] = (uint32_t)((a[2] >> 2) & 0x3f) | ((uint32_t)a[1] << 6) | ((uint32_t)a[0] << 14);
+}
 
-    ret = !((r->n[9] == 0x3FFFFFUL) & ((r->n[8] & r->n[7] & r->n[6] & r->n[5] & r->n[4] & r->n[3] & r->n[2]) == 0x3FFFFFFUL) & ((r->n[1] + 0x40UL + ((r->n[0] + 0x3D1UL) >> 26)) > 0x3FFFFFFUL));
-#ifdef VERIFY
-    r->magnitude = 1;
-    if (ret) {
-        r->normalized = 1;
-        rustsecp256k1_v0_8_1_fe_verify(r);
-    } else {
-        r->normalized = 0;
-    }
-#endif
-    return ret;
+static int rustsecp256k1_v0_9_0_fe_impl_set_b32_limit(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a) {
+    rustsecp256k1_v0_9_0_fe_impl_set_b32_mod(r, a);
+    return !((r->n[9] == 0x3FFFFFUL) & ((r->n[8] & r->n[7] & r->n[6] & r->n[5] & r->n[4] & r->n[3] & r->n[2]) == 0x3FFFFFFUL) & ((r->n[1] + 0x40UL + ((r->n[0] + 0x3D1UL) >> 26)) > 0x3FFFFFFUL));
 }
 
 /** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */
-static void rustsecp256k1_v0_8_1_fe_get_b32(unsigned char *r, const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
+static void rustsecp256k1_v0_9_0_fe_impl_get_b32(unsigned char *r, const rustsecp256k1_v0_9_0_fe *a) {
     r[0] = (a->n[9] >> 14) & 0xff;
     r[1] = (a->n[9] >> 6) & 0xff;
     r[2] = ((a->n[9] & 0x3F) << 2) | ((a->n[8] >> 24) & 0x3);
@@ -416,15 +344,15 @@ static void rustsecp256k1_v0_8_1_fe_get_b32(unsigned char *r, const rustsecp256k
     r[31] = a->n[0] & 0xff;
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_negate(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a, int m) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->magnitude <= m);
-    rustsecp256k1_v0_8_1_fe_verify(a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_negate_unchecked(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int m) {
+    /* For all legal values of m (0..31), the following properties hold: */
     VERIFY_CHECK(0x3FFFC2FUL * 2 * (m + 1) >= 0x3FFFFFFUL * 2 * m);
     VERIFY_CHECK(0x3FFFFBFUL * 2 * (m + 1) >= 0x3FFFFFFUL * 2 * m);
     VERIFY_CHECK(0x3FFFFFFUL * 2 * (m + 1) >= 0x3FFFFFFUL * 2 * m);
     VERIFY_CHECK(0x03FFFFFUL * 2 * (m + 1) >= 0x03FFFFFUL * 2 * m);
-#endif
+
+    /* Due to the properties above, the left hand in the subtractions below is never less than
+     * the right hand. */
     r->n[0] = 0x3FFFC2FUL * 2 * (m + 1) - a->n[0];
     r->n[1] = 0x3FFFFBFUL * 2 * (m + 1) - a->n[1];
     r->n[2] = 0x3FFFFFFUL * 2 * (m + 1) - a->n[2];
@@ -435,14 +363,9 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_negate(rustsecp256k1_v0_8_1
     r->n[7] = 0x3FFFFFFUL * 2 * (m + 1) - a->n[7];
     r->n[8] = 0x3FFFFFFUL * 2 * (m + 1) - a->n[8];
     r->n[9] = 0x03FFFFFUL * 2 * (m + 1) - a->n[9];
-#ifdef VERIFY
-    r->magnitude = m + 1;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_int(rustsecp256k1_v0_8_1_fe *r, int a) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_mul_int_unchecked(rustsecp256k1_v0_9_0_fe *r, int a) {
     r->n[0] *= a;
     r->n[1] *= a;
     r->n[2] *= a;
@@ -453,17 +376,9 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_int(rustsecp256k1_v0_8_
     r->n[7] *= a;
     r->n[8] *= a;
     r->n[9] *= a;
-#ifdef VERIFY
-    r->magnitude *= a;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_add(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_add(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a) {
     r->n[0] += a->n[0];
     r->n[1] += a->n[1];
     r->n[2] += a->n[2];
@@ -474,18 +389,17 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_add(rustsecp256k1_v0_8_1_fe
     r->n[7] += a->n[7];
     r->n[8] += a->n[8];
     r->n[9] += a->n[9];
-#ifdef VERIFY
-    r->magnitude += a->magnitude;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
+}
+
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_add_int(rustsecp256k1_v0_9_0_fe *r, int a) {
+    r->n[0] += a;
 }
 
 #if defined(USE_EXTERNAL_ASM)
 
 /* External assembler implementation */
-void rustsecp256k1_v0_8_1_fe_mul_inner(uint32_t *r, const uint32_t *a, const uint32_t * SECP256K1_RESTRICT b);
-void rustsecp256k1_v0_8_1_fe_sqr_inner(uint32_t *r, const uint32_t *a);
+void rustsecp256k1_v0_9_0_fe_mul_inner(uint32_t *r, const uint32_t *a, const uint32_t * SECP256K1_RESTRICT b);
+void rustsecp256k1_v0_9_0_fe_sqr_inner(uint32_t *r, const uint32_t *a);
 
 #else
 
@@ -495,7 +409,7 @@ void rustsecp256k1_v0_8_1_fe_sqr_inner(uint32_t *r, const uint32_t *a);
 #define VERIFY_BITS(x, n) do { } while(0)
 #endif
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_inner(uint32_t *r, const uint32_t *a, const uint32_t * SECP256K1_RESTRICT b) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_mul_inner(uint32_t *r, const uint32_t *a, const uint32_t * SECP256K1_RESTRICT b) {
     uint64_t c, d;
     uint64_t u0, u1, u2, u3, u4, u5, u6, u7, u8;
     uint32_t t9, t1, t0, t2, t3, t4, t5, t6, t7;
@@ -825,7 +739,7 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_inner(uint32_t *r, cons
     /* [r9 r8 r7 r6 r5 r4 r3 r2 r1 r0] = [p18 p17 p16 p15 p14 p13 p12 p11 p10 p9 p8 p7 p6 p5 p4 p3 p2 p1 p0] */
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_sqr_inner(uint32_t *r, const uint32_t *a) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_sqr_inner(uint32_t *r, const uint32_t *a) {
     uint64_t c, d;
     uint64_t u0, u1, u2, u3, u4, u5, u6, u7, u8;
     uint32_t t9, t0, t1, t2, t3, t4, t5, t6, t7;
@@ -1100,40 +1014,19 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_sqr_inner(uint32_t *r, cons
 }
 #endif
 
-static void rustsecp256k1_v0_8_1_fe_mul(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe * SECP256K1_RESTRICT b) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->magnitude <= 8);
-    VERIFY_CHECK(b->magnitude <= 8);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-    rustsecp256k1_v0_8_1_fe_verify(b);
-    VERIFY_CHECK(r != b);
-    VERIFY_CHECK(a != b);
-#endif
-    rustsecp256k1_v0_8_1_fe_mul_inner(r->n, a->n, b->n);
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_mul(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe * SECP256K1_RESTRICT b) {
+    rustsecp256k1_v0_9_0_fe_mul_inner(r->n, a->n, b->n);
 }
 
-static void rustsecp256k1_v0_8_1_fe_sqr(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->magnitude <= 8);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
-    rustsecp256k1_v0_8_1_fe_sqr_inner(r->n, a->n);
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_sqr(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a) {
+    rustsecp256k1_v0_9_0_fe_sqr_inner(r->n, a->n);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_cmov(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a, int flag) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_cmov(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int flag) {
     uint32_t mask0, mask1;
-    VG_CHECK_VERIFY(r->n, sizeof(r->n));
-    mask0 = flag + ~((uint32_t)0);
+    volatile int vflag = flag;
+    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
+    mask0 = vflag + ~((uint32_t)0);
     mask1 = ~mask0;
     r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
     r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
@@ -1145,25 +1038,14 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_cmov(rustsecp256k1_v0_8_1_f
     r->n[7] = (r->n[7] & mask0) | (a->n[7] & mask1);
     r->n[8] = (r->n[8] & mask0) | (a->n[8] & mask1);
     r->n[9] = (r->n[9] & mask0) | (a->n[9] & mask1);
-#ifdef VERIFY
-    if (flag) {
-        r->magnitude = a->magnitude;
-        r->normalized = a->normalized;
-    }
-#endif
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_half(rustsecp256k1_v0_8_1_fe *r) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_fe_impl_half(rustsecp256k1_v0_9_0_fe *r) {
     uint32_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4],
              t5 = r->n[5], t6 = r->n[6], t7 = r->n[7], t8 = r->n[8], t9 = r->n[9];
     uint32_t one = (uint32_t)1;
     uint32_t mask = -(t0 & one) >> 6;
 
-#ifdef VERIFY
-    rustsecp256k1_v0_8_1_fe_verify(r);
-    VERIFY_CHECK(r->magnitude < 32);
-#endif
-
     /* Bounds analysis (over the rationals).
      *
      * Let m = r->magnitude
@@ -1210,10 +1092,8 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_half(rustsecp256k1_v0_8_1_f
      *
      * Current bounds: t0..t8 <= C * (m/2 + 1/2)
      *                     t9 <= D * (m/2 + 1/4)
-     */
-
-#ifdef VERIFY
-    /* Therefore the output magnitude (M) has to be set such that:
+     *
+     * Therefore the output magnitude (M) has to be set such that:
      *     t0..t8: C * M >= C * (m/2 + 1/2)
      *         t9: D * M >= D * (m/2 + 1/4)
      *
@@ -1223,16 +1103,13 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_half(rustsecp256k1_v0_8_1_f
      * and since we want the smallest such integer value for M:
      *     M == floor(m/2) + 1
      */
-    r->magnitude = (r->magnitude >> 1) + 1;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_storage_cmov(rustsecp256k1_v0_8_1_fe_storage *r, const rustsecp256k1_v0_8_1_fe_storage *a, int flag) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_fe_storage_cmov(rustsecp256k1_v0_9_0_fe_storage *r, const rustsecp256k1_v0_9_0_fe_storage *a, int flag) {
     uint32_t mask0, mask1;
-    VG_CHECK_VERIFY(r->n, sizeof(r->n));
-    mask0 = flag + ~((uint32_t)0);
+    volatile int vflag = flag;
+    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
+    mask0 = vflag + ~((uint32_t)0);
     mask1 = ~mask0;
     r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
     r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
@@ -1244,10 +1121,7 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_storage_cmov(rustsecp256k1_
     r->n[7] = (r->n[7] & mask0) | (a->n[7] & mask1);
 }
 
-static void rustsecp256k1_v0_8_1_fe_to_storage(rustsecp256k1_v0_8_1_fe_storage *r, const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-#endif
+static void rustsecp256k1_v0_9_0_fe_impl_to_storage(rustsecp256k1_v0_9_0_fe_storage *r, const rustsecp256k1_v0_9_0_fe *a) {
     r->n[0] = a->n[0] | a->n[1] << 26;
     r->n[1] = a->n[1] >> 6 | a->n[2] << 20;
     r->n[2] = a->n[2] >> 12 | a->n[3] << 14;
@@ -1258,7 +1132,7 @@ static void rustsecp256k1_v0_8_1_fe_to_storage(rustsecp256k1_v0_8_1_fe_storage *
     r->n[7] = a->n[8] >> 16 | a->n[9] << 10;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_from_storage(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe_storage *a) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_fe_impl_from_storage(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe_storage *a) {
     r->n[0] = a->n[0] & 0x3FFFFFFUL;
     r->n[1] = a->n[0] >> 26 | ((a->n[1] << 6) & 0x3FFFFFFUL);
     r->n[2] = a->n[1] >> 20 | ((a->n[2] << 12) & 0x3FFFFFFUL);
@@ -1269,19 +1143,14 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_from_storage(rustsecp256k1_
     r->n[7] = a->n[5] >> 22 | ((a->n[6] << 10) & 0x3FFFFFFUL);
     r->n[8] = a->n[6] >> 16 | ((a->n[7] << 16) & 0x3FFFFFFUL);
     r->n[9] = a->n[7] >> 10;
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_from_signed30(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_modinv32_signed30 *a) {
+static void rustsecp256k1_v0_9_0_fe_from_signed30(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_modinv32_signed30 *a) {
     const uint32_t M26 = UINT32_MAX >> 6;
     const uint32_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4],
                    a5 = a->v[5], a6 = a->v[6], a7 = a->v[7], a8 = a->v[8];
 
-    /* The output from rustsecp256k1_v0_8_1_modinv32{_var} should be normalized to range [0,modulus), and
+    /* The output from rustsecp256k1_v0_9_0_modinv32{_var} should be normalized to range [0,modulus), and
      * have limbs in [0,2^30). The modulus is < 2^256, so the top limb must be below 2^(256-30*8).
      */
     VERIFY_CHECK(a0 >> 30 == 0);
@@ -1304,23 +1173,13 @@ static void rustsecp256k1_v0_8_1_fe_from_signed30(rustsecp256k1_v0_8_1_fe *r, co
     r->n[7] = (a6 >>  2           ) & M26;
     r->n[8] = (a6 >> 28 | a7 <<  2) & M26;
     r->n[9] = (a7 >> 24 | a8 <<  6);
-
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_to_signed30(rustsecp256k1_v0_8_1_modinv32_signed30 *r, const rustsecp256k1_v0_8_1_fe *a) {
+static void rustsecp256k1_v0_9_0_fe_to_signed30(rustsecp256k1_v0_9_0_modinv32_signed30 *r, const rustsecp256k1_v0_9_0_fe *a) {
     const uint32_t M30 = UINT32_MAX >> 2;
     const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4],
                    a5 = a->n[5], a6 = a->n[6], a7 = a->n[7], a8 = a->n[8], a9 = a->n[9];
 
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-#endif
-
     r->v[0] = (a0       | a1 << 26) & M30;
     r->v[1] = (a1 >>  4 | a2 << 22) & M30;
     r->v[2] = (a2 >>  8 | a3 << 18) & M30;
@@ -1333,35 +1192,52 @@ static void rustsecp256k1_v0_8_1_fe_to_signed30(rustsecp256k1_v0_8_1_modinv32_si
     r->v[8] =  a9 >>  6;
 }
 
-static const rustsecp256k1_v0_8_1_modinv32_modinfo rustsecp256k1_v0_8_1_const_modinfo_fe = {
+static const rustsecp256k1_v0_9_0_modinv32_modinfo rustsecp256k1_v0_9_0_const_modinfo_fe = {
     {{-0x3D1, -4, 0, 0, 0, 0, 0, 0, 65536}},
     0x2DDACACFL
 };
 
-static void rustsecp256k1_v0_8_1_fe_inv(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *x) {
-    rustsecp256k1_v0_8_1_fe tmp;
-    rustsecp256k1_v0_8_1_modinv32_signed30 s;
+static void rustsecp256k1_v0_9_0_fe_impl_inv(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *x) {
+    rustsecp256k1_v0_9_0_fe tmp = *x;
+    rustsecp256k1_v0_9_0_modinv32_signed30 s;
 
-    tmp = *x;
-    rustsecp256k1_v0_8_1_fe_normalize(&tmp);
-    rustsecp256k1_v0_8_1_fe_to_signed30(&s, &tmp);
-    rustsecp256k1_v0_8_1_modinv32(&s, &rustsecp256k1_v0_8_1_const_modinfo_fe);
-    rustsecp256k1_v0_8_1_fe_from_signed30(r, &s);
+    rustsecp256k1_v0_9_0_fe_normalize(&tmp);
+    rustsecp256k1_v0_9_0_fe_to_signed30(&s, &tmp);
+    rustsecp256k1_v0_9_0_modinv32(&s, &rustsecp256k1_v0_9_0_const_modinfo_fe);
+    rustsecp256k1_v0_9_0_fe_from_signed30(r, &s);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_inv_var(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *x) {
+    rustsecp256k1_v0_9_0_fe tmp = *x;
+    rustsecp256k1_v0_9_0_modinv32_signed30 s;
 
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_fe_normalizes_to_zero(r) == rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&tmp));
+    rustsecp256k1_v0_9_0_fe_normalize_var(&tmp);
+    rustsecp256k1_v0_9_0_fe_to_signed30(&s, &tmp);
+    rustsecp256k1_v0_9_0_modinv32_var(&s, &rustsecp256k1_v0_9_0_const_modinfo_fe);
+    rustsecp256k1_v0_9_0_fe_from_signed30(r, &s);
 }
 
-static void rustsecp256k1_v0_8_1_fe_inv_var(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *x) {
-    rustsecp256k1_v0_8_1_fe tmp;
-    rustsecp256k1_v0_8_1_modinv32_signed30 s;
+static int rustsecp256k1_v0_9_0_fe_impl_is_square_var(const rustsecp256k1_v0_9_0_fe *x) {
+    rustsecp256k1_v0_9_0_fe tmp;
+    rustsecp256k1_v0_9_0_modinv32_signed30 s;
+    int jac, ret;
 
     tmp = *x;
-    rustsecp256k1_v0_8_1_fe_normalize_var(&tmp);
-    rustsecp256k1_v0_8_1_fe_to_signed30(&s, &tmp);
-    rustsecp256k1_v0_8_1_modinv32_var(&s, &rustsecp256k1_v0_8_1_const_modinfo_fe);
-    rustsecp256k1_v0_8_1_fe_from_signed30(r, &s);
-
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_fe_normalizes_to_zero(r) == rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&tmp));
+    rustsecp256k1_v0_9_0_fe_normalize_var(&tmp);
+    /* rustsecp256k1_v0_9_0_jacobi32_maybe_var cannot deal with input 0. */
+    if (rustsecp256k1_v0_9_0_fe_is_zero(&tmp)) return 1;
+    rustsecp256k1_v0_9_0_fe_to_signed30(&s, &tmp);
+    jac = rustsecp256k1_v0_9_0_jacobi32_maybe_var(&s, &rustsecp256k1_v0_9_0_const_modinfo_fe);
+    if (jac == 0) {
+        /* rustsecp256k1_v0_9_0_jacobi32_maybe_var failed to compute the Jacobi symbol. Fall back
+         * to computing a square root. This should be extremely rare with random
+         * input (except in VERIFY mode, where a lower iteration count is used). */
+        rustsecp256k1_v0_9_0_fe dummy;
+        ret = rustsecp256k1_v0_9_0_fe_sqrt(&dummy, &tmp);
+    } else {
+        ret = jac >= 0;
+    }
+    return ret;
 }
 
 #endif /* SECP256K1_FIELD_REPR_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/field_5x52.h b/secp256k1-sys/depend/secp256k1/src/field_5x52.h
index ad674402c..21ac9ec91 100644
--- a/secp256k1-sys/depend/secp256k1/src/field_5x52.h
+++ b/secp256k1-sys/depend/secp256k1/src/field_5x52.h
@@ -9,16 +9,29 @@
 
 #include <stdint.h>
 
+/** This field implementation represents the value as 5 uint64_t limbs in base
+ *  2^52. */
 typedef struct {
-    /* X = sum(i=0..4, n[i]*2^(i*52)) mod p
-     * where p = 2^256 - 0x1000003D1
-     */
+   /* A field element f represents the sum(i=0..4, f.n[i] << (i*52)) mod p,
+    * where p is the field modulus, 2^256 - 2^32 - 977.
+    *
+    * The individual limbs f.n[i] can exceed 2^52; the field's magnitude roughly
+    * corresponds to how much excess is allowed. The value
+    * sum(i=0..4, f.n[i] << (i*52)) may exceed p, unless the field element is
+    * normalized. */
     uint64_t n[5];
-#ifdef VERIFY
-    int magnitude;
-    int normalized;
-#endif
-} rustsecp256k1_v0_8_1_fe;
+    /*
+     * Magnitude m requires:
+     *     n[i] <= 2 * m * (2^52 - 1) for i=0..3
+     *     n[4] <= 2 * m * (2^48 - 1)
+     *
+     * Normalized requires:
+     *     n[i] <= (2^52 - 1) for i=0..3
+     *     sum(i=0..4, n[i] << (i*52)) < p
+     *     (together these imply n[4] <= 2^48 - 1)
+     */
+    SECP256K1_FE_VERIFY_FIELDS
+} rustsecp256k1_v0_9_0_fe;
 
 /* Unpacks a constant into a overlapping multi-limbed FE element. */
 #define SECP256K1_FE_CONST_INNER(d7, d6, d5, d4, d3, d2, d1, d0) { \
@@ -29,15 +42,9 @@ typedef struct {
     ((uint64_t)(d6) >> 16) | (((uint64_t)(d7)) << 16) \
 }
 
-#ifdef VERIFY
-#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {SECP256K1_FE_CONST_INNER((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0)), 1, 1}
-#else
-#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {SECP256K1_FE_CONST_INNER((d7), (d6), (d5), (d4), (d3), (d2), (d1), (d0))}
-#endif
-
 typedef struct {
     uint64_t n[4];
-} rustsecp256k1_v0_8_1_fe_storage;
+} rustsecp256k1_v0_9_0_fe_storage;
 
 #define SECP256K1_FE_STORAGE_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{ \
     (d0) | (((uint64_t)(d1)) << 32), \
diff --git a/secp256k1-sys/depend/secp256k1/src/field_5x52_asm_impl.h b/secp256k1-sys/depend/secp256k1/src/field_5x52_asm_impl.h
index cefb14516..a98892ded 100644
--- a/secp256k1-sys/depend/secp256k1/src/field_5x52_asm_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/field_5x52_asm_impl.h
@@ -14,7 +14,9 @@
 #ifndef SECP256K1_FIELD_INNER5X52_IMPL_H
 #define SECP256K1_FIELD_INNER5X52_IMPL_H
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_inner(uint64_t *r, const uint64_t *a, const uint64_t * SECP256K1_RESTRICT b) {
+#include "util.h"
+
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_mul_inner(uint64_t *r, const uint64_t *a, const uint64_t * SECP256K1_RESTRICT b) {
 /**
  * Registers: rdx:rax = multiplication accumulator
  *            r9:r8   = c
@@ -278,13 +280,13 @@ __asm__ __volatile__(
     "addq %%rsi,%%r8\n"
     /* r[4] = c */
     "movq %%r8,32(%%rdi)\n"
-: "+S"(a), "=m"(tmp1), "=m"(tmp2), "=m"(tmp3)
+: "+S"(a), "=&m"(tmp1), "=&m"(tmp2), "=&m"(tmp3)
 : "b"(b), "D"(r)
 : "%rax", "%rcx", "%rdx", "%r8", "%r9", "%r10", "%r11", "%r12", "%r13", "%r14", "%r15", "cc", "memory"
 );
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_sqr_inner(uint64_t *r, const uint64_t *a) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_sqr_inner(uint64_t *r, const uint64_t *a) {
 /**
  * Registers: rdx:rax = multiplication accumulator
  *            r9:r8   = c
@@ -493,7 +495,7 @@ __asm__ __volatile__(
     "addq %%rsi,%%r8\n"
     /* r[4] = c */
     "movq %%r8,32(%%rdi)\n"
-: "+S"(a), "=m"(tmp1), "=m"(tmp2), "=m"(tmp3)
+: "+S"(a), "=&m"(tmp1), "=&m"(tmp2), "=&m"(tmp3)
 : "D"(r)
 : "%rax", "%rbx", "%rcx", "%rdx", "%r8", "%r9", "%r10", "%r11", "%r12", "%r13", "%r14", "%r15", "cc", "memory"
 );
diff --git a/secp256k1-sys/depend/secp256k1/src/field_5x52_impl.h b/secp256k1-sys/depend/secp256k1/src/field_5x52_impl.h
index a658ab95a..5c1c8dc7a 100644
--- a/secp256k1-sys/depend/secp256k1/src/field_5x52_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/field_5x52_impl.h
@@ -7,10 +7,7 @@
 #ifndef SECP256K1_FIELD_REPR_IMPL_H
 #define SECP256K1_FIELD_REPR_IMPL_H
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
-
+#include "checkmem.h"
 #include "util.h"
 #include "field.h"
 #include "modinv64_impl.h"
@@ -21,59 +18,33 @@
 #include "field_5x52_int128_impl.h"
 #endif
 
-/** Implements arithmetic modulo FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F,
- *  represented as 5 uint64_t's in base 2^52, least significant first. Note that the limbs are allowed to
- *  contain >52 bits each.
- *
- *  Each field element has a 'magnitude' associated with it. Internally, a magnitude M means:
- *  - 2*M*(2^48-1) is the max (inclusive) of the most significant limb
- *  - 2*M*(2^52-1) is the max (inclusive) of the remaining limbs
- *
- *  Operations have different rules for propagating magnitude to their outputs. If an operation takes a
- *  magnitude M as a parameter, that means the magnitude of input field elements can be at most M (inclusive).
- *
- *  Each field element also has a 'normalized' flag. A field element is normalized if its magnitude is either
- *  0 or 1, and its value is already reduced modulo the order of the field.
- */
-
 #ifdef VERIFY
-static void rustsecp256k1_v0_8_1_fe_verify(const rustsecp256k1_v0_8_1_fe *a) {
+static void rustsecp256k1_v0_9_0_fe_impl_verify(const rustsecp256k1_v0_9_0_fe *a) {
     const uint64_t *d = a->n;
-    int m = a->normalized ? 1 : 2 * a->magnitude, r = 1;
+    int m = a->normalized ? 1 : 2 * a->magnitude;
    /* secp256k1 'p' value defined in "Standards for Efficient Cryptography" (SEC2) 2.7.1. */
-    r &= (d[0] <= 0xFFFFFFFFFFFFFULL * m);
-    r &= (d[1] <= 0xFFFFFFFFFFFFFULL * m);
-    r &= (d[2] <= 0xFFFFFFFFFFFFFULL * m);
-    r &= (d[3] <= 0xFFFFFFFFFFFFFULL * m);
-    r &= (d[4] <= 0x0FFFFFFFFFFFFULL * m);
-    r &= (a->magnitude >= 0);
-    r &= (a->magnitude <= 2048);
+    VERIFY_CHECK(d[0] <= 0xFFFFFFFFFFFFFULL * m);
+    VERIFY_CHECK(d[1] <= 0xFFFFFFFFFFFFFULL * m);
+    VERIFY_CHECK(d[2] <= 0xFFFFFFFFFFFFFULL * m);
+    VERIFY_CHECK(d[3] <= 0xFFFFFFFFFFFFFULL * m);
+    VERIFY_CHECK(d[4] <= 0x0FFFFFFFFFFFFULL * m);
     if (a->normalized) {
-        r &= (a->magnitude <= 1);
-        if (r && (d[4] == 0x0FFFFFFFFFFFFULL) && ((d[3] & d[2] & d[1]) == 0xFFFFFFFFFFFFFULL)) {
-            r &= (d[0] < 0xFFFFEFFFFFC2FULL);
+        if ((d[4] == 0x0FFFFFFFFFFFFULL) && ((d[3] & d[2] & d[1]) == 0xFFFFFFFFFFFFFULL)) {
+            VERIFY_CHECK(d[0] < 0xFFFFEFFFFFC2FULL);
         }
     }
-    VERIFY_CHECK(r == 1);
 }
 #endif
 
-static void rustsecp256k1_v0_8_1_fe_get_bounds(rustsecp256k1_v0_8_1_fe *r, int m) {
-    VERIFY_CHECK(m >= 0);
-    VERIFY_CHECK(m <= 2048);
+static void rustsecp256k1_v0_9_0_fe_impl_get_bounds(rustsecp256k1_v0_9_0_fe *r, int m) {
     r->n[0] = 0xFFFFFFFFFFFFFULL * 2 * m;
     r->n[1] = 0xFFFFFFFFFFFFFULL * 2 * m;
     r->n[2] = 0xFFFFFFFFFFFFFULL * 2 * m;
     r->n[3] = 0xFFFFFFFFFFFFFULL * 2 * m;
     r->n[4] = 0x0FFFFFFFFFFFFULL * 2 * m;
-#ifdef VERIFY
-    r->magnitude = m;
-    r->normalized = (m == 0);
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_normalize(rustsecp256k1_v0_8_1_fe *r) {
+static void rustsecp256k1_v0_9_0_fe_impl_normalize(rustsecp256k1_v0_9_0_fe *r) {
     uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
 
     /* Reduce t4 at the start so there will be at most a single carry from the first pass */
@@ -108,15 +79,9 @@ static void rustsecp256k1_v0_8_1_fe_normalize(rustsecp256k1_v0_8_1_fe *r) {
     t4 &= 0x0FFFFFFFFFFFFULL;
 
     r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
-
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_normalize_weak(rustsecp256k1_v0_8_1_fe *r) {
+static void rustsecp256k1_v0_9_0_fe_impl_normalize_weak(rustsecp256k1_v0_9_0_fe *r) {
     uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
 
     /* Reduce t4 at the start so there will be at most a single carry from the first pass */
@@ -133,14 +98,9 @@ static void rustsecp256k1_v0_8_1_fe_normalize_weak(rustsecp256k1_v0_8_1_fe *r) {
     VERIFY_CHECK(t4 >> 49 == 0);
 
     r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
-
-#ifdef VERIFY
-    r->magnitude = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_normalize_var(rustsecp256k1_v0_8_1_fe *r) {
+static void rustsecp256k1_v0_9_0_fe_impl_normalize_var(rustsecp256k1_v0_9_0_fe *r) {
     uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
 
     /* Reduce t4 at the start so there will be at most a single carry from the first pass */
@@ -176,15 +136,9 @@ static void rustsecp256k1_v0_8_1_fe_normalize_var(rustsecp256k1_v0_8_1_fe *r) {
     }
 
     r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
-
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero(const rustsecp256k1_v0_8_1_fe *r) {
+static int rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero(const rustsecp256k1_v0_9_0_fe *r) {
     uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
 
     /* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
@@ -207,7 +161,7 @@ static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero(const rustsecp256k1_v0_8_1
     return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
 }
 
-static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(const rustsecp256k1_v0_8_1_fe *r) {
+static int rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero_var(const rustsecp256k1_v0_9_0_fe *r) {
     uint64_t t0, t1, t2, t3, t4;
     uint64_t z0, z1;
     uint64_t x;
@@ -248,53 +202,29 @@ static int rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(const rustsecp256k1_v0
     return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_set_int(rustsecp256k1_v0_8_1_fe *r, int a) {
-    VERIFY_CHECK(0 <= a && a <= 0x7FFF);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_set_int(rustsecp256k1_v0_9_0_fe *r, int a) {
     r->n[0] = a;
     r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0;
-#ifdef VERIFY
-    r->magnitude = (a != 0);
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_fe_is_zero(const rustsecp256k1_v0_8_1_fe *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_impl_is_zero(const rustsecp256k1_v0_9_0_fe *a) {
     const uint64_t *t = a->n;
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
     return (t[0] | t[1] | t[2] | t[3] | t[4]) == 0;
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_fe_is_odd(const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_impl_is_odd(const rustsecp256k1_v0_9_0_fe *a) {
     return a->n[0] & 1;
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_clear(rustsecp256k1_v0_8_1_fe *a) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_clear(rustsecp256k1_v0_9_0_fe *a) {
     int i;
-#ifdef VERIFY
-    a->magnitude = 0;
-    a->normalized = 1;
-#endif
     for (i=0; i<5; i++) {
         a->n[i] = 0;
     }
 }
 
-static int rustsecp256k1_v0_8_1_fe_cmp_var(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *b) {
+static int rustsecp256k1_v0_9_0_fe_impl_cmp_var(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *b) {
     int i;
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-    VERIFY_CHECK(b->normalized);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-    rustsecp256k1_v0_8_1_fe_verify(b);
-#endif
     for (i = 4; i >= 0; i--) {
         if (a->n[i] > b->n[i]) {
             return 1;
@@ -306,8 +236,7 @@ static int rustsecp256k1_v0_8_1_fe_cmp_var(const rustsecp256k1_v0_8_1_fe *a, con
     return 0;
 }
 
-static int rustsecp256k1_v0_8_1_fe_set_b32(rustsecp256k1_v0_8_1_fe *r, const unsigned char *a) {
-    int ret;
+static void rustsecp256k1_v0_9_0_fe_impl_set_b32_mod(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a) {
     r->n[0] = (uint64_t)a[31]
             | ((uint64_t)a[30] << 8)
             | ((uint64_t)a[29] << 16)
@@ -342,25 +271,15 @@ static int rustsecp256k1_v0_8_1_fe_set_b32(rustsecp256k1_v0_8_1_fe *r, const uns
             | ((uint64_t)a[2] << 24)
             | ((uint64_t)a[1] << 32)
             | ((uint64_t)a[0] << 40);
-    ret = !((r->n[4] == 0x0FFFFFFFFFFFFULL) & ((r->n[3] & r->n[2] & r->n[1]) == 0xFFFFFFFFFFFFFULL) & (r->n[0] >= 0xFFFFEFFFFFC2FULL));
-#ifdef VERIFY
-    r->magnitude = 1;
-    if (ret) {
-        r->normalized = 1;
-        rustsecp256k1_v0_8_1_fe_verify(r);
-    } else {
-        r->normalized = 0;
-    }
-#endif
-    return ret;
+}
+
+static int rustsecp256k1_v0_9_0_fe_impl_set_b32_limit(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a) {
+    rustsecp256k1_v0_9_0_fe_impl_set_b32_mod(r, a);
+    return !((r->n[4] == 0x0FFFFFFFFFFFFULL) & ((r->n[3] & r->n[2] & r->n[1]) == 0xFFFFFFFFFFFFFULL) & (r->n[0] >= 0xFFFFEFFFFFC2FULL));
 }
 
 /** Convert a field element to a 32-byte big endian value. Requires the input to be normalized */
-static void rustsecp256k1_v0_8_1_fe_get_b32(unsigned char *r, const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
+static void rustsecp256k1_v0_9_0_fe_impl_get_b32(unsigned char *r, const rustsecp256k1_v0_9_0_fe *a) {
     r[0] = (a->n[4] >> 40) & 0xFF;
     r[1] = (a->n[4] >> 32) & 0xFF;
     r[2] = (a->n[4] >> 24) & 0xFF;
@@ -395,113 +314,67 @@ static void rustsecp256k1_v0_8_1_fe_get_b32(unsigned char *r, const rustsecp256k
     r[31] = a->n[0] & 0xFF;
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_negate(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a, int m) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->magnitude <= m);
-    rustsecp256k1_v0_8_1_fe_verify(a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_negate_unchecked(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int m) {
+    /* For all legal values of m (0..31), the following properties hold: */
     VERIFY_CHECK(0xFFFFEFFFFFC2FULL * 2 * (m + 1) >= 0xFFFFFFFFFFFFFULL * 2 * m);
     VERIFY_CHECK(0xFFFFFFFFFFFFFULL * 2 * (m + 1) >= 0xFFFFFFFFFFFFFULL * 2 * m);
     VERIFY_CHECK(0x0FFFFFFFFFFFFULL * 2 * (m + 1) >= 0x0FFFFFFFFFFFFULL * 2 * m);
-#endif
+
+    /* Due to the properties above, the left hand in the subtractions below is never less than
+     * the right hand. */
     r->n[0] = 0xFFFFEFFFFFC2FULL * 2 * (m + 1) - a->n[0];
     r->n[1] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[1];
     r->n[2] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[2];
     r->n[3] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[3];
     r->n[4] = 0x0FFFFFFFFFFFFULL * 2 * (m + 1) - a->n[4];
-#ifdef VERIFY
-    r->magnitude = m + 1;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_int(rustsecp256k1_v0_8_1_fe *r, int a) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_mul_int_unchecked(rustsecp256k1_v0_9_0_fe *r, int a) {
     r->n[0] *= a;
     r->n[1] *= a;
     r->n[2] *= a;
     r->n[3] *= a;
     r->n[4] *= a;
-#ifdef VERIFY
-    r->magnitude *= a;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_add(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_add_int(rustsecp256k1_v0_9_0_fe *r, int a) {
+    r->n[0] += a;
+}
+
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_add(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a) {
     r->n[0] += a->n[0];
     r->n[1] += a->n[1];
     r->n[2] += a->n[2];
     r->n[3] += a->n[3];
     r->n[4] += a->n[4];
-#ifdef VERIFY
-    r->magnitude += a->magnitude;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_mul(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe * SECP256K1_RESTRICT b) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->magnitude <= 8);
-    VERIFY_CHECK(b->magnitude <= 8);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-    rustsecp256k1_v0_8_1_fe_verify(b);
-    VERIFY_CHECK(r != b);
-    VERIFY_CHECK(a != b);
-#endif
-    rustsecp256k1_v0_8_1_fe_mul_inner(r->n, a->n, b->n);
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_mul(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe * SECP256K1_RESTRICT b) {
+    rustsecp256k1_v0_9_0_fe_mul_inner(r->n, a->n, b->n);
 }
 
-static void rustsecp256k1_v0_8_1_fe_sqr(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->magnitude <= 8);
-    rustsecp256k1_v0_8_1_fe_verify(a);
-#endif
-    rustsecp256k1_v0_8_1_fe_sqr_inner(r->n, a->n);
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_sqr(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a) {
+    rustsecp256k1_v0_9_0_fe_sqr_inner(r->n, a->n);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_cmov(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a, int flag) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_impl_cmov(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int flag) {
     uint64_t mask0, mask1;
-    VG_CHECK_VERIFY(r->n, sizeof(r->n));
-    mask0 = flag + ~((uint64_t)0);
+    volatile int vflag = flag;
+    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
+    mask0 = vflag + ~((uint64_t)0);
     mask1 = ~mask0;
     r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
     r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
     r->n[2] = (r->n[2] & mask0) | (a->n[2] & mask1);
     r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
     r->n[4] = (r->n[4] & mask0) | (a->n[4] & mask1);
-#ifdef VERIFY
-    if (flag) {
-        r->magnitude = a->magnitude;
-        r->normalized = a->normalized;
-    }
-#endif
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_half(rustsecp256k1_v0_8_1_fe *r) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_fe_impl_half(rustsecp256k1_v0_9_0_fe *r) {
     uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
     uint64_t one = (uint64_t)1;
     uint64_t mask = -(t0 & one) >> 12;
 
-#ifdef VERIFY
-    rustsecp256k1_v0_8_1_fe_verify(r);
-    VERIFY_CHECK(r->magnitude < 32);
-#endif
-
     /* Bounds analysis (over the rationals).
      *
      * Let m = r->magnitude
@@ -538,10 +411,8 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_half(rustsecp256k1_v0_8_1_f
      *
      * Current bounds: t0..t3 <= C * (m/2 + 1/2)
      *                     t4 <= D * (m/2 + 1/4)
-     */
-
-#ifdef VERIFY
-    /* Therefore the output magnitude (M) has to be set such that:
+     *
+     * Therefore the output magnitude (M) has to be set such that:
      *     t0..t3: C * M >= C * (m/2 + 1/2)
      *         t4: D * M >= D * (m/2 + 1/4)
      *
@@ -551,16 +422,13 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_half(rustsecp256k1_v0_8_1_f
      * and since we want the smallest such integer value for M:
      *     M == floor(m/2) + 1
      */
-    r->magnitude = (r->magnitude >> 1) + 1;
-    r->normalized = 0;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_storage_cmov(rustsecp256k1_v0_8_1_fe_storage *r, const rustsecp256k1_v0_8_1_fe_storage *a, int flag) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_fe_storage_cmov(rustsecp256k1_v0_9_0_fe_storage *r, const rustsecp256k1_v0_9_0_fe_storage *a, int flag) {
     uint64_t mask0, mask1;
-    VG_CHECK_VERIFY(r->n, sizeof(r->n));
-    mask0 = flag + ~((uint64_t)0);
+    volatile int vflag = flag;
+    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
+    mask0 = vflag + ~((uint64_t)0);
     mask1 = ~mask0;
     r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
     r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
@@ -568,34 +436,26 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_storage_cmov(rustsecp256k1_
     r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
 }
 
-static void rustsecp256k1_v0_8_1_fe_to_storage(rustsecp256k1_v0_8_1_fe_storage *r, const rustsecp256k1_v0_8_1_fe *a) {
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-#endif
+static void rustsecp256k1_v0_9_0_fe_impl_to_storage(rustsecp256k1_v0_9_0_fe_storage *r, const rustsecp256k1_v0_9_0_fe *a) {
     r->n[0] = a->n[0] | a->n[1] << 52;
     r->n[1] = a->n[1] >> 12 | a->n[2] << 40;
     r->n[2] = a->n[2] >> 24 | a->n[3] << 28;
     r->n[3] = a->n[3] >> 36 | a->n[4] << 16;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_fe_from_storage(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe_storage *a) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_fe_impl_from_storage(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe_storage *a) {
     r->n[0] = a->n[0] & 0xFFFFFFFFFFFFFULL;
     r->n[1] = a->n[0] >> 52 | ((a->n[1] << 12) & 0xFFFFFFFFFFFFFULL);
     r->n[2] = a->n[1] >> 40 | ((a->n[2] << 24) & 0xFFFFFFFFFFFFFULL);
     r->n[3] = a->n[2] >> 28 | ((a->n[3] << 36) & 0xFFFFFFFFFFFFFULL);
     r->n[4] = a->n[3] >> 16;
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_from_signed62(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_modinv64_signed62 *a) {
+static void rustsecp256k1_v0_9_0_fe_from_signed62(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_modinv64_signed62 *a) {
     const uint64_t M52 = UINT64_MAX >> 12;
     const uint64_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4];
 
-    /* The output from rustsecp256k1_v0_8_1_modinv64{_var} should be normalized to range [0,modulus), and
+    /* The output from rustsecp256k1_v0_9_0_modinv64{_var} should be normalized to range [0,modulus), and
      * have limbs in [0,2^62). The modulus is < 2^256, so the top limb must be below 2^(256-62*4).
      */
     VERIFY_CHECK(a0 >> 62 == 0);
@@ -609,22 +469,12 @@ static void rustsecp256k1_v0_8_1_fe_from_signed62(rustsecp256k1_v0_8_1_fe *r, co
     r->n[2] = (a1 >> 42 | a2 << 20) & M52;
     r->n[3] = (a2 >> 32 | a3 << 30) & M52;
     r->n[4] = (a3 >> 22 | a4 << 40);
-
-#ifdef VERIFY
-    r->magnitude = 1;
-    r->normalized = 1;
-    rustsecp256k1_v0_8_1_fe_verify(r);
-#endif
 }
 
-static void rustsecp256k1_v0_8_1_fe_to_signed62(rustsecp256k1_v0_8_1_modinv64_signed62 *r, const rustsecp256k1_v0_8_1_fe *a) {
+static void rustsecp256k1_v0_9_0_fe_to_signed62(rustsecp256k1_v0_9_0_modinv64_signed62 *r, const rustsecp256k1_v0_9_0_fe *a) {
     const uint64_t M62 = UINT64_MAX >> 2;
     const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4];
 
-#ifdef VERIFY
-    VERIFY_CHECK(a->normalized);
-#endif
-
     r->v[0] = (a0       | a1 << 52) & M62;
     r->v[1] = (a1 >> 10 | a2 << 42) & M62;
     r->v[2] = (a2 >> 20 | a3 << 32) & M62;
@@ -632,39 +482,52 @@ static void rustsecp256k1_v0_8_1_fe_to_signed62(rustsecp256k1_v0_8_1_modinv64_si
     r->v[4] =  a4 >> 40;
 }
 
-static const rustsecp256k1_v0_8_1_modinv64_modinfo rustsecp256k1_v0_8_1_const_modinfo_fe = {
+static const rustsecp256k1_v0_9_0_modinv64_modinfo rustsecp256k1_v0_9_0_const_modinfo_fe = {
     {{-0x1000003D1LL, 0, 0, 0, 256}},
     0x27C7F6E22DDACACFLL
 };
 
-static void rustsecp256k1_v0_8_1_fe_inv(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *x) {
-    rustsecp256k1_v0_8_1_fe tmp;
-    rustsecp256k1_v0_8_1_modinv64_signed62 s;
+static void rustsecp256k1_v0_9_0_fe_impl_inv(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *x) {
+    rustsecp256k1_v0_9_0_fe tmp = *x;
+    rustsecp256k1_v0_9_0_modinv64_signed62 s;
 
-    tmp = *x;
-    rustsecp256k1_v0_8_1_fe_normalize(&tmp);
-    rustsecp256k1_v0_8_1_fe_to_signed62(&s, &tmp);
-    rustsecp256k1_v0_8_1_modinv64(&s, &rustsecp256k1_v0_8_1_const_modinfo_fe);
-    rustsecp256k1_v0_8_1_fe_from_signed62(r, &s);
+    rustsecp256k1_v0_9_0_fe_normalize(&tmp);
+    rustsecp256k1_v0_9_0_fe_to_signed62(&s, &tmp);
+    rustsecp256k1_v0_9_0_modinv64(&s, &rustsecp256k1_v0_9_0_const_modinfo_fe);
+    rustsecp256k1_v0_9_0_fe_from_signed62(r, &s);
+}
 
-#ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_fe_normalizes_to_zero(r) == rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&tmp));
-#endif
+static void rustsecp256k1_v0_9_0_fe_impl_inv_var(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *x) {
+    rustsecp256k1_v0_9_0_fe tmp = *x;
+    rustsecp256k1_v0_9_0_modinv64_signed62 s;
+
+    rustsecp256k1_v0_9_0_fe_normalize_var(&tmp);
+    rustsecp256k1_v0_9_0_fe_to_signed62(&s, &tmp);
+    rustsecp256k1_v0_9_0_modinv64_var(&s, &rustsecp256k1_v0_9_0_const_modinfo_fe);
+    rustsecp256k1_v0_9_0_fe_from_signed62(r, &s);
 }
 
-static void rustsecp256k1_v0_8_1_fe_inv_var(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *x) {
-    rustsecp256k1_v0_8_1_fe tmp;
-    rustsecp256k1_v0_8_1_modinv64_signed62 s;
+static int rustsecp256k1_v0_9_0_fe_impl_is_square_var(const rustsecp256k1_v0_9_0_fe *x) {
+    rustsecp256k1_v0_9_0_fe tmp;
+    rustsecp256k1_v0_9_0_modinv64_signed62 s;
+    int jac, ret;
 
     tmp = *x;
-    rustsecp256k1_v0_8_1_fe_normalize_var(&tmp);
-    rustsecp256k1_v0_8_1_fe_to_signed62(&s, &tmp);
-    rustsecp256k1_v0_8_1_modinv64_var(&s, &rustsecp256k1_v0_8_1_const_modinfo_fe);
-    rustsecp256k1_v0_8_1_fe_from_signed62(r, &s);
-
-#ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_fe_normalizes_to_zero(r) == rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&tmp));
-#endif
+    rustsecp256k1_v0_9_0_fe_normalize_var(&tmp);
+    /* rustsecp256k1_v0_9_0_jacobi64_maybe_var cannot deal with input 0. */
+    if (rustsecp256k1_v0_9_0_fe_is_zero(&tmp)) return 1;
+    rustsecp256k1_v0_9_0_fe_to_signed62(&s, &tmp);
+    jac = rustsecp256k1_v0_9_0_jacobi64_maybe_var(&s, &rustsecp256k1_v0_9_0_const_modinfo_fe);
+    if (jac == 0) {
+        /* rustsecp256k1_v0_9_0_jacobi64_maybe_var failed to compute the Jacobi symbol. Fall back
+         * to computing a square root. This should be extremely rare with random
+         * input (except in VERIFY mode, where a lower iteration count is used). */
+        rustsecp256k1_v0_9_0_fe dummy;
+        ret = rustsecp256k1_v0_9_0_fe_sqrt(&dummy, &tmp);
+    } else {
+        ret = jac >= 0;
+    }
+    return ret;
 }
 
 #endif /* SECP256K1_FIELD_REPR_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/field_5x52_int128_impl.h b/secp256k1-sys/depend/secp256k1/src/field_5x52_int128_impl.h
index 59dea2622..44d6cf5dd 100644
--- a/secp256k1-sys/depend/secp256k1/src/field_5x52_int128_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/field_5x52_int128_impl.h
@@ -10,17 +10,18 @@
 #include <stdint.h>
 
 #include "int128.h"
+#include "util.h"
 
 #ifdef VERIFY
 #define VERIFY_BITS(x, n) VERIFY_CHECK(((x) >> (n)) == 0)
-#define VERIFY_BITS_128(x, n) VERIFY_CHECK(rustsecp256k1_v0_8_1_u128_check_bits((x), (n)))
+#define VERIFY_BITS_128(x, n) VERIFY_CHECK(rustsecp256k1_v0_9_0_u128_check_bits((x), (n)))
 #else
 #define VERIFY_BITS(x, n) do { } while(0)
 #define VERIFY_BITS_128(x, n) do { } while(0)
 #endif
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_inner(uint64_t *r, const uint64_t *a, const uint64_t * SECP256K1_RESTRICT b) {
-    rustsecp256k1_v0_8_1_uint128 c, d;
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_mul_inner(uint64_t *r, const uint64_t *a, const uint64_t * SECP256K1_RESTRICT b) {
+    rustsecp256k1_v0_9_0_uint128 c, d;
     uint64_t t3, t4, tx, u0;
     uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
     const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
@@ -44,35 +45,35 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_inner(uint64_t *r, cons
      *  Note that [x 0 0 0 0 0] = [x*R].
      */
 
-    rustsecp256k1_v0_8_1_u128_mul(&d, a0, b[3]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a1, b[2]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a2, b[1]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a3, b[0]);
+    rustsecp256k1_v0_9_0_u128_mul(&d, a0, b[3]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a1, b[2]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a2, b[1]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a3, b[0]);
     VERIFY_BITS_128(&d, 114);
     /* [d 0 0 0] = [p3 0 0 0] */
-    rustsecp256k1_v0_8_1_u128_mul(&c, a4, b[4]);
+    rustsecp256k1_v0_9_0_u128_mul(&c, a4, b[4]);
     VERIFY_BITS_128(&c, 112);
     /* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, R, rustsecp256k1_v0_8_1_u128_to_u64(&c)); rustsecp256k1_v0_8_1_u128_rshift(&c, 64);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, R, rustsecp256k1_v0_9_0_u128_to_u64(&c)); rustsecp256k1_v0_9_0_u128_rshift(&c, 64);
     VERIFY_BITS_128(&d, 115);
     VERIFY_BITS_128(&c, 48);
     /* [(c<<12) 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
-    t3 = rustsecp256k1_v0_8_1_u128_to_u64(&d) & M; rustsecp256k1_v0_8_1_u128_rshift(&d, 52);
+    t3 = rustsecp256k1_v0_9_0_u128_to_u64(&d) & M; rustsecp256k1_v0_9_0_u128_rshift(&d, 52);
     VERIFY_BITS(t3, 52);
     VERIFY_BITS_128(&d, 63);
     /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
 
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a0, b[4]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a1, b[3]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a2, b[2]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a3, b[1]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a4, b[0]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a0, b[4]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a1, b[3]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a2, b[2]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a3, b[1]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a4, b[0]);
     VERIFY_BITS_128(&d, 115);
     /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, R << 12, rustsecp256k1_v0_8_1_u128_to_u64(&c));
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, R << 12, rustsecp256k1_v0_9_0_u128_to_u64(&c));
     VERIFY_BITS_128(&d, 116);
     /* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
-    t4 = rustsecp256k1_v0_8_1_u128_to_u64(&d) & M; rustsecp256k1_v0_8_1_u128_rshift(&d, 52);
+    t4 = rustsecp256k1_v0_9_0_u128_to_u64(&d) & M; rustsecp256k1_v0_9_0_u128_rshift(&d, 52);
     VERIFY_BITS(t4, 52);
     VERIFY_BITS_128(&d, 64);
     /* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
@@ -81,16 +82,16 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_inner(uint64_t *r, cons
     VERIFY_BITS(t4, 48);
     /* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
 
-    rustsecp256k1_v0_8_1_u128_mul(&c, a0, b[0]);
+    rustsecp256k1_v0_9_0_u128_mul(&c, a0, b[0]);
     VERIFY_BITS_128(&c, 112);
     /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a1, b[4]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a2, b[3]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a3, b[2]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a4, b[1]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a1, b[4]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a2, b[3]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a3, b[2]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a4, b[1]);
     VERIFY_BITS_128(&d, 115);
     /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
-    u0 = rustsecp256k1_v0_8_1_u128_to_u64(&d) & M; rustsecp256k1_v0_8_1_u128_rshift(&d, 52);
+    u0 = rustsecp256k1_v0_9_0_u128_to_u64(&d) & M; rustsecp256k1_v0_9_0_u128_rshift(&d, 52);
     VERIFY_BITS(u0, 52);
     VERIFY_BITS_128(&d, 63);
     /* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
@@ -98,65 +99,65 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_mul_inner(uint64_t *r, cons
     u0 = (u0 << 4) | tx;
     VERIFY_BITS(u0, 56);
     /* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, u0, R >> 4);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, u0, R >> 4);
     VERIFY_BITS_128(&c, 115);
     /* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
-    r[0] = rustsecp256k1_v0_8_1_u128_to_u64(&c) & M; rustsecp256k1_v0_8_1_u128_rshift(&c, 52);
+    r[0] = rustsecp256k1_v0_9_0_u128_to_u64(&c) & M; rustsecp256k1_v0_9_0_u128_rshift(&c, 52);
     VERIFY_BITS(r[0], 52);
     VERIFY_BITS_128(&c, 61);
     /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
 
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, a0, b[1]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, a1, b[0]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, a0, b[1]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, a1, b[0]);
     VERIFY_BITS_128(&c, 114);
     /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a2, b[4]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a3, b[3]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a4, b[2]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a2, b[4]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a3, b[3]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a4, b[2]);
     VERIFY_BITS_128(&d, 114);
     /* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, rustsecp256k1_v0_8_1_u128_to_u64(&d) & M, R); rustsecp256k1_v0_8_1_u128_rshift(&d, 52);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, rustsecp256k1_v0_9_0_u128_to_u64(&d) & M, R); rustsecp256k1_v0_9_0_u128_rshift(&d, 52);
     VERIFY_BITS_128(&c, 115);
     VERIFY_BITS_128(&d, 62);
     /* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
-    r[1] = rustsecp256k1_v0_8_1_u128_to_u64(&c) & M; rustsecp256k1_v0_8_1_u128_rshift(&c, 52);
+    r[1] = rustsecp256k1_v0_9_0_u128_to_u64(&c) & M; rustsecp256k1_v0_9_0_u128_rshift(&c, 52);
     VERIFY_BITS(r[1], 52);
     VERIFY_BITS_128(&c, 63);
     /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
 
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, a0, b[2]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, a1, b[1]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, a2, b[0]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, a0, b[2]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, a1, b[1]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, a2, b[0]);
     VERIFY_BITS_128(&c, 114);
     /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a3, b[4]);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a4, b[3]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a3, b[4]);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a4, b[3]);
     VERIFY_BITS_128(&d, 114);
     /* [d 0 0 t4 t3 c t1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, R, rustsecp256k1_v0_8_1_u128_to_u64(&d)); rustsecp256k1_v0_8_1_u128_rshift(&d, 64);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, R, rustsecp256k1_v0_9_0_u128_to_u64(&d)); rustsecp256k1_v0_9_0_u128_rshift(&d, 64);
     VERIFY_BITS_128(&c, 115);
     VERIFY_BITS_128(&d, 50);
     /* [(d<<12) 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
 
-    r[2] = rustsecp256k1_v0_8_1_u128_to_u64(&c) & M; rustsecp256k1_v0_8_1_u128_rshift(&c, 52);
+    r[2] = rustsecp256k1_v0_9_0_u128_to_u64(&c) & M; rustsecp256k1_v0_9_0_u128_rshift(&c, 52);
     VERIFY_BITS(r[2], 52);
     VERIFY_BITS_128(&c, 63);
     /* [(d<<12) 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, R << 12, rustsecp256k1_v0_8_1_u128_to_u64(&d));
-    rustsecp256k1_v0_8_1_u128_accum_u64(&c, t3);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, R << 12, rustsecp256k1_v0_9_0_u128_to_u64(&d));
+    rustsecp256k1_v0_9_0_u128_accum_u64(&c, t3);
     VERIFY_BITS_128(&c, 100);
     /* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
-    r[3] = rustsecp256k1_v0_8_1_u128_to_u64(&c) & M; rustsecp256k1_v0_8_1_u128_rshift(&c, 52);
+    r[3] = rustsecp256k1_v0_9_0_u128_to_u64(&c) & M; rustsecp256k1_v0_9_0_u128_rshift(&c, 52);
     VERIFY_BITS(r[3], 52);
     VERIFY_BITS_128(&c, 48);
     /* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
-    r[4] = rustsecp256k1_v0_8_1_u128_to_u64(&c) + t4;
+    r[4] = rustsecp256k1_v0_9_0_u128_to_u64(&c) + t4;
     VERIFY_BITS(r[4], 49);
     /* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_sqr_inner(uint64_t *r, const uint64_t *a) {
-    rustsecp256k1_v0_8_1_uint128 c, d;
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_sqr_inner(uint64_t *r, const uint64_t *a) {
+    rustsecp256k1_v0_9_0_uint128 c, d;
     uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
     int64_t t3, t4, tx, u0;
     const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
@@ -172,32 +173,32 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_sqr_inner(uint64_t *r, cons
      *  Note that [x 0 0 0 0 0] = [x*R].
      */
 
-    rustsecp256k1_v0_8_1_u128_mul(&d, a0*2, a3);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a1*2, a2);
+    rustsecp256k1_v0_9_0_u128_mul(&d, a0*2, a3);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a1*2, a2);
     VERIFY_BITS_128(&d, 114);
     /* [d 0 0 0] = [p3 0 0 0] */
-    rustsecp256k1_v0_8_1_u128_mul(&c, a4, a4);
+    rustsecp256k1_v0_9_0_u128_mul(&c, a4, a4);
     VERIFY_BITS_128(&c, 112);
     /* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, R, rustsecp256k1_v0_8_1_u128_to_u64(&c)); rustsecp256k1_v0_8_1_u128_rshift(&c, 64);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, R, rustsecp256k1_v0_9_0_u128_to_u64(&c)); rustsecp256k1_v0_9_0_u128_rshift(&c, 64);
     VERIFY_BITS_128(&d, 115);
     VERIFY_BITS_128(&c, 48);
     /* [(c<<12) 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
-    t3 = rustsecp256k1_v0_8_1_u128_to_u64(&d) & M; rustsecp256k1_v0_8_1_u128_rshift(&d, 52);
+    t3 = rustsecp256k1_v0_9_0_u128_to_u64(&d) & M; rustsecp256k1_v0_9_0_u128_rshift(&d, 52);
     VERIFY_BITS(t3, 52);
     VERIFY_BITS_128(&d, 63);
     /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
 
     a4 *= 2;
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a0, a4);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a1*2, a3);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a2, a2);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a0, a4);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a1*2, a3);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a2, a2);
     VERIFY_BITS_128(&d, 115);
     /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, R << 12, rustsecp256k1_v0_8_1_u128_to_u64(&c));
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, R << 12, rustsecp256k1_v0_9_0_u128_to_u64(&c));
     VERIFY_BITS_128(&d, 116);
     /* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
-    t4 = rustsecp256k1_v0_8_1_u128_to_u64(&d) & M; rustsecp256k1_v0_8_1_u128_rshift(&d, 52);
+    t4 = rustsecp256k1_v0_9_0_u128_to_u64(&d) & M; rustsecp256k1_v0_9_0_u128_rshift(&d, 52);
     VERIFY_BITS(t4, 52);
     VERIFY_BITS_128(&d, 64);
     /* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
@@ -206,14 +207,14 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_sqr_inner(uint64_t *r, cons
     VERIFY_BITS(t4, 48);
     /* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
 
-    rustsecp256k1_v0_8_1_u128_mul(&c, a0, a0);
+    rustsecp256k1_v0_9_0_u128_mul(&c, a0, a0);
     VERIFY_BITS_128(&c, 112);
     /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a1, a4);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a2*2, a3);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a1, a4);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a2*2, a3);
     VERIFY_BITS_128(&d, 114);
     /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
-    u0 = rustsecp256k1_v0_8_1_u128_to_u64(&d) & M; rustsecp256k1_v0_8_1_u128_rshift(&d, 52);
+    u0 = rustsecp256k1_v0_9_0_u128_to_u64(&d) & M; rustsecp256k1_v0_9_0_u128_rshift(&d, 52);
     VERIFY_BITS(u0, 52);
     VERIFY_BITS_128(&d, 62);
     /* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
@@ -221,56 +222,56 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_fe_sqr_inner(uint64_t *r, cons
     u0 = (u0 << 4) | tx;
     VERIFY_BITS(u0, 56);
     /* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, u0, R >> 4);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, u0, R >> 4);
     VERIFY_BITS_128(&c, 113);
     /* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
-    r[0] = rustsecp256k1_v0_8_1_u128_to_u64(&c) & M; rustsecp256k1_v0_8_1_u128_rshift(&c, 52);
+    r[0] = rustsecp256k1_v0_9_0_u128_to_u64(&c) & M; rustsecp256k1_v0_9_0_u128_rshift(&c, 52);
     VERIFY_BITS(r[0], 52);
     VERIFY_BITS_128(&c, 61);
     /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
 
     a0 *= 2;
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, a0, a1);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, a0, a1);
     VERIFY_BITS_128(&c, 114);
     /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a2, a4);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a3, a3);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a2, a4);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a3, a3);
     VERIFY_BITS_128(&d, 114);
     /* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, rustsecp256k1_v0_8_1_u128_to_u64(&d) & M, R); rustsecp256k1_v0_8_1_u128_rshift(&d, 52);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, rustsecp256k1_v0_9_0_u128_to_u64(&d) & M, R); rustsecp256k1_v0_9_0_u128_rshift(&d, 52);
     VERIFY_BITS_128(&c, 115);
     VERIFY_BITS_128(&d, 62);
     /* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
-    r[1] = rustsecp256k1_v0_8_1_u128_to_u64(&c) & M; rustsecp256k1_v0_8_1_u128_rshift(&c, 52);
+    r[1] = rustsecp256k1_v0_9_0_u128_to_u64(&c) & M; rustsecp256k1_v0_9_0_u128_rshift(&c, 52);
     VERIFY_BITS(r[1], 52);
     VERIFY_BITS_128(&c, 63);
     /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
 
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, a0, a2);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, a1, a1);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, a0, a2);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, a1, a1);
     VERIFY_BITS_128(&c, 114);
     /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&d, a3, a4);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&d, a3, a4);
     VERIFY_BITS_128(&d, 114);
     /* [d 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, R, rustsecp256k1_v0_8_1_u128_to_u64(&d)); rustsecp256k1_v0_8_1_u128_rshift(&d, 64);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, R, rustsecp256k1_v0_9_0_u128_to_u64(&d)); rustsecp256k1_v0_9_0_u128_rshift(&d, 64);
     VERIFY_BITS_128(&c, 115);
     VERIFY_BITS_128(&d, 50);
     /* [(d<<12) 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
-    r[2] = rustsecp256k1_v0_8_1_u128_to_u64(&c) & M; rustsecp256k1_v0_8_1_u128_rshift(&c, 52);
+    r[2] = rustsecp256k1_v0_9_0_u128_to_u64(&c) & M; rustsecp256k1_v0_9_0_u128_rshift(&c, 52);
     VERIFY_BITS(r[2], 52);
     VERIFY_BITS_128(&c, 63);
     /* [(d<<12) 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
 
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c, R << 12, rustsecp256k1_v0_8_1_u128_to_u64(&d));
-    rustsecp256k1_v0_8_1_u128_accum_u64(&c, t3);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c, R << 12, rustsecp256k1_v0_9_0_u128_to_u64(&d));
+    rustsecp256k1_v0_9_0_u128_accum_u64(&c, t3);
     VERIFY_BITS_128(&c, 100);
     /* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
-    r[3] = rustsecp256k1_v0_8_1_u128_to_u64(&c) & M; rustsecp256k1_v0_8_1_u128_rshift(&c, 52);
+    r[3] = rustsecp256k1_v0_9_0_u128_to_u64(&c) & M; rustsecp256k1_v0_9_0_u128_rshift(&c, 52);
     VERIFY_BITS(r[3], 52);
     VERIFY_BITS_128(&c, 48);
     /* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
-    r[4] = rustsecp256k1_v0_8_1_u128_to_u64(&c) + t4;
+    r[4] = rustsecp256k1_v0_9_0_u128_to_u64(&c) + t4;
     VERIFY_BITS(r[4], 49);
     /* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
 }
diff --git a/secp256k1-sys/depend/secp256k1/src/field_impl.h b/secp256k1-sys/depend/secp256k1/src/field_impl.h
index 9f15fa0a7..823faf271 100644
--- a/secp256k1-sys/depend/secp256k1/src/field_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/field_impl.h
@@ -7,10 +7,7 @@
 #ifndef SECP256K1_FIELD_IMPL_H
 #define SECP256K1_FIELD_IMPL_H
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
-
+#include "field.h"
 #include "util.h"
 
 #if defined(SECP256K1_WIDEMUL_INT128)
@@ -21,21 +18,20 @@
 #error "Please select wide multiplication implementation"
 #endif
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_fe_equal(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *b) {
-    rustsecp256k1_v0_8_1_fe na;
-    rustsecp256k1_v0_8_1_fe_negate(&na, a, 1);
-    rustsecp256k1_v0_8_1_fe_add(&na, b);
-    return rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&na);
-}
-
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_fe_equal_var(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *b) {
-    rustsecp256k1_v0_8_1_fe na;
-    rustsecp256k1_v0_8_1_fe_negate(&na, a, 1);
-    rustsecp256k1_v0_8_1_fe_add(&na, b);
-    return rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&na);
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_equal(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *b) {
+    rustsecp256k1_v0_9_0_fe na;
+#ifdef VERIFY
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    rustsecp256k1_v0_9_0_fe_verify(b);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(a, 1);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(b, 31);
+#endif
+    rustsecp256k1_v0_9_0_fe_negate(&na, a, 1);
+    rustsecp256k1_v0_9_0_fe_add(&na, b);
+    return rustsecp256k1_v0_9_0_fe_normalizes_to_zero(&na);
 }
 
-static int rustsecp256k1_v0_8_1_fe_sqrt(rustsecp256k1_v0_8_1_fe *r, const rustsecp256k1_v0_8_1_fe *a) {
+static int rustsecp256k1_v0_9_0_fe_sqrt(rustsecp256k1_v0_9_0_fe * SECP256K1_RESTRICT r, const rustsecp256k1_v0_9_0_fe * SECP256K1_RESTRICT a) {
     /** Given that p is congruent to 3 mod 4, we can compute the square root of
      *  a mod p as the (p+1)/4'th power of a.
      *
@@ -45,94 +41,384 @@ static int rustsecp256k1_v0_8_1_fe_sqrt(rustsecp256k1_v0_8_1_fe *r, const rustse
      *  Also because (p+1)/4 is an even number, the computed square root is
      *  itself always a square (a ** ((p+1)/4) is the square of a ** ((p+1)/8)).
      */
-    rustsecp256k1_v0_8_1_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
-    int j;
+    rustsecp256k1_v0_9_0_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
+    int j, ret;
 
+#ifdef VERIFY
     VERIFY_CHECK(r != a);
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(a, 8);
+#endif
 
     /** The binary representation of (p + 1)/4 has 3 blocks of 1s, with lengths in
      *  { 2, 22, 223 }. Use an addition chain to calculate 2^n - 1 for each block:
      *  1, [2], 3, 6, 9, 11, [22], 44, 88, 176, 220, [223]
      */
 
-    rustsecp256k1_v0_8_1_fe_sqr(&x2, a);
-    rustsecp256k1_v0_8_1_fe_mul(&x2, &x2, a);
+    rustsecp256k1_v0_9_0_fe_sqr(&x2, a);
+    rustsecp256k1_v0_9_0_fe_mul(&x2, &x2, a);
 
-    rustsecp256k1_v0_8_1_fe_sqr(&x3, &x2);
-    rustsecp256k1_v0_8_1_fe_mul(&x3, &x3, a);
+    rustsecp256k1_v0_9_0_fe_sqr(&x3, &x2);
+    rustsecp256k1_v0_9_0_fe_mul(&x3, &x3, a);
 
     x6 = x3;
     for (j=0; j<3; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&x6, &x6);
+        rustsecp256k1_v0_9_0_fe_sqr(&x6, &x6);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&x6, &x6, &x3);
+    rustsecp256k1_v0_9_0_fe_mul(&x6, &x6, &x3);
 
     x9 = x6;
     for (j=0; j<3; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&x9, &x9);
+        rustsecp256k1_v0_9_0_fe_sqr(&x9, &x9);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&x9, &x9, &x3);
+    rustsecp256k1_v0_9_0_fe_mul(&x9, &x9, &x3);
 
     x11 = x9;
     for (j=0; j<2; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&x11, &x11);
+        rustsecp256k1_v0_9_0_fe_sqr(&x11, &x11);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&x11, &x11, &x2);
+    rustsecp256k1_v0_9_0_fe_mul(&x11, &x11, &x2);
 
     x22 = x11;
     for (j=0; j<11; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&x22, &x22);
+        rustsecp256k1_v0_9_0_fe_sqr(&x22, &x22);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&x22, &x22, &x11);
+    rustsecp256k1_v0_9_0_fe_mul(&x22, &x22, &x11);
 
     x44 = x22;
     for (j=0; j<22; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&x44, &x44);
+        rustsecp256k1_v0_9_0_fe_sqr(&x44, &x44);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&x44, &x44, &x22);
+    rustsecp256k1_v0_9_0_fe_mul(&x44, &x44, &x22);
 
     x88 = x44;
     for (j=0; j<44; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&x88, &x88);
+        rustsecp256k1_v0_9_0_fe_sqr(&x88, &x88);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&x88, &x88, &x44);
+    rustsecp256k1_v0_9_0_fe_mul(&x88, &x88, &x44);
 
     x176 = x88;
     for (j=0; j<88; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&x176, &x176);
+        rustsecp256k1_v0_9_0_fe_sqr(&x176, &x176);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&x176, &x176, &x88);
+    rustsecp256k1_v0_9_0_fe_mul(&x176, &x176, &x88);
 
     x220 = x176;
     for (j=0; j<44; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&x220, &x220);
+        rustsecp256k1_v0_9_0_fe_sqr(&x220, &x220);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&x220, &x220, &x44);
+    rustsecp256k1_v0_9_0_fe_mul(&x220, &x220, &x44);
 
     x223 = x220;
     for (j=0; j<3; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&x223, &x223);
+        rustsecp256k1_v0_9_0_fe_sqr(&x223, &x223);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&x223, &x223, &x3);
+    rustsecp256k1_v0_9_0_fe_mul(&x223, &x223, &x3);
 
     /* The final result is then assembled using a sliding window over the blocks. */
 
     t1 = x223;
     for (j=0; j<23; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&t1, &t1);
+        rustsecp256k1_v0_9_0_fe_sqr(&t1, &t1);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&t1, &t1, &x22);
+    rustsecp256k1_v0_9_0_fe_mul(&t1, &t1, &x22);
     for (j=0; j<6; j++) {
-        rustsecp256k1_v0_8_1_fe_sqr(&t1, &t1);
+        rustsecp256k1_v0_9_0_fe_sqr(&t1, &t1);
     }
-    rustsecp256k1_v0_8_1_fe_mul(&t1, &t1, &x2);
-    rustsecp256k1_v0_8_1_fe_sqr(&t1, &t1);
-    rustsecp256k1_v0_8_1_fe_sqr(r, &t1);
+    rustsecp256k1_v0_9_0_fe_mul(&t1, &t1, &x2);
+    rustsecp256k1_v0_9_0_fe_sqr(&t1, &t1);
+    rustsecp256k1_v0_9_0_fe_sqr(r, &t1);
 
     /* Check that a square root was actually calculated */
 
-    rustsecp256k1_v0_8_1_fe_sqr(&t1, r);
-    return rustsecp256k1_v0_8_1_fe_equal(&t1, a);
+    rustsecp256k1_v0_9_0_fe_sqr(&t1, r);
+    ret = rustsecp256k1_v0_9_0_fe_equal(&t1, a);
+
+#ifdef VERIFY
+    if (!ret) {
+        rustsecp256k1_v0_9_0_fe_negate(&t1, &t1, 1);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&t1);
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_fe_equal(&t1, a));
+    }
+#endif
+    return ret;
+}
+
+#ifndef VERIFY
+static void rustsecp256k1_v0_9_0_fe_verify(const rustsecp256k1_v0_9_0_fe *a) { (void)a; }
+static void rustsecp256k1_v0_9_0_fe_verify_magnitude(const rustsecp256k1_v0_9_0_fe *a, int m) { (void)a; (void)m; }
+#else
+static void rustsecp256k1_v0_9_0_fe_impl_verify(const rustsecp256k1_v0_9_0_fe *a);
+static void rustsecp256k1_v0_9_0_fe_verify(const rustsecp256k1_v0_9_0_fe *a) {
+    /* Magnitude between 0 and 32. */
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(a, 32);
+    /* Normalized is 0 or 1. */
+    VERIFY_CHECK((a->normalized == 0) || (a->normalized == 1));
+    /* If normalized, magnitude must be 0 or 1. */
+    if (a->normalized) rustsecp256k1_v0_9_0_fe_verify_magnitude(a, 1);
+    /* Invoke implementation-specific checks. */
+    rustsecp256k1_v0_9_0_fe_impl_verify(a);
+}
+
+static void rustsecp256k1_v0_9_0_fe_verify_magnitude(const rustsecp256k1_v0_9_0_fe *a, int m) {
+    VERIFY_CHECK(m >= 0);
+    VERIFY_CHECK(m <= 32);
+    VERIFY_CHECK(a->magnitude <= m);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_normalize(rustsecp256k1_v0_9_0_fe *r);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_normalize(rustsecp256k1_v0_9_0_fe *r) {
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    rustsecp256k1_v0_9_0_fe_impl_normalize(r);
+    r->magnitude = 1;
+    r->normalized = 1;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_normalize_weak(rustsecp256k1_v0_9_0_fe *r);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_normalize_weak(rustsecp256k1_v0_9_0_fe *r) {
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    rustsecp256k1_v0_9_0_fe_impl_normalize_weak(r);
+    r->magnitude = 1;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_normalize_var(rustsecp256k1_v0_9_0_fe *r);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_normalize_var(rustsecp256k1_v0_9_0_fe *r) {
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    rustsecp256k1_v0_9_0_fe_impl_normalize_var(r);
+    r->magnitude = 1;
+    r->normalized = 1;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static int rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero(const rustsecp256k1_v0_9_0_fe *r);
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_normalizes_to_zero(const rustsecp256k1_v0_9_0_fe *r) {
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    return rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero(r);
+}
+
+static int rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero_var(const rustsecp256k1_v0_9_0_fe *r);
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(const rustsecp256k1_v0_9_0_fe *r) {
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    return rustsecp256k1_v0_9_0_fe_impl_normalizes_to_zero_var(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_set_int(rustsecp256k1_v0_9_0_fe *r, int a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_set_int(rustsecp256k1_v0_9_0_fe *r, int a) {
+    VERIFY_CHECK(0 <= a && a <= 0x7FFF);
+    rustsecp256k1_v0_9_0_fe_impl_set_int(r, a);
+    r->magnitude = (a != 0);
+    r->normalized = 1;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_add_int(rustsecp256k1_v0_9_0_fe *r, int a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_add_int(rustsecp256k1_v0_9_0_fe *r, int a) {
+    VERIFY_CHECK(0 <= a && a <= 0x7FFF);
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    rustsecp256k1_v0_9_0_fe_impl_add_int(r, a);
+    r->magnitude += 1;
+    r->normalized = 0;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_clear(rustsecp256k1_v0_9_0_fe *a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_clear(rustsecp256k1_v0_9_0_fe *a) {
+    a->magnitude = 0;
+    a->normalized = 1;
+    rustsecp256k1_v0_9_0_fe_impl_clear(a);
+    rustsecp256k1_v0_9_0_fe_verify(a);
+}
+
+static int rustsecp256k1_v0_9_0_fe_impl_is_zero(const rustsecp256k1_v0_9_0_fe *a);
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_is_zero(const rustsecp256k1_v0_9_0_fe *a) {
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    VERIFY_CHECK(a->normalized);
+    return rustsecp256k1_v0_9_0_fe_impl_is_zero(a);
+}
+
+static int rustsecp256k1_v0_9_0_fe_impl_is_odd(const rustsecp256k1_v0_9_0_fe *a);
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_is_odd(const rustsecp256k1_v0_9_0_fe *a) {
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    VERIFY_CHECK(a->normalized);
+    return rustsecp256k1_v0_9_0_fe_impl_is_odd(a);
+}
+
+static int rustsecp256k1_v0_9_0_fe_impl_cmp_var(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *b);
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_cmp_var(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *b) {
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    rustsecp256k1_v0_9_0_fe_verify(b);
+    VERIFY_CHECK(a->normalized);
+    VERIFY_CHECK(b->normalized);
+    return rustsecp256k1_v0_9_0_fe_impl_cmp_var(a, b);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_set_b32_mod(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_set_b32_mod(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a) {
+    rustsecp256k1_v0_9_0_fe_impl_set_b32_mod(r, a);
+    r->magnitude = 1;
+    r->normalized = 0;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static int rustsecp256k1_v0_9_0_fe_impl_set_b32_limit(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a);
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_set_b32_limit(rustsecp256k1_v0_9_0_fe *r, const unsigned char *a) {
+    if (rustsecp256k1_v0_9_0_fe_impl_set_b32_limit(r, a)) {
+        r->magnitude = 1;
+        r->normalized = 1;
+        rustsecp256k1_v0_9_0_fe_verify(r);
+        return 1;
+    } else {
+        /* Mark the output field element as invalid. */
+        r->magnitude = -1;
+        return 0;
+    }
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_get_b32(unsigned char *r, const rustsecp256k1_v0_9_0_fe *a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_get_b32(unsigned char *r, const rustsecp256k1_v0_9_0_fe *a) {
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    VERIFY_CHECK(a->normalized);
+    rustsecp256k1_v0_9_0_fe_impl_get_b32(r, a);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_negate_unchecked(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int m);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_negate_unchecked(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int m) {
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    VERIFY_CHECK(m >= 0 && m <= 31);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(a, m);
+    rustsecp256k1_v0_9_0_fe_impl_negate_unchecked(r, a, m);
+    r->magnitude = m + 1;
+    r->normalized = 0;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_mul_int_unchecked(rustsecp256k1_v0_9_0_fe *r, int a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_mul_int_unchecked(rustsecp256k1_v0_9_0_fe *r, int a) {
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    VERIFY_CHECK(a >= 0 && a <= 32);
+    VERIFY_CHECK(a*r->magnitude <= 32);
+    rustsecp256k1_v0_9_0_fe_impl_mul_int_unchecked(r, a);
+    r->magnitude *= a;
+    r->normalized = 0;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_add(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_add(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a) {
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    VERIFY_CHECK(r->magnitude + a->magnitude <= 32);
+    rustsecp256k1_v0_9_0_fe_impl_add(r, a);
+    r->magnitude += a->magnitude;
+    r->normalized = 0;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_mul(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe * SECP256K1_RESTRICT b);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_mul(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe * SECP256K1_RESTRICT b) {
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    rustsecp256k1_v0_9_0_fe_verify(b);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(a, 8);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(b, 8);
+    VERIFY_CHECK(r != b);
+    VERIFY_CHECK(a != b);
+    rustsecp256k1_v0_9_0_fe_impl_mul(r, a, b);
+    r->magnitude = 1;
+    r->normalized = 0;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_sqr(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_sqr(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a) {
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(a, 8);
+    rustsecp256k1_v0_9_0_fe_impl_sqr(r, a);
+    r->magnitude = 1;
+    r->normalized = 0;
+    rustsecp256k1_v0_9_0_fe_verify(r);
 }
 
+static void rustsecp256k1_v0_9_0_fe_impl_cmov(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int flag);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_cmov(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *a, int flag) {
+    VERIFY_CHECK(flag == 0 || flag == 1);
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    rustsecp256k1_v0_9_0_fe_impl_cmov(r, a, flag);
+    if (a->magnitude > r->magnitude) r->magnitude = a->magnitude;
+    if (!a->normalized) r->normalized = 0;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_to_storage(rustsecp256k1_v0_9_0_fe_storage *r, const rustsecp256k1_v0_9_0_fe *a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_to_storage(rustsecp256k1_v0_9_0_fe_storage *r, const rustsecp256k1_v0_9_0_fe *a) {
+    rustsecp256k1_v0_9_0_fe_verify(a);
+    VERIFY_CHECK(a->normalized);
+    rustsecp256k1_v0_9_0_fe_impl_to_storage(r, a);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_from_storage(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe_storage *a);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_from_storage(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe_storage *a) {
+    rustsecp256k1_v0_9_0_fe_impl_from_storage(r, a);
+    r->magnitude = 1;
+    r->normalized = 1;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_inv(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *x);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_inv(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *x) {
+    int input_is_zero = rustsecp256k1_v0_9_0_fe_normalizes_to_zero(x);
+    rustsecp256k1_v0_9_0_fe_verify(x);
+    rustsecp256k1_v0_9_0_fe_impl_inv(r, x);
+    r->magnitude = x->magnitude > 0;
+    r->normalized = 1;
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_fe_normalizes_to_zero(r) == input_is_zero);
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_inv_var(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *x);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_inv_var(rustsecp256k1_v0_9_0_fe *r, const rustsecp256k1_v0_9_0_fe *x) {
+    int input_is_zero = rustsecp256k1_v0_9_0_fe_normalizes_to_zero(x);
+    rustsecp256k1_v0_9_0_fe_verify(x);
+    rustsecp256k1_v0_9_0_fe_impl_inv_var(r, x);
+    r->magnitude = x->magnitude > 0;
+    r->normalized = 1;
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_fe_normalizes_to_zero(r) == input_is_zero);
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static int rustsecp256k1_v0_9_0_fe_impl_is_square_var(const rustsecp256k1_v0_9_0_fe *x);
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_fe_is_square_var(const rustsecp256k1_v0_9_0_fe *x) {
+    int ret;
+    rustsecp256k1_v0_9_0_fe tmp = *x, sqrt;
+    rustsecp256k1_v0_9_0_fe_verify(x);
+    ret = rustsecp256k1_v0_9_0_fe_impl_is_square_var(x);
+    rustsecp256k1_v0_9_0_fe_normalize_weak(&tmp);
+    VERIFY_CHECK(ret == rustsecp256k1_v0_9_0_fe_sqrt(&sqrt, &tmp));
+    return ret;
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_get_bounds(rustsecp256k1_v0_9_0_fe* r, int m);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_get_bounds(rustsecp256k1_v0_9_0_fe* r, int m) {
+    VERIFY_CHECK(m >= 0);
+    VERIFY_CHECK(m <= 32);
+    rustsecp256k1_v0_9_0_fe_impl_get_bounds(r, m);
+    r->magnitude = m;
+    r->normalized = (m == 0);
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_fe_impl_half(rustsecp256k1_v0_9_0_fe *r);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_fe_half(rustsecp256k1_v0_9_0_fe *r) {
+    rustsecp256k1_v0_9_0_fe_verify(r);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(r, 31);
+    rustsecp256k1_v0_9_0_fe_impl_half(r);
+    r->magnitude = (r->magnitude >> 1) + 1;
+    r->normalized = 0;
+    rustsecp256k1_v0_9_0_fe_verify(r);
+}
+
+#endif /* defined(VERIFY) */
+
 #endif /* SECP256K1_FIELD_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/group.h b/secp256k1-sys/depend/secp256k1/src/group.h
index c07d81746..329a7651c 100644
--- a/secp256k1-sys/depend/secp256k1/src/group.h
+++ b/secp256k1-sys/depend/secp256k1/src/group.h
@@ -14,10 +14,10 @@
  *  Note: For exhaustive test mode, secp256k1 is replaced by a small subgroup of a different curve.
  */
 typedef struct {
-    rustsecp256k1_v0_8_1_fe x;
-    rustsecp256k1_v0_8_1_fe y;
+    rustsecp256k1_v0_9_0_fe x;
+    rustsecp256k1_v0_9_0_fe y;
     int infinity; /* whether this represents the point at infinity */
-} rustsecp256k1_v0_8_1_ge;
+} rustsecp256k1_v0_9_0_ge;
 
 #define SECP256K1_GE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), 0}
 #define SECP256K1_GE_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1}
@@ -26,48 +26,62 @@ typedef struct {
  *  Note: For exhastive test mode, secp256k1 is replaced by a small subgroup of a different curve.
  */
 typedef struct {
-    rustsecp256k1_v0_8_1_fe x; /* actual X: x/z^2 */
-    rustsecp256k1_v0_8_1_fe y; /* actual Y: y/z^3 */
-    rustsecp256k1_v0_8_1_fe z;
+    rustsecp256k1_v0_9_0_fe x; /* actual X: x/z^2 */
+    rustsecp256k1_v0_9_0_fe y; /* actual Y: y/z^3 */
+    rustsecp256k1_v0_9_0_fe z;
     int infinity; /* whether this represents the point at infinity */
-} rustsecp256k1_v0_8_1_gej;
+} rustsecp256k1_v0_9_0_gej;
 
 #define SECP256K1_GEJ_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_CONST((i),(j),(k),(l),(m),(n),(o),(p)), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1), 0}
 #define SECP256K1_GEJ_CONST_INFINITY {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), 1}
 
 typedef struct {
-    rustsecp256k1_v0_8_1_fe_storage x;
-    rustsecp256k1_v0_8_1_fe_storage y;
-} rustsecp256k1_v0_8_1_ge_storage;
+    rustsecp256k1_v0_9_0_fe_storage x;
+    rustsecp256k1_v0_9_0_fe_storage y;
+} rustsecp256k1_v0_9_0_ge_storage;
 
 #define SECP256K1_GE_STORAGE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p) {SECP256K1_FE_STORAGE_CONST((a),(b),(c),(d),(e),(f),(g),(h)), SECP256K1_FE_STORAGE_CONST((i),(j),(k),(l),(m),(n),(o),(p))}
 
 #define SECP256K1_GE_STORAGE_CONST_GET(t) SECP256K1_FE_STORAGE_CONST_GET(t.x), SECP256K1_FE_STORAGE_CONST_GET(t.y)
 
+/** Maximum allowed magnitudes for group element coordinates
+ *  in affine (x, y) and jacobian (x, y, z) representation. */
+#define SECP256K1_GE_X_MAGNITUDE_MAX  4
+#define SECP256K1_GE_Y_MAGNITUDE_MAX  3
+#define SECP256K1_GEJ_X_MAGNITUDE_MAX 4
+#define SECP256K1_GEJ_Y_MAGNITUDE_MAX 4
+#define SECP256K1_GEJ_Z_MAGNITUDE_MAX 1
+
 /** Set a group element equal to the point with given X and Y coordinates */
-static void rustsecp256k1_v0_8_1_ge_set_xy(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_fe *x, const rustsecp256k1_v0_8_1_fe *y);
+static void rustsecp256k1_v0_9_0_ge_set_xy(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_fe *x, const rustsecp256k1_v0_9_0_fe *y);
 
 /** Set a group element (affine) equal to the point with the given X coordinate, and given oddness
  *  for Y. Return value indicates whether the result is valid. */
-static int rustsecp256k1_v0_8_1_ge_set_xo_var(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_fe *x, int odd);
+static int rustsecp256k1_v0_9_0_ge_set_xo_var(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_fe *x, int odd);
+
+/** Determine whether x is a valid X coordinate on the curve. */
+static int rustsecp256k1_v0_9_0_ge_x_on_curve_var(const rustsecp256k1_v0_9_0_fe *x);
+
+/** Determine whether fraction xn/xd is a valid X coordinate on the curve (xd != 0). */
+static int rustsecp256k1_v0_9_0_ge_x_frac_on_curve_var(const rustsecp256k1_v0_9_0_fe *xn, const rustsecp256k1_v0_9_0_fe *xd);
 
 /** Check whether a group element is the point at infinity. */
-static int rustsecp256k1_v0_8_1_ge_is_infinity(const rustsecp256k1_v0_8_1_ge *a);
+static int rustsecp256k1_v0_9_0_ge_is_infinity(const rustsecp256k1_v0_9_0_ge *a);
 
 /** Check whether a group element is valid (i.e., on the curve). */
-static int rustsecp256k1_v0_8_1_ge_is_valid_var(const rustsecp256k1_v0_8_1_ge *a);
+static int rustsecp256k1_v0_9_0_ge_is_valid_var(const rustsecp256k1_v0_9_0_ge *a);
 
 /** Set r equal to the inverse of a (i.e., mirrored around the X axis) */
-static void rustsecp256k1_v0_8_1_ge_neg(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_ge *a);
+static void rustsecp256k1_v0_9_0_ge_neg(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge *a);
 
 /** Set a group element equal to another which is given in jacobian coordinates. Constant time. */
-static void rustsecp256k1_v0_8_1_ge_set_gej(rustsecp256k1_v0_8_1_ge *r, rustsecp256k1_v0_8_1_gej *a);
+static void rustsecp256k1_v0_9_0_ge_set_gej(rustsecp256k1_v0_9_0_ge *r, rustsecp256k1_v0_9_0_gej *a);
 
 /** Set a group element equal to another which is given in jacobian coordinates. */
-static void rustsecp256k1_v0_8_1_ge_set_gej_var(rustsecp256k1_v0_8_1_ge *r, rustsecp256k1_v0_8_1_gej *a);
+static void rustsecp256k1_v0_9_0_ge_set_gej_var(rustsecp256k1_v0_9_0_ge *r, rustsecp256k1_v0_9_0_gej *a);
 
 /** Set a batch of group elements equal to the inputs given in jacobian coordinates */
-static void rustsecp256k1_v0_8_1_ge_set_all_gej_var(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_gej *a, size_t len);
+static void rustsecp256k1_v0_9_0_ge_set_all_gej_var(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_gej *a, size_t len);
 
 /** Bring a batch of inputs to the same global z "denominator", based on ratios between
  *  (omitted) z coordinates of adjacent elements.
@@ -86,72 +100,73 @@ static void rustsecp256k1_v0_8_1_ge_set_all_gej_var(rustsecp256k1_v0_8_1_ge *r,
  *
  *  The coordinates of the final element a[len-1] are not changed.
  */
-static void rustsecp256k1_v0_8_1_ge_table_set_globalz(size_t len, rustsecp256k1_v0_8_1_ge *a, const rustsecp256k1_v0_8_1_fe *zr);
+static void rustsecp256k1_v0_9_0_ge_table_set_globalz(size_t len, rustsecp256k1_v0_9_0_ge *a, const rustsecp256k1_v0_9_0_fe *zr);
 
 /** Set a group element (affine) equal to the point at infinity. */
-static void rustsecp256k1_v0_8_1_ge_set_infinity(rustsecp256k1_v0_8_1_ge *r);
+static void rustsecp256k1_v0_9_0_ge_set_infinity(rustsecp256k1_v0_9_0_ge *r);
 
 /** Set a group element (jacobian) equal to the point at infinity. */
-static void rustsecp256k1_v0_8_1_gej_set_infinity(rustsecp256k1_v0_8_1_gej *r);
+static void rustsecp256k1_v0_9_0_gej_set_infinity(rustsecp256k1_v0_9_0_gej *r);
 
 /** Set a group element (jacobian) equal to another which is given in affine coordinates. */
-static void rustsecp256k1_v0_8_1_gej_set_ge(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_ge *a);
+static void rustsecp256k1_v0_9_0_gej_set_ge(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_ge *a);
 
 /** Check two group elements (jacobian) for equality in variable time. */
-static int rustsecp256k1_v0_8_1_gej_eq_var(const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_gej *b);
+static int rustsecp256k1_v0_9_0_gej_eq_var(const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_gej *b);
 
-/** Compare the X coordinate of a group element (jacobian). */
-static int rustsecp256k1_v0_8_1_gej_eq_x_var(const rustsecp256k1_v0_8_1_fe *x, const rustsecp256k1_v0_8_1_gej *a);
+/** Compare the X coordinate of a group element (jacobian).
+  * The magnitude of the group element's X coordinate must not exceed 31. */
+static int rustsecp256k1_v0_9_0_gej_eq_x_var(const rustsecp256k1_v0_9_0_fe *x, const rustsecp256k1_v0_9_0_gej *a);
 
 /** Set r equal to the inverse of a (i.e., mirrored around the X axis) */
-static void rustsecp256k1_v0_8_1_gej_neg(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a);
+static void rustsecp256k1_v0_9_0_gej_neg(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a);
 
 /** Check whether a group element is the point at infinity. */
-static int rustsecp256k1_v0_8_1_gej_is_infinity(const rustsecp256k1_v0_8_1_gej *a);
+static int rustsecp256k1_v0_9_0_gej_is_infinity(const rustsecp256k1_v0_9_0_gej *a);
 
 /** Set r equal to the double of a. Constant time. */
-static void rustsecp256k1_v0_8_1_gej_double(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a);
+static void rustsecp256k1_v0_9_0_gej_double(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a);
 
 /** Set r equal to the double of a. If rzr is not-NULL this sets *rzr such that r->z == a->z * *rzr (where infinity means an implicit z = 0). */
-static void rustsecp256k1_v0_8_1_gej_double_var(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, rustsecp256k1_v0_8_1_fe *rzr);
+static void rustsecp256k1_v0_9_0_gej_double_var(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, rustsecp256k1_v0_9_0_fe *rzr);
 
 /** Set r equal to the sum of a and b. If rzr is non-NULL this sets *rzr such that r->z == a->z * *rzr (a cannot be infinity in that case). */
-static void rustsecp256k1_v0_8_1_gej_add_var(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_gej *b, rustsecp256k1_v0_8_1_fe *rzr);
+static void rustsecp256k1_v0_9_0_gej_add_var(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_gej *b, rustsecp256k1_v0_9_0_fe *rzr);
 
 /** Set r equal to the sum of a and b (with b given in affine coordinates, and not infinity). */
-static void rustsecp256k1_v0_8_1_gej_add_ge(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_ge *b);
+static void rustsecp256k1_v0_9_0_gej_add_ge(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_ge *b);
 
 /** Set r equal to the sum of a and b (with b given in affine coordinates). This is more efficient
-    than rustsecp256k1_v0_8_1_gej_add_var. It is identical to rustsecp256k1_v0_8_1_gej_add_ge but without constant-time
+    than rustsecp256k1_v0_9_0_gej_add_var. It is identical to rustsecp256k1_v0_9_0_gej_add_ge but without constant-time
     guarantee, and b is allowed to be infinity. If rzr is non-NULL this sets *rzr such that r->z == a->z * *rzr (a cannot be infinity in that case). */
-static void rustsecp256k1_v0_8_1_gej_add_ge_var(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_ge *b, rustsecp256k1_v0_8_1_fe *rzr);
+static void rustsecp256k1_v0_9_0_gej_add_ge_var(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_ge *b, rustsecp256k1_v0_9_0_fe *rzr);
 
 /** Set r equal to the sum of a and b (with the inverse of b's Z coordinate passed as bzinv). */
-static void rustsecp256k1_v0_8_1_gej_add_zinv_var(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_ge *b, const rustsecp256k1_v0_8_1_fe *bzinv);
+static void rustsecp256k1_v0_9_0_gej_add_zinv_var(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_ge *b, const rustsecp256k1_v0_9_0_fe *bzinv);
 
 /** Set r to be equal to lambda times a, where lambda is chosen in a way such that this is very fast. */
-static void rustsecp256k1_v0_8_1_ge_mul_lambda(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_ge *a);
+static void rustsecp256k1_v0_9_0_ge_mul_lambda(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge *a);
 
-/** Clear a rustsecp256k1_v0_8_1_gej to prevent leaking sensitive information. */
-static void rustsecp256k1_v0_8_1_gej_clear(rustsecp256k1_v0_8_1_gej *r);
+/** Clear a rustsecp256k1_v0_9_0_gej to prevent leaking sensitive information. */
+static void rustsecp256k1_v0_9_0_gej_clear(rustsecp256k1_v0_9_0_gej *r);
 
-/** Clear a rustsecp256k1_v0_8_1_ge to prevent leaking sensitive information. */
-static void rustsecp256k1_v0_8_1_ge_clear(rustsecp256k1_v0_8_1_ge *r);
+/** Clear a rustsecp256k1_v0_9_0_ge to prevent leaking sensitive information. */
+static void rustsecp256k1_v0_9_0_ge_clear(rustsecp256k1_v0_9_0_ge *r);
 
 /** Convert a group element to the storage type. */
-static void rustsecp256k1_v0_8_1_ge_to_storage(rustsecp256k1_v0_8_1_ge_storage *r, const rustsecp256k1_v0_8_1_ge *a);
+static void rustsecp256k1_v0_9_0_ge_to_storage(rustsecp256k1_v0_9_0_ge_storage *r, const rustsecp256k1_v0_9_0_ge *a);
 
 /** Convert a group element back from the storage type. */
-static void rustsecp256k1_v0_8_1_ge_from_storage(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_ge_storage *a);
+static void rustsecp256k1_v0_9_0_ge_from_storage(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge_storage *a);
 
 /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time.  Both *r and *a must be initialized.*/
-static void rustsecp256k1_v0_8_1_gej_cmov(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, int flag);
+static void rustsecp256k1_v0_9_0_gej_cmov(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, int flag);
 
 /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time.  Both *r and *a must be initialized.*/
-static void rustsecp256k1_v0_8_1_ge_storage_cmov(rustsecp256k1_v0_8_1_ge_storage *r, const rustsecp256k1_v0_8_1_ge_storage *a, int flag);
+static void rustsecp256k1_v0_9_0_ge_storage_cmov(rustsecp256k1_v0_9_0_ge_storage *r, const rustsecp256k1_v0_9_0_ge_storage *a, int flag);
 
 /** Rescale a jacobian point by b which must be non-zero. Constant-time. */
-static void rustsecp256k1_v0_8_1_gej_rescale(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_fe *b);
+static void rustsecp256k1_v0_9_0_gej_rescale(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_fe *b);
 
 /** Determine if a point (which is assumed to be on the curve) is in the correct (sub)group of the curve.
  *
@@ -162,6 +177,12 @@ static void rustsecp256k1_v0_8_1_gej_rescale(rustsecp256k1_v0_8_1_gej *r, const
  * (very) small subgroup, and that subgroup is what is used for all cryptographic operations. In that mode, this
  * function checks whether a point that is on the curve is in fact also in that subgroup.
  */
-static int rustsecp256k1_v0_8_1_ge_is_in_correct_subgroup(const rustsecp256k1_v0_8_1_ge* ge);
+static int rustsecp256k1_v0_9_0_ge_is_in_correct_subgroup(const rustsecp256k1_v0_9_0_ge* ge);
+
+/** Check invariants on an affine group element (no-op unless VERIFY is enabled). */
+static void rustsecp256k1_v0_9_0_ge_verify(const rustsecp256k1_v0_9_0_ge *a);
+
+/** Check invariants on a Jacobian group element (no-op unless VERIFY is enabled). */
+static void rustsecp256k1_v0_9_0_gej_verify(const rustsecp256k1_v0_9_0_gej *a);
 
 #endif /* SECP256K1_GROUP_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/group_impl.h b/secp256k1-sys/depend/secp256k1/src/group_impl.h
index 22ae3f841..3ece1a305 100644
--- a/secp256k1-sys/depend/secp256k1/src/group_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/group_impl.h
@@ -9,130 +9,213 @@
 
 #include "field.h"
 #include "group.h"
-
+#include "util.h"
+
+/* Begin of section generated by sage/gen_exhaustive_groups.sage. */
+#define SECP256K1_G_ORDER_7 SECP256K1_GE_CONST(\
+    0x66625d13, 0x317ffe44, 0x63d32cff, 0x1ca02b9b,\
+    0xe5c6d070, 0x50b4b05e, 0x81cc30db, 0xf5166f0a,\
+    0x1e60e897, 0xa7c00c7c, 0x2df53eb6, 0x98274ff4,\
+    0x64252f42, 0x8ca44e17, 0x3b25418c, 0xff4ab0cf\
+)
 #define SECP256K1_G_ORDER_13 SECP256K1_GE_CONST(\
-    0xc3459c3d, 0x35326167, 0xcd86cce8, 0x07a2417f,\
-    0x5b8bd567, 0xde8538ee, 0x0d507b0c, 0xd128f5bb,\
-    0x8e467fec, 0xcd30000a, 0x6cc1184e, 0x25d382c2,\
-    0xa2f4494e, 0x2fbe9abc, 0x8b64abac, 0xd005fb24\
+    0xa2482ff8, 0x4bf34edf, 0xa51262fd, 0xe57921db,\
+    0xe0dd2cb7, 0xa5914790, 0xbc71631f, 0xc09704fb,\
+    0x942536cb, 0xa3e49492, 0x3a701cc3, 0xee3e443f,\
+    0xdf182aa9, 0x15b8aa6a, 0x166d3b19, 0xba84b045\
 )
 #define SECP256K1_G_ORDER_199 SECP256K1_GE_CONST(\
-    0x226e653f, 0xc8df7744, 0x9bacbf12, 0x7d1dcbf9,\
-    0x87f05b2a, 0xe7edbd28, 0x1f564575, 0xc48dcf18,\
-    0xa13872c2, 0xe933bb17, 0x5d9ffd5b, 0xb5b6e10c,\
-    0x57fe3c00, 0xbaaaa15a, 0xe003ec3e, 0x9c269bae\
+    0x7fb07b5c, 0xd07c3bda, 0x553902e2, 0x7a87ea2c,\
+    0x35108a7f, 0x051f41e5, 0xb76abad5, 0x1f2703ad,\
+    0x0a251539, 0x5b4c4438, 0x952a634f, 0xac10dd4d,\
+    0x6d6f4745, 0x98990c27, 0x3a4f3116, 0xd32ff969\
 )
 /** Generator for secp256k1, value 'g' defined in
  *  "Standards for Efficient Cryptography" (SEC2) 2.7.1.
  */
 #define SECP256K1_G SECP256K1_GE_CONST(\
-    0x79BE667EUL, 0xF9DCBBACUL, 0x55A06295UL, 0xCE870B07UL,\
-    0x029BFCDBUL, 0x2DCE28D9UL, 0x59F2815BUL, 0x16F81798UL,\
-    0x483ADA77UL, 0x26A3C465UL, 0x5DA4FBFCUL, 0x0E1108A8UL,\
-    0xFD17B448UL, 0xA6855419UL, 0x9C47D08FUL, 0xFB10D4B8UL\
+    0x79be667e, 0xf9dcbbac, 0x55a06295, 0xce870b07,\
+    0x029bfcdb, 0x2dce28d9, 0x59f2815b, 0x16f81798,\
+    0x483ada77, 0x26a3c465, 0x5da4fbfc, 0x0e1108a8,\
+    0xfd17b448, 0xa6855419, 0x9c47d08f, 0xfb10d4b8\
 )
 /* These exhaustive group test orders and generators are chosen such that:
  * - The field size is equal to that of secp256k1, so field code is the same.
- * - The curve equation is of the form y^2=x^3+B for some constant B.
- * - The subgroup has a generator 2*P, where P.x=1.
+ * - The curve equation is of the form y^2=x^3+B for some small constant B.
+ * - The subgroup has a generator 2*P, where P.x is as small as possible.
  * - The subgroup has size less than 1000 to permit exhaustive testing.
  * - The subgroup admits an endomorphism of the form lambda*(x,y) == (beta*x,y).
- *
- * These parameters are generated using sage/gen_exhaustive_groups.sage.
  */
 #if defined(EXHAUSTIVE_TEST_ORDER)
-#  if EXHAUSTIVE_TEST_ORDER == 13
-static const rustsecp256k1_v0_8_1_ge rustsecp256k1_v0_8_1_ge_const_g = SECP256K1_G_ORDER_13;
+#  if EXHAUSTIVE_TEST_ORDER == 7
+
+static const rustsecp256k1_v0_9_0_ge rustsecp256k1_v0_9_0_ge_const_g = SECP256K1_G_ORDER_7;
+#define SECP256K1_B 6
+
+#  elif EXHAUSTIVE_TEST_ORDER == 13
+
+static const rustsecp256k1_v0_9_0_ge rustsecp256k1_v0_9_0_ge_const_g = SECP256K1_G_ORDER_13;
+#define SECP256K1_B 2
 
-static const rustsecp256k1_v0_8_1_fe rustsecp256k1_v0_8_1_fe_const_b = SECP256K1_FE_CONST(
-    0x3d3486b2, 0x159a9ca5, 0xc75638be, 0xb23a69bc,
-    0x946a45ab, 0x24801247, 0xb4ed2b8e, 0x26b6a417
-);
 #  elif EXHAUSTIVE_TEST_ORDER == 199
-static const rustsecp256k1_v0_8_1_ge rustsecp256k1_v0_8_1_ge_const_g = SECP256K1_G_ORDER_199;
 
-static const rustsecp256k1_v0_8_1_fe rustsecp256k1_v0_8_1_fe_const_b = SECP256K1_FE_CONST(
-    0x2cca28fa, 0xfc614b80, 0x2a3db42b, 0x00ba00b1,
-    0xbea8d943, 0xdace9ab2, 0x9536daea, 0x0074defb
-);
+static const rustsecp256k1_v0_9_0_ge rustsecp256k1_v0_9_0_ge_const_g = SECP256K1_G_ORDER_199;
+#define SECP256K1_B 4
+
 #  else
 #    error No known generator for the specified exhaustive test group order.
 #  endif
 #else
-static const rustsecp256k1_v0_8_1_ge rustsecp256k1_v0_8_1_ge_const_g = SECP256K1_G;
 
-static const rustsecp256k1_v0_8_1_fe rustsecp256k1_v0_8_1_fe_const_b = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 7);
+static const rustsecp256k1_v0_9_0_ge rustsecp256k1_v0_9_0_ge_const_g = SECP256K1_G;
+#define SECP256K1_B 7
+
+#endif
+/* End of section generated by sage/gen_exhaustive_groups.sage. */
+
+static void rustsecp256k1_v0_9_0_ge_verify(const rustsecp256k1_v0_9_0_ge *a) {
+#ifdef VERIFY
+    rustsecp256k1_v0_9_0_fe_verify(&a->x);
+    rustsecp256k1_v0_9_0_fe_verify(&a->y);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(&a->x, SECP256K1_GE_X_MAGNITUDE_MAX);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(&a->y, SECP256K1_GE_Y_MAGNITUDE_MAX);
+    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
+#endif
+    (void)a;
+}
+
+static void rustsecp256k1_v0_9_0_gej_verify(const rustsecp256k1_v0_9_0_gej *a) {
+#ifdef VERIFY
+    rustsecp256k1_v0_9_0_fe_verify(&a->x);
+    rustsecp256k1_v0_9_0_fe_verify(&a->y);
+    rustsecp256k1_v0_9_0_fe_verify(&a->z);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(&a->x, SECP256K1_GEJ_X_MAGNITUDE_MAX);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(&a->y, SECP256K1_GEJ_Y_MAGNITUDE_MAX);
+    rustsecp256k1_v0_9_0_fe_verify_magnitude(&a->z, SECP256K1_GEJ_Z_MAGNITUDE_MAX);
+    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
 #endif
+    (void)a;
+}
+
+/* Set r to the affine coordinates of Jacobian point (a.x, a.y, 1/zi). */
+static void rustsecp256k1_v0_9_0_ge_set_gej_zinv(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_fe *zi) {
+    rustsecp256k1_v0_9_0_fe zi2;
+    rustsecp256k1_v0_9_0_fe zi3;
+    rustsecp256k1_v0_9_0_gej_verify(a);
+    rustsecp256k1_v0_9_0_fe_verify(zi);
+    VERIFY_CHECK(!a->infinity);
+
+    rustsecp256k1_v0_9_0_fe_sqr(&zi2, zi);
+    rustsecp256k1_v0_9_0_fe_mul(&zi3, &zi2, zi);
+    rustsecp256k1_v0_9_0_fe_mul(&r->x, &a->x, &zi2);
+    rustsecp256k1_v0_9_0_fe_mul(&r->y, &a->y, &zi3);
+    r->infinity = a->infinity;
 
-static void rustsecp256k1_v0_8_1_ge_set_gej_zinv(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_fe *zi) {
-    rustsecp256k1_v0_8_1_fe zi2;
-    rustsecp256k1_v0_8_1_fe zi3;
+    rustsecp256k1_v0_9_0_ge_verify(r);
+}
+
+/* Set r to the affine coordinates of Jacobian point (a.x, a.y, 1/zi). */
+static void rustsecp256k1_v0_9_0_ge_set_ge_zinv(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge *a, const rustsecp256k1_v0_9_0_fe *zi) {
+    rustsecp256k1_v0_9_0_fe zi2;
+    rustsecp256k1_v0_9_0_fe zi3;
+    rustsecp256k1_v0_9_0_ge_verify(a);
+    rustsecp256k1_v0_9_0_fe_verify(zi);
     VERIFY_CHECK(!a->infinity);
-    rustsecp256k1_v0_8_1_fe_sqr(&zi2, zi);
-    rustsecp256k1_v0_8_1_fe_mul(&zi3, &zi2, zi);
-    rustsecp256k1_v0_8_1_fe_mul(&r->x, &a->x, &zi2);
-    rustsecp256k1_v0_8_1_fe_mul(&r->y, &a->y, &zi3);
+
+    rustsecp256k1_v0_9_0_fe_sqr(&zi2, zi);
+    rustsecp256k1_v0_9_0_fe_mul(&zi3, &zi2, zi);
+    rustsecp256k1_v0_9_0_fe_mul(&r->x, &a->x, &zi2);
+    rustsecp256k1_v0_9_0_fe_mul(&r->y, &a->y, &zi3);
     r->infinity = a->infinity;
+
+    rustsecp256k1_v0_9_0_ge_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_ge_set_xy(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_fe *x, const rustsecp256k1_v0_8_1_fe *y) {
+static void rustsecp256k1_v0_9_0_ge_set_xy(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_fe *x, const rustsecp256k1_v0_9_0_fe *y) {
+    rustsecp256k1_v0_9_0_fe_verify(x);
+    rustsecp256k1_v0_9_0_fe_verify(y);
+
     r->infinity = 0;
     r->x = *x;
     r->y = *y;
+
+    rustsecp256k1_v0_9_0_ge_verify(r);
 }
 
-static int rustsecp256k1_v0_8_1_ge_is_infinity(const rustsecp256k1_v0_8_1_ge *a) {
+static int rustsecp256k1_v0_9_0_ge_is_infinity(const rustsecp256k1_v0_9_0_ge *a) {
+    rustsecp256k1_v0_9_0_ge_verify(a);
+
     return a->infinity;
 }
 
-static void rustsecp256k1_v0_8_1_ge_neg(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_ge *a) {
+static void rustsecp256k1_v0_9_0_ge_neg(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge *a) {
+    rustsecp256k1_v0_9_0_ge_verify(a);
+
     *r = *a;
-    rustsecp256k1_v0_8_1_fe_normalize_weak(&r->y);
-    rustsecp256k1_v0_8_1_fe_negate(&r->y, &r->y, 1);
+    rustsecp256k1_v0_9_0_fe_normalize_weak(&r->y);
+    rustsecp256k1_v0_9_0_fe_negate(&r->y, &r->y, 1);
+
+    rustsecp256k1_v0_9_0_ge_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_ge_set_gej(rustsecp256k1_v0_8_1_ge *r, rustsecp256k1_v0_8_1_gej *a) {
-    rustsecp256k1_v0_8_1_fe z2, z3;
+static void rustsecp256k1_v0_9_0_ge_set_gej(rustsecp256k1_v0_9_0_ge *r, rustsecp256k1_v0_9_0_gej *a) {
+    rustsecp256k1_v0_9_0_fe z2, z3;
+    rustsecp256k1_v0_9_0_gej_verify(a);
+
     r->infinity = a->infinity;
-    rustsecp256k1_v0_8_1_fe_inv(&a->z, &a->z);
-    rustsecp256k1_v0_8_1_fe_sqr(&z2, &a->z);
-    rustsecp256k1_v0_8_1_fe_mul(&z3, &a->z, &z2);
-    rustsecp256k1_v0_8_1_fe_mul(&a->x, &a->x, &z2);
-    rustsecp256k1_v0_8_1_fe_mul(&a->y, &a->y, &z3);
-    rustsecp256k1_v0_8_1_fe_set_int(&a->z, 1);
+    rustsecp256k1_v0_9_0_fe_inv(&a->z, &a->z);
+    rustsecp256k1_v0_9_0_fe_sqr(&z2, &a->z);
+    rustsecp256k1_v0_9_0_fe_mul(&z3, &a->z, &z2);
+    rustsecp256k1_v0_9_0_fe_mul(&a->x, &a->x, &z2);
+    rustsecp256k1_v0_9_0_fe_mul(&a->y, &a->y, &z3);
+    rustsecp256k1_v0_9_0_fe_set_int(&a->z, 1);
     r->x = a->x;
     r->y = a->y;
+
+    rustsecp256k1_v0_9_0_gej_verify(a);
+    rustsecp256k1_v0_9_0_ge_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_ge_set_gej_var(rustsecp256k1_v0_8_1_ge *r, rustsecp256k1_v0_8_1_gej *a) {
-    rustsecp256k1_v0_8_1_fe z2, z3;
-    if (a->infinity) {
-        rustsecp256k1_v0_8_1_ge_set_infinity(r);
+static void rustsecp256k1_v0_9_0_ge_set_gej_var(rustsecp256k1_v0_9_0_ge *r, rustsecp256k1_v0_9_0_gej *a) {
+    rustsecp256k1_v0_9_0_fe z2, z3;
+    rustsecp256k1_v0_9_0_gej_verify(a);
+
+    if (rustsecp256k1_v0_9_0_gej_is_infinity(a)) {
+        rustsecp256k1_v0_9_0_ge_set_infinity(r);
         return;
     }
-    rustsecp256k1_v0_8_1_fe_inv_var(&a->z, &a->z);
-    rustsecp256k1_v0_8_1_fe_sqr(&z2, &a->z);
-    rustsecp256k1_v0_8_1_fe_mul(&z3, &a->z, &z2);
-    rustsecp256k1_v0_8_1_fe_mul(&a->x, &a->x, &z2);
-    rustsecp256k1_v0_8_1_fe_mul(&a->y, &a->y, &z3);
-    rustsecp256k1_v0_8_1_fe_set_int(&a->z, 1);
-    rustsecp256k1_v0_8_1_ge_set_xy(r, &a->x, &a->y);
+    r->infinity = 0;
+    rustsecp256k1_v0_9_0_fe_inv_var(&a->z, &a->z);
+    rustsecp256k1_v0_9_0_fe_sqr(&z2, &a->z);
+    rustsecp256k1_v0_9_0_fe_mul(&z3, &a->z, &z2);
+    rustsecp256k1_v0_9_0_fe_mul(&a->x, &a->x, &z2);
+    rustsecp256k1_v0_9_0_fe_mul(&a->y, &a->y, &z3);
+    rustsecp256k1_v0_9_0_fe_set_int(&a->z, 1);
+    rustsecp256k1_v0_9_0_ge_set_xy(r, &a->x, &a->y);
+
+    rustsecp256k1_v0_9_0_gej_verify(a);
+    rustsecp256k1_v0_9_0_ge_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_ge_set_all_gej_var(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_gej *a, size_t len) {
-    rustsecp256k1_v0_8_1_fe u;
+static void rustsecp256k1_v0_9_0_ge_set_all_gej_var(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_gej *a, size_t len) {
+    rustsecp256k1_v0_9_0_fe u;
     size_t i;
     size_t last_i = SIZE_MAX;
+#ifdef VERIFY
+    for (i = 0; i < len; i++) {
+        rustsecp256k1_v0_9_0_gej_verify(&a[i]);
+    }
+#endif
 
     for (i = 0; i < len; i++) {
         if (a[i].infinity) {
-            rustsecp256k1_v0_8_1_ge_set_infinity(&r[i]);
+            rustsecp256k1_v0_9_0_ge_set_infinity(&r[i]);
         } else {
             /* Use destination's x coordinates as scratch space */
             if (last_i == SIZE_MAX) {
                 r[i].x = a[i].z;
             } else {
-                rustsecp256k1_v0_8_1_fe_mul(&r[i].x, &r[last_i].x, &a[i].z);
+                rustsecp256k1_v0_9_0_fe_mul(&r[i].x, &r[last_i].x, &a[i].z);
             }
             last_i = i;
         }
@@ -140,14 +223,14 @@ static void rustsecp256k1_v0_8_1_ge_set_all_gej_var(rustsecp256k1_v0_8_1_ge *r,
     if (last_i == SIZE_MAX) {
         return;
     }
-    rustsecp256k1_v0_8_1_fe_inv_var(&u, &r[last_i].x);
+    rustsecp256k1_v0_9_0_fe_inv_var(&u, &r[last_i].x);
 
     i = last_i;
     while (i > 0) {
         i--;
         if (!a[i].infinity) {
-            rustsecp256k1_v0_8_1_fe_mul(&r[last_i].x, &r[i].x, &u);
-            rustsecp256k1_v0_8_1_fe_mul(&u, &u, &a[last_i].z);
+            rustsecp256k1_v0_9_0_fe_mul(&r[last_i].x, &r[i].x, &u);
+            rustsecp256k1_v0_9_0_fe_mul(&u, &u, &a[last_i].z);
             last_i = i;
         }
     }
@@ -156,130 +239,174 @@ static void rustsecp256k1_v0_8_1_ge_set_all_gej_var(rustsecp256k1_v0_8_1_ge *r,
 
     for (i = 0; i < len; i++) {
         if (!a[i].infinity) {
-            rustsecp256k1_v0_8_1_ge_set_gej_zinv(&r[i], &a[i], &r[i].x);
+            rustsecp256k1_v0_9_0_ge_set_gej_zinv(&r[i], &a[i], &r[i].x);
         }
     }
+
+#ifdef VERIFY
+    for (i = 0; i < len; i++) {
+        rustsecp256k1_v0_9_0_ge_verify(&r[i]);
+    }
+#endif
 }
 
-static void rustsecp256k1_v0_8_1_ge_table_set_globalz(size_t len, rustsecp256k1_v0_8_1_ge *a, const rustsecp256k1_v0_8_1_fe *zr) {
-    size_t i = len - 1;
-    rustsecp256k1_v0_8_1_fe zs;
+static void rustsecp256k1_v0_9_0_ge_table_set_globalz(size_t len, rustsecp256k1_v0_9_0_ge *a, const rustsecp256k1_v0_9_0_fe *zr) {
+    size_t i;
+    rustsecp256k1_v0_9_0_fe zs;
+#ifdef VERIFY
+    for (i = 0; i < len; i++) {
+        rustsecp256k1_v0_9_0_ge_verify(&a[i]);
+        rustsecp256k1_v0_9_0_fe_verify(&zr[i]);
+    }
+#endif
 
     if (len > 0) {
+        i = len - 1;
         /* Ensure all y values are in weak normal form for fast negation of points */
-        rustsecp256k1_v0_8_1_fe_normalize_weak(&a[i].y);
+        rustsecp256k1_v0_9_0_fe_normalize_weak(&a[i].y);
         zs = zr[i];
 
         /* Work our way backwards, using the z-ratios to scale the x/y values. */
         while (i > 0) {
-            rustsecp256k1_v0_8_1_gej tmpa;
             if (i != len - 1) {
-                rustsecp256k1_v0_8_1_fe_mul(&zs, &zs, &zr[i]);
+                rustsecp256k1_v0_9_0_fe_mul(&zs, &zs, &zr[i]);
             }
             i--;
-            tmpa.x = a[i].x;
-            tmpa.y = a[i].y;
-            tmpa.infinity = 0;
-            rustsecp256k1_v0_8_1_ge_set_gej_zinv(&a[i], &tmpa, &zs);
+            rustsecp256k1_v0_9_0_ge_set_ge_zinv(&a[i], &a[i], &zs);
         }
     }
+
+#ifdef VERIFY
+    for (i = 0; i < len; i++) {
+        rustsecp256k1_v0_9_0_ge_verify(&a[i]);
+    }
+#endif
 }
 
-static void rustsecp256k1_v0_8_1_gej_set_infinity(rustsecp256k1_v0_8_1_gej *r) {
+static void rustsecp256k1_v0_9_0_gej_set_infinity(rustsecp256k1_v0_9_0_gej *r) {
     r->infinity = 1;
-    rustsecp256k1_v0_8_1_fe_clear(&r->x);
-    rustsecp256k1_v0_8_1_fe_clear(&r->y);
-    rustsecp256k1_v0_8_1_fe_clear(&r->z);
+    rustsecp256k1_v0_9_0_fe_clear(&r->x);
+    rustsecp256k1_v0_9_0_fe_clear(&r->y);
+    rustsecp256k1_v0_9_0_fe_clear(&r->z);
+
+    rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_ge_set_infinity(rustsecp256k1_v0_8_1_ge *r) {
+static void rustsecp256k1_v0_9_0_ge_set_infinity(rustsecp256k1_v0_9_0_ge *r) {
     r->infinity = 1;
-    rustsecp256k1_v0_8_1_fe_clear(&r->x);
-    rustsecp256k1_v0_8_1_fe_clear(&r->y);
+    rustsecp256k1_v0_9_0_fe_clear(&r->x);
+    rustsecp256k1_v0_9_0_fe_clear(&r->y);
+
+    rustsecp256k1_v0_9_0_ge_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_gej_clear(rustsecp256k1_v0_8_1_gej *r) {
+static void rustsecp256k1_v0_9_0_gej_clear(rustsecp256k1_v0_9_0_gej *r) {
     r->infinity = 0;
-    rustsecp256k1_v0_8_1_fe_clear(&r->x);
-    rustsecp256k1_v0_8_1_fe_clear(&r->y);
-    rustsecp256k1_v0_8_1_fe_clear(&r->z);
+    rustsecp256k1_v0_9_0_fe_clear(&r->x);
+    rustsecp256k1_v0_9_0_fe_clear(&r->y);
+    rustsecp256k1_v0_9_0_fe_clear(&r->z);
+
+    rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_ge_clear(rustsecp256k1_v0_8_1_ge *r) {
+static void rustsecp256k1_v0_9_0_ge_clear(rustsecp256k1_v0_9_0_ge *r) {
     r->infinity = 0;
-    rustsecp256k1_v0_8_1_fe_clear(&r->x);
-    rustsecp256k1_v0_8_1_fe_clear(&r->y);
+    rustsecp256k1_v0_9_0_fe_clear(&r->x);
+    rustsecp256k1_v0_9_0_fe_clear(&r->y);
+
+    rustsecp256k1_v0_9_0_ge_verify(r);
 }
 
-static int rustsecp256k1_v0_8_1_ge_set_xo_var(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_fe *x, int odd) {
-    rustsecp256k1_v0_8_1_fe x2, x3;
+static int rustsecp256k1_v0_9_0_ge_set_xo_var(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_fe *x, int odd) {
+    rustsecp256k1_v0_9_0_fe x2, x3;
+    int ret;
+    rustsecp256k1_v0_9_0_fe_verify(x);
+
     r->x = *x;
-    rustsecp256k1_v0_8_1_fe_sqr(&x2, x);
-    rustsecp256k1_v0_8_1_fe_mul(&x3, x, &x2);
+    rustsecp256k1_v0_9_0_fe_sqr(&x2, x);
+    rustsecp256k1_v0_9_0_fe_mul(&x3, x, &x2);
     r->infinity = 0;
-    rustsecp256k1_v0_8_1_fe_add(&x3, &rustsecp256k1_v0_8_1_fe_const_b);
-    if (!rustsecp256k1_v0_8_1_fe_sqrt(&r->y, &x3)) {
-        return 0;
+    rustsecp256k1_v0_9_0_fe_add_int(&x3, SECP256K1_B);
+    ret = rustsecp256k1_v0_9_0_fe_sqrt(&r->y, &x3);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&r->y);
+    if (rustsecp256k1_v0_9_0_fe_is_odd(&r->y) != odd) {
+        rustsecp256k1_v0_9_0_fe_negate(&r->y, &r->y, 1);
     }
-    rustsecp256k1_v0_8_1_fe_normalize_var(&r->y);
-    if (rustsecp256k1_v0_8_1_fe_is_odd(&r->y) != odd) {
-        rustsecp256k1_v0_8_1_fe_negate(&r->y, &r->y, 1);
-    }
-    return 1;
 
+    rustsecp256k1_v0_9_0_ge_verify(r);
+    return ret;
 }
 
-static void rustsecp256k1_v0_8_1_gej_set_ge(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_ge *a) {
+static void rustsecp256k1_v0_9_0_gej_set_ge(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_ge *a) {
+   rustsecp256k1_v0_9_0_ge_verify(a);
+
    r->infinity = a->infinity;
    r->x = a->x;
    r->y = a->y;
-   rustsecp256k1_v0_8_1_fe_set_int(&r->z, 1);
+   rustsecp256k1_v0_9_0_fe_set_int(&r->z, 1);
+
+   rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
-static int rustsecp256k1_v0_8_1_gej_eq_var(const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_gej *b) {
-    rustsecp256k1_v0_8_1_gej tmp;
-    rustsecp256k1_v0_8_1_gej_neg(&tmp, a);
-    rustsecp256k1_v0_8_1_gej_add_var(&tmp, &tmp, b, NULL);
-    return rustsecp256k1_v0_8_1_gej_is_infinity(&tmp);
+static int rustsecp256k1_v0_9_0_gej_eq_var(const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_gej *b) {
+    rustsecp256k1_v0_9_0_gej tmp;
+    rustsecp256k1_v0_9_0_gej_verify(b);
+    rustsecp256k1_v0_9_0_gej_verify(a);
+
+    rustsecp256k1_v0_9_0_gej_neg(&tmp, a);
+    rustsecp256k1_v0_9_0_gej_add_var(&tmp, &tmp, b, NULL);
+    return rustsecp256k1_v0_9_0_gej_is_infinity(&tmp);
 }
 
-static int rustsecp256k1_v0_8_1_gej_eq_x_var(const rustsecp256k1_v0_8_1_fe *x, const rustsecp256k1_v0_8_1_gej *a) {
-    rustsecp256k1_v0_8_1_fe r, r2;
+static int rustsecp256k1_v0_9_0_gej_eq_x_var(const rustsecp256k1_v0_9_0_fe *x, const rustsecp256k1_v0_9_0_gej *a) {
+    rustsecp256k1_v0_9_0_fe r;
+    rustsecp256k1_v0_9_0_fe_verify(x);
+    rustsecp256k1_v0_9_0_gej_verify(a);
+#ifdef VERIFY
     VERIFY_CHECK(!a->infinity);
-    rustsecp256k1_v0_8_1_fe_sqr(&r, &a->z); rustsecp256k1_v0_8_1_fe_mul(&r, &r, x);
-    r2 = a->x; rustsecp256k1_v0_8_1_fe_normalize_weak(&r2);
-    return rustsecp256k1_v0_8_1_fe_equal_var(&r, &r2);
+#endif
+
+    rustsecp256k1_v0_9_0_fe_sqr(&r, &a->z); rustsecp256k1_v0_9_0_fe_mul(&r, &r, x);
+    return rustsecp256k1_v0_9_0_fe_equal(&r, &a->x);
 }
 
-static void rustsecp256k1_v0_8_1_gej_neg(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a) {
+static void rustsecp256k1_v0_9_0_gej_neg(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a) {
+    rustsecp256k1_v0_9_0_gej_verify(a);
+
     r->infinity = a->infinity;
     r->x = a->x;
     r->y = a->y;
     r->z = a->z;
-    rustsecp256k1_v0_8_1_fe_normalize_weak(&r->y);
-    rustsecp256k1_v0_8_1_fe_negate(&r->y, &r->y, 1);
+    rustsecp256k1_v0_9_0_fe_normalize_weak(&r->y);
+    rustsecp256k1_v0_9_0_fe_negate(&r->y, &r->y, 1);
+
+    rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
-static int rustsecp256k1_v0_8_1_gej_is_infinity(const rustsecp256k1_v0_8_1_gej *a) {
+static int rustsecp256k1_v0_9_0_gej_is_infinity(const rustsecp256k1_v0_9_0_gej *a) {
+    rustsecp256k1_v0_9_0_gej_verify(a);
+
     return a->infinity;
 }
 
-static int rustsecp256k1_v0_8_1_ge_is_valid_var(const rustsecp256k1_v0_8_1_ge *a) {
-    rustsecp256k1_v0_8_1_fe y2, x3;
+static int rustsecp256k1_v0_9_0_ge_is_valid_var(const rustsecp256k1_v0_9_0_ge *a) {
+    rustsecp256k1_v0_9_0_fe y2, x3;
+    rustsecp256k1_v0_9_0_ge_verify(a);
+
     if (a->infinity) {
         return 0;
     }
     /* y^2 = x^3 + 7 */
-    rustsecp256k1_v0_8_1_fe_sqr(&y2, &a->y);
-    rustsecp256k1_v0_8_1_fe_sqr(&x3, &a->x); rustsecp256k1_v0_8_1_fe_mul(&x3, &x3, &a->x);
-    rustsecp256k1_v0_8_1_fe_add(&x3, &rustsecp256k1_v0_8_1_fe_const_b);
-    rustsecp256k1_v0_8_1_fe_normalize_weak(&x3);
-    return rustsecp256k1_v0_8_1_fe_equal_var(&y2, &x3);
+    rustsecp256k1_v0_9_0_fe_sqr(&y2, &a->y);
+    rustsecp256k1_v0_9_0_fe_sqr(&x3, &a->x); rustsecp256k1_v0_9_0_fe_mul(&x3, &x3, &a->x);
+    rustsecp256k1_v0_9_0_fe_add_int(&x3, SECP256K1_B);
+    return rustsecp256k1_v0_9_0_fe_equal(&y2, &x3);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_gej_double(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_gej_double(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a) {
     /* Operations: 3 mul, 4 sqr, 8 add/half/mul_int/negate */
-    rustsecp256k1_v0_8_1_fe l, s, t;
+    rustsecp256k1_v0_9_0_fe l, s, t;
+    rustsecp256k1_v0_9_0_gej_verify(a);
 
     r->infinity = a->infinity;
 
@@ -292,24 +419,28 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_gej_double(rustsecp256k1_v0_8_
      * Z3 = Y1*Z1
      */
 
-    rustsecp256k1_v0_8_1_fe_mul(&r->z, &a->z, &a->y); /* Z3 = Y1*Z1 (1) */
-    rustsecp256k1_v0_8_1_fe_sqr(&s, &a->y);           /* S = Y1^2 (1) */
-    rustsecp256k1_v0_8_1_fe_sqr(&l, &a->x);           /* L = X1^2 (1) */
-    rustsecp256k1_v0_8_1_fe_mul_int(&l, 3);           /* L = 3*X1^2 (3) */
-    rustsecp256k1_v0_8_1_fe_half(&l);                 /* L = 3/2*X1^2 (2) */
-    rustsecp256k1_v0_8_1_fe_negate(&t, &s, 1);        /* T = -S (2) */
-    rustsecp256k1_v0_8_1_fe_mul(&t, &t, &a->x);       /* T = -X1*S (1) */
-    rustsecp256k1_v0_8_1_fe_sqr(&r->x, &l);           /* X3 = L^2 (1) */
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &t);           /* X3 = L^2 + T (2) */
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &t);           /* X3 = L^2 + 2*T (3) */
-    rustsecp256k1_v0_8_1_fe_sqr(&s, &s);              /* S' = S^2 (1) */
-    rustsecp256k1_v0_8_1_fe_add(&t, &r->x);           /* T' = X3 + T (4) */
-    rustsecp256k1_v0_8_1_fe_mul(&r->y, &t, &l);       /* Y3 = L*(X3 + T) (1) */
-    rustsecp256k1_v0_8_1_fe_add(&r->y, &s);           /* Y3 = L*(X3 + T) + S^2 (2) */
-    rustsecp256k1_v0_8_1_fe_negate(&r->y, &r->y, 2);  /* Y3 = -(L*(X3 + T) + S^2) (3) */
-}
-
-static void rustsecp256k1_v0_8_1_gej_double_var(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, rustsecp256k1_v0_8_1_fe *rzr) {
+    rustsecp256k1_v0_9_0_fe_mul(&r->z, &a->z, &a->y); /* Z3 = Y1*Z1 (1) */
+    rustsecp256k1_v0_9_0_fe_sqr(&s, &a->y);           /* S = Y1^2 (1) */
+    rustsecp256k1_v0_9_0_fe_sqr(&l, &a->x);           /* L = X1^2 (1) */
+    rustsecp256k1_v0_9_0_fe_mul_int(&l, 3);           /* L = 3*X1^2 (3) */
+    rustsecp256k1_v0_9_0_fe_half(&l);                 /* L = 3/2*X1^2 (2) */
+    rustsecp256k1_v0_9_0_fe_negate(&t, &s, 1);        /* T = -S (2) */
+    rustsecp256k1_v0_9_0_fe_mul(&t, &t, &a->x);       /* T = -X1*S (1) */
+    rustsecp256k1_v0_9_0_fe_sqr(&r->x, &l);           /* X3 = L^2 (1) */
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &t);           /* X3 = L^2 + T (2) */
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &t);           /* X3 = L^2 + 2*T (3) */
+    rustsecp256k1_v0_9_0_fe_sqr(&s, &s);              /* S' = S^2 (1) */
+    rustsecp256k1_v0_9_0_fe_add(&t, &r->x);           /* T' = X3 + T (4) */
+    rustsecp256k1_v0_9_0_fe_mul(&r->y, &t, &l);       /* Y3 = L*(X3 + T) (1) */
+    rustsecp256k1_v0_9_0_fe_add(&r->y, &s);           /* Y3 = L*(X3 + T) + S^2 (2) */
+    rustsecp256k1_v0_9_0_fe_negate(&r->y, &r->y, 2);  /* Y3 = -(L*(X3 + T) + S^2) (3) */
+
+    rustsecp256k1_v0_9_0_gej_verify(r);
+}
+
+static void rustsecp256k1_v0_9_0_gej_double_var(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, rustsecp256k1_v0_9_0_fe *rzr) {
+    rustsecp256k1_v0_9_0_gej_verify(a);
+
     /** For secp256k1, 2Q is infinity if and only if Q is infinity. This is because if 2Q = infinity,
      *  Q must equal -Q, or that Q.y == -(Q.y), or Q.y is 0. For a point on y^2 = x^3 + 7 to have
      *  y=0, x^3 must be -7 mod p. However, -7 has no cube root mod p.
@@ -321,24 +452,28 @@ static void rustsecp256k1_v0_8_1_gej_double_var(rustsecp256k1_v0_8_1_gej *r, con
      *  point will be gibberish (z = 0 but infinity = 0).
      */
     if (a->infinity) {
-        rustsecp256k1_v0_8_1_gej_set_infinity(r);
+        rustsecp256k1_v0_9_0_gej_set_infinity(r);
         if (rzr != NULL) {
-            rustsecp256k1_v0_8_1_fe_set_int(rzr, 1);
+            rustsecp256k1_v0_9_0_fe_set_int(rzr, 1);
         }
         return;
     }
 
     if (rzr != NULL) {
         *rzr = a->y;
-        rustsecp256k1_v0_8_1_fe_normalize_weak(rzr);
+        rustsecp256k1_v0_9_0_fe_normalize_weak(rzr);
     }
 
-    rustsecp256k1_v0_8_1_gej_double(r, a);
+    rustsecp256k1_v0_9_0_gej_double(r, a);
+
+    rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_gej_add_var(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_gej *b, rustsecp256k1_v0_8_1_fe *rzr) {
+static void rustsecp256k1_v0_9_0_gej_add_var(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_gej *b, rustsecp256k1_v0_9_0_fe *rzr) {
     /* 12 mul, 4 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
-    rustsecp256k1_v0_8_1_fe z22, z12, u1, u2, s1, s2, h, i, h2, h3, t;
+    rustsecp256k1_v0_9_0_fe z22, z12, u1, u2, s1, s2, h, i, h2, h3, t;
+    rustsecp256k1_v0_9_0_gej_verify(a);
+    rustsecp256k1_v0_9_0_gej_verify(b);
 
     if (a->infinity) {
         VERIFY_CHECK(rzr == NULL);
@@ -347,86 +482,91 @@ static void rustsecp256k1_v0_8_1_gej_add_var(rustsecp256k1_v0_8_1_gej *r, const
     }
     if (b->infinity) {
         if (rzr != NULL) {
-            rustsecp256k1_v0_8_1_fe_set_int(rzr, 1);
+            rustsecp256k1_v0_9_0_fe_set_int(rzr, 1);
         }
         *r = *a;
         return;
     }
 
-    rustsecp256k1_v0_8_1_fe_sqr(&z22, &b->z);
-    rustsecp256k1_v0_8_1_fe_sqr(&z12, &a->z);
-    rustsecp256k1_v0_8_1_fe_mul(&u1, &a->x, &z22);
-    rustsecp256k1_v0_8_1_fe_mul(&u2, &b->x, &z12);
-    rustsecp256k1_v0_8_1_fe_mul(&s1, &a->y, &z22); rustsecp256k1_v0_8_1_fe_mul(&s1, &s1, &b->z);
-    rustsecp256k1_v0_8_1_fe_mul(&s2, &b->y, &z12); rustsecp256k1_v0_8_1_fe_mul(&s2, &s2, &a->z);
-    rustsecp256k1_v0_8_1_fe_negate(&h, &u1, 1); rustsecp256k1_v0_8_1_fe_add(&h, &u2);
-    rustsecp256k1_v0_8_1_fe_negate(&i, &s2, 1); rustsecp256k1_v0_8_1_fe_add(&i, &s1);
-    if (rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&h)) {
-        if (rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&i)) {
-            rustsecp256k1_v0_8_1_gej_double_var(r, a, rzr);
+    rustsecp256k1_v0_9_0_fe_sqr(&z22, &b->z);
+    rustsecp256k1_v0_9_0_fe_sqr(&z12, &a->z);
+    rustsecp256k1_v0_9_0_fe_mul(&u1, &a->x, &z22);
+    rustsecp256k1_v0_9_0_fe_mul(&u2, &b->x, &z12);
+    rustsecp256k1_v0_9_0_fe_mul(&s1, &a->y, &z22); rustsecp256k1_v0_9_0_fe_mul(&s1, &s1, &b->z);
+    rustsecp256k1_v0_9_0_fe_mul(&s2, &b->y, &z12); rustsecp256k1_v0_9_0_fe_mul(&s2, &s2, &a->z);
+    rustsecp256k1_v0_9_0_fe_negate(&h, &u1, 1); rustsecp256k1_v0_9_0_fe_add(&h, &u2);
+    rustsecp256k1_v0_9_0_fe_negate(&i, &s2, 1); rustsecp256k1_v0_9_0_fe_add(&i, &s1);
+    if (rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&h)) {
+        if (rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&i)) {
+            rustsecp256k1_v0_9_0_gej_double_var(r, a, rzr);
         } else {
             if (rzr != NULL) {
-                rustsecp256k1_v0_8_1_fe_set_int(rzr, 0);
+                rustsecp256k1_v0_9_0_fe_set_int(rzr, 0);
             }
-            rustsecp256k1_v0_8_1_gej_set_infinity(r);
+            rustsecp256k1_v0_9_0_gej_set_infinity(r);
         }
         return;
     }
 
     r->infinity = 0;
-    rustsecp256k1_v0_8_1_fe_mul(&t, &h, &b->z);
+    rustsecp256k1_v0_9_0_fe_mul(&t, &h, &b->z);
     if (rzr != NULL) {
         *rzr = t;
     }
-    rustsecp256k1_v0_8_1_fe_mul(&r->z, &a->z, &t);
+    rustsecp256k1_v0_9_0_fe_mul(&r->z, &a->z, &t);
+
+    rustsecp256k1_v0_9_0_fe_sqr(&h2, &h);
+    rustsecp256k1_v0_9_0_fe_negate(&h2, &h2, 1);
+    rustsecp256k1_v0_9_0_fe_mul(&h3, &h2, &h);
+    rustsecp256k1_v0_9_0_fe_mul(&t, &u1, &h2);
 
-    rustsecp256k1_v0_8_1_fe_sqr(&h2, &h);
-    rustsecp256k1_v0_8_1_fe_negate(&h2, &h2, 1);
-    rustsecp256k1_v0_8_1_fe_mul(&h3, &h2, &h);
-    rustsecp256k1_v0_8_1_fe_mul(&t, &u1, &h2);
+    rustsecp256k1_v0_9_0_fe_sqr(&r->x, &i);
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &h3);
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &t);
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &t);
 
-    rustsecp256k1_v0_8_1_fe_sqr(&r->x, &i);
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &h3);
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &t);
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &t);
+    rustsecp256k1_v0_9_0_fe_add(&t, &r->x);
+    rustsecp256k1_v0_9_0_fe_mul(&r->y, &t, &i);
+    rustsecp256k1_v0_9_0_fe_mul(&h3, &h3, &s1);
+    rustsecp256k1_v0_9_0_fe_add(&r->y, &h3);
 
-    rustsecp256k1_v0_8_1_fe_add(&t, &r->x);
-    rustsecp256k1_v0_8_1_fe_mul(&r->y, &t, &i);
-    rustsecp256k1_v0_8_1_fe_mul(&h3, &h3, &s1);
-    rustsecp256k1_v0_8_1_fe_add(&r->y, &h3);
+    rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_gej_add_ge_var(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_ge *b, rustsecp256k1_v0_8_1_fe *rzr) {
-    /* 8 mul, 3 sqr, 13 add/negate/normalize_weak/normalizes_to_zero (ignoring special cases) */
-    rustsecp256k1_v0_8_1_fe z12, u1, u2, s1, s2, h, i, h2, h3, t;
+static void rustsecp256k1_v0_9_0_gej_add_ge_var(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_ge *b, rustsecp256k1_v0_9_0_fe *rzr) {
+    /* Operations: 8 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
+    rustsecp256k1_v0_9_0_fe z12, u1, u2, s1, s2, h, i, h2, h3, t;
+    rustsecp256k1_v0_9_0_gej_verify(a);
+    rustsecp256k1_v0_9_0_ge_verify(b);
+
     if (a->infinity) {
         VERIFY_CHECK(rzr == NULL);
-        rustsecp256k1_v0_8_1_gej_set_ge(r, b);
+        rustsecp256k1_v0_9_0_gej_set_ge(r, b);
         return;
     }
     if (b->infinity) {
         if (rzr != NULL) {
-            rustsecp256k1_v0_8_1_fe_set_int(rzr, 1);
+            rustsecp256k1_v0_9_0_fe_set_int(rzr, 1);
         }
         *r = *a;
         return;
     }
 
-    rustsecp256k1_v0_8_1_fe_sqr(&z12, &a->z);
-    u1 = a->x; rustsecp256k1_v0_8_1_fe_normalize_weak(&u1);
-    rustsecp256k1_v0_8_1_fe_mul(&u2, &b->x, &z12);
-    s1 = a->y; rustsecp256k1_v0_8_1_fe_normalize_weak(&s1);
-    rustsecp256k1_v0_8_1_fe_mul(&s2, &b->y, &z12); rustsecp256k1_v0_8_1_fe_mul(&s2, &s2, &a->z);
-    rustsecp256k1_v0_8_1_fe_negate(&h, &u1, 1); rustsecp256k1_v0_8_1_fe_add(&h, &u2);
-    rustsecp256k1_v0_8_1_fe_negate(&i, &s2, 1); rustsecp256k1_v0_8_1_fe_add(&i, &s1);
-    if (rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&h)) {
-        if (rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&i)) {
-            rustsecp256k1_v0_8_1_gej_double_var(r, a, rzr);
+    rustsecp256k1_v0_9_0_fe_sqr(&z12, &a->z);
+    u1 = a->x;
+    rustsecp256k1_v0_9_0_fe_mul(&u2, &b->x, &z12);
+    s1 = a->y;
+    rustsecp256k1_v0_9_0_fe_mul(&s2, &b->y, &z12); rustsecp256k1_v0_9_0_fe_mul(&s2, &s2, &a->z);
+    rustsecp256k1_v0_9_0_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); rustsecp256k1_v0_9_0_fe_add(&h, &u2);
+    rustsecp256k1_v0_9_0_fe_negate(&i, &s2, 1); rustsecp256k1_v0_9_0_fe_add(&i, &s1);
+    if (rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&h)) {
+        if (rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&i)) {
+            rustsecp256k1_v0_9_0_gej_double_var(r, a, rzr);
         } else {
             if (rzr != NULL) {
-                rustsecp256k1_v0_8_1_fe_set_int(rzr, 0);
+                rustsecp256k1_v0_9_0_fe_set_int(rzr, 0);
             }
-            rustsecp256k1_v0_8_1_gej_set_infinity(r);
+            rustsecp256k1_v0_9_0_gej_set_infinity(r);
         }
         return;
     }
@@ -435,36 +575,43 @@ static void rustsecp256k1_v0_8_1_gej_add_ge_var(rustsecp256k1_v0_8_1_gej *r, con
     if (rzr != NULL) {
         *rzr = h;
     }
-    rustsecp256k1_v0_8_1_fe_mul(&r->z, &a->z, &h);
+    rustsecp256k1_v0_9_0_fe_mul(&r->z, &a->z, &h);
 
-    rustsecp256k1_v0_8_1_fe_sqr(&h2, &h);
-    rustsecp256k1_v0_8_1_fe_negate(&h2, &h2, 1);
-    rustsecp256k1_v0_8_1_fe_mul(&h3, &h2, &h);
-    rustsecp256k1_v0_8_1_fe_mul(&t, &u1, &h2);
+    rustsecp256k1_v0_9_0_fe_sqr(&h2, &h);
+    rustsecp256k1_v0_9_0_fe_negate(&h2, &h2, 1);
+    rustsecp256k1_v0_9_0_fe_mul(&h3, &h2, &h);
+    rustsecp256k1_v0_9_0_fe_mul(&t, &u1, &h2);
 
-    rustsecp256k1_v0_8_1_fe_sqr(&r->x, &i);
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &h3);
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &t);
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &t);
+    rustsecp256k1_v0_9_0_fe_sqr(&r->x, &i);
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &h3);
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &t);
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &t);
 
-    rustsecp256k1_v0_8_1_fe_add(&t, &r->x);
-    rustsecp256k1_v0_8_1_fe_mul(&r->y, &t, &i);
-    rustsecp256k1_v0_8_1_fe_mul(&h3, &h3, &s1);
-    rustsecp256k1_v0_8_1_fe_add(&r->y, &h3);
+    rustsecp256k1_v0_9_0_fe_add(&t, &r->x);
+    rustsecp256k1_v0_9_0_fe_mul(&r->y, &t, &i);
+    rustsecp256k1_v0_9_0_fe_mul(&h3, &h3, &s1);
+    rustsecp256k1_v0_9_0_fe_add(&r->y, &h3);
+
+    rustsecp256k1_v0_9_0_gej_verify(r);
+    if (rzr != NULL) rustsecp256k1_v0_9_0_fe_verify(rzr);
 }
 
-static void rustsecp256k1_v0_8_1_gej_add_zinv_var(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_ge *b, const rustsecp256k1_v0_8_1_fe *bzinv) {
-    /* 9 mul, 3 sqr, 13 add/negate/normalize_weak/normalizes_to_zero (ignoring special cases) */
-    rustsecp256k1_v0_8_1_fe az, z12, u1, u2, s1, s2, h, i, h2, h3, t;
+static void rustsecp256k1_v0_9_0_gej_add_zinv_var(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_ge *b, const rustsecp256k1_v0_9_0_fe *bzinv) {
+    /* Operations: 9 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
+    rustsecp256k1_v0_9_0_fe az, z12, u1, u2, s1, s2, h, i, h2, h3, t;
+    rustsecp256k1_v0_9_0_gej_verify(a);
+    rustsecp256k1_v0_9_0_ge_verify(b);
+    rustsecp256k1_v0_9_0_fe_verify(bzinv);
 
     if (a->infinity) {
-        rustsecp256k1_v0_8_1_fe bzinv2, bzinv3;
+        rustsecp256k1_v0_9_0_fe bzinv2, bzinv3;
         r->infinity = b->infinity;
-        rustsecp256k1_v0_8_1_fe_sqr(&bzinv2, bzinv);
-        rustsecp256k1_v0_8_1_fe_mul(&bzinv3, &bzinv2, bzinv);
-        rustsecp256k1_v0_8_1_fe_mul(&r->x, &b->x, &bzinv2);
-        rustsecp256k1_v0_8_1_fe_mul(&r->y, &b->y, &bzinv3);
-        rustsecp256k1_v0_8_1_fe_set_int(&r->z, 1);
+        rustsecp256k1_v0_9_0_fe_sqr(&bzinv2, bzinv);
+        rustsecp256k1_v0_9_0_fe_mul(&bzinv3, &bzinv2, bzinv);
+        rustsecp256k1_v0_9_0_fe_mul(&r->x, &b->x, &bzinv2);
+        rustsecp256k1_v0_9_0_fe_mul(&r->y, &b->y, &bzinv3);
+        rustsecp256k1_v0_9_0_fe_set_int(&r->z, 1);
+        rustsecp256k1_v0_9_0_gej_verify(r);
         return;
     }
     if (b->infinity) {
@@ -480,53 +627,56 @@ static void rustsecp256k1_v0_8_1_gej_add_zinv_var(rustsecp256k1_v0_8_1_gej *r, c
      *  The variable az below holds the modified Z coordinate for a, which is used
      *  for the computation of rx and ry, but not for rz.
      */
-    rustsecp256k1_v0_8_1_fe_mul(&az, &a->z, bzinv);
-
-    rustsecp256k1_v0_8_1_fe_sqr(&z12, &az);
-    u1 = a->x; rustsecp256k1_v0_8_1_fe_normalize_weak(&u1);
-    rustsecp256k1_v0_8_1_fe_mul(&u2, &b->x, &z12);
-    s1 = a->y; rustsecp256k1_v0_8_1_fe_normalize_weak(&s1);
-    rustsecp256k1_v0_8_1_fe_mul(&s2, &b->y, &z12); rustsecp256k1_v0_8_1_fe_mul(&s2, &s2, &az);
-    rustsecp256k1_v0_8_1_fe_negate(&h, &u1, 1); rustsecp256k1_v0_8_1_fe_add(&h, &u2);
-    rustsecp256k1_v0_8_1_fe_negate(&i, &s2, 1); rustsecp256k1_v0_8_1_fe_add(&i, &s1);
-    if (rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&h)) {
-        if (rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&i)) {
-            rustsecp256k1_v0_8_1_gej_double_var(r, a, NULL);
+    rustsecp256k1_v0_9_0_fe_mul(&az, &a->z, bzinv);
+
+    rustsecp256k1_v0_9_0_fe_sqr(&z12, &az);
+    u1 = a->x;
+    rustsecp256k1_v0_9_0_fe_mul(&u2, &b->x, &z12);
+    s1 = a->y;
+    rustsecp256k1_v0_9_0_fe_mul(&s2, &b->y, &z12); rustsecp256k1_v0_9_0_fe_mul(&s2, &s2, &az);
+    rustsecp256k1_v0_9_0_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); rustsecp256k1_v0_9_0_fe_add(&h, &u2);
+    rustsecp256k1_v0_9_0_fe_negate(&i, &s2, 1); rustsecp256k1_v0_9_0_fe_add(&i, &s1);
+    if (rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&h)) {
+        if (rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&i)) {
+            rustsecp256k1_v0_9_0_gej_double_var(r, a, NULL);
         } else {
-            rustsecp256k1_v0_8_1_gej_set_infinity(r);
+            rustsecp256k1_v0_9_0_gej_set_infinity(r);
         }
         return;
     }
 
     r->infinity = 0;
-    rustsecp256k1_v0_8_1_fe_mul(&r->z, &a->z, &h);
+    rustsecp256k1_v0_9_0_fe_mul(&r->z, &a->z, &h);
+
+    rustsecp256k1_v0_9_0_fe_sqr(&h2, &h);
+    rustsecp256k1_v0_9_0_fe_negate(&h2, &h2, 1);
+    rustsecp256k1_v0_9_0_fe_mul(&h3, &h2, &h);
+    rustsecp256k1_v0_9_0_fe_mul(&t, &u1, &h2);
 
-    rustsecp256k1_v0_8_1_fe_sqr(&h2, &h);
-    rustsecp256k1_v0_8_1_fe_negate(&h2, &h2, 1);
-    rustsecp256k1_v0_8_1_fe_mul(&h3, &h2, &h);
-    rustsecp256k1_v0_8_1_fe_mul(&t, &u1, &h2);
+    rustsecp256k1_v0_9_0_fe_sqr(&r->x, &i);
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &h3);
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &t);
+    rustsecp256k1_v0_9_0_fe_add(&r->x, &t);
 
-    rustsecp256k1_v0_8_1_fe_sqr(&r->x, &i);
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &h3);
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &t);
-    rustsecp256k1_v0_8_1_fe_add(&r->x, &t);
+    rustsecp256k1_v0_9_0_fe_add(&t, &r->x);
+    rustsecp256k1_v0_9_0_fe_mul(&r->y, &t, &i);
+    rustsecp256k1_v0_9_0_fe_mul(&h3, &h3, &s1);
+    rustsecp256k1_v0_9_0_fe_add(&r->y, &h3);
 
-    rustsecp256k1_v0_8_1_fe_add(&t, &r->x);
-    rustsecp256k1_v0_8_1_fe_mul(&r->y, &t, &i);
-    rustsecp256k1_v0_8_1_fe_mul(&h3, &h3, &s1);
-    rustsecp256k1_v0_8_1_fe_add(&r->y, &h3);
+    rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
 
-static void rustsecp256k1_v0_8_1_gej_add_ge(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_ge *b) {
-    /* Operations: 7 mul, 5 sqr, 24 add/cmov/half/mul_int/negate/normalize_weak/normalizes_to_zero */
-    rustsecp256k1_v0_8_1_fe zz, u1, u2, s1, s2, t, tt, m, n, q, rr;
-    rustsecp256k1_v0_8_1_fe m_alt, rr_alt;
-    int infinity, degenerate;
+static void rustsecp256k1_v0_9_0_gej_add_ge(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_ge *b) {
+    /* Operations: 7 mul, 5 sqr, 21 add/cmov/half/mul_int/negate/normalizes_to_zero */
+    rustsecp256k1_v0_9_0_fe zz, u1, u2, s1, s2, t, tt, m, n, q, rr;
+    rustsecp256k1_v0_9_0_fe m_alt, rr_alt;
+    int degenerate;
+    rustsecp256k1_v0_9_0_gej_verify(a);
+    rustsecp256k1_v0_9_0_ge_verify(b);
     VERIFY_CHECK(!b->infinity);
-    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
 
-    /** In:
+    /*  In:
      *    Eric Brier and Marc Joye, Weierstrass Elliptic Curves and Side-Channel Attacks.
      *    In D. Naccache and P. Paillier, Eds., Public Key Cryptography, vol. 2274 of Lecture Notes in Computer Science, pages 335-345. Springer-Verlag, 2002.
      *  we find as solution for a unified addition/doubling formula:
@@ -576,130 +726,199 @@ static void rustsecp256k1_v0_8_1_gej_add_ge(rustsecp256k1_v0_8_1_gej *r, const r
      *      so this covers everything.
      */
 
-    rustsecp256k1_v0_8_1_fe_sqr(&zz, &a->z);                       /* z = Z1^2 */
-    u1 = a->x; rustsecp256k1_v0_8_1_fe_normalize_weak(&u1);        /* u1 = U1 = X1*Z2^2 (1) */
-    rustsecp256k1_v0_8_1_fe_mul(&u2, &b->x, &zz);                  /* u2 = U2 = X2*Z1^2 (1) */
-    s1 = a->y; rustsecp256k1_v0_8_1_fe_normalize_weak(&s1);        /* s1 = S1 = Y1*Z2^3 (1) */
-    rustsecp256k1_v0_8_1_fe_mul(&s2, &b->y, &zz);                  /* s2 = Y2*Z1^2 (1) */
-    rustsecp256k1_v0_8_1_fe_mul(&s2, &s2, &a->z);                  /* s2 = S2 = Y2*Z1^3 (1) */
-    t = u1; rustsecp256k1_v0_8_1_fe_add(&t, &u2);                  /* t = T = U1+U2 (2) */
-    m = s1; rustsecp256k1_v0_8_1_fe_add(&m, &s2);                  /* m = M = S1+S2 (2) */
-    rustsecp256k1_v0_8_1_fe_sqr(&rr, &t);                          /* rr = T^2 (1) */
-    rustsecp256k1_v0_8_1_fe_negate(&m_alt, &u2, 1);                /* Malt = -X2*Z1^2 */
-    rustsecp256k1_v0_8_1_fe_mul(&tt, &u1, &m_alt);                 /* tt = -U1*U2 (2) */
-    rustsecp256k1_v0_8_1_fe_add(&rr, &tt);                         /* rr = R = T^2-U1*U2 (3) */
-    /** If lambda = R/M = 0/0 we have a problem (except in the "trivial"
-     *  case that Z = z1z2 = 0, and this is special-cased later on). */
-    degenerate = rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&m) &
-                 rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&rr);
+    rustsecp256k1_v0_9_0_fe_sqr(&zz, &a->z);                       /* z = Z1^2 */
+    u1 = a->x;                                          /* u1 = U1 = X1*Z2^2 (GEJ_X_M) */
+    rustsecp256k1_v0_9_0_fe_mul(&u2, &b->x, &zz);                  /* u2 = U2 = X2*Z1^2 (1) */
+    s1 = a->y;                                          /* s1 = S1 = Y1*Z2^3 (GEJ_Y_M) */
+    rustsecp256k1_v0_9_0_fe_mul(&s2, &b->y, &zz);                  /* s2 = Y2*Z1^2 (1) */
+    rustsecp256k1_v0_9_0_fe_mul(&s2, &s2, &a->z);                  /* s2 = S2 = Y2*Z1^3 (1) */
+    t = u1; rustsecp256k1_v0_9_0_fe_add(&t, &u2);                  /* t = T = U1+U2 (GEJ_X_M+1) */
+    m = s1; rustsecp256k1_v0_9_0_fe_add(&m, &s2);                  /* m = M = S1+S2 (GEJ_Y_M+1) */
+    rustsecp256k1_v0_9_0_fe_sqr(&rr, &t);                          /* rr = T^2 (1) */
+    rustsecp256k1_v0_9_0_fe_negate(&m_alt, &u2, 1);                /* Malt = -X2*Z1^2 (2) */
+    rustsecp256k1_v0_9_0_fe_mul(&tt, &u1, &m_alt);                 /* tt = -U1*U2 (1) */
+    rustsecp256k1_v0_9_0_fe_add(&rr, &tt);                         /* rr = R = T^2-U1*U2 (2) */
+    /* If lambda = R/M = R/0 we have a problem (except in the "trivial"
+     * case that Z = z1z2 = 0, and this is special-cased later on). */
+    degenerate = rustsecp256k1_v0_9_0_fe_normalizes_to_zero(&m);
     /* This only occurs when y1 == -y2 and x1^3 == x2^3, but x1 != x2.
      * This means either x1 == beta*x2 or beta*x1 == x2, where beta is
      * a nontrivial cube root of one. In either case, an alternate
      * non-indeterminate expression for lambda is (y1 - y2)/(x1 - x2),
      * so we set R/M equal to this. */
     rr_alt = s1;
-    rustsecp256k1_v0_8_1_fe_mul_int(&rr_alt, 2);       /* rr = Y1*Z2^3 - Y2*Z1^3 (2) */
-    rustsecp256k1_v0_8_1_fe_add(&m_alt, &u1);          /* Malt = X1*Z2^2 - X2*Z1^2 */
+    rustsecp256k1_v0_9_0_fe_mul_int(&rr_alt, 2);       /* rr_alt = Y1*Z2^3 - Y2*Z1^3 (GEJ_Y_M*2) */
+    rustsecp256k1_v0_9_0_fe_add(&m_alt, &u1);          /* Malt = X1*Z2^2 - X2*Z1^2 (GEJ_X_M+2) */
 
-    rustsecp256k1_v0_8_1_fe_cmov(&rr_alt, &rr, !degenerate);
-    rustsecp256k1_v0_8_1_fe_cmov(&m_alt, &m, !degenerate);
-    /* Now Ralt / Malt = lambda and is guaranteed not to be 0/0.
+    rustsecp256k1_v0_9_0_fe_cmov(&rr_alt, &rr, !degenerate);       /* rr_alt (GEJ_Y_M*2) */
+    rustsecp256k1_v0_9_0_fe_cmov(&m_alt, &m, !degenerate);         /* m_alt (GEJ_X_M+2) */
+    /* Now Ralt / Malt = lambda and is guaranteed not to be Ralt / 0.
      * From here on out Ralt and Malt represent the numerator
      * and denominator of lambda; R and M represent the explicit
      * expressions x1^2 + x2^2 + x1x2 and y1 + y2. */
-    rustsecp256k1_v0_8_1_fe_sqr(&n, &m_alt);                       /* n = Malt^2 (1) */
-    rustsecp256k1_v0_8_1_fe_negate(&q, &t, 2);                     /* q = -T (3) */
-    rustsecp256k1_v0_8_1_fe_mul(&q, &q, &n);                       /* q = Q = -T*Malt^2 (1) */
+    rustsecp256k1_v0_9_0_fe_sqr(&n, &m_alt);                       /* n = Malt^2 (1) */
+    rustsecp256k1_v0_9_0_fe_negate(&q, &t,
+        SECP256K1_GEJ_X_MAGNITUDE_MAX + 1);             /* q = -T (GEJ_X_M+2) */
+    rustsecp256k1_v0_9_0_fe_mul(&q, &q, &n);                       /* q = Q = -T*Malt^2 (1) */
     /* These two lines use the observation that either M == Malt or M == 0,
      * so M^3 * Malt is either Malt^4 (which is computed by squaring), or
      * zero (which is "computed" by cmov). So the cost is one squaring
      * versus two multiplications. */
-    rustsecp256k1_v0_8_1_fe_sqr(&n, &n);
-    rustsecp256k1_v0_8_1_fe_cmov(&n, &m, degenerate);              /* n = M^3 * Malt (2) */
-    rustsecp256k1_v0_8_1_fe_sqr(&t, &rr_alt);                      /* t = Ralt^2 (1) */
-    rustsecp256k1_v0_8_1_fe_mul(&r->z, &a->z, &m_alt);             /* r->z = Z3 = Malt*Z (1) */
-    infinity = rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&r->z) & ~a->infinity;
-    rustsecp256k1_v0_8_1_fe_add(&t, &q);                           /* t = Ralt^2 + Q (2) */
+    rustsecp256k1_v0_9_0_fe_sqr(&n, &n);                           /* n = Malt^4 (1) */
+    rustsecp256k1_v0_9_0_fe_cmov(&n, &m, degenerate);              /* n = M^3 * Malt (GEJ_Y_M+1) */
+    rustsecp256k1_v0_9_0_fe_sqr(&t, &rr_alt);                      /* t = Ralt^2 (1) */
+    rustsecp256k1_v0_9_0_fe_mul(&r->z, &a->z, &m_alt);             /* r->z = Z3 = Malt*Z (1) */
+    rustsecp256k1_v0_9_0_fe_add(&t, &q);                           /* t = Ralt^2 + Q (2) */
     r->x = t;                                           /* r->x = X3 = Ralt^2 + Q (2) */
-    rustsecp256k1_v0_8_1_fe_mul_int(&t, 2);                        /* t = 2*X3 (4) */
-    rustsecp256k1_v0_8_1_fe_add(&t, &q);                           /* t = 2*X3 + Q (5) */
-    rustsecp256k1_v0_8_1_fe_mul(&t, &t, &rr_alt);                  /* t = Ralt*(2*X3 + Q) (1) */
-    rustsecp256k1_v0_8_1_fe_add(&t, &n);                           /* t = Ralt*(2*X3 + Q) + M^3*Malt (3) */
-    rustsecp256k1_v0_8_1_fe_negate(&r->y, &t, 3);                  /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (4) */
-    rustsecp256k1_v0_8_1_fe_half(&r->y);                           /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 (3) */
+    rustsecp256k1_v0_9_0_fe_mul_int(&t, 2);                        /* t = 2*X3 (4) */
+    rustsecp256k1_v0_9_0_fe_add(&t, &q);                           /* t = 2*X3 + Q (5) */
+    rustsecp256k1_v0_9_0_fe_mul(&t, &t, &rr_alt);                  /* t = Ralt*(2*X3 + Q) (1) */
+    rustsecp256k1_v0_9_0_fe_add(&t, &n);                           /* t = Ralt*(2*X3 + Q) + M^3*Malt (GEJ_Y_M+2) */
+    rustsecp256k1_v0_9_0_fe_negate(&r->y, &t,
+        SECP256K1_GEJ_Y_MAGNITUDE_MAX + 2);             /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (GEJ_Y_M+3) */
+    rustsecp256k1_v0_9_0_fe_half(&r->y);                           /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 ((GEJ_Y_M+3)/2 + 1) */
+
+    /* In case a->infinity == 1, replace r with (b->x, b->y, 1). */
+    rustsecp256k1_v0_9_0_fe_cmov(&r->x, &b->x, a->infinity);
+    rustsecp256k1_v0_9_0_fe_cmov(&r->y, &b->y, a->infinity);
+    rustsecp256k1_v0_9_0_fe_cmov(&r->z, &rustsecp256k1_v0_9_0_fe_one, a->infinity);
+
+    /* Set r->infinity if r->z is 0.
+     *
+     * If a->infinity is set, then r->infinity = (r->z == 0) = (1 == 0) = false,
+     * which is correct because the function assumes that b is not infinity.
+     *
+     * Now assume !a->infinity. This implies Z = Z1 != 0.
+     *
+     * Case y1 = -y2:
+     * In this case we could have a = -b, namely if x1 = x2.
+     * We have degenerate = true, r->z = (x1 - x2) * Z.
+     * Then r->infinity = ((x1 - x2)Z == 0) = (x1 == x2) = (a == -b).
+     *
+     * Case y1 != -y2:
+     * In this case, we can't have a = -b.
+     * We have degenerate = false, r->z = (y1 + y2) * Z.
+     * Then r->infinity = ((y1 + y2)Z == 0) = (y1 == -y2) = false. */
+    r->infinity = rustsecp256k1_v0_9_0_fe_normalizes_to_zero(&r->z);
 
-    /** In case a->infinity == 1, replace r with (b->x, b->y, 1). */
-    rustsecp256k1_v0_8_1_fe_cmov(&r->x, &b->x, a->infinity);
-    rustsecp256k1_v0_8_1_fe_cmov(&r->y, &b->y, a->infinity);
-    rustsecp256k1_v0_8_1_fe_cmov(&r->z, &rustsecp256k1_v0_8_1_fe_one, a->infinity);
-    r->infinity = infinity;
+    rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_gej_rescale(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_fe *s) {
+static void rustsecp256k1_v0_9_0_gej_rescale(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_fe *s) {
     /* Operations: 4 mul, 1 sqr */
-    rustsecp256k1_v0_8_1_fe zz;
-    VERIFY_CHECK(!rustsecp256k1_v0_8_1_fe_is_zero(s));
-    rustsecp256k1_v0_8_1_fe_sqr(&zz, s);
-    rustsecp256k1_v0_8_1_fe_mul(&r->x, &r->x, &zz);                /* r->x *= s^2 */
-    rustsecp256k1_v0_8_1_fe_mul(&r->y, &r->y, &zz);
-    rustsecp256k1_v0_8_1_fe_mul(&r->y, &r->y, s);                  /* r->y *= s^3 */
-    rustsecp256k1_v0_8_1_fe_mul(&r->z, &r->z, s);                  /* r->z *= s   */
+    rustsecp256k1_v0_9_0_fe zz;
+    rustsecp256k1_v0_9_0_gej_verify(r);
+    rustsecp256k1_v0_9_0_fe_verify(s);
+#ifdef VERIFY
+    VERIFY_CHECK(!rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(s));
+#endif
+
+    rustsecp256k1_v0_9_0_fe_sqr(&zz, s);
+    rustsecp256k1_v0_9_0_fe_mul(&r->x, &r->x, &zz);                /* r->x *= s^2 */
+    rustsecp256k1_v0_9_0_fe_mul(&r->y, &r->y, &zz);
+    rustsecp256k1_v0_9_0_fe_mul(&r->y, &r->y, s);                  /* r->y *= s^3 */
+    rustsecp256k1_v0_9_0_fe_mul(&r->z, &r->z, s);                  /* r->z *= s   */
+
+    rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_ge_to_storage(rustsecp256k1_v0_8_1_ge_storage *r, const rustsecp256k1_v0_8_1_ge *a) {
-    rustsecp256k1_v0_8_1_fe x, y;
+static void rustsecp256k1_v0_9_0_ge_to_storage(rustsecp256k1_v0_9_0_ge_storage *r, const rustsecp256k1_v0_9_0_ge *a) {
+    rustsecp256k1_v0_9_0_fe x, y;
+    rustsecp256k1_v0_9_0_ge_verify(a);
     VERIFY_CHECK(!a->infinity);
+
     x = a->x;
-    rustsecp256k1_v0_8_1_fe_normalize(&x);
+    rustsecp256k1_v0_9_0_fe_normalize(&x);
     y = a->y;
-    rustsecp256k1_v0_8_1_fe_normalize(&y);
-    rustsecp256k1_v0_8_1_fe_to_storage(&r->x, &x);
-    rustsecp256k1_v0_8_1_fe_to_storage(&r->y, &y);
+    rustsecp256k1_v0_9_0_fe_normalize(&y);
+    rustsecp256k1_v0_9_0_fe_to_storage(&r->x, &x);
+    rustsecp256k1_v0_9_0_fe_to_storage(&r->y, &y);
 }
 
-static void rustsecp256k1_v0_8_1_ge_from_storage(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_ge_storage *a) {
-    rustsecp256k1_v0_8_1_fe_from_storage(&r->x, &a->x);
-    rustsecp256k1_v0_8_1_fe_from_storage(&r->y, &a->y);
+static void rustsecp256k1_v0_9_0_ge_from_storage(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge_storage *a) {
+    rustsecp256k1_v0_9_0_fe_from_storage(&r->x, &a->x);
+    rustsecp256k1_v0_9_0_fe_from_storage(&r->y, &a->y);
     r->infinity = 0;
+
+    rustsecp256k1_v0_9_0_ge_verify(r);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_gej_cmov(rustsecp256k1_v0_8_1_gej *r, const rustsecp256k1_v0_8_1_gej *a, int flag) {
-    rustsecp256k1_v0_8_1_fe_cmov(&r->x, &a->x, flag);
-    rustsecp256k1_v0_8_1_fe_cmov(&r->y, &a->y, flag);
-    rustsecp256k1_v0_8_1_fe_cmov(&r->z, &a->z, flag);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_gej_cmov(rustsecp256k1_v0_9_0_gej *r, const rustsecp256k1_v0_9_0_gej *a, int flag) {
+    rustsecp256k1_v0_9_0_gej_verify(r);
+    rustsecp256k1_v0_9_0_gej_verify(a);
 
+    rustsecp256k1_v0_9_0_fe_cmov(&r->x, &a->x, flag);
+    rustsecp256k1_v0_9_0_fe_cmov(&r->y, &a->y, flag);
+    rustsecp256k1_v0_9_0_fe_cmov(&r->z, &a->z, flag);
     r->infinity ^= (r->infinity ^ a->infinity) & flag;
+
+    rustsecp256k1_v0_9_0_gej_verify(r);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_ge_storage_cmov(rustsecp256k1_v0_8_1_ge_storage *r, const rustsecp256k1_v0_8_1_ge_storage *a, int flag) {
-    rustsecp256k1_v0_8_1_fe_storage_cmov(&r->x, &a->x, flag);
-    rustsecp256k1_v0_8_1_fe_storage_cmov(&r->y, &a->y, flag);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_ge_storage_cmov(rustsecp256k1_v0_9_0_ge_storage *r, const rustsecp256k1_v0_9_0_ge_storage *a, int flag) {
+    rustsecp256k1_v0_9_0_fe_storage_cmov(&r->x, &a->x, flag);
+    rustsecp256k1_v0_9_0_fe_storage_cmov(&r->y, &a->y, flag);
 }
 
-static void rustsecp256k1_v0_8_1_ge_mul_lambda(rustsecp256k1_v0_8_1_ge *r, const rustsecp256k1_v0_8_1_ge *a) {
+static void rustsecp256k1_v0_9_0_ge_mul_lambda(rustsecp256k1_v0_9_0_ge *r, const rustsecp256k1_v0_9_0_ge *a) {
+    rustsecp256k1_v0_9_0_ge_verify(a);
+
     *r = *a;
-    rustsecp256k1_v0_8_1_fe_mul(&r->x, &r->x, &rustsecp256k1_v0_8_1_const_beta);
+    rustsecp256k1_v0_9_0_fe_mul(&r->x, &r->x, &rustsecp256k1_v0_9_0_const_beta);
+
+    rustsecp256k1_v0_9_0_ge_verify(r);
 }
 
-static int rustsecp256k1_v0_8_1_ge_is_in_correct_subgroup(const rustsecp256k1_v0_8_1_ge* ge) {
+static int rustsecp256k1_v0_9_0_ge_is_in_correct_subgroup(const rustsecp256k1_v0_9_0_ge* ge) {
 #ifdef EXHAUSTIVE_TEST_ORDER
-    rustsecp256k1_v0_8_1_gej out;
+    rustsecp256k1_v0_9_0_gej out;
     int i;
+    rustsecp256k1_v0_9_0_ge_verify(ge);
 
     /* A very simple EC multiplication ladder that avoids a dependency on ecmult. */
-    rustsecp256k1_v0_8_1_gej_set_infinity(&out);
+    rustsecp256k1_v0_9_0_gej_set_infinity(&out);
     for (i = 0; i < 32; ++i) {
-        rustsecp256k1_v0_8_1_gej_double_var(&out, &out, NULL);
+        rustsecp256k1_v0_9_0_gej_double_var(&out, &out, NULL);
         if ((((uint32_t)EXHAUSTIVE_TEST_ORDER) >> (31 - i)) & 1) {
-            rustsecp256k1_v0_8_1_gej_add_ge_var(&out, &out, ge, NULL);
+            rustsecp256k1_v0_9_0_gej_add_ge_var(&out, &out, ge, NULL);
         }
     }
-    return rustsecp256k1_v0_8_1_gej_is_infinity(&out);
+    return rustsecp256k1_v0_9_0_gej_is_infinity(&out);
 #else
+    rustsecp256k1_v0_9_0_ge_verify(ge);
+
     (void)ge;
     /* The real secp256k1 group has cofactor 1, so the subgroup is the entire curve. */
     return 1;
 #endif
 }
 
+static int rustsecp256k1_v0_9_0_ge_x_on_curve_var(const rustsecp256k1_v0_9_0_fe *x) {
+    rustsecp256k1_v0_9_0_fe c;
+    rustsecp256k1_v0_9_0_fe_sqr(&c, x);
+    rustsecp256k1_v0_9_0_fe_mul(&c, &c, x);
+    rustsecp256k1_v0_9_0_fe_add_int(&c, SECP256K1_B);
+    return rustsecp256k1_v0_9_0_fe_is_square_var(&c);
+}
+
+static int rustsecp256k1_v0_9_0_ge_x_frac_on_curve_var(const rustsecp256k1_v0_9_0_fe *xn, const rustsecp256k1_v0_9_0_fe *xd) {
+    /* We want to determine whether (xn/xd) is on the curve.
+     *
+     * (xn/xd)^3 + 7 is square <=> xd*xn^3 + 7*xd^4 is square (multiplying by xd^4, a square).
+     */
+     rustsecp256k1_v0_9_0_fe r, t;
+#ifdef VERIFY
+     VERIFY_CHECK(!rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(xd));
+#endif
+     rustsecp256k1_v0_9_0_fe_mul(&r, xd, xn); /* r = xd*xn */
+     rustsecp256k1_v0_9_0_fe_sqr(&t, xn); /* t = xn^2 */
+     rustsecp256k1_v0_9_0_fe_mul(&r, &r, &t); /* r = xd*xn^3 */
+     rustsecp256k1_v0_9_0_fe_sqr(&t, xd); /* t = xd^2 */
+     rustsecp256k1_v0_9_0_fe_sqr(&t, &t); /* t = xd^4 */
+     VERIFY_CHECK(SECP256K1_B <= 31);
+     rustsecp256k1_v0_9_0_fe_mul_int(&t, SECP256K1_B); /* t = 7*xd^4 */
+     rustsecp256k1_v0_9_0_fe_add(&r, &t); /* r = xd*xn^3 + 7*xd^4 */
+     return rustsecp256k1_v0_9_0_fe_is_square_var(&r);
+}
+
 #endif /* SECP256K1_GROUP_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/hash.h b/secp256k1-sys/depend/secp256k1/src/hash.h
index ac624de1d..a22424b05 100644
--- a/secp256k1-sys/depend/secp256k1/src/hash.h
+++ b/secp256k1-sys/depend/secp256k1/src/hash.h
@@ -14,28 +14,28 @@ typedef struct {
     uint32_t s[8];
     unsigned char buf[64];
     uint64_t bytes;
-} rustsecp256k1_v0_8_1_sha256;
+} rustsecp256k1_v0_9_0_sha256;
 
-static void rustsecp256k1_v0_8_1_sha256_initialize(rustsecp256k1_v0_8_1_sha256 *hash);
-static void rustsecp256k1_v0_8_1_sha256_write(rustsecp256k1_v0_8_1_sha256 *hash, const unsigned char *data, size_t size);
-static void rustsecp256k1_v0_8_1_sha256_finalize(rustsecp256k1_v0_8_1_sha256 *hash, unsigned char *out32);
+static void rustsecp256k1_v0_9_0_sha256_initialize(rustsecp256k1_v0_9_0_sha256 *hash);
+static void rustsecp256k1_v0_9_0_sha256_write(rustsecp256k1_v0_9_0_sha256 *hash, const unsigned char *data, size_t size);
+static void rustsecp256k1_v0_9_0_sha256_finalize(rustsecp256k1_v0_9_0_sha256 *hash, unsigned char *out32);
 
 typedef struct {
-    rustsecp256k1_v0_8_1_sha256 inner, outer;
-} rustsecp256k1_v0_8_1_hmac_sha256;
+    rustsecp256k1_v0_9_0_sha256 inner, outer;
+} rustsecp256k1_v0_9_0_hmac_sha256;
 
-static void rustsecp256k1_v0_8_1_hmac_sha256_initialize(rustsecp256k1_v0_8_1_hmac_sha256 *hash, const unsigned char *key, size_t size);
-static void rustsecp256k1_v0_8_1_hmac_sha256_write(rustsecp256k1_v0_8_1_hmac_sha256 *hash, const unsigned char *data, size_t size);
-static void rustsecp256k1_v0_8_1_hmac_sha256_finalize(rustsecp256k1_v0_8_1_hmac_sha256 *hash, unsigned char *out32);
+static void rustsecp256k1_v0_9_0_hmac_sha256_initialize(rustsecp256k1_v0_9_0_hmac_sha256 *hash, const unsigned char *key, size_t size);
+static void rustsecp256k1_v0_9_0_hmac_sha256_write(rustsecp256k1_v0_9_0_hmac_sha256 *hash, const unsigned char *data, size_t size);
+static void rustsecp256k1_v0_9_0_hmac_sha256_finalize(rustsecp256k1_v0_9_0_hmac_sha256 *hash, unsigned char *out32);
 
 typedef struct {
     unsigned char v[32];
     unsigned char k[32];
     int retry;
-} rustsecp256k1_v0_8_1_rfc6979_hmac_sha256;
+} rustsecp256k1_v0_9_0_rfc6979_hmac_sha256;
 
-static void rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_initialize(rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 *rng, const unsigned char *key, size_t keylen);
-static void rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 *rng, unsigned char *out, size_t outlen);
-static void rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_finalize(rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 *rng);
+static void rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_initialize(rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 *rng, const unsigned char *key, size_t keylen);
+static void rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_generate(rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 *rng, unsigned char *out, size_t outlen);
+static void rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_finalize(rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 *rng);
 
 #endif /* SECP256K1_HASH_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/hash_impl.h b/secp256k1-sys/depend/secp256k1/src/hash_impl.h
index 7b2973b08..c45adef6b 100644
--- a/secp256k1-sys/depend/secp256k1/src/hash_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/hash_impl.h
@@ -28,7 +28,7 @@
     (h) = t1 + t2; \
 } while(0)
 
-static void rustsecp256k1_v0_8_1_sha256_initialize(rustsecp256k1_v0_8_1_sha256 *hash) {
+static void rustsecp256k1_v0_9_0_sha256_initialize(rustsecp256k1_v0_9_0_sha256 *hash) {
     hash->s[0] = 0x6a09e667ul;
     hash->s[1] = 0xbb67ae85ul;
     hash->s[2] = 0x3c6ef372ul;
@@ -41,26 +41,26 @@ static void rustsecp256k1_v0_8_1_sha256_initialize(rustsecp256k1_v0_8_1_sha256 *
 }
 
 /** Perform one SHA-256 transformation, processing 16 big endian 32-bit words. */
-static void rustsecp256k1_v0_8_1_sha256_transform(uint32_t* s, const unsigned char* buf) {
+static void rustsecp256k1_v0_9_0_sha256_transform(uint32_t* s, const unsigned char* buf) {
     uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4], f = s[5], g = s[6], h = s[7];
     uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
 
-    Round(a, b, c, d, e, f, g, h, 0x428a2f98,  w0 = rustsecp256k1_v0_8_1_read_be32(&buf[0]));
-    Round(h, a, b, c, d, e, f, g, 0x71374491,  w1 = rustsecp256k1_v0_8_1_read_be32(&buf[4]));
-    Round(g, h, a, b, c, d, e, f, 0xb5c0fbcf,  w2 = rustsecp256k1_v0_8_1_read_be32(&buf[8]));
-    Round(f, g, h, a, b, c, d, e, 0xe9b5dba5,  w3 = rustsecp256k1_v0_8_1_read_be32(&buf[12]));
-    Round(e, f, g, h, a, b, c, d, 0x3956c25b,  w4 = rustsecp256k1_v0_8_1_read_be32(&buf[16]));
-    Round(d, e, f, g, h, a, b, c, 0x59f111f1,  w5 = rustsecp256k1_v0_8_1_read_be32(&buf[20]));
-    Round(c, d, e, f, g, h, a, b, 0x923f82a4,  w6 = rustsecp256k1_v0_8_1_read_be32(&buf[24]));
-    Round(b, c, d, e, f, g, h, a, 0xab1c5ed5,  w7 = rustsecp256k1_v0_8_1_read_be32(&buf[28]));
-    Round(a, b, c, d, e, f, g, h, 0xd807aa98,  w8 = rustsecp256k1_v0_8_1_read_be32(&buf[32]));
-    Round(h, a, b, c, d, e, f, g, 0x12835b01,  w9 = rustsecp256k1_v0_8_1_read_be32(&buf[36]));
-    Round(g, h, a, b, c, d, e, f, 0x243185be, w10 = rustsecp256k1_v0_8_1_read_be32(&buf[40]));
-    Round(f, g, h, a, b, c, d, e, 0x550c7dc3, w11 = rustsecp256k1_v0_8_1_read_be32(&buf[44]));
-    Round(e, f, g, h, a, b, c, d, 0x72be5d74, w12 = rustsecp256k1_v0_8_1_read_be32(&buf[48]));
-    Round(d, e, f, g, h, a, b, c, 0x80deb1fe, w13 = rustsecp256k1_v0_8_1_read_be32(&buf[52]));
-    Round(c, d, e, f, g, h, a, b, 0x9bdc06a7, w14 = rustsecp256k1_v0_8_1_read_be32(&buf[56]));
-    Round(b, c, d, e, f, g, h, a, 0xc19bf174, w15 = rustsecp256k1_v0_8_1_read_be32(&buf[60]));
+    Round(a, b, c, d, e, f, g, h, 0x428a2f98,  w0 = rustsecp256k1_v0_9_0_read_be32(&buf[0]));
+    Round(h, a, b, c, d, e, f, g, 0x71374491,  w1 = rustsecp256k1_v0_9_0_read_be32(&buf[4]));
+    Round(g, h, a, b, c, d, e, f, 0xb5c0fbcf,  w2 = rustsecp256k1_v0_9_0_read_be32(&buf[8]));
+    Round(f, g, h, a, b, c, d, e, 0xe9b5dba5,  w3 = rustsecp256k1_v0_9_0_read_be32(&buf[12]));
+    Round(e, f, g, h, a, b, c, d, 0x3956c25b,  w4 = rustsecp256k1_v0_9_0_read_be32(&buf[16]));
+    Round(d, e, f, g, h, a, b, c, 0x59f111f1,  w5 = rustsecp256k1_v0_9_0_read_be32(&buf[20]));
+    Round(c, d, e, f, g, h, a, b, 0x923f82a4,  w6 = rustsecp256k1_v0_9_0_read_be32(&buf[24]));
+    Round(b, c, d, e, f, g, h, a, 0xab1c5ed5,  w7 = rustsecp256k1_v0_9_0_read_be32(&buf[28]));
+    Round(a, b, c, d, e, f, g, h, 0xd807aa98,  w8 = rustsecp256k1_v0_9_0_read_be32(&buf[32]));
+    Round(h, a, b, c, d, e, f, g, 0x12835b01,  w9 = rustsecp256k1_v0_9_0_read_be32(&buf[36]));
+    Round(g, h, a, b, c, d, e, f, 0x243185be, w10 = rustsecp256k1_v0_9_0_read_be32(&buf[40]));
+    Round(f, g, h, a, b, c, d, e, 0x550c7dc3, w11 = rustsecp256k1_v0_9_0_read_be32(&buf[44]));
+    Round(e, f, g, h, a, b, c, d, 0x72be5d74, w12 = rustsecp256k1_v0_9_0_read_be32(&buf[48]));
+    Round(d, e, f, g, h, a, b, c, 0x80deb1fe, w13 = rustsecp256k1_v0_9_0_read_be32(&buf[52]));
+    Round(c, d, e, f, g, h, a, b, 0x9bdc06a7, w14 = rustsecp256k1_v0_9_0_read_be32(&buf[56]));
+    Round(b, c, d, e, f, g, h, a, 0xc19bf174, w15 = rustsecp256k1_v0_9_0_read_be32(&buf[60]));
 
     Round(a, b, c, d, e, f, g, h, 0xe49b69c1, w0 += sigma1(w14) + w9 + sigma0(w1));
     Round(h, a, b, c, d, e, f, g, 0xefbe4786, w1 += sigma1(w15) + w10 + sigma0(w2));
@@ -123,7 +123,7 @@ static void rustsecp256k1_v0_8_1_sha256_transform(uint32_t* s, const unsigned ch
     s[7] += h;
 }
 
-static void rustsecp256k1_v0_8_1_sha256_write(rustsecp256k1_v0_8_1_sha256 *hash, const unsigned char *data, size_t len) {
+static void rustsecp256k1_v0_9_0_sha256_write(rustsecp256k1_v0_9_0_sha256 *hash, const unsigned char *data, size_t len) {
     size_t bufsize = hash->bytes & 0x3F;
     hash->bytes += len;
     VERIFY_CHECK(hash->bytes >= len);
@@ -133,87 +133,87 @@ static void rustsecp256k1_v0_8_1_sha256_write(rustsecp256k1_v0_8_1_sha256 *hash,
         memcpy(hash->buf + bufsize, data, chunk_len);
         data += chunk_len;
         len -= chunk_len;
-        rustsecp256k1_v0_8_1_sha256_transform(hash->s, hash->buf);
+        rustsecp256k1_v0_9_0_sha256_transform(hash->s, hash->buf);
         bufsize = 0;
     }
     if (len) {
         /* Fill the buffer with what remains. */
-        memcpy(((unsigned char*)hash->buf) + bufsize, data, len);
+        memcpy(hash->buf + bufsize, data, len);
     }
 }
 
-static void rustsecp256k1_v0_8_1_sha256_finalize(rustsecp256k1_v0_8_1_sha256 *hash, unsigned char *out32) {
+static void rustsecp256k1_v0_9_0_sha256_finalize(rustsecp256k1_v0_9_0_sha256 *hash, unsigned char *out32) {
     static const unsigned char pad[64] = {0x80};
     unsigned char sizedesc[8];
     int i;
     /* The maximum message size of SHA256 is 2^64-1 bits. */
     VERIFY_CHECK(hash->bytes < ((uint64_t)1 << 61));
-    rustsecp256k1_v0_8_1_write_be32(&sizedesc[0], hash->bytes >> 29);
-    rustsecp256k1_v0_8_1_write_be32(&sizedesc[4], hash->bytes << 3);
-    rustsecp256k1_v0_8_1_sha256_write(hash, pad, 1 + ((119 - (hash->bytes % 64)) % 64));
-    rustsecp256k1_v0_8_1_sha256_write(hash, sizedesc, 8);
+    rustsecp256k1_v0_9_0_write_be32(&sizedesc[0], hash->bytes >> 29);
+    rustsecp256k1_v0_9_0_write_be32(&sizedesc[4], hash->bytes << 3);
+    rustsecp256k1_v0_9_0_sha256_write(hash, pad, 1 + ((119 - (hash->bytes % 64)) % 64));
+    rustsecp256k1_v0_9_0_sha256_write(hash, sizedesc, 8);
     for (i = 0; i < 8; i++) {
-        rustsecp256k1_v0_8_1_write_be32(&out32[4*i], hash->s[i]);
+        rustsecp256k1_v0_9_0_write_be32(&out32[4*i], hash->s[i]);
         hash->s[i] = 0;
     }
 }
 
 /* Initializes a sha256 struct and writes the 64 byte string
  * SHA256(tag)||SHA256(tag) into it. */
-static void rustsecp256k1_v0_8_1_sha256_initialize_tagged(rustsecp256k1_v0_8_1_sha256 *hash, const unsigned char *tag, size_t taglen) {
+static void rustsecp256k1_v0_9_0_sha256_initialize_tagged(rustsecp256k1_v0_9_0_sha256 *hash, const unsigned char *tag, size_t taglen) {
     unsigned char buf[32];
-    rustsecp256k1_v0_8_1_sha256_initialize(hash);
-    rustsecp256k1_v0_8_1_sha256_write(hash, tag, taglen);
-    rustsecp256k1_v0_8_1_sha256_finalize(hash, buf);
+    rustsecp256k1_v0_9_0_sha256_initialize(hash);
+    rustsecp256k1_v0_9_0_sha256_write(hash, tag, taglen);
+    rustsecp256k1_v0_9_0_sha256_finalize(hash, buf);
 
-    rustsecp256k1_v0_8_1_sha256_initialize(hash);
-    rustsecp256k1_v0_8_1_sha256_write(hash, buf, 32);
-    rustsecp256k1_v0_8_1_sha256_write(hash, buf, 32);
+    rustsecp256k1_v0_9_0_sha256_initialize(hash);
+    rustsecp256k1_v0_9_0_sha256_write(hash, buf, 32);
+    rustsecp256k1_v0_9_0_sha256_write(hash, buf, 32);
 }
 
-static void rustsecp256k1_v0_8_1_hmac_sha256_initialize(rustsecp256k1_v0_8_1_hmac_sha256 *hash, const unsigned char *key, size_t keylen) {
+static void rustsecp256k1_v0_9_0_hmac_sha256_initialize(rustsecp256k1_v0_9_0_hmac_sha256 *hash, const unsigned char *key, size_t keylen) {
     size_t n;
     unsigned char rkey[64];
     if (keylen <= sizeof(rkey)) {
         memcpy(rkey, key, keylen);
         memset(rkey + keylen, 0, sizeof(rkey) - keylen);
     } else {
-        rustsecp256k1_v0_8_1_sha256 sha256;
-        rustsecp256k1_v0_8_1_sha256_initialize(&sha256);
-        rustsecp256k1_v0_8_1_sha256_write(&sha256, key, keylen);
-        rustsecp256k1_v0_8_1_sha256_finalize(&sha256, rkey);
+        rustsecp256k1_v0_9_0_sha256 sha256;
+        rustsecp256k1_v0_9_0_sha256_initialize(&sha256);
+        rustsecp256k1_v0_9_0_sha256_write(&sha256, key, keylen);
+        rustsecp256k1_v0_9_0_sha256_finalize(&sha256, rkey);
         memset(rkey + 32, 0, 32);
     }
 
-    rustsecp256k1_v0_8_1_sha256_initialize(&hash->outer);
+    rustsecp256k1_v0_9_0_sha256_initialize(&hash->outer);
     for (n = 0; n < sizeof(rkey); n++) {
         rkey[n] ^= 0x5c;
     }
-    rustsecp256k1_v0_8_1_sha256_write(&hash->outer, rkey, sizeof(rkey));
+    rustsecp256k1_v0_9_0_sha256_write(&hash->outer, rkey, sizeof(rkey));
 
-    rustsecp256k1_v0_8_1_sha256_initialize(&hash->inner);
+    rustsecp256k1_v0_9_0_sha256_initialize(&hash->inner);
     for (n = 0; n < sizeof(rkey); n++) {
         rkey[n] ^= 0x5c ^ 0x36;
     }
-    rustsecp256k1_v0_8_1_sha256_write(&hash->inner, rkey, sizeof(rkey));
+    rustsecp256k1_v0_9_0_sha256_write(&hash->inner, rkey, sizeof(rkey));
     memset(rkey, 0, sizeof(rkey));
 }
 
-static void rustsecp256k1_v0_8_1_hmac_sha256_write(rustsecp256k1_v0_8_1_hmac_sha256 *hash, const unsigned char *data, size_t size) {
-    rustsecp256k1_v0_8_1_sha256_write(&hash->inner, data, size);
+static void rustsecp256k1_v0_9_0_hmac_sha256_write(rustsecp256k1_v0_9_0_hmac_sha256 *hash, const unsigned char *data, size_t size) {
+    rustsecp256k1_v0_9_0_sha256_write(&hash->inner, data, size);
 }
 
-static void rustsecp256k1_v0_8_1_hmac_sha256_finalize(rustsecp256k1_v0_8_1_hmac_sha256 *hash, unsigned char *out32) {
+static void rustsecp256k1_v0_9_0_hmac_sha256_finalize(rustsecp256k1_v0_9_0_hmac_sha256 *hash, unsigned char *out32) {
     unsigned char temp[32];
-    rustsecp256k1_v0_8_1_sha256_finalize(&hash->inner, temp);
-    rustsecp256k1_v0_8_1_sha256_write(&hash->outer, temp, 32);
+    rustsecp256k1_v0_9_0_sha256_finalize(&hash->inner, temp);
+    rustsecp256k1_v0_9_0_sha256_write(&hash->outer, temp, 32);
     memset(temp, 0, 32);
-    rustsecp256k1_v0_8_1_sha256_finalize(&hash->outer, out32);
+    rustsecp256k1_v0_9_0_sha256_finalize(&hash->outer, out32);
 }
 
 
-static void rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_initialize(rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 *rng, const unsigned char *key, size_t keylen) {
-    rustsecp256k1_v0_8_1_hmac_sha256 hmac;
+static void rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_initialize(rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 *rng, const unsigned char *key, size_t keylen) {
+    rustsecp256k1_v0_9_0_hmac_sha256 hmac;
     static const unsigned char zero[1] = {0x00};
     static const unsigned char one[1] = {0x01};
 
@@ -221,47 +221,47 @@ static void rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_initialize(rustsecp256k1_v0
     memset(rng->k, 0x00, 32); /* RFC6979 3.2.c. */
 
     /* RFC6979 3.2.d. */
-    rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hmac, rng->k, 32);
-    rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, rng->v, 32);
-    rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, zero, 1);
-    rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, key, keylen);
-    rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hmac, rng->k);
-    rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hmac, rng->k, 32);
-    rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, rng->v, 32);
-    rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hmac, rng->v);
+    rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hmac, rng->k, 32);
+    rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, rng->v, 32);
+    rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, zero, 1);
+    rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, key, keylen);
+    rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hmac, rng->k);
+    rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hmac, rng->k, 32);
+    rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, rng->v, 32);
+    rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hmac, rng->v);
 
     /* RFC6979 3.2.f. */
-    rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hmac, rng->k, 32);
-    rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, rng->v, 32);
-    rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, one, 1);
-    rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, key, keylen);
-    rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hmac, rng->k);
-    rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hmac, rng->k, 32);
-    rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, rng->v, 32);
-    rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hmac, rng->v);
+    rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hmac, rng->k, 32);
+    rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, rng->v, 32);
+    rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, one, 1);
+    rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, key, keylen);
+    rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hmac, rng->k);
+    rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hmac, rng->k, 32);
+    rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, rng->v, 32);
+    rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hmac, rng->v);
     rng->retry = 0;
 }
 
-static void rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 *rng, unsigned char *out, size_t outlen) {
+static void rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_generate(rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 *rng, unsigned char *out, size_t outlen) {
     /* RFC6979 3.2.h. */
     static const unsigned char zero[1] = {0x00};
     if (rng->retry) {
-        rustsecp256k1_v0_8_1_hmac_sha256 hmac;
-        rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hmac, rng->k, 32);
-        rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, rng->v, 32);
-        rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, zero, 1);
-        rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hmac, rng->k);
-        rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hmac, rng->k, 32);
-        rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, rng->v, 32);
-        rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hmac, rng->v);
+        rustsecp256k1_v0_9_0_hmac_sha256 hmac;
+        rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hmac, rng->k, 32);
+        rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, rng->v, 32);
+        rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, zero, 1);
+        rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hmac, rng->k);
+        rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hmac, rng->k, 32);
+        rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, rng->v, 32);
+        rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hmac, rng->v);
     }
 
     while (outlen > 0) {
-        rustsecp256k1_v0_8_1_hmac_sha256 hmac;
+        rustsecp256k1_v0_9_0_hmac_sha256 hmac;
         int now = outlen;
-        rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hmac, rng->k, 32);
-        rustsecp256k1_v0_8_1_hmac_sha256_write(&hmac, rng->v, 32);
-        rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hmac, rng->v);
+        rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hmac, rng->k, 32);
+        rustsecp256k1_v0_9_0_hmac_sha256_write(&hmac, rng->v, 32);
+        rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hmac, rng->v);
         if (now > 32) {
             now = 32;
         }
@@ -273,7 +273,7 @@ static void rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(rustsecp256k1_v0_8
     rng->retry = 1;
 }
 
-static void rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_finalize(rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 *rng) {
+static void rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_finalize(rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 *rng) {
     memset(rng->k, 0, 32);
     memset(rng->v, 0, 32);
     rng->retry = 0;
diff --git a/secp256k1-sys/depend/secp256k1/src/int128.h b/secp256k1-sys/depend/secp256k1/src/int128.h
index eeaf7967e..50c388c78 100644
--- a/secp256k1-sys/depend/secp256k1/src/int128.h
+++ b/secp256k1-sys/depend/secp256k1/src/int128.h
@@ -13,72 +13,77 @@
 #  endif
 
 /* Construct an unsigned 128-bit value from a high and a low 64-bit value. */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_load(rustsecp256k1_v0_8_1_uint128 *r, uint64_t hi, uint64_t lo);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_load(rustsecp256k1_v0_9_0_uint128 *r, uint64_t hi, uint64_t lo);
 
 /* Multiply two unsigned 64-bit values a and b and write the result to r. */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_mul(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a, uint64_t b);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_mul(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a, uint64_t b);
 
 /* Multiply two unsigned 64-bit values a and b and add the result to r.
  * The final result is taken modulo 2^128.
  */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_accum_mul(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a, uint64_t b);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_accum_mul(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a, uint64_t b);
 
 /* Add an unsigned 64-bit value a to r.
  * The final result is taken modulo 2^128.
  */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_accum_u64(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_accum_u64(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a);
 
 /* Unsigned (logical) right shift.
  * Non-constant time in n.
  */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_rshift(rustsecp256k1_v0_8_1_uint128 *r, unsigned int n);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_rshift(rustsecp256k1_v0_9_0_uint128 *r, unsigned int n);
 
 /* Return the low 64-bits of a 128-bit value as an unsigned 64-bit value. */
-static SECP256K1_INLINE uint64_t rustsecp256k1_v0_8_1_u128_to_u64(const rustsecp256k1_v0_8_1_uint128 *a);
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_u128_to_u64(const rustsecp256k1_v0_9_0_uint128 *a);
 
 /* Return the high 64-bits of a 128-bit value as an unsigned 64-bit value. */
-static SECP256K1_INLINE uint64_t rustsecp256k1_v0_8_1_u128_hi_u64(const rustsecp256k1_v0_8_1_uint128 *a);
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_u128_hi_u64(const rustsecp256k1_v0_9_0_uint128 *a);
 
 /* Write an unsigned 64-bit value to r. */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_from_u64(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_from_u64(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a);
 
 /* Tests if r is strictly less than to 2^n.
  * n must be strictly less than 128.
  */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_u128_check_bits(const rustsecp256k1_v0_8_1_uint128 *r, unsigned int n);
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_u128_check_bits(const rustsecp256k1_v0_9_0_uint128 *r, unsigned int n);
 
 /* Construct an signed 128-bit value from a high and a low 64-bit value. */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_load(rustsecp256k1_v0_8_1_int128 *r, int64_t hi, uint64_t lo);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_load(rustsecp256k1_v0_9_0_int128 *r, int64_t hi, uint64_t lo);
 
 /* Multiply two signed 64-bit values a and b and write the result to r. */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_mul(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_mul(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b);
 
 /* Multiply two signed 64-bit values a and b and add the result to r.
  * Overflow or underflow from the addition is undefined behaviour.
  */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_accum_mul(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_accum_mul(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b);
 
 /* Compute a*d - b*c from signed 64-bit values and write the result to r. */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_det(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b, int64_t c, int64_t d);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_det(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b, int64_t c, int64_t d);
 
 /* Signed (arithmetic) right shift.
  * Non-constant time in b.
  */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_rshift(rustsecp256k1_v0_8_1_int128 *r, unsigned int b);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_rshift(rustsecp256k1_v0_9_0_int128 *r, unsigned int b);
 
-/* Return the low 64-bits of a 128-bit value interpreted as an signed 64-bit value. */
-static SECP256K1_INLINE int64_t rustsecp256k1_v0_8_1_i128_to_i64(const rustsecp256k1_v0_8_1_int128 *a);
+/* Return the input value modulo 2^64. */
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_i128_to_u64(const rustsecp256k1_v0_9_0_int128 *a);
+
+/* Return the value as a signed 64-bit value.
+ * Requires the input to be between INT64_MIN and INT64_MAX.
+ */
+static SECP256K1_INLINE int64_t rustsecp256k1_v0_9_0_i128_to_i64(const rustsecp256k1_v0_9_0_int128 *a);
 
 /* Write a signed 64-bit value to r. */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_from_i64(rustsecp256k1_v0_8_1_int128 *r, int64_t a);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_from_i64(rustsecp256k1_v0_9_0_int128 *r, int64_t a);
 
 /* Compare two 128-bit values for equality. */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_i128_eq_var(const rustsecp256k1_v0_8_1_int128 *a, const rustsecp256k1_v0_8_1_int128 *b);
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_i128_eq_var(const rustsecp256k1_v0_9_0_int128 *a, const rustsecp256k1_v0_9_0_int128 *b);
 
-/* Tests if r is equal to 2^n.
+/* Tests if r is equal to sign*2^n (sign must be 1 or -1).
  * n must be strictly less than 127.
  */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_i128_check_pow2(const rustsecp256k1_v0_8_1_int128 *r, unsigned int n);
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_i128_check_pow2(const rustsecp256k1_v0_9_0_int128 *r, unsigned int n, int sign);
 
 #endif
 
diff --git a/secp256k1-sys/depend/secp256k1/src/int128_native.h b/secp256k1-sys/depend/secp256k1/src/int128_native.h
index 0ceba8748..9127183a8 100644
--- a/secp256k1-sys/depend/secp256k1/src/int128_native.h
+++ b/secp256k1-sys/depend/secp256k1/src/int128_native.h
@@ -13,7 +13,7 @@ SECP256K1_GNUC_EXT typedef __int128 int128_t;
 /* No (U)INT128_C macros because compilers providing __int128 do not support 128-bit literals.  */
 #endif
 
-typedef uint128_t rustsecp256k1_v0_8_1_uint128;
-typedef int128_t rustsecp256k1_v0_8_1_int128;
+typedef uint128_t rustsecp256k1_v0_9_0_uint128;
+typedef int128_t rustsecp256k1_v0_9_0_int128;
 
 #endif
diff --git a/secp256k1-sys/depend/secp256k1/src/int128_native_impl.h b/secp256k1-sys/depend/secp256k1/src/int128_native_impl.h
index 96d35c181..51f33a544 100644
--- a/secp256k1-sys/depend/secp256k1/src/int128_native_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/int128_native_impl.h
@@ -2,86 +2,93 @@
 #define SECP256K1_INT128_NATIVE_IMPL_H
 
 #include "int128.h"
+#include "util.h"
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_load(rustsecp256k1_v0_8_1_uint128 *r, uint64_t hi, uint64_t lo) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_load(rustsecp256k1_v0_9_0_uint128 *r, uint64_t hi, uint64_t lo) {
     *r = (((uint128_t)hi) << 64) + lo;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_mul(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a, uint64_t b) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_mul(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a, uint64_t b) {
    *r = (uint128_t)a * b;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_accum_mul(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a, uint64_t b) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_accum_mul(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a, uint64_t b) {
    *r += (uint128_t)a * b;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_accum_u64(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_accum_u64(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a) {
    *r += a;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_rshift(rustsecp256k1_v0_8_1_uint128 *r, unsigned int n) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_rshift(rustsecp256k1_v0_9_0_uint128 *r, unsigned int n) {
    VERIFY_CHECK(n < 128);
    *r >>= n;
 }
 
-static SECP256K1_INLINE uint64_t rustsecp256k1_v0_8_1_u128_to_u64(const rustsecp256k1_v0_8_1_uint128 *a) {
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_u128_to_u64(const rustsecp256k1_v0_9_0_uint128 *a) {
    return (uint64_t)(*a);
 }
 
-static SECP256K1_INLINE uint64_t rustsecp256k1_v0_8_1_u128_hi_u64(const rustsecp256k1_v0_8_1_uint128 *a) {
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_u128_hi_u64(const rustsecp256k1_v0_9_0_uint128 *a) {
    return (uint64_t)(*a >> 64);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_from_u64(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_from_u64(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a) {
    *r = a;
 }
 
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_u128_check_bits(const rustsecp256k1_v0_8_1_uint128 *r, unsigned int n) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_u128_check_bits(const rustsecp256k1_v0_9_0_uint128 *r, unsigned int n) {
    VERIFY_CHECK(n < 128);
    return (*r >> n == 0);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_load(rustsecp256k1_v0_8_1_int128 *r, int64_t hi, uint64_t lo) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_load(rustsecp256k1_v0_9_0_int128 *r, int64_t hi, uint64_t lo) {
     *r = (((uint128_t)(uint64_t)hi) << 64) + lo;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_mul(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_mul(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b) {
    *r = (int128_t)a * b;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_accum_mul(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_accum_mul(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b) {
    int128_t ab = (int128_t)a * b;
    VERIFY_CHECK(0 <= ab ? *r <= INT128_MAX - ab : INT128_MIN - ab <= *r);
    *r += ab;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_det(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b, int64_t c, int64_t d) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_det(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b, int64_t c, int64_t d) {
    int128_t ad = (int128_t)a * d;
    int128_t bc = (int128_t)b * c;
    VERIFY_CHECK(0 <= bc ? INT128_MIN + bc <= ad : ad <= INT128_MAX + bc);
    *r = ad - bc;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_rshift(rustsecp256k1_v0_8_1_int128 *r, unsigned int n) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_rshift(rustsecp256k1_v0_9_0_int128 *r, unsigned int n) {
    VERIFY_CHECK(n < 128);
    *r >>= n;
 }
 
-static SECP256K1_INLINE int64_t rustsecp256k1_v0_8_1_i128_to_i64(const rustsecp256k1_v0_8_1_int128 *a) {
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_i128_to_u64(const rustsecp256k1_v0_9_0_int128 *a) {
+   return (uint64_t)*a;
+}
+
+static SECP256K1_INLINE int64_t rustsecp256k1_v0_9_0_i128_to_i64(const rustsecp256k1_v0_9_0_int128 *a) {
+   VERIFY_CHECK(INT64_MIN <= *a && *a <= INT64_MAX);
    return *a;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_from_i64(rustsecp256k1_v0_8_1_int128 *r, int64_t a) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_from_i64(rustsecp256k1_v0_9_0_int128 *r, int64_t a) {
    *r = a;
 }
 
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_i128_eq_var(const rustsecp256k1_v0_8_1_int128 *a, const rustsecp256k1_v0_8_1_int128 *b) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_i128_eq_var(const rustsecp256k1_v0_9_0_int128 *a, const rustsecp256k1_v0_9_0_int128 *b) {
    return *a == *b;
 }
 
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_i128_check_pow2(const rustsecp256k1_v0_8_1_int128 *r, unsigned int n) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_i128_check_pow2(const rustsecp256k1_v0_9_0_int128 *r, unsigned int n, int sign) {
    VERIFY_CHECK(n < 127);
-   return (*r == (int128_t)1 << n);
+   VERIFY_CHECK(sign == 1 || sign == -1);
+   return (*r == (int128_t)((uint128_t)sign << n));
 }
 
 #endif
diff --git a/secp256k1-sys/depend/secp256k1/src/int128_struct.h b/secp256k1-sys/depend/secp256k1/src/int128_struct.h
index 3a14c6630..50192b09f 100644
--- a/secp256k1-sys/depend/secp256k1/src/int128_struct.h
+++ b/secp256k1-sys/depend/secp256k1/src/int128_struct.h
@@ -7,8 +7,8 @@
 typedef struct {
   uint64_t lo;
   uint64_t hi;
-} rustsecp256k1_v0_8_1_uint128;
+} rustsecp256k1_v0_9_0_uint128;
 
-typedef rustsecp256k1_v0_8_1_uint128 rustsecp256k1_v0_8_1_int128;
+typedef rustsecp256k1_v0_9_0_uint128 rustsecp256k1_v0_9_0_int128;
 
 #endif
diff --git a/secp256k1-sys/depend/secp256k1/src/int128_struct_impl.h b/secp256k1-sys/depend/secp256k1/src/int128_struct_impl.h
index ceb84865f..644ccb6bf 100644
--- a/secp256k1-sys/depend/secp256k1/src/int128_struct_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/int128_struct_impl.h
@@ -2,6 +2,7 @@
 #define SECP256K1_INT128_STRUCT_IMPL_H
 
 #include "int128.h"
+#include "util.h"
 
 #if defined(_MSC_VER) && (defined(_M_X64) || defined(_M_ARM64)) /* MSVC */
 #    include <intrin.h>
@@ -12,23 +13,23 @@
 #        if defined(SECP256K1_MSVC_MULH_TEST_OVERRIDE)
 #            pragma message(__FILE__ ": SECP256K1_MSVC_MULH_TEST_OVERRIDE is defined, forcing use of __(u)mulh.")
 #        endif
-static SECP256K1_INLINE uint64_t rustsecp256k1_v0_8_1_umul128(uint64_t a, uint64_t b, uint64_t* hi) {
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_umul128(uint64_t a, uint64_t b, uint64_t* hi) {
     *hi = __umulh(a, b);
     return a * b;
 }
 
-static SECP256K1_INLINE int64_t rustsecp256k1_v0_8_1_mul128(int64_t a, int64_t b, int64_t* hi) {
+static SECP256K1_INLINE int64_t rustsecp256k1_v0_9_0_mul128(int64_t a, int64_t b, int64_t* hi) {
     *hi = __mulh(a, b);
     return (uint64_t)a * (uint64_t)b;
 }
 #    else
 /* On x84_64 MSVC, use native _(u)mul128 for 64x64->128 multiplications. */
-#        define rustsecp256k1_v0_8_1_umul128 _umul128
-#        define rustsecp256k1_v0_8_1_mul128 _mul128
+#        define rustsecp256k1_v0_9_0_umul128 _umul128
+#        define rustsecp256k1_v0_9_0_mul128 _mul128
 #    endif
 #else
 /* On other systems, emulate 64x64->128 multiplications using 32x32->64 multiplications. */
-static SECP256K1_INLINE uint64_t rustsecp256k1_v0_8_1_umul128(uint64_t a, uint64_t b, uint64_t* hi) {
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_umul128(uint64_t a, uint64_t b, uint64_t* hi) {
     uint64_t ll = (uint64_t)(uint32_t)a * (uint32_t)b;
     uint64_t lh = (uint32_t)a * (b >> 32);
     uint64_t hl = (a >> 32) * (uint32_t)b;
@@ -38,7 +39,7 @@ static SECP256K1_INLINE uint64_t rustsecp256k1_v0_8_1_umul128(uint64_t a, uint64
     return (mid34 << 32) + (uint32_t)ll;
 }
 
-static SECP256K1_INLINE int64_t rustsecp256k1_v0_8_1_mul128(int64_t a, int64_t b, int64_t* hi) {
+static SECP256K1_INLINE int64_t rustsecp256k1_v0_9_0_mul128(int64_t a, int64_t b, int64_t* hi) {
     uint64_t ll = (uint64_t)(uint32_t)a * (uint32_t)b;
     int64_t lh = (uint32_t)a * (b >> 32);
     int64_t hl = (a >> 32) * (uint32_t)b;
@@ -49,23 +50,23 @@ static SECP256K1_INLINE int64_t rustsecp256k1_v0_8_1_mul128(int64_t a, int64_t b
 }
 #endif
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_load(rustsecp256k1_v0_8_1_uint128 *r, uint64_t hi, uint64_t lo) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_load(rustsecp256k1_v0_9_0_uint128 *r, uint64_t hi, uint64_t lo) {
     r->hi = hi;
     r->lo = lo;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_mul(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a, uint64_t b) {
-   r->lo = rustsecp256k1_v0_8_1_umul128(a, b, &r->hi);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_mul(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a, uint64_t b) {
+   r->lo = rustsecp256k1_v0_9_0_umul128(a, b, &r->hi);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_accum_mul(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a, uint64_t b) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_accum_mul(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a, uint64_t b) {
    uint64_t lo, hi;
-   lo = rustsecp256k1_v0_8_1_umul128(a, b, &hi);
+   lo = rustsecp256k1_v0_9_0_umul128(a, b, &hi);
    r->lo += lo;
    r->hi += hi + (r->lo < lo);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_accum_u64(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_accum_u64(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a) {
    r->lo += a;
    r->hi += r->lo < a;
 }
@@ -73,50 +74,55 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_accum_u64(rustsecp256k1_v
 /* Unsigned (logical) right shift.
  * Non-constant time in n.
  */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_rshift(rustsecp256k1_v0_8_1_uint128 *r, unsigned int n) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_rshift(rustsecp256k1_v0_9_0_uint128 *r, unsigned int n) {
    VERIFY_CHECK(n < 128);
    if (n >= 64) {
      r->lo = r->hi >> (n-64);
      r->hi = 0;
    } else if (n > 0) {
+#if defined(_MSC_VER) && defined(_M_X64)
+     VERIFY_CHECK(n < 64);
+     r->lo = __shiftright128(r->lo, r->hi, n);
+#else
      r->lo = ((1U * r->hi) << (64-n)) | r->lo >> n;
+#endif
      r->hi >>= n;
    }
 }
 
-static SECP256K1_INLINE uint64_t rustsecp256k1_v0_8_1_u128_to_u64(const rustsecp256k1_v0_8_1_uint128 *a) {
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_u128_to_u64(const rustsecp256k1_v0_9_0_uint128 *a) {
    return a->lo;
 }
 
-static SECP256K1_INLINE uint64_t rustsecp256k1_v0_8_1_u128_hi_u64(const rustsecp256k1_v0_8_1_uint128 *a) {
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_u128_hi_u64(const rustsecp256k1_v0_9_0_uint128 *a) {
    return a->hi;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_u128_from_u64(rustsecp256k1_v0_8_1_uint128 *r, uint64_t a) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_u128_from_u64(rustsecp256k1_v0_9_0_uint128 *r, uint64_t a) {
    r->hi = 0;
    r->lo = a;
 }
 
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_u128_check_bits(const rustsecp256k1_v0_8_1_uint128 *r, unsigned int n) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_u128_check_bits(const rustsecp256k1_v0_9_0_uint128 *r, unsigned int n) {
    VERIFY_CHECK(n < 128);
    return n >= 64 ? r->hi >> (n - 64) == 0
                   : r->hi == 0 && r->lo >> n == 0;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_load(rustsecp256k1_v0_8_1_int128 *r, int64_t hi, uint64_t lo) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_load(rustsecp256k1_v0_9_0_int128 *r, int64_t hi, uint64_t lo) {
     r->hi = hi;
     r->lo = lo;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_mul(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_mul(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b) {
    int64_t hi;
-   r->lo = (uint64_t)rustsecp256k1_v0_8_1_mul128(a, b, &hi);
+   r->lo = (uint64_t)rustsecp256k1_v0_9_0_mul128(a, b, &hi);
    r->hi = (uint64_t)hi;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_accum_mul(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_accum_mul(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b) {
    int64_t hi;
-   uint64_t lo = (uint64_t)rustsecp256k1_v0_8_1_mul128(a, b, &hi);
+   uint64_t lo = (uint64_t)rustsecp256k1_v0_9_0_mul128(a, b, &hi);
    r->lo += lo;
    hi += r->lo < lo;
    /* Verify no overflow.
@@ -133,9 +139,9 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_accum_mul(rustsecp256k1_v
    r->hi += hi;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_dissip_mul(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_dissip_mul(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b) {
    int64_t hi;
-   uint64_t lo = (uint64_t)rustsecp256k1_v0_8_1_mul128(a, b, &hi);
+   uint64_t lo = (uint64_t)rustsecp256k1_v0_9_0_mul128(a, b, &hi);
    hi += r->lo < lo;
    /* Verify no overflow.
     * If r represents a positive value (the sign bit is not set) and the value we are subtracting is a negative value (the sign bit is set),
@@ -151,15 +157,15 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_dissip_mul(rustsecp256k1_
    r->lo -= lo;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_det(rustsecp256k1_v0_8_1_int128 *r, int64_t a, int64_t b, int64_t c, int64_t d) {
-   rustsecp256k1_v0_8_1_i128_mul(r, a, d);
-   rustsecp256k1_v0_8_1_i128_dissip_mul(r, b, c);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_det(rustsecp256k1_v0_9_0_int128 *r, int64_t a, int64_t b, int64_t c, int64_t d) {
+   rustsecp256k1_v0_9_0_i128_mul(r, a, d);
+   rustsecp256k1_v0_9_0_i128_dissip_mul(r, b, c);
 }
 
 /* Signed (arithmetic) right shift.
  * Non-constant time in n.
  */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_rshift(rustsecp256k1_v0_8_1_int128 *r, unsigned int n) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_rshift(rustsecp256k1_v0_9_0_int128 *r, unsigned int n) {
    VERIFY_CHECK(n < 128);
    if (n >= 64) {
      r->lo = (uint64_t)((int64_t)(r->hi) >> (n-64));
@@ -170,23 +176,30 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_rshift(rustsecp256k1_v0_8
    }
 }
 
-static SECP256K1_INLINE int64_t rustsecp256k1_v0_8_1_i128_to_i64(const rustsecp256k1_v0_8_1_int128 *a) {
-   return (int64_t)a->lo;
+static SECP256K1_INLINE uint64_t rustsecp256k1_v0_9_0_i128_to_u64(const rustsecp256k1_v0_9_0_int128 *a) {
+   return a->lo;
+}
+
+static SECP256K1_INLINE int64_t rustsecp256k1_v0_9_0_i128_to_i64(const rustsecp256k1_v0_9_0_int128 *a) {
+   /* Verify that a represents a 64 bit signed value by checking that the high bits are a sign extension of the low bits. */
+   VERIFY_CHECK(a->hi == -(a->lo >> 63));
+   return (int64_t)rustsecp256k1_v0_9_0_i128_to_u64(a);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_i128_from_i64(rustsecp256k1_v0_8_1_int128 *r, int64_t a) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_i128_from_i64(rustsecp256k1_v0_9_0_int128 *r, int64_t a) {
    r->hi = (uint64_t)(a >> 63);
    r->lo = (uint64_t)a;
 }
 
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_i128_eq_var(const rustsecp256k1_v0_8_1_int128 *a, const rustsecp256k1_v0_8_1_int128 *b) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_i128_eq_var(const rustsecp256k1_v0_9_0_int128 *a, const rustsecp256k1_v0_9_0_int128 *b) {
    return a->hi == b->hi && a->lo == b->lo;
 }
 
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_i128_check_pow2(const rustsecp256k1_v0_8_1_int128 *r, unsigned int n) {
-   VERIFY_CHECK(n < 127);
-   return n >= 64 ? r->hi == (uint64_t)1 << (n - 64) && r->lo == 0
-                  : r->hi == 0 && r->lo == (uint64_t)1 << n;
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_i128_check_pow2(const rustsecp256k1_v0_9_0_int128 *r, unsigned int n, int sign) {
+    VERIFY_CHECK(n < 127);
+    VERIFY_CHECK(sign == 1 || sign == -1);
+    return n >= 64 ? r->hi == (uint64_t)sign << (n - 64) && r->lo == 0
+                   : r->hi == (uint64_t)(sign >> 1) && r->lo == (uint64_t)sign << n;
 }
 
 #endif
diff --git a/secp256k1-sys/depend/secp256k1/src/modinv32.h b/secp256k1-sys/depend/secp256k1/src/modinv32.h
index 19c22a8ae..92d07dab2 100644
--- a/secp256k1-sys/depend/secp256k1/src/modinv32.h
+++ b/secp256k1-sys/depend/secp256k1/src/modinv32.h
@@ -7,10 +7,6 @@
 #ifndef SECP256K1_MODINV32_H
 #define SECP256K1_MODINV32_H
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
-
 #include "util.h"
 
 /* A signed 30-bit limb representation of integers.
@@ -18,15 +14,15 @@
  * Its value is sum(v[i] * 2^(30*i), i=0..8). */
 typedef struct {
     int32_t v[9];
-} rustsecp256k1_v0_8_1_modinv32_signed30;
+} rustsecp256k1_v0_9_0_modinv32_signed30;
 
 typedef struct {
     /* The modulus in signed30 notation, must be odd and in [3, 2^256]. */
-    rustsecp256k1_v0_8_1_modinv32_signed30 modulus;
+    rustsecp256k1_v0_9_0_modinv32_signed30 modulus;
 
     /* modulus^{-1} mod 2^30 */
     uint32_t modulus_inv30;
-} rustsecp256k1_v0_8_1_modinv32_modinfo;
+} rustsecp256k1_v0_9_0_modinv32_modinfo;
 
 /* Replace x with its modular inverse mod modinfo->modulus. x must be in range [0, modulus).
  * If x is zero, the result will be zero as well. If not, the inverse must exist (i.e., the gcd of
@@ -34,9 +30,14 @@ typedef struct {
  *
  * On output, all of x's limbs will be in [0, 2^30).
  */
-static void rustsecp256k1_v0_8_1_modinv32_var(rustsecp256k1_v0_8_1_modinv32_signed30 *x, const rustsecp256k1_v0_8_1_modinv32_modinfo *modinfo);
+static void rustsecp256k1_v0_9_0_modinv32_var(rustsecp256k1_v0_9_0_modinv32_signed30 *x, const rustsecp256k1_v0_9_0_modinv32_modinfo *modinfo);
+
+/* Same as rustsecp256k1_v0_9_0_modinv32_var, but constant time in x (not in the modulus). */
+static void rustsecp256k1_v0_9_0_modinv32(rustsecp256k1_v0_9_0_modinv32_signed30 *x, const rustsecp256k1_v0_9_0_modinv32_modinfo *modinfo);
 
-/* Same as rustsecp256k1_v0_8_1_modinv32_var, but constant time in x (not in the modulus). */
-static void rustsecp256k1_v0_8_1_modinv32(rustsecp256k1_v0_8_1_modinv32_signed30 *x, const rustsecp256k1_v0_8_1_modinv32_modinfo *modinfo);
+/* Compute the Jacobi symbol for (x | modinfo->modulus). x must be coprime with modulus (and thus
+ * cannot be 0, as modulus >= 3). All limbs of x must be non-negative. Returns 0 if the result
+ * cannot be computed. */
+static int rustsecp256k1_v0_9_0_jacobi32_maybe_var(const rustsecp256k1_v0_9_0_modinv32_signed30 *x, const rustsecp256k1_v0_9_0_modinv32_modinfo *modinfo);
 
 #endif /* SECP256K1_MODINV32_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/modinv32_impl.h b/secp256k1-sys/depend/secp256k1/src/modinv32_impl.h
index 170730d60..4ce2da54e 100644
--- a/secp256k1-sys/depend/secp256k1/src/modinv32_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modinv32_impl.h
@@ -21,10 +21,10 @@
  */
 
 #ifdef VERIFY
-static const rustsecp256k1_v0_8_1_modinv32_signed30 SECP256K1_SIGNED30_ONE = {{1}};
+static const rustsecp256k1_v0_9_0_modinv32_signed30 SECP256K1_SIGNED30_ONE = {{1}};
 
 /* Compute a*factor and put it in r. All but the top limb in r will be in range [0,2^30). */
-static void rustsecp256k1_v0_8_1_modinv32_mul_30(rustsecp256k1_v0_8_1_modinv32_signed30 *r, const rustsecp256k1_v0_8_1_modinv32_signed30 *a, int alen, int32_t factor) {
+static void rustsecp256k1_v0_9_0_modinv32_mul_30(rustsecp256k1_v0_9_0_modinv32_signed30 *r, const rustsecp256k1_v0_9_0_modinv32_signed30 *a, int alen, int32_t factor) {
     const int32_t M30 = (int32_t)(UINT32_MAX >> 2);
     int64_t c = 0;
     int i;
@@ -38,11 +38,11 @@ static void rustsecp256k1_v0_8_1_modinv32_mul_30(rustsecp256k1_v0_8_1_modinv32_s
 }
 
 /* Return -1 for a<b*factor, 0 for a==b*factor, 1 for a>b*factor. A consists of alen limbs; b has 9. */
-static int rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(const rustsecp256k1_v0_8_1_modinv32_signed30 *a, int alen, const rustsecp256k1_v0_8_1_modinv32_signed30 *b, int32_t factor) {
+static int rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(const rustsecp256k1_v0_9_0_modinv32_signed30 *a, int alen, const rustsecp256k1_v0_9_0_modinv32_signed30 *b, int32_t factor) {
     int i;
-    rustsecp256k1_v0_8_1_modinv32_signed30 am, bm;
-    rustsecp256k1_v0_8_1_modinv32_mul_30(&am, a, alen, 1); /* Normalize all but the top limb of a. */
-    rustsecp256k1_v0_8_1_modinv32_mul_30(&bm, b, 9, factor);
+    rustsecp256k1_v0_9_0_modinv32_signed30 am, bm;
+    rustsecp256k1_v0_9_0_modinv32_mul_30(&am, a, alen, 1); /* Normalize all but the top limb of a. */
+    rustsecp256k1_v0_9_0_modinv32_mul_30(&bm, b, 9, factor);
     for (i = 0; i < 8; ++i) {
         /* Verify that all but the top limb of a and b are normalized. */
         VERIFY_CHECK(am.v[i] >> 30 == 0);
@@ -60,11 +60,11 @@ static int rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(const rustsecp256k1_v0_8_1_m
  * to it to bring it to range [0,modulus). If sign < 0, the input will also be negated in the
  * process. The input must have limbs in range (-2^30,2^30). The output will have limbs in range
  * [0,2^30). */
-static void rustsecp256k1_v0_8_1_modinv32_normalize_30(rustsecp256k1_v0_8_1_modinv32_signed30 *r, int32_t sign, const rustsecp256k1_v0_8_1_modinv32_modinfo *modinfo) {
+static void rustsecp256k1_v0_9_0_modinv32_normalize_30(rustsecp256k1_v0_9_0_modinv32_signed30 *r, int32_t sign, const rustsecp256k1_v0_9_0_modinv32_modinfo *modinfo) {
     const int32_t M30 = (int32_t)(UINT32_MAX >> 2);
     int32_t r0 = r->v[0], r1 = r->v[1], r2 = r->v[2], r3 = r->v[3], r4 = r->v[4],
             r5 = r->v[5], r6 = r->v[6], r7 = r->v[7], r8 = r->v[8];
-    int32_t cond_add, cond_negate;
+    volatile int32_t cond_add, cond_negate;
 
 #ifdef VERIFY
     /* Verify that all limbs are in range (-2^30,2^30). */
@@ -73,8 +73,8 @@ static void rustsecp256k1_v0_8_1_modinv32_normalize_30(rustsecp256k1_v0_8_1_modi
         VERIFY_CHECK(r->v[i] >= -M30);
         VERIFY_CHECK(r->v[i] <= M30);
     }
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(r, 9, &modinfo->modulus, -2) > 0); /* r > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(r, 9, &modinfo->modulus, 1) < 0); /* r < modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(r, 9, &modinfo->modulus, -2) > 0); /* r > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(r, 9, &modinfo->modulus, 1) < 0); /* r < modulus */
 #endif
 
     /* In a first step, add the modulus if the input is negative, and then negate if requested.
@@ -154,8 +154,8 @@ static void rustsecp256k1_v0_8_1_modinv32_normalize_30(rustsecp256k1_v0_8_1_modi
     VERIFY_CHECK(r6 >> 30 == 0);
     VERIFY_CHECK(r7 >> 30 == 0);
     VERIFY_CHECK(r8 >> 30 == 0);
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(r, 9, &modinfo->modulus, 0) >= 0); /* r >= 0 */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(r, 9, &modinfo->modulus, 1) < 0); /* r < modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(r, 9, &modinfo->modulus, 0) >= 0); /* r >= 0 */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(r, 9, &modinfo->modulus, 1) < 0); /* r < modulus */
 #endif
 }
 
@@ -166,7 +166,7 @@ static void rustsecp256k1_v0_8_1_modinv32_normalize_30(rustsecp256k1_v0_8_1_modi
  */
 typedef struct {
     int32_t u, v, q, r;
-} rustsecp256k1_v0_8_1_modinv32_trans2x2;
+} rustsecp256k1_v0_9_0_modinv32_trans2x2;
 
 /* Compute the transition matrix and zeta for 30 divsteps.
  *
@@ -178,7 +178,7 @@ typedef struct {
  *
  * Implements the divsteps_n_matrix function from the explanation.
  */
-static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30(int32_t zeta, uint32_t f0, uint32_t g0, rustsecp256k1_v0_8_1_modinv32_trans2x2 *t) {
+static int32_t rustsecp256k1_v0_9_0_modinv32_divsteps_30(int32_t zeta, uint32_t f0, uint32_t g0, rustsecp256k1_v0_9_0_modinv32_trans2x2 *t) {
     /* u,v,q,r are the elements of the transformation matrix being built up,
      * starting with the identity matrix. Semantically they are signed integers
      * in range [-2^30,2^30], but here represented as unsigned mod 2^32. This
@@ -186,7 +186,8 @@ static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30(int32_t zeta, uint32_t
      * being inside [-2^31,2^31) means that casting to signed works correctly.
      */
     uint32_t u = 1, v = 0, q = 0, r = 1;
-    uint32_t c1, c2, f = f0, g = g0, x, y, z;
+    volatile uint32_t c1, c2;
+    uint32_t mask1, mask2, f = f0, g = g0, x, y, z;
     int i;
 
     for (i = 0; i < 30; ++i) {
@@ -195,23 +196,25 @@ static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30(int32_t zeta, uint32_t
         VERIFY_CHECK((q * f0 + r * g0) == g << i);
         /* Compute conditional masks for (zeta < 0) and for (g & 1). */
         c1 = zeta >> 31;
-        c2 = -(g & 1);
+        mask1 = c1;
+        c2 = g & 1;
+        mask2 = -c2;
         /* Compute x,y,z, conditionally negated versions of f,u,v. */
-        x = (f ^ c1) - c1;
-        y = (u ^ c1) - c1;
-        z = (v ^ c1) - c1;
+        x = (f ^ mask1) - mask1;
+        y = (u ^ mask1) - mask1;
+        z = (v ^ mask1) - mask1;
         /* Conditionally add x,y,z to g,q,r. */
-        g += x & c2;
-        q += y & c2;
-        r += z & c2;
-        /* In what follows, c1 is a condition mask for (zeta < 0) and (g & 1). */
-        c1 &= c2;
+        g += x & mask2;
+        q += y & mask2;
+        r += z & mask2;
+        /* In what follows, mask1 is a condition mask for (zeta < 0) and (g & 1). */
+        mask1 &= mask2;
         /* Conditionally change zeta into -zeta-2 or zeta-1. */
-        zeta = (zeta ^ c1) - 1;
+        zeta = (zeta ^ mask1) - 1;
         /* Conditionally add g,q,r to f,u,v. */
-        f += g & c1;
-        u += q & c1;
-        v += r & c1;
+        f += g & mask1;
+        u += q & mask1;
+        v += r & mask1;
         /* Shifts */
         g >>= 1;
         u <<= 1;
@@ -232,6 +235,21 @@ static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30(int32_t zeta, uint32_t
     return zeta;
 }
 
+/* rustsecp256k1_v0_9_0_modinv32_inv256[i] = -(2*i+1)^-1 (mod 256) */
+static const uint8_t rustsecp256k1_v0_9_0_modinv32_inv256[128] = {
+    0xFF, 0x55, 0x33, 0x49, 0xC7, 0x5D, 0x3B, 0x11, 0x0F, 0xE5, 0xC3, 0x59,
+    0xD7, 0xED, 0xCB, 0x21, 0x1F, 0x75, 0x53, 0x69, 0xE7, 0x7D, 0x5B, 0x31,
+    0x2F, 0x05, 0xE3, 0x79, 0xF7, 0x0D, 0xEB, 0x41, 0x3F, 0x95, 0x73, 0x89,
+    0x07, 0x9D, 0x7B, 0x51, 0x4F, 0x25, 0x03, 0x99, 0x17, 0x2D, 0x0B, 0x61,
+    0x5F, 0xB5, 0x93, 0xA9, 0x27, 0xBD, 0x9B, 0x71, 0x6F, 0x45, 0x23, 0xB9,
+    0x37, 0x4D, 0x2B, 0x81, 0x7F, 0xD5, 0xB3, 0xC9, 0x47, 0xDD, 0xBB, 0x91,
+    0x8F, 0x65, 0x43, 0xD9, 0x57, 0x6D, 0x4B, 0xA1, 0x9F, 0xF5, 0xD3, 0xE9,
+    0x67, 0xFD, 0xDB, 0xB1, 0xAF, 0x85, 0x63, 0xF9, 0x77, 0x8D, 0x6B, 0xC1,
+    0xBF, 0x15, 0xF3, 0x09, 0x87, 0x1D, 0xFB, 0xD1, 0xCF, 0xA5, 0x83, 0x19,
+    0x97, 0xAD, 0x8B, 0xE1, 0xDF, 0x35, 0x13, 0x29, 0xA7, 0x3D, 0x1B, 0xF1,
+    0xEF, 0xC5, 0xA3, 0x39, 0xB7, 0xCD, 0xAB, 0x01
+};
+
 /* Compute the transition matrix and eta for 30 divsteps (variable time).
  *
  * Input:  eta: initial eta
@@ -242,23 +260,8 @@ static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30(int32_t zeta, uint32_t
  *
  * Implements the divsteps_n_matrix_var function from the explanation.
  */
-static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30_var(int32_t eta, uint32_t f0, uint32_t g0, rustsecp256k1_v0_8_1_modinv32_trans2x2 *t) {
-    /* inv256[i] = -(2*i+1)^-1 (mod 256) */
-    static const uint8_t inv256[128] = {
-        0xFF, 0x55, 0x33, 0x49, 0xC7, 0x5D, 0x3B, 0x11, 0x0F, 0xE5, 0xC3, 0x59,
-        0xD7, 0xED, 0xCB, 0x21, 0x1F, 0x75, 0x53, 0x69, 0xE7, 0x7D, 0x5B, 0x31,
-        0x2F, 0x05, 0xE3, 0x79, 0xF7, 0x0D, 0xEB, 0x41, 0x3F, 0x95, 0x73, 0x89,
-        0x07, 0x9D, 0x7B, 0x51, 0x4F, 0x25, 0x03, 0x99, 0x17, 0x2D, 0x0B, 0x61,
-        0x5F, 0xB5, 0x93, 0xA9, 0x27, 0xBD, 0x9B, 0x71, 0x6F, 0x45, 0x23, 0xB9,
-        0x37, 0x4D, 0x2B, 0x81, 0x7F, 0xD5, 0xB3, 0xC9, 0x47, 0xDD, 0xBB, 0x91,
-        0x8F, 0x65, 0x43, 0xD9, 0x57, 0x6D, 0x4B, 0xA1, 0x9F, 0xF5, 0xD3, 0xE9,
-        0x67, 0xFD, 0xDB, 0xB1, 0xAF, 0x85, 0x63, 0xF9, 0x77, 0x8D, 0x6B, 0xC1,
-        0xBF, 0x15, 0xF3, 0x09, 0x87, 0x1D, 0xFB, 0xD1, 0xCF, 0xA5, 0x83, 0x19,
-        0x97, 0xAD, 0x8B, 0xE1, 0xDF, 0x35, 0x13, 0x29, 0xA7, 0x3D, 0x1B, 0xF1,
-        0xEF, 0xC5, 0xA3, 0x39, 0xB7, 0xCD, 0xAB, 0x01
-    };
-
-    /* Transformation matrix; see comments in rustsecp256k1_v0_8_1_modinv32_divsteps_30. */
+static int32_t rustsecp256k1_v0_9_0_modinv32_divsteps_30_var(int32_t eta, uint32_t f0, uint32_t g0, rustsecp256k1_v0_9_0_modinv32_trans2x2 *t) {
+    /* Transformation matrix; see comments in rustsecp256k1_v0_9_0_modinv32_divsteps_30. */
     uint32_t u = 1, v = 0, q = 0, r = 1;
     uint32_t f = f0, g = g0, m;
     uint16_t w;
@@ -266,7 +269,7 @@ static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30_var(int32_t eta, uint32
 
     for (;;) {
         /* Use a sentinel bit to count zeros only up to i. */
-        zeros = rustsecp256k1_v0_8_1_ctz32_var(g | (UINT32_MAX << i));
+        zeros = rustsecp256k1_v0_9_0_ctz32_var(g | (UINT32_MAX << i));
         /* Perform zeros divsteps at once; they all just divide g by two. */
         g >>= zeros;
         u <<= zeros;
@@ -297,7 +300,7 @@ static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30_var(int32_t eta, uint32
         VERIFY_CHECK(limit > 0 && limit <= 30);
         m = (UINT32_MAX >> (32 - limit)) & 255U;
         /* Find what multiple of f must be added to g to cancel its bottom min(limit, 8) bits. */
-        w = (g * inv256[(f >> 1) & 127]) & m;
+        w = (g * rustsecp256k1_v0_9_0_modinv32_inv256[(f >> 1) & 127]) & m;
         /* Do so. */
         g += f * w;
         q += u * w;
@@ -317,6 +320,86 @@ static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30_var(int32_t eta, uint32
     return eta;
 }
 
+/* Compute the transition matrix and eta for 30 posdivsteps (variable time, eta=-delta), and keeps track
+ * of the Jacobi symbol along the way. f0 and g0 must be f and g mod 2^32 rather than 2^30, because
+ * Jacobi tracking requires knowing (f mod 8) rather than just (f mod 2).
+ *
+ * Input:        eta: initial eta
+ *               f0:  bottom limb of initial f
+ *               g0:  bottom limb of initial g
+ * Output:       t: transition matrix
+ * Input/Output: (*jacp & 1) is bitflipped if and only if the Jacobi symbol of (f | g) changes sign
+ *               by applying the returned transformation matrix to it. The other bits of *jacp may
+ *               change, but are meaningless.
+ * Return: final eta
+ */
+static int32_t rustsecp256k1_v0_9_0_modinv32_posdivsteps_30_var(int32_t eta, uint32_t f0, uint32_t g0, rustsecp256k1_v0_9_0_modinv32_trans2x2 *t, int *jacp) {
+    /* Transformation matrix. */
+    uint32_t u = 1, v = 0, q = 0, r = 1;
+    uint32_t f = f0, g = g0, m;
+    uint16_t w;
+    int i = 30, limit, zeros;
+    int jac = *jacp;
+
+    for (;;) {
+        /* Use a sentinel bit to count zeros only up to i. */
+        zeros = rustsecp256k1_v0_9_0_ctz32_var(g | (UINT32_MAX << i));
+        /* Perform zeros divsteps at once; they all just divide g by two. */
+        g >>= zeros;
+        u <<= zeros;
+        v <<= zeros;
+        eta -= zeros;
+        i -= zeros;
+        /* Update the bottom bit of jac: when dividing g by an odd power of 2,
+         * if (f mod 8) is 3 or 5, the Jacobi symbol changes sign. */
+        jac ^= (zeros & ((f >> 1) ^ (f >> 2)));
+        /* We're done once we've done 30 posdivsteps. */
+        if (i == 0) break;
+        VERIFY_CHECK((f & 1) == 1);
+        VERIFY_CHECK((g & 1) == 1);
+        VERIFY_CHECK((u * f0 + v * g0) == f << (30 - i));
+        VERIFY_CHECK((q * f0 + r * g0) == g << (30 - i));
+        /* If eta is negative, negate it and replace f,g with g,f. */
+        if (eta < 0) {
+            uint32_t tmp;
+            eta = -eta;
+            /* Update bottom bit of jac: when swapping f and g, the Jacobi symbol changes sign
+             * if both f and g are 3 mod 4. */
+            jac ^= ((f & g) >> 1);
+            tmp = f; f = g; g = tmp;
+            tmp = u; u = q; q = tmp;
+            tmp = v; v = r; r = tmp;
+        }
+        /* eta is now >= 0. In what follows we're going to cancel out the bottom bits of g. No more
+         * than i can be cancelled out (as we'd be done before that point), and no more than eta+1
+         * can be done as its sign will flip once that happens. */
+        limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
+        /* m is a mask for the bottom min(limit, 8) bits (our table only supports 8 bits). */
+        VERIFY_CHECK(limit > 0 && limit <= 30);
+        m = (UINT32_MAX >> (32 - limit)) & 255U;
+        /* Find what multiple of f must be added to g to cancel its bottom min(limit, 8) bits. */
+        w = (g * rustsecp256k1_v0_9_0_modinv32_inv256[(f >> 1) & 127]) & m;
+        /* Do so. */
+        g += f * w;
+        q += u * w;
+        r += v * w;
+        VERIFY_CHECK((g & m) == 0);
+    }
+    /* Return data in t and return value. */
+    t->u = (int32_t)u;
+    t->v = (int32_t)v;
+    t->q = (int32_t)q;
+    t->r = (int32_t)r;
+    /* The determinant of t must be a power of two. This guarantees that multiplication with t
+     * does not change the gcd of f and g, apart from adding a power-of-2 factor to it (which
+     * will be divided out again). As each divstep's individual matrix has determinant 2 or -2,
+     * the aggregate of 30 of them will have determinant 2^30 or -2^30. */
+    VERIFY_CHECK((int64_t)t->u * t->r - (int64_t)t->v * t->q == ((int64_t)1) << 30 ||
+                 (int64_t)t->u * t->r - (int64_t)t->v * t->q == -(((int64_t)1) << 30));
+    *jacp = jac;
+    return eta;
+}
+
 /* Compute (t/2^30) * [d, e] mod modulus, where t is a transition matrix for 30 divsteps.
  *
  * On input and output, d and e are in range (-2*modulus,modulus). All output limbs will be in range
@@ -324,21 +407,19 @@ static int32_t rustsecp256k1_v0_8_1_modinv32_divsteps_30_var(int32_t eta, uint32
  *
  * This implements the update_de function from the explanation.
  */
-static void rustsecp256k1_v0_8_1_modinv32_update_de_30(rustsecp256k1_v0_8_1_modinv32_signed30 *d, rustsecp256k1_v0_8_1_modinv32_signed30 *e, const rustsecp256k1_v0_8_1_modinv32_trans2x2 *t, const rustsecp256k1_v0_8_1_modinv32_modinfo* modinfo) {
+static void rustsecp256k1_v0_9_0_modinv32_update_de_30(rustsecp256k1_v0_9_0_modinv32_signed30 *d, rustsecp256k1_v0_9_0_modinv32_signed30 *e, const rustsecp256k1_v0_9_0_modinv32_trans2x2 *t, const rustsecp256k1_v0_9_0_modinv32_modinfo* modinfo) {
     const int32_t M30 = (int32_t)(UINT32_MAX >> 2);
     const int32_t u = t->u, v = t->v, q = t->q, r = t->r;
     int32_t di, ei, md, me, sd, se;
     int64_t cd, ce;
     int i;
 #ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(d, 9, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(d, 9, &modinfo->modulus, 1) < 0);  /* d <    modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(e, 9, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(e, 9, &modinfo->modulus, 1) < 0);  /* e <    modulus */
-    VERIFY_CHECK((labs(u) + labs(v)) >= 0); /* |u|+|v| doesn't overflow */
-    VERIFY_CHECK((labs(q) + labs(r)) >= 0); /* |q|+|r| doesn't overflow */
-    VERIFY_CHECK((labs(u) + labs(v)) <= M30 + 1); /* |u|+|v| <= 2^30 */
-    VERIFY_CHECK((labs(q) + labs(r)) <= M30 + 1); /* |q|+|r| <= 2^30 */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(d, 9, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(d, 9, &modinfo->modulus, 1) < 0);  /* d <    modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(e, 9, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(e, 9, &modinfo->modulus, 1) < 0);  /* e <    modulus */
+    VERIFY_CHECK(labs(u) <= (M30 + 1 - labs(v))); /* |u|+|v| <= 2^30 */
+    VERIFY_CHECK(labs(q) <= (M30 + 1 - labs(r))); /* |q|+|r| <= 2^30 */
 #endif
     /* [md,me] start as zero; plus [u,q] if d is negative; plus [v,r] if e is negative. */
     sd = d->v[8] >> 31;
@@ -375,10 +456,10 @@ static void rustsecp256k1_v0_8_1_modinv32_update_de_30(rustsecp256k1_v0_8_1_modi
     d->v[8] = (int32_t)cd;
     e->v[8] = (int32_t)ce;
 #ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(d, 9, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(d, 9, &modinfo->modulus, 1) < 0);  /* d <    modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(e, 9, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(e, 9, &modinfo->modulus, 1) < 0);  /* e <    modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(d, 9, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(d, 9, &modinfo->modulus, 1) < 0);  /* d <    modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(e, 9, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(e, 9, &modinfo->modulus, 1) < 0);  /* e <    modulus */
 #endif
 }
 
@@ -386,7 +467,7 @@ static void rustsecp256k1_v0_8_1_modinv32_update_de_30(rustsecp256k1_v0_8_1_modi
  *
  * This implements the update_fg function from the explanation.
  */
-static void rustsecp256k1_v0_8_1_modinv32_update_fg_30(rustsecp256k1_v0_8_1_modinv32_signed30 *f, rustsecp256k1_v0_8_1_modinv32_signed30 *g, const rustsecp256k1_v0_8_1_modinv32_trans2x2 *t) {
+static void rustsecp256k1_v0_9_0_modinv32_update_fg_30(rustsecp256k1_v0_9_0_modinv32_signed30 *f, rustsecp256k1_v0_9_0_modinv32_signed30 *g, const rustsecp256k1_v0_9_0_modinv32_trans2x2 *t) {
     const int32_t M30 = (int32_t)(UINT32_MAX >> 2);
     const int32_t u = t->u, v = t->v, q = t->q, r = t->r;
     int32_t fi, gi;
@@ -421,7 +502,7 @@ static void rustsecp256k1_v0_8_1_modinv32_update_fg_30(rustsecp256k1_v0_8_1_modi
  *
  * This implements the update_fg function from the explanation in modinv64_impl.h.
  */
-static void rustsecp256k1_v0_8_1_modinv32_update_fg_30_var(int len, rustsecp256k1_v0_8_1_modinv32_signed30 *f, rustsecp256k1_v0_8_1_modinv32_signed30 *g, const rustsecp256k1_v0_8_1_modinv32_trans2x2 *t) {
+static void rustsecp256k1_v0_9_0_modinv32_update_fg_30_var(int len, rustsecp256k1_v0_9_0_modinv32_signed30 *f, rustsecp256k1_v0_9_0_modinv32_signed30 *g, const rustsecp256k1_v0_9_0_modinv32_trans2x2 *t) {
     const int32_t M30 = (int32_t)(UINT32_MAX >> 2);
     const int32_t u = t->u, v = t->v, q = t->q, r = t->r;
     int32_t fi, gi;
@@ -452,35 +533,35 @@ static void rustsecp256k1_v0_8_1_modinv32_update_fg_30_var(int len, rustsecp256k
 }
 
 /* Compute the inverse of x modulo modinfo->modulus, and replace x with it (constant time in x). */
-static void rustsecp256k1_v0_8_1_modinv32(rustsecp256k1_v0_8_1_modinv32_signed30 *x, const rustsecp256k1_v0_8_1_modinv32_modinfo *modinfo) {
+static void rustsecp256k1_v0_9_0_modinv32(rustsecp256k1_v0_9_0_modinv32_signed30 *x, const rustsecp256k1_v0_9_0_modinv32_modinfo *modinfo) {
     /* Start with d=0, e=1, f=modulus, g=x, zeta=-1. */
-    rustsecp256k1_v0_8_1_modinv32_signed30 d = {{0}};
-    rustsecp256k1_v0_8_1_modinv32_signed30 e = {{1}};
-    rustsecp256k1_v0_8_1_modinv32_signed30 f = modinfo->modulus;
-    rustsecp256k1_v0_8_1_modinv32_signed30 g = *x;
+    rustsecp256k1_v0_9_0_modinv32_signed30 d = {{0}};
+    rustsecp256k1_v0_9_0_modinv32_signed30 e = {{1}};
+    rustsecp256k1_v0_9_0_modinv32_signed30 f = modinfo->modulus;
+    rustsecp256k1_v0_9_0_modinv32_signed30 g = *x;
     int i;
     int32_t zeta = -1; /* zeta = -(delta+1/2); delta is initially 1/2. */
 
     /* Do 20 iterations of 30 divsteps each = 600 divsteps. 590 suffices for 256-bit inputs. */
     for (i = 0; i < 20; ++i) {
         /* Compute transition matrix and new zeta after 30 divsteps. */
-        rustsecp256k1_v0_8_1_modinv32_trans2x2 t;
-        zeta = rustsecp256k1_v0_8_1_modinv32_divsteps_30(zeta, f.v[0], g.v[0], &t);
+        rustsecp256k1_v0_9_0_modinv32_trans2x2 t;
+        zeta = rustsecp256k1_v0_9_0_modinv32_divsteps_30(zeta, f.v[0], g.v[0], &t);
         /* Update d,e using that transition matrix. */
-        rustsecp256k1_v0_8_1_modinv32_update_de_30(&d, &e, &t, modinfo);
+        rustsecp256k1_v0_9_0_modinv32_update_de_30(&d, &e, &t, modinfo);
         /* Update f,g using that transition matrix. */
 #ifdef VERIFY
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, -1) > 0); /* f > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, 1) <= 0); /* f <= modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, 9, &modinfo->modulus, -1) > 0); /* g > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, 9, &modinfo->modulus, 1) < 0);  /* g <  modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, -1) > 0); /* f > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, 9, &modinfo->modulus, -1) > 0); /* g > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, 9, &modinfo->modulus, 1) < 0);  /* g <  modulus */
 #endif
-        rustsecp256k1_v0_8_1_modinv32_update_fg_30(&f, &g, &t);
+        rustsecp256k1_v0_9_0_modinv32_update_fg_30(&f, &g, &t);
 #ifdef VERIFY
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, -1) > 0); /* f > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, 1) <= 0); /* f <= modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, 9, &modinfo->modulus, -1) > 0); /* g > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, 9, &modinfo->modulus, 1) < 0);  /* g <  modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, -1) > 0); /* f > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, 9, &modinfo->modulus, -1) > 0); /* g > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, 9, &modinfo->modulus, 1) < 0);  /* g <  modulus */
 #endif
     }
 
@@ -489,28 +570,28 @@ static void rustsecp256k1_v0_8_1_modinv32(rustsecp256k1_v0_8_1_modinv32_signed30
      * values i.e. +/- 1, and d now contains +/- the modular inverse. */
 #ifdef VERIFY
     /* g == 0 */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, 9, &SECP256K1_SIGNED30_ONE, 0) == 0);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, 9, &SECP256K1_SIGNED30_ONE, 0) == 0);
     /* |f| == 1, or (x == 0 and d == 0 and |f|=modulus) */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, 9, &SECP256K1_SIGNED30_ONE, -1) == 0 ||
-                 rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, 9, &SECP256K1_SIGNED30_ONE, 1) == 0 ||
-                 (rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(x, 9, &SECP256K1_SIGNED30_ONE, 0) == 0 &&
-                  rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&d, 9, &SECP256K1_SIGNED30_ONE, 0) == 0 &&
-                  (rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, 1) == 0 ||
-                   rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, -1) == 0)));
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, 9, &SECP256K1_SIGNED30_ONE, -1) == 0 ||
+                 rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, 9, &SECP256K1_SIGNED30_ONE, 1) == 0 ||
+                 (rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(x, 9, &SECP256K1_SIGNED30_ONE, 0) == 0 &&
+                  rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&d, 9, &SECP256K1_SIGNED30_ONE, 0) == 0 &&
+                  (rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, 1) == 0 ||
+                   rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, 9, &modinfo->modulus, -1) == 0)));
 #endif
 
     /* Optionally negate d, normalize to [0,modulus), and return it. */
-    rustsecp256k1_v0_8_1_modinv32_normalize_30(&d, f.v[8], modinfo);
+    rustsecp256k1_v0_9_0_modinv32_normalize_30(&d, f.v[8], modinfo);
     *x = d;
 }
 
 /* Compute the inverse of x modulo modinfo->modulus, and replace x with it (variable time). */
-static void rustsecp256k1_v0_8_1_modinv32_var(rustsecp256k1_v0_8_1_modinv32_signed30 *x, const rustsecp256k1_v0_8_1_modinv32_modinfo *modinfo) {
+static void rustsecp256k1_v0_9_0_modinv32_var(rustsecp256k1_v0_9_0_modinv32_signed30 *x, const rustsecp256k1_v0_9_0_modinv32_modinfo *modinfo) {
     /* Start with d=0, e=1, f=modulus, g=x, eta=-1. */
-    rustsecp256k1_v0_8_1_modinv32_signed30 d = {{0, 0, 0, 0, 0, 0, 0, 0, 0}};
-    rustsecp256k1_v0_8_1_modinv32_signed30 e = {{1, 0, 0, 0, 0, 0, 0, 0, 0}};
-    rustsecp256k1_v0_8_1_modinv32_signed30 f = modinfo->modulus;
-    rustsecp256k1_v0_8_1_modinv32_signed30 g = *x;
+    rustsecp256k1_v0_9_0_modinv32_signed30 d = {{0, 0, 0, 0, 0, 0, 0, 0, 0}};
+    rustsecp256k1_v0_9_0_modinv32_signed30 e = {{1, 0, 0, 0, 0, 0, 0, 0, 0}};
+    rustsecp256k1_v0_9_0_modinv32_signed30 f = modinfo->modulus;
+    rustsecp256k1_v0_9_0_modinv32_signed30 g = *x;
 #ifdef VERIFY
     int i = 0;
 #endif
@@ -521,18 +602,18 @@ static void rustsecp256k1_v0_8_1_modinv32_var(rustsecp256k1_v0_8_1_modinv32_sign
     /* Do iterations of 30 divsteps each until g=0. */
     while (1) {
         /* Compute transition matrix and new eta after 30 divsteps. */
-        rustsecp256k1_v0_8_1_modinv32_trans2x2 t;
-        eta = rustsecp256k1_v0_8_1_modinv32_divsteps_30_var(eta, f.v[0], g.v[0], &t);
+        rustsecp256k1_v0_9_0_modinv32_trans2x2 t;
+        eta = rustsecp256k1_v0_9_0_modinv32_divsteps_30_var(eta, f.v[0], g.v[0], &t);
         /* Update d,e using that transition matrix. */
-        rustsecp256k1_v0_8_1_modinv32_update_de_30(&d, &e, &t, modinfo);
+        rustsecp256k1_v0_9_0_modinv32_update_de_30(&d, &e, &t, modinfo);
         /* Update f,g using that transition matrix. */
 #ifdef VERIFY
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
 #endif
-        rustsecp256k1_v0_8_1_modinv32_update_fg_30_var(len, &f, &g, &t);
+        rustsecp256k1_v0_9_0_modinv32_update_fg_30_var(len, &f, &g, &t);
         /* If the bottom limb of g is 0, there is a chance g=0. */
         if (g.v[0] == 0) {
             cond = 0;
@@ -558,10 +639,10 @@ static void rustsecp256k1_v0_8_1_modinv32_var(rustsecp256k1_v0_8_1_modinv32_sign
         }
 #ifdef VERIFY
         VERIFY_CHECK(++i < 25); /* We should never need more than 25*30 = 750 divsteps */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
 #endif
     }
 
@@ -569,19 +650,89 @@ static void rustsecp256k1_v0_8_1_modinv32_var(rustsecp256k1_v0_8_1_modinv32_sign
      * the initial f, g values i.e. +/- 1, and d now contains +/- the modular inverse. */
 #ifdef VERIFY
     /* g == 0 */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&g, len, &SECP256K1_SIGNED30_ONE, 0) == 0);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, len, &SECP256K1_SIGNED30_ONE, 0) == 0);
     /* |f| == 1, or (x == 0 and d == 0 and |f|=modulus) */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, len, &SECP256K1_SIGNED30_ONE, -1) == 0 ||
-                 rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, len, &SECP256K1_SIGNED30_ONE, 1) == 0 ||
-                 (rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(x, 9, &SECP256K1_SIGNED30_ONE, 0) == 0 &&
-                  rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&d, 9, &SECP256K1_SIGNED30_ONE, 0) == 0 &&
-                  (rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 1) == 0 ||
-                   rustsecp256k1_v0_8_1_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, -1) == 0)));
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &SECP256K1_SIGNED30_ONE, -1) == 0 ||
+                 rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &SECP256K1_SIGNED30_ONE, 1) == 0 ||
+                 (rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(x, 9, &SECP256K1_SIGNED30_ONE, 0) == 0 &&
+                  rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&d, 9, &SECP256K1_SIGNED30_ONE, 0) == 0 &&
+                  (rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 1) == 0 ||
+                   rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, -1) == 0)));
 #endif
 
     /* Optionally negate d, normalize to [0,modulus), and return it. */
-    rustsecp256k1_v0_8_1_modinv32_normalize_30(&d, f.v[len - 1], modinfo);
+    rustsecp256k1_v0_9_0_modinv32_normalize_30(&d, f.v[len - 1], modinfo);
     *x = d;
 }
 
+/* Do up to 50 iterations of 30 posdivsteps (up to 1500 steps; more is extremely rare) each until f=1.
+ * In VERIFY mode use a lower number of iterations (750, close to the median 756), so failure actually occurs. */
+#ifdef VERIFY
+#define JACOBI32_ITERATIONS 25
+#else
+#define JACOBI32_ITERATIONS 50
+#endif
+
+/* Compute the Jacobi symbol of x modulo modinfo->modulus (variable time). gcd(x,modulus) must be 1. */
+static int rustsecp256k1_v0_9_0_jacobi32_maybe_var(const rustsecp256k1_v0_9_0_modinv32_signed30 *x, const rustsecp256k1_v0_9_0_modinv32_modinfo *modinfo) {
+    /* Start with f=modulus, g=x, eta=-1. */
+    rustsecp256k1_v0_9_0_modinv32_signed30 f = modinfo->modulus;
+    rustsecp256k1_v0_9_0_modinv32_signed30 g = *x;
+    int j, len = 9;
+    int32_t eta = -1; /* eta = -delta; delta is initially 1 */
+    int32_t cond, fn, gn;
+    int jac = 0;
+    int count;
+
+    /* The input limbs must all be non-negative. */
+    VERIFY_CHECK(g.v[0] >= 0 && g.v[1] >= 0 && g.v[2] >= 0 && g.v[3] >= 0 && g.v[4] >= 0 && g.v[5] >= 0 && g.v[6] >= 0 && g.v[7] >= 0 && g.v[8] >= 0);
+
+    /* If x > 0, then if the loop below converges, it converges to f=g=gcd(x,modulus). Since we
+     * require that gcd(x,modulus)=1 and modulus>=3, x cannot be 0. Thus, we must reach f=1 (or
+     * time out). */
+    VERIFY_CHECK((g.v[0] | g.v[1] | g.v[2] | g.v[3] | g.v[4] | g.v[5] | g.v[6] | g.v[7] | g.v[8]) != 0);
+
+    for (count = 0; count < JACOBI32_ITERATIONS; ++count) {
+        /* Compute transition matrix and new eta after 30 posdivsteps. */
+        rustsecp256k1_v0_9_0_modinv32_trans2x2 t;
+        eta = rustsecp256k1_v0_9_0_modinv32_posdivsteps_30_var(eta, f.v[0] | ((uint32_t)f.v[1] << 30), g.v[0] | ((uint32_t)g.v[1] << 30), &t, &jac);
+        /* Update f,g using that transition matrix. */
+#ifdef VERIFY
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 0) > 0); /* f > 0 */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, 0) > 0); /* g > 0 */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, 1) < 0);  /* g < modulus */
+#endif
+        rustsecp256k1_v0_9_0_modinv32_update_fg_30_var(len, &f, &g, &t);
+        /* If the bottom limb of f is 1, there is a chance that f=1. */
+        if (f.v[0] == 1) {
+            cond = 0;
+            /* Check if the other limbs are also 0. */
+            for (j = 1; j < len; ++j) {
+                cond |= f.v[j];
+            }
+            /* If so, we're done. If f=1, the Jacobi symbol (g | f)=1. */
+            if (cond == 0) return 1 - 2*(jac & 1);
+        }
+
+        /* Determine if len>1 and limb (len-1) of both f and g is 0. */
+        fn = f.v[len - 1];
+        gn = g.v[len - 1];
+        cond = ((int32_t)len - 2) >> 31;
+        cond |= fn;
+        cond |= gn;
+        /* If so, reduce length. */
+        if (cond == 0) --len;
+#ifdef VERIFY
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 0) > 0); /* f > 0 */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, 0) > 0); /* g > 0 */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv32_mul_cmp_30(&g, len, &modinfo->modulus, 1) < 0);  /* g < modulus */
+#endif
+    }
+
+    /* The loop failed to converge to f=g after 1500 iterations. Return 0, indicating unknown result. */
+    return 0;
+}
+
 #endif /* SECP256K1_MODINV32_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/modinv64.h b/secp256k1-sys/depend/secp256k1/src/modinv64.h
index ae960ea23..c0783d41b 100644
--- a/secp256k1-sys/depend/secp256k1/src/modinv64.h
+++ b/secp256k1-sys/depend/secp256k1/src/modinv64.h
@@ -7,10 +7,6 @@
 #ifndef SECP256K1_MODINV64_H
 #define SECP256K1_MODINV64_H
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
-
 #include "util.h"
 
 #ifndef SECP256K1_WIDEMUL_INT128
@@ -22,15 +18,15 @@
  * Its value is sum(v[i] * 2^(62*i), i=0..4). */
 typedef struct {
     int64_t v[5];
-} rustsecp256k1_v0_8_1_modinv64_signed62;
+} rustsecp256k1_v0_9_0_modinv64_signed62;
 
 typedef struct {
     /* The modulus in signed62 notation, must be odd and in [3, 2^256]. */
-    rustsecp256k1_v0_8_1_modinv64_signed62 modulus;
+    rustsecp256k1_v0_9_0_modinv64_signed62 modulus;
 
     /* modulus^{-1} mod 2^62 */
     uint64_t modulus_inv62;
-} rustsecp256k1_v0_8_1_modinv64_modinfo;
+} rustsecp256k1_v0_9_0_modinv64_modinfo;
 
 /* Replace x with its modular inverse mod modinfo->modulus. x must be in range [0, modulus).
  * If x is zero, the result will be zero as well. If not, the inverse must exist (i.e., the gcd of
@@ -38,9 +34,14 @@ typedef struct {
  *
  * On output, all of x's limbs will be in [0, 2^62).
  */
-static void rustsecp256k1_v0_8_1_modinv64_var(rustsecp256k1_v0_8_1_modinv64_signed62 *x, const rustsecp256k1_v0_8_1_modinv64_modinfo *modinfo);
+static void rustsecp256k1_v0_9_0_modinv64_var(rustsecp256k1_v0_9_0_modinv64_signed62 *x, const rustsecp256k1_v0_9_0_modinv64_modinfo *modinfo);
+
+/* Same as rustsecp256k1_v0_9_0_modinv64_var, but constant time in x (not in the modulus). */
+static void rustsecp256k1_v0_9_0_modinv64(rustsecp256k1_v0_9_0_modinv64_signed62 *x, const rustsecp256k1_v0_9_0_modinv64_modinfo *modinfo);
 
-/* Same as rustsecp256k1_v0_8_1_modinv64_var, but constant time in x (not in the modulus). */
-static void rustsecp256k1_v0_8_1_modinv64(rustsecp256k1_v0_8_1_modinv64_signed62 *x, const rustsecp256k1_v0_8_1_modinv64_modinfo *modinfo);
+/* Compute the Jacobi symbol for (x | modinfo->modulus). x must be coprime with modulus (and thus
+ * cannot be 0, as modulus >= 3). All limbs of x must be non-negative. Returns 0 if the result
+ * cannot be computed. */
+static int rustsecp256k1_v0_9_0_jacobi64_maybe_var(const rustsecp256k1_v0_9_0_modinv64_signed62 *x, const rustsecp256k1_v0_9_0_modinv64_modinfo *modinfo);
 
 #endif /* SECP256K1_MODINV64_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/modinv64_impl.h b/secp256k1-sys/depend/secp256k1/src/modinv64_impl.h
index 2ba67fb34..5a9101017 100644
--- a/secp256k1-sys/depend/secp256k1/src/modinv64_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modinv64_impl.h
@@ -24,41 +24,41 @@
  */
 typedef struct {
     int64_t u, v, q, r;
-} rustsecp256k1_v0_8_1_modinv64_trans2x2;
+} rustsecp256k1_v0_9_0_modinv64_trans2x2;
 
 #ifdef VERIFY
 /* Helper function to compute the absolute value of an int64_t.
  * (we don't use abs/labs/llabs as it depends on the int sizes). */
-static int64_t rustsecp256k1_v0_8_1_modinv64_abs(int64_t v) {
+static int64_t rustsecp256k1_v0_9_0_modinv64_abs(int64_t v) {
     VERIFY_CHECK(v > INT64_MIN);
     if (v < 0) return -v;
     return v;
 }
 
-static const rustsecp256k1_v0_8_1_modinv64_signed62 SECP256K1_SIGNED62_ONE = {{1}};
+static const rustsecp256k1_v0_9_0_modinv64_signed62 SECP256K1_SIGNED62_ONE = {{1}};
 
 /* Compute a*factor and put it in r. All but the top limb in r will be in range [0,2^62). */
-static void rustsecp256k1_v0_8_1_modinv64_mul_62(rustsecp256k1_v0_8_1_modinv64_signed62 *r, const rustsecp256k1_v0_8_1_modinv64_signed62 *a, int alen, int64_t factor) {
-    const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
-    rustsecp256k1_v0_8_1_int128 c, d;
+static void rustsecp256k1_v0_9_0_modinv64_mul_62(rustsecp256k1_v0_9_0_modinv64_signed62 *r, const rustsecp256k1_v0_9_0_modinv64_signed62 *a, int alen, int64_t factor) {
+    const uint64_t M62 = UINT64_MAX >> 2;
+    rustsecp256k1_v0_9_0_int128 c, d;
     int i;
-    rustsecp256k1_v0_8_1_i128_from_i64(&c, 0);
+    rustsecp256k1_v0_9_0_i128_from_i64(&c, 0);
     for (i = 0; i < 4; ++i) {
-        if (i < alen) rustsecp256k1_v0_8_1_i128_accum_mul(&c, a->v[i], factor);
-        r->v[i] = rustsecp256k1_v0_8_1_i128_to_i64(&c) & M62; rustsecp256k1_v0_8_1_i128_rshift(&c, 62);
+        if (i < alen) rustsecp256k1_v0_9_0_i128_accum_mul(&c, a->v[i], factor);
+        r->v[i] = rustsecp256k1_v0_9_0_i128_to_u64(&c) & M62; rustsecp256k1_v0_9_0_i128_rshift(&c, 62);
     }
-    if (4 < alen) rustsecp256k1_v0_8_1_i128_accum_mul(&c, a->v[4], factor);
-    rustsecp256k1_v0_8_1_i128_from_i64(&d, rustsecp256k1_v0_8_1_i128_to_i64(&c));
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_i128_eq_var(&c, &d));
-    r->v[4] = rustsecp256k1_v0_8_1_i128_to_i64(&c);
+    if (4 < alen) rustsecp256k1_v0_9_0_i128_accum_mul(&c, a->v[4], factor);
+    rustsecp256k1_v0_9_0_i128_from_i64(&d, rustsecp256k1_v0_9_0_i128_to_i64(&c));
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_i128_eq_var(&c, &d));
+    r->v[4] = rustsecp256k1_v0_9_0_i128_to_i64(&c);
 }
 
 /* Return -1 for a<b*factor, 0 for a==b*factor, 1 for a>b*factor. A has alen limbs; b has 5. */
-static int rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(const rustsecp256k1_v0_8_1_modinv64_signed62 *a, int alen, const rustsecp256k1_v0_8_1_modinv64_signed62 *b, int64_t factor) {
+static int rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(const rustsecp256k1_v0_9_0_modinv64_signed62 *a, int alen, const rustsecp256k1_v0_9_0_modinv64_signed62 *b, int64_t factor) {
     int i;
-    rustsecp256k1_v0_8_1_modinv64_signed62 am, bm;
-    rustsecp256k1_v0_8_1_modinv64_mul_62(&am, a, alen, 1); /* Normalize all but the top limb of a. */
-    rustsecp256k1_v0_8_1_modinv64_mul_62(&bm, b, 5, factor);
+    rustsecp256k1_v0_9_0_modinv64_signed62 am, bm;
+    rustsecp256k1_v0_9_0_modinv64_mul_62(&am, a, alen, 1); /* Normalize all but the top limb of a. */
+    rustsecp256k1_v0_9_0_modinv64_mul_62(&bm, b, 5, factor);
     for (i = 0; i < 4; ++i) {
         /* Verify that all but the top limb of a and b are normalized. */
         VERIFY_CHECK(am.v[i] >> 62 == 0);
@@ -71,11 +71,13 @@ static int rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(const rustsecp256k1_v0_8_1_m
     return 0;
 }
 
-/* Check if the determinant of t is equal to 1 << n. */
-static int rustsecp256k1_v0_8_1_modinv64_det_check_pow2(const rustsecp256k1_v0_8_1_modinv64_trans2x2 *t, unsigned int n) {
-    rustsecp256k1_v0_8_1_int128 a;
-    rustsecp256k1_v0_8_1_i128_det(&a, t->u, t->v, t->q, t->r);
-    return rustsecp256k1_v0_8_1_i128_check_pow2(&a, n);
+/* Check if the determinant of t is equal to 1 << n. If abs, check if |det t| == 1 << n. */
+static int rustsecp256k1_v0_9_0_modinv64_det_check_pow2(const rustsecp256k1_v0_9_0_modinv64_trans2x2 *t, unsigned int n, int abs) {
+    rustsecp256k1_v0_9_0_int128 a;
+    rustsecp256k1_v0_9_0_i128_det(&a, t->u, t->v, t->q, t->r);
+    if (rustsecp256k1_v0_9_0_i128_check_pow2(&a, n, 1)) return 1;
+    if (abs && rustsecp256k1_v0_9_0_i128_check_pow2(&a, n, -1)) return 1;
+    return 0;
 }
 #endif
 
@@ -83,10 +85,10 @@ static int rustsecp256k1_v0_8_1_modinv64_det_check_pow2(const rustsecp256k1_v0_8
  * to it to bring it to range [0,modulus). If sign < 0, the input will also be negated in the
  * process. The input must have limbs in range (-2^62,2^62). The output will have limbs in range
  * [0,2^62). */
-static void rustsecp256k1_v0_8_1_modinv64_normalize_62(rustsecp256k1_v0_8_1_modinv64_signed62 *r, int64_t sign, const rustsecp256k1_v0_8_1_modinv64_modinfo *modinfo) {
+static void rustsecp256k1_v0_9_0_modinv64_normalize_62(rustsecp256k1_v0_9_0_modinv64_signed62 *r, int64_t sign, const rustsecp256k1_v0_9_0_modinv64_modinfo *modinfo) {
     const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
     int64_t r0 = r->v[0], r1 = r->v[1], r2 = r->v[2], r3 = r->v[3], r4 = r->v[4];
-    int64_t cond_add, cond_negate;
+    volatile int64_t cond_add, cond_negate;
 
 #ifdef VERIFY
     /* Verify that all limbs are in range (-2^62,2^62). */
@@ -95,8 +97,8 @@ static void rustsecp256k1_v0_8_1_modinv64_normalize_62(rustsecp256k1_v0_8_1_modi
         VERIFY_CHECK(r->v[i] >= -M62);
         VERIFY_CHECK(r->v[i] <= M62);
     }
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, -2) > 0); /* r > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, -2) > 0); /* r > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
 #endif
 
     /* In a first step, add the modulus if the input is negative, and then negate if requested.
@@ -148,8 +150,8 @@ static void rustsecp256k1_v0_8_1_modinv64_normalize_62(rustsecp256k1_v0_8_1_modi
     VERIFY_CHECK(r2 >> 62 == 0);
     VERIFY_CHECK(r3 >> 62 == 0);
     VERIFY_CHECK(r4 >> 62 == 0);
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 0) >= 0); /* r >= 0 */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 0) >= 0); /* r >= 0 */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
 #endif
 }
 
@@ -164,7 +166,7 @@ static void rustsecp256k1_v0_8_1_modinv64_normalize_62(rustsecp256k1_v0_8_1_modi
  *
  * Implements the divsteps_n_matrix function from the explanation.
  */
-static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_59(int64_t zeta, uint64_t f0, uint64_t g0, rustsecp256k1_v0_8_1_modinv64_trans2x2 *t) {
+static int64_t rustsecp256k1_v0_9_0_modinv64_divsteps_59(int64_t zeta, uint64_t f0, uint64_t g0, rustsecp256k1_v0_9_0_modinv64_trans2x2 *t) {
     /* u,v,q,r are the elements of the transformation matrix being built up,
      * starting with the identity matrix times 8 (because the caller expects
      * a result scaled by 2^62). Semantically they are signed integers
@@ -173,7 +175,8 @@ static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_59(int64_t zeta, uint64_t
      * being inside [-2^63,2^63) means that casting to signed works correctly.
      */
     uint64_t u = 8, v = 0, q = 0, r = 8;
-    uint64_t c1, c2, f = f0, g = g0, x, y, z;
+    volatile uint64_t c1, c2;
+    uint64_t mask1, mask2, f = f0, g = g0, x, y, z;
     int i;
 
     for (i = 3; i < 62; ++i) {
@@ -182,23 +185,25 @@ static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_59(int64_t zeta, uint64_t
         VERIFY_CHECK((q * f0 + r * g0) == g << i);
         /* Compute conditional masks for (zeta < 0) and for (g & 1). */
         c1 = zeta >> 63;
-        c2 = -(g & 1);
+        mask1 = c1;
+        c2 = g & 1;
+        mask2 = -c2;
         /* Compute x,y,z, conditionally negated versions of f,u,v. */
-        x = (f ^ c1) - c1;
-        y = (u ^ c1) - c1;
-        z = (v ^ c1) - c1;
+        x = (f ^ mask1) - mask1;
+        y = (u ^ mask1) - mask1;
+        z = (v ^ mask1) - mask1;
         /* Conditionally add x,y,z to g,q,r. */
-        g += x & c2;
-        q += y & c2;
-        r += z & c2;
+        g += x & mask2;
+        q += y & mask2;
+        r += z & mask2;
         /* In what follows, c1 is a condition mask for (zeta < 0) and (g & 1). */
-        c1 &= c2;
+        mask1 &= mask2;
         /* Conditionally change zeta into -zeta-2 or zeta-1. */
-        zeta = (zeta ^ c1) - 1;
+        zeta = (zeta ^ mask1) - 1;
         /* Conditionally add g,q,r to f,u,v. */
-        f += g & c1;
-        u += q & c1;
-        v += r & c1;
+        f += g & mask1;
+        u += q & mask1;
+        v += r & mask1;
         /* Shifts */
         g >>= 1;
         u <<= 1;
@@ -218,7 +223,7 @@ static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_59(int64_t zeta, uint64_t
      * aggregate of 59 of them will have determinant 2^59. Multiplying with the initial
      * 8*identity (which has determinant 2^6) means the overall outputs has determinant
      * 2^65. */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_det_check_pow2(t, 65));
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_det_check_pow2(t, 65, 0));
 #endif
     return zeta;
 }
@@ -233,8 +238,8 @@ static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_59(int64_t zeta, uint64_t
  *
  * Implements the divsteps_n_matrix_var function from the explanation.
  */
-static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_62_var(int64_t eta, uint64_t f0, uint64_t g0, rustsecp256k1_v0_8_1_modinv64_trans2x2 *t) {
-    /* Transformation matrix; see comments in rustsecp256k1_v0_8_1_modinv64_divsteps_62. */
+static int64_t rustsecp256k1_v0_9_0_modinv64_divsteps_62_var(int64_t eta, uint64_t f0, uint64_t g0, rustsecp256k1_v0_9_0_modinv64_trans2x2 *t) {
+    /* Transformation matrix; see comments in rustsecp256k1_v0_9_0_modinv64_divsteps_62. */
     uint64_t u = 1, v = 0, q = 0, r = 1;
     uint64_t f = f0, g = g0, m;
     uint32_t w;
@@ -242,7 +247,7 @@ static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_62_var(int64_t eta, uint64
 
     for (;;) {
         /* Use a sentinel bit to count zeros only up to i. */
-        zeros = rustsecp256k1_v0_8_1_ctz64_var(g | (UINT64_MAX << i));
+        zeros = rustsecp256k1_v0_9_0_ctz64_var(g | (UINT64_MAX << i));
         /* Perform zeros divsteps at once; they all just divide g by two. */
         g >>= zeros;
         u <<= zeros;
@@ -266,7 +271,7 @@ static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_62_var(int64_t eta, uint64
             tmp = v; v = r; r = -tmp;
             /* Use a formula to cancel out up to 6 bits of g. Also, no more than i can be cancelled
              * out (as we'd be done before that point), and no more than eta+1 can be done as its
-             * will flip again once that happens. */
+             * sign will flip again once that happens. */
             limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
             VERIFY_CHECK(limit > 0 && limit <= 62);
             /* m is a mask for the bottom min(limit, 6) bits. */
@@ -301,8 +306,100 @@ static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_62_var(int64_t eta, uint64
      * does not change the gcd of f and g, apart from adding a power-of-2 factor to it (which
      * will be divided out again). As each divstep's individual matrix has determinant 2, the
      * aggregate of 62 of them will have determinant 2^62. */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_det_check_pow2(t, 62));
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_det_check_pow2(t, 62, 0));
+#endif
+    return eta;
+}
+
+/* Compute the transition matrix and eta for 62 posdivsteps (variable time, eta=-delta), and keeps track
+ * of the Jacobi symbol along the way. f0 and g0 must be f and g mod 2^64 rather than 2^62, because
+ * Jacobi tracking requires knowing (f mod 8) rather than just (f mod 2).
+ *
+ * Input:        eta: initial eta
+ *               f0:  bottom limb of initial f
+ *               g0:  bottom limb of initial g
+ * Output:       t: transition matrix
+ * Input/Output: (*jacp & 1) is bitflipped if and only if the Jacobi symbol of (f | g) changes sign
+ *               by applying the returned transformation matrix to it. The other bits of *jacp may
+ *               change, but are meaningless.
+ * Return:       final eta
+ */
+static int64_t rustsecp256k1_v0_9_0_modinv64_posdivsteps_62_var(int64_t eta, uint64_t f0, uint64_t g0, rustsecp256k1_v0_9_0_modinv64_trans2x2 *t, int *jacp) {
+    /* Transformation matrix; see comments in rustsecp256k1_v0_9_0_modinv64_divsteps_62. */
+    uint64_t u = 1, v = 0, q = 0, r = 1;
+    uint64_t f = f0, g = g0, m;
+    uint32_t w;
+    int i = 62, limit, zeros;
+    int jac = *jacp;
+
+    for (;;) {
+        /* Use a sentinel bit to count zeros only up to i. */
+        zeros = rustsecp256k1_v0_9_0_ctz64_var(g | (UINT64_MAX << i));
+        /* Perform zeros divsteps at once; they all just divide g by two. */
+        g >>= zeros;
+        u <<= zeros;
+        v <<= zeros;
+        eta -= zeros;
+        i -= zeros;
+        /* Update the bottom bit of jac: when dividing g by an odd power of 2,
+         * if (f mod 8) is 3 or 5, the Jacobi symbol changes sign. */
+        jac ^= (zeros & ((f >> 1) ^ (f >> 2)));
+        /* We're done once we've done 62 posdivsteps. */
+        if (i == 0) break;
+        VERIFY_CHECK((f & 1) == 1);
+        VERIFY_CHECK((g & 1) == 1);
+        VERIFY_CHECK((u * f0 + v * g0) == f << (62 - i));
+        VERIFY_CHECK((q * f0 + r * g0) == g << (62 - i));
+        /* If eta is negative, negate it and replace f,g with g,f. */
+        if (eta < 0) {
+            uint64_t tmp;
+            eta = -eta;
+            tmp = f; f = g; g = tmp;
+            tmp = u; u = q; q = tmp;
+            tmp = v; v = r; r = tmp;
+            /* Update bottom bit of jac: when swapping f and g, the Jacobi symbol changes sign
+             * if both f and g are 3 mod 4. */
+            jac ^= ((f & g) >> 1);
+            /* Use a formula to cancel out up to 6 bits of g. Also, no more than i can be cancelled
+             * out (as we'd be done before that point), and no more than eta+1 can be done as its
+             * sign will flip again once that happens. */
+            limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
+            VERIFY_CHECK(limit > 0 && limit <= 62);
+            /* m is a mask for the bottom min(limit, 6) bits. */
+            m = (UINT64_MAX >> (64 - limit)) & 63U;
+            /* Find what multiple of f must be added to g to cancel its bottom min(limit, 6)
+             * bits. */
+            w = (f * g * (f * f - 2)) & m;
+        } else {
+            /* In this branch, use a simpler formula that only lets us cancel up to 4 bits of g, as
+             * eta tends to be smaller here. */
+            limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
+            VERIFY_CHECK(limit > 0 && limit <= 62);
+            /* m is a mask for the bottom min(limit, 4) bits. */
+            m = (UINT64_MAX >> (64 - limit)) & 15U;
+            /* Find what multiple of f must be added to g to cancel its bottom min(limit, 4)
+             * bits. */
+            w = f + (((f + 1) & 4) << 1);
+            w = (-w * g) & m;
+        }
+        g += f * w;
+        q += u * w;
+        r += v * w;
+        VERIFY_CHECK((g & m) == 0);
+    }
+    /* Return data in t and return value. */
+    t->u = (int64_t)u;
+    t->v = (int64_t)v;
+    t->q = (int64_t)q;
+    t->r = (int64_t)r;
+#ifdef VERIFY
+    /* The determinant of t must be a power of two. This guarantees that multiplication with t
+     * does not change the gcd of f and g, apart from adding a power-of-2 factor to it (which
+     * will be divided out again). As each divstep's individual matrix has determinant 2 or -2,
+     * the aggregate of 62 of them will have determinant 2^62 or -2^62. */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_det_check_pow2(t, 62, 1));
 #endif
+    *jacp = jac;
     return eta;
 }
 
@@ -313,22 +410,20 @@ static int64_t rustsecp256k1_v0_8_1_modinv64_divsteps_62_var(int64_t eta, uint64
  *
  * This implements the update_de function from the explanation.
  */
-static void rustsecp256k1_v0_8_1_modinv64_update_de_62(rustsecp256k1_v0_8_1_modinv64_signed62 *d, rustsecp256k1_v0_8_1_modinv64_signed62 *e, const rustsecp256k1_v0_8_1_modinv64_trans2x2 *t, const rustsecp256k1_v0_8_1_modinv64_modinfo* modinfo) {
-    const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
+static void rustsecp256k1_v0_9_0_modinv64_update_de_62(rustsecp256k1_v0_9_0_modinv64_signed62 *d, rustsecp256k1_v0_9_0_modinv64_signed62 *e, const rustsecp256k1_v0_9_0_modinv64_trans2x2 *t, const rustsecp256k1_v0_9_0_modinv64_modinfo* modinfo) {
+    const uint64_t M62 = UINT64_MAX >> 2;
     const int64_t d0 = d->v[0], d1 = d->v[1], d2 = d->v[2], d3 = d->v[3], d4 = d->v[4];
     const int64_t e0 = e->v[0], e1 = e->v[1], e2 = e->v[2], e3 = e->v[3], e4 = e->v[4];
     const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
     int64_t md, me, sd, se;
-    rustsecp256k1_v0_8_1_int128 cd, ce;
+    rustsecp256k1_v0_9_0_int128 cd, ce;
 #ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_modinv64_abs(u) + rustsecp256k1_v0_8_1_modinv64_abs(v)) >= 0); /* |u|+|v| doesn't overflow */
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_modinv64_abs(q) + rustsecp256k1_v0_8_1_modinv64_abs(r)) >= 0); /* |q|+|r| doesn't overflow */
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_modinv64_abs(u) + rustsecp256k1_v0_8_1_modinv64_abs(v)) <= M62 + 1); /* |u|+|v| <= 2^62 */
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_modinv64_abs(q) + rustsecp256k1_v0_8_1_modinv64_abs(r)) <= M62 + 1); /* |q|+|r| <= 2^62 */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_abs(u) <= (((int64_t)1 << 62) - rustsecp256k1_v0_9_0_modinv64_abs(v))); /* |u|+|v| <= 2^62 */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_abs(q) <= (((int64_t)1 << 62) - rustsecp256k1_v0_9_0_modinv64_abs(r))); /* |q|+|r| <= 2^62 */
 #endif
     /* [md,me] start as zero; plus [u,q] if d is negative; plus [v,r] if e is negative. */
     sd = d4 >> 63;
@@ -336,69 +431,69 @@ static void rustsecp256k1_v0_8_1_modinv64_update_de_62(rustsecp256k1_v0_8_1_modi
     md = (u & sd) + (v & se);
     me = (q & sd) + (r & se);
     /* Begin computing t*[d,e]. */
-    rustsecp256k1_v0_8_1_i128_mul(&cd, u, d0);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, v, e0);
-    rustsecp256k1_v0_8_1_i128_mul(&ce, q, d0);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, r, e0);
+    rustsecp256k1_v0_9_0_i128_mul(&cd, u, d0);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, v, e0);
+    rustsecp256k1_v0_9_0_i128_mul(&ce, q, d0);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, r, e0);
     /* Correct md,me so that t*[d,e]+modulus*[md,me] has 62 zero bottom bits. */
-    md -= (modinfo->modulus_inv62 * (uint64_t)rustsecp256k1_v0_8_1_i128_to_i64(&cd) + md) & M62;
-    me -= (modinfo->modulus_inv62 * (uint64_t)rustsecp256k1_v0_8_1_i128_to_i64(&ce) + me) & M62;
+    md -= (modinfo->modulus_inv62 * rustsecp256k1_v0_9_0_i128_to_u64(&cd) + md) & M62;
+    me -= (modinfo->modulus_inv62 * rustsecp256k1_v0_9_0_i128_to_u64(&ce) + me) & M62;
     /* Update the beginning of computation for t*[d,e]+modulus*[md,me] now md,me are known. */
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, modinfo->modulus.v[0], md);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, modinfo->modulus.v[0], me);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, modinfo->modulus.v[0], md);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, modinfo->modulus.v[0], me);
     /* Verify that the low 62 bits of the computation are indeed zero, and then throw them away. */
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_i128_to_i64(&cd) & M62) == 0); rustsecp256k1_v0_8_1_i128_rshift(&cd, 62);
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_i128_to_i64(&ce) & M62) == 0); rustsecp256k1_v0_8_1_i128_rshift(&ce, 62);
+    VERIFY_CHECK((rustsecp256k1_v0_9_0_i128_to_u64(&cd) & M62) == 0); rustsecp256k1_v0_9_0_i128_rshift(&cd, 62);
+    VERIFY_CHECK((rustsecp256k1_v0_9_0_i128_to_u64(&ce) & M62) == 0); rustsecp256k1_v0_9_0_i128_rshift(&ce, 62);
     /* Compute limb 1 of t*[d,e]+modulus*[md,me], and store it as output limb 0 (= down shift). */
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, u, d1);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, v, e1);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, q, d1);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, r, e1);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, u, d1);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, v, e1);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, q, d1);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, r, e1);
     if (modinfo->modulus.v[1]) { /* Optimize for the case where limb of modulus is zero. */
-        rustsecp256k1_v0_8_1_i128_accum_mul(&cd, modinfo->modulus.v[1], md);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&ce, modinfo->modulus.v[1], me);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&cd, modinfo->modulus.v[1], md);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&ce, modinfo->modulus.v[1], me);
     }
-    d->v[0] = rustsecp256k1_v0_8_1_i128_to_i64(&cd) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cd, 62);
-    e->v[0] = rustsecp256k1_v0_8_1_i128_to_i64(&ce) & M62; rustsecp256k1_v0_8_1_i128_rshift(&ce, 62);
+    d->v[0] = rustsecp256k1_v0_9_0_i128_to_u64(&cd) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cd, 62);
+    e->v[0] = rustsecp256k1_v0_9_0_i128_to_u64(&ce) & M62; rustsecp256k1_v0_9_0_i128_rshift(&ce, 62);
     /* Compute limb 2 of t*[d,e]+modulus*[md,me], and store it as output limb 1. */
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, u, d2);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, v, e2);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, q, d2);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, r, e2);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, u, d2);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, v, e2);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, q, d2);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, r, e2);
     if (modinfo->modulus.v[2]) { /* Optimize for the case where limb of modulus is zero. */
-        rustsecp256k1_v0_8_1_i128_accum_mul(&cd, modinfo->modulus.v[2], md);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&ce, modinfo->modulus.v[2], me);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&cd, modinfo->modulus.v[2], md);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&ce, modinfo->modulus.v[2], me);
     }
-    d->v[1] = rustsecp256k1_v0_8_1_i128_to_i64(&cd) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cd, 62);
-    e->v[1] = rustsecp256k1_v0_8_1_i128_to_i64(&ce) & M62; rustsecp256k1_v0_8_1_i128_rshift(&ce, 62);
+    d->v[1] = rustsecp256k1_v0_9_0_i128_to_u64(&cd) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cd, 62);
+    e->v[1] = rustsecp256k1_v0_9_0_i128_to_u64(&ce) & M62; rustsecp256k1_v0_9_0_i128_rshift(&ce, 62);
     /* Compute limb 3 of t*[d,e]+modulus*[md,me], and store it as output limb 2. */
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, u, d3);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, v, e3);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, q, d3);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, r, e3);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, u, d3);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, v, e3);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, q, d3);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, r, e3);
     if (modinfo->modulus.v[3]) { /* Optimize for the case where limb of modulus is zero. */
-        rustsecp256k1_v0_8_1_i128_accum_mul(&cd, modinfo->modulus.v[3], md);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&ce, modinfo->modulus.v[3], me);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&cd, modinfo->modulus.v[3], md);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&ce, modinfo->modulus.v[3], me);
     }
-    d->v[2] = rustsecp256k1_v0_8_1_i128_to_i64(&cd) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cd, 62);
-    e->v[2] = rustsecp256k1_v0_8_1_i128_to_i64(&ce) & M62; rustsecp256k1_v0_8_1_i128_rshift(&ce, 62);
+    d->v[2] = rustsecp256k1_v0_9_0_i128_to_u64(&cd) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cd, 62);
+    e->v[2] = rustsecp256k1_v0_9_0_i128_to_u64(&ce) & M62; rustsecp256k1_v0_9_0_i128_rshift(&ce, 62);
     /* Compute limb 4 of t*[d,e]+modulus*[md,me], and store it as output limb 3. */
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, u, d4);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, v, e4);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, q, d4);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, r, e4);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cd, modinfo->modulus.v[4], md);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&ce, modinfo->modulus.v[4], me);
-    d->v[3] = rustsecp256k1_v0_8_1_i128_to_i64(&cd) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cd, 62);
-    e->v[3] = rustsecp256k1_v0_8_1_i128_to_i64(&ce) & M62; rustsecp256k1_v0_8_1_i128_rshift(&ce, 62);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, u, d4);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, v, e4);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, q, d4);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, r, e4);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cd, modinfo->modulus.v[4], md);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&ce, modinfo->modulus.v[4], me);
+    d->v[3] = rustsecp256k1_v0_9_0_i128_to_u64(&cd) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cd, 62);
+    e->v[3] = rustsecp256k1_v0_9_0_i128_to_u64(&ce) & M62; rustsecp256k1_v0_9_0_i128_rshift(&ce, 62);
     /* What remains is limb 5 of t*[d,e]+modulus*[md,me]; store it as output limb 4. */
-    d->v[4] = rustsecp256k1_v0_8_1_i128_to_i64(&cd);
-    e->v[4] = rustsecp256k1_v0_8_1_i128_to_i64(&ce);
+    d->v[4] = rustsecp256k1_v0_9_0_i128_to_i64(&cd);
+    e->v[4] = rustsecp256k1_v0_9_0_i128_to_i64(&ce);
 #ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
 #endif
 }
 
@@ -406,51 +501,51 @@ static void rustsecp256k1_v0_8_1_modinv64_update_de_62(rustsecp256k1_v0_8_1_modi
  *
  * This implements the update_fg function from the explanation.
  */
-static void rustsecp256k1_v0_8_1_modinv64_update_fg_62(rustsecp256k1_v0_8_1_modinv64_signed62 *f, rustsecp256k1_v0_8_1_modinv64_signed62 *g, const rustsecp256k1_v0_8_1_modinv64_trans2x2 *t) {
-    const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
+static void rustsecp256k1_v0_9_0_modinv64_update_fg_62(rustsecp256k1_v0_9_0_modinv64_signed62 *f, rustsecp256k1_v0_9_0_modinv64_signed62 *g, const rustsecp256k1_v0_9_0_modinv64_trans2x2 *t) {
+    const uint64_t M62 = UINT64_MAX >> 2;
     const int64_t f0 = f->v[0], f1 = f->v[1], f2 = f->v[2], f3 = f->v[3], f4 = f->v[4];
     const int64_t g0 = g->v[0], g1 = g->v[1], g2 = g->v[2], g3 = g->v[3], g4 = g->v[4];
     const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
-    rustsecp256k1_v0_8_1_int128 cf, cg;
+    rustsecp256k1_v0_9_0_int128 cf, cg;
     /* Start computing t*[f,g]. */
-    rustsecp256k1_v0_8_1_i128_mul(&cf, u, f0);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, v, g0);
-    rustsecp256k1_v0_8_1_i128_mul(&cg, q, f0);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, r, g0);
+    rustsecp256k1_v0_9_0_i128_mul(&cf, u, f0);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, v, g0);
+    rustsecp256k1_v0_9_0_i128_mul(&cg, q, f0);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, r, g0);
     /* Verify that the bottom 62 bits of the result are zero, and then throw them away. */
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_i128_to_i64(&cf) & M62) == 0); rustsecp256k1_v0_8_1_i128_rshift(&cf, 62);
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_i128_to_i64(&cg) & M62) == 0); rustsecp256k1_v0_8_1_i128_rshift(&cg, 62);
+    VERIFY_CHECK((rustsecp256k1_v0_9_0_i128_to_u64(&cf) & M62) == 0); rustsecp256k1_v0_9_0_i128_rshift(&cf, 62);
+    VERIFY_CHECK((rustsecp256k1_v0_9_0_i128_to_u64(&cg) & M62) == 0); rustsecp256k1_v0_9_0_i128_rshift(&cg, 62);
     /* Compute limb 1 of t*[f,g], and store it as output limb 0 (= down shift). */
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, u, f1);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, v, g1);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, q, f1);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, r, g1);
-    f->v[0] = rustsecp256k1_v0_8_1_i128_to_i64(&cf) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cf, 62);
-    g->v[0] = rustsecp256k1_v0_8_1_i128_to_i64(&cg) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cg, 62);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, u, f1);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, v, g1);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, q, f1);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, r, g1);
+    f->v[0] = rustsecp256k1_v0_9_0_i128_to_u64(&cf) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cf, 62);
+    g->v[0] = rustsecp256k1_v0_9_0_i128_to_u64(&cg) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cg, 62);
     /* Compute limb 2 of t*[f,g], and store it as output limb 1. */
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, u, f2);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, v, g2);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, q, f2);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, r, g2);
-    f->v[1] = rustsecp256k1_v0_8_1_i128_to_i64(&cf) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cf, 62);
-    g->v[1] = rustsecp256k1_v0_8_1_i128_to_i64(&cg) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cg, 62);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, u, f2);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, v, g2);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, q, f2);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, r, g2);
+    f->v[1] = rustsecp256k1_v0_9_0_i128_to_u64(&cf) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cf, 62);
+    g->v[1] = rustsecp256k1_v0_9_0_i128_to_u64(&cg) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cg, 62);
     /* Compute limb 3 of t*[f,g], and store it as output limb 2. */
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, u, f3);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, v, g3);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, q, f3);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, r, g3);
-    f->v[2] = rustsecp256k1_v0_8_1_i128_to_i64(&cf) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cf, 62);
-    g->v[2] = rustsecp256k1_v0_8_1_i128_to_i64(&cg) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cg, 62);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, u, f3);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, v, g3);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, q, f3);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, r, g3);
+    f->v[2] = rustsecp256k1_v0_9_0_i128_to_u64(&cf) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cf, 62);
+    g->v[2] = rustsecp256k1_v0_9_0_i128_to_u64(&cg) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cg, 62);
     /* Compute limb 4 of t*[f,g], and store it as output limb 3. */
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, u, f4);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, v, g4);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, q, f4);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, r, g4);
-    f->v[3] = rustsecp256k1_v0_8_1_i128_to_i64(&cf) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cf, 62);
-    g->v[3] = rustsecp256k1_v0_8_1_i128_to_i64(&cg) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cg, 62);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, u, f4);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, v, g4);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, q, f4);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, r, g4);
+    f->v[3] = rustsecp256k1_v0_9_0_i128_to_u64(&cf) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cf, 62);
+    g->v[3] = rustsecp256k1_v0_9_0_i128_to_u64(&cg) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cg, 62);
     /* What remains is limb 5 of t*[f,g]; store it as output limb 4. */
-    f->v[4] = rustsecp256k1_v0_8_1_i128_to_i64(&cf);
-    g->v[4] = rustsecp256k1_v0_8_1_i128_to_i64(&cg);
+    f->v[4] = rustsecp256k1_v0_9_0_i128_to_i64(&cf);
+    g->v[4] = rustsecp256k1_v0_9_0_i128_to_i64(&cg);
 }
 
 /* Compute (t/2^62) * [f, g], where t is a transition matrix for 62 divsteps.
@@ -459,70 +554,70 @@ static void rustsecp256k1_v0_8_1_modinv64_update_fg_62(rustsecp256k1_v0_8_1_modi
  *
  * This implements the update_fg function from the explanation.
  */
-static void rustsecp256k1_v0_8_1_modinv64_update_fg_62_var(int len, rustsecp256k1_v0_8_1_modinv64_signed62 *f, rustsecp256k1_v0_8_1_modinv64_signed62 *g, const rustsecp256k1_v0_8_1_modinv64_trans2x2 *t) {
-    const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
+static void rustsecp256k1_v0_9_0_modinv64_update_fg_62_var(int len, rustsecp256k1_v0_9_0_modinv64_signed62 *f, rustsecp256k1_v0_9_0_modinv64_signed62 *g, const rustsecp256k1_v0_9_0_modinv64_trans2x2 *t) {
+    const uint64_t M62 = UINT64_MAX >> 2;
     const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
     int64_t fi, gi;
-    rustsecp256k1_v0_8_1_int128 cf, cg;
+    rustsecp256k1_v0_9_0_int128 cf, cg;
     int i;
     VERIFY_CHECK(len > 0);
     /* Start computing t*[f,g]. */
     fi = f->v[0];
     gi = g->v[0];
-    rustsecp256k1_v0_8_1_i128_mul(&cf, u, fi);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cf, v, gi);
-    rustsecp256k1_v0_8_1_i128_mul(&cg, q, fi);
-    rustsecp256k1_v0_8_1_i128_accum_mul(&cg, r, gi);
+    rustsecp256k1_v0_9_0_i128_mul(&cf, u, fi);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cf, v, gi);
+    rustsecp256k1_v0_9_0_i128_mul(&cg, q, fi);
+    rustsecp256k1_v0_9_0_i128_accum_mul(&cg, r, gi);
     /* Verify that the bottom 62 bits of the result are zero, and then throw them away. */
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_i128_to_i64(&cf) & M62) == 0); rustsecp256k1_v0_8_1_i128_rshift(&cf, 62);
-    VERIFY_CHECK((rustsecp256k1_v0_8_1_i128_to_i64(&cg) & M62) == 0); rustsecp256k1_v0_8_1_i128_rshift(&cg, 62);
+    VERIFY_CHECK((rustsecp256k1_v0_9_0_i128_to_u64(&cf) & M62) == 0); rustsecp256k1_v0_9_0_i128_rshift(&cf, 62);
+    VERIFY_CHECK((rustsecp256k1_v0_9_0_i128_to_u64(&cg) & M62) == 0); rustsecp256k1_v0_9_0_i128_rshift(&cg, 62);
     /* Now iteratively compute limb i=1..len of t*[f,g], and store them in output limb i-1 (shifting
      * down by 62 bits). */
     for (i = 1; i < len; ++i) {
         fi = f->v[i];
         gi = g->v[i];
-        rustsecp256k1_v0_8_1_i128_accum_mul(&cf, u, fi);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&cf, v, gi);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&cg, q, fi);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&cg, r, gi);
-        f->v[i - 1] = rustsecp256k1_v0_8_1_i128_to_i64(&cf) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cf, 62);
-        g->v[i - 1] = rustsecp256k1_v0_8_1_i128_to_i64(&cg) & M62; rustsecp256k1_v0_8_1_i128_rshift(&cg, 62);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&cf, u, fi);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&cf, v, gi);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&cg, q, fi);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&cg, r, gi);
+        f->v[i - 1] = rustsecp256k1_v0_9_0_i128_to_u64(&cf) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cf, 62);
+        g->v[i - 1] = rustsecp256k1_v0_9_0_i128_to_u64(&cg) & M62; rustsecp256k1_v0_9_0_i128_rshift(&cg, 62);
     }
     /* What remains is limb (len) of t*[f,g]; store it as output limb (len-1). */
-    f->v[len - 1] = rustsecp256k1_v0_8_1_i128_to_i64(&cf);
-    g->v[len - 1] = rustsecp256k1_v0_8_1_i128_to_i64(&cg);
+    f->v[len - 1] = rustsecp256k1_v0_9_0_i128_to_i64(&cf);
+    g->v[len - 1] = rustsecp256k1_v0_9_0_i128_to_i64(&cg);
 }
 
 /* Compute the inverse of x modulo modinfo->modulus, and replace x with it (constant time in x). */
-static void rustsecp256k1_v0_8_1_modinv64(rustsecp256k1_v0_8_1_modinv64_signed62 *x, const rustsecp256k1_v0_8_1_modinv64_modinfo *modinfo) {
+static void rustsecp256k1_v0_9_0_modinv64(rustsecp256k1_v0_9_0_modinv64_signed62 *x, const rustsecp256k1_v0_9_0_modinv64_modinfo *modinfo) {
     /* Start with d=0, e=1, f=modulus, g=x, zeta=-1. */
-    rustsecp256k1_v0_8_1_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
-    rustsecp256k1_v0_8_1_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
-    rustsecp256k1_v0_8_1_modinv64_signed62 f = modinfo->modulus;
-    rustsecp256k1_v0_8_1_modinv64_signed62 g = *x;
+    rustsecp256k1_v0_9_0_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
+    rustsecp256k1_v0_9_0_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
+    rustsecp256k1_v0_9_0_modinv64_signed62 f = modinfo->modulus;
+    rustsecp256k1_v0_9_0_modinv64_signed62 g = *x;
     int i;
     int64_t zeta = -1; /* zeta = -(delta+1/2); delta starts at 1/2. */
 
     /* Do 10 iterations of 59 divsteps each = 590 divsteps. This suffices for 256-bit inputs. */
     for (i = 0; i < 10; ++i) {
         /* Compute transition matrix and new zeta after 59 divsteps. */
-        rustsecp256k1_v0_8_1_modinv64_trans2x2 t;
-        zeta = rustsecp256k1_v0_8_1_modinv64_divsteps_59(zeta, f.v[0], g.v[0], &t);
+        rustsecp256k1_v0_9_0_modinv64_trans2x2 t;
+        zeta = rustsecp256k1_v0_9_0_modinv64_divsteps_59(zeta, f.v[0], g.v[0], &t);
         /* Update d,e using that transition matrix. */
-        rustsecp256k1_v0_8_1_modinv64_update_de_62(&d, &e, &t, modinfo);
+        rustsecp256k1_v0_9_0_modinv64_update_de_62(&d, &e, &t, modinfo);
         /* Update f,g using that transition matrix. */
 #ifdef VERIFY
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
 #endif
-        rustsecp256k1_v0_8_1_modinv64_update_fg_62(&f, &g, &t);
+        rustsecp256k1_v0_9_0_modinv64_update_fg_62(&f, &g, &t);
 #ifdef VERIFY
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
 #endif
     }
 
@@ -531,28 +626,28 @@ static void rustsecp256k1_v0_8_1_modinv64(rustsecp256k1_v0_8_1_modinv64_signed62
      * values i.e. +/- 1, and d now contains +/- the modular inverse. */
 #ifdef VERIFY
     /* g == 0 */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, 5, &SECP256K1_SIGNED62_ONE, 0) == 0);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, 5, &SECP256K1_SIGNED62_ONE, 0) == 0);
     /* |f| == 1, or (x == 0 and d == 0 and |f|=modulus) */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
-                 rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
-                 (rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
-                  rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
-                  (rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) == 0 ||
-                   rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) == 0)));
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
+                 rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
+                 (rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
+                  rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
+                  (rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) == 0 ||
+                   rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) == 0)));
 #endif
 
     /* Optionally negate d, normalize to [0,modulus), and return it. */
-    rustsecp256k1_v0_8_1_modinv64_normalize_62(&d, f.v[4], modinfo);
+    rustsecp256k1_v0_9_0_modinv64_normalize_62(&d, f.v[4], modinfo);
     *x = d;
 }
 
 /* Compute the inverse of x modulo modinfo->modulus, and replace x with it (variable time). */
-static void rustsecp256k1_v0_8_1_modinv64_var(rustsecp256k1_v0_8_1_modinv64_signed62 *x, const rustsecp256k1_v0_8_1_modinv64_modinfo *modinfo) {
+static void rustsecp256k1_v0_9_0_modinv64_var(rustsecp256k1_v0_9_0_modinv64_signed62 *x, const rustsecp256k1_v0_9_0_modinv64_modinfo *modinfo) {
     /* Start with d=0, e=1, f=modulus, g=x, eta=-1. */
-    rustsecp256k1_v0_8_1_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
-    rustsecp256k1_v0_8_1_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
-    rustsecp256k1_v0_8_1_modinv64_signed62 f = modinfo->modulus;
-    rustsecp256k1_v0_8_1_modinv64_signed62 g = *x;
+    rustsecp256k1_v0_9_0_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
+    rustsecp256k1_v0_9_0_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
+    rustsecp256k1_v0_9_0_modinv64_signed62 f = modinfo->modulus;
+    rustsecp256k1_v0_9_0_modinv64_signed62 g = *x;
 #ifdef VERIFY
     int i = 0;
 #endif
@@ -563,18 +658,18 @@ static void rustsecp256k1_v0_8_1_modinv64_var(rustsecp256k1_v0_8_1_modinv64_sign
     /* Do iterations of 62 divsteps each until g=0. */
     while (1) {
         /* Compute transition matrix and new eta after 62 divsteps. */
-        rustsecp256k1_v0_8_1_modinv64_trans2x2 t;
-        eta = rustsecp256k1_v0_8_1_modinv64_divsteps_62_var(eta, f.v[0], g.v[0], &t);
+        rustsecp256k1_v0_9_0_modinv64_trans2x2 t;
+        eta = rustsecp256k1_v0_9_0_modinv64_divsteps_62_var(eta, f.v[0], g.v[0], &t);
         /* Update d,e using that transition matrix. */
-        rustsecp256k1_v0_8_1_modinv64_update_de_62(&d, &e, &t, modinfo);
+        rustsecp256k1_v0_9_0_modinv64_update_de_62(&d, &e, &t, modinfo);
         /* Update f,g using that transition matrix. */
 #ifdef VERIFY
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
 #endif
-        rustsecp256k1_v0_8_1_modinv64_update_fg_62_var(len, &f, &g, &t);
+        rustsecp256k1_v0_9_0_modinv64_update_fg_62_var(len, &f, &g, &t);
         /* If the bottom limb of g is zero, there is a chance that g=0. */
         if (g.v[0] == 0) {
             cond = 0;
@@ -600,10 +695,10 @@ static void rustsecp256k1_v0_8_1_modinv64_var(rustsecp256k1_v0_8_1_modinv64_sign
         }
 #ifdef VERIFY
         VERIFY_CHECK(++i < 12); /* We should never need more than 12*62 = 744 divsteps */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
-        VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
 #endif
     }
 
@@ -611,19 +706,89 @@ static void rustsecp256k1_v0_8_1_modinv64_var(rustsecp256k1_v0_8_1_modinv64_sign
      * the initial f, g values i.e. +/- 1, and d now contains +/- the modular inverse. */
 #ifdef VERIFY
     /* g == 0 */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&g, len, &SECP256K1_SIGNED62_ONE, 0) == 0);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, len, &SECP256K1_SIGNED62_ONE, 0) == 0);
     /* |f| == 1, or (x == 0 and d == 0 and |f|=modulus) */
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
-                 rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
-                 (rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
-                  rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
-                  (rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) == 0 ||
-                   rustsecp256k1_v0_8_1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) == 0)));
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
+                 rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
+                 (rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
+                  rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
+                  (rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) == 0 ||
+                   rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) == 0)));
 #endif
 
     /* Optionally negate d, normalize to [0,modulus), and return it. */
-    rustsecp256k1_v0_8_1_modinv64_normalize_62(&d, f.v[len - 1], modinfo);
+    rustsecp256k1_v0_9_0_modinv64_normalize_62(&d, f.v[len - 1], modinfo);
     *x = d;
 }
 
+/* Do up to 25 iterations of 62 posdivsteps (up to 1550 steps; more is extremely rare) each until f=1.
+ * In VERIFY mode use a lower number of iterations (744, close to the median 756), so failure actually occurs. */
+#ifdef VERIFY
+#define JACOBI64_ITERATIONS 12
+#else
+#define JACOBI64_ITERATIONS 25
+#endif
+
+/* Compute the Jacobi symbol of x modulo modinfo->modulus (variable time). gcd(x,modulus) must be 1. */
+static int rustsecp256k1_v0_9_0_jacobi64_maybe_var(const rustsecp256k1_v0_9_0_modinv64_signed62 *x, const rustsecp256k1_v0_9_0_modinv64_modinfo *modinfo) {
+    /* Start with f=modulus, g=x, eta=-1. */
+    rustsecp256k1_v0_9_0_modinv64_signed62 f = modinfo->modulus;
+    rustsecp256k1_v0_9_0_modinv64_signed62 g = *x;
+    int j, len = 5;
+    int64_t eta = -1; /* eta = -delta; delta is initially 1 */
+    int64_t cond, fn, gn;
+    int jac = 0;
+    int count;
+
+    /* The input limbs must all be non-negative. */
+    VERIFY_CHECK(g.v[0] >= 0 && g.v[1] >= 0 && g.v[2] >= 0 && g.v[3] >= 0 && g.v[4] >= 0);
+
+    /* If x > 0, then if the loop below converges, it converges to f=g=gcd(x,modulus). Since we
+     * require that gcd(x,modulus)=1 and modulus>=3, x cannot be 0. Thus, we must reach f=1 (or
+     * time out). */
+    VERIFY_CHECK((g.v[0] | g.v[1] | g.v[2] | g.v[3] | g.v[4]) != 0);
+
+    for (count = 0; count < JACOBI64_ITERATIONS; ++count) {
+        /* Compute transition matrix and new eta after 62 posdivsteps. */
+        rustsecp256k1_v0_9_0_modinv64_trans2x2 t;
+        eta = rustsecp256k1_v0_9_0_modinv64_posdivsteps_62_var(eta, f.v[0] | ((uint64_t)f.v[1] << 62), g.v[0] | ((uint64_t)g.v[1] << 62), &t, &jac);
+        /* Update f,g using that transition matrix. */
+#ifdef VERIFY
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 0) > 0); /* f > 0 */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 0) > 0); /* g > 0 */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g < modulus */
+#endif
+        rustsecp256k1_v0_9_0_modinv64_update_fg_62_var(len, &f, &g, &t);
+        /* If the bottom limb of f is 1, there is a chance that f=1. */
+        if (f.v[0] == 1) {
+            cond = 0;
+            /* Check if the other limbs are also 0. */
+            for (j = 1; j < len; ++j) {
+                cond |= f.v[j];
+            }
+            /* If so, we're done. When f=1, the Jacobi symbol (g | f)=1. */
+            if (cond == 0) return 1 - 2*(jac & 1);
+        }
+
+        /* Determine if len>1 and limb (len-1) of both f and g is 0. */
+        fn = f.v[len - 1];
+        gn = g.v[len - 1];
+        cond = ((int64_t)len - 2) >> 63;
+        cond |= fn;
+        cond |= gn;
+        /* If so, reduce length. */
+        if (cond == 0) --len;
+#ifdef VERIFY
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 0) > 0); /* f > 0 */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 0) > 0); /* g > 0 */
+        VERIFY_CHECK(rustsecp256k1_v0_9_0_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g < modulus */
+#endif
+    }
+
+    /* The loop failed to converge to f=g after 1550 iterations. Return 0, indicating unknown result. */
+    return 0;
+}
+
 #endif /* SECP256K1_MODINV64_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/ecdh/Makefile.am.include b/secp256k1-sys/depend/secp256k1/src/modules/ecdh/Makefile.am.include
index 7eed62bc0..260aa883d 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/ecdh/Makefile.am.include
+++ b/secp256k1-sys/depend/secp256k1/src/modules/ecdh/Makefile.am.include
@@ -1,4 +1,4 @@
-include_HEADERS += include/rustsecp256k1_v0_8_1_ecdh.h
+include_HEADERS += include/rustsecp256k1_v0_9_0_ecdh.h
 noinst_HEADERS += src/modules/ecdh/main_impl.h
 noinst_HEADERS += src/modules/ecdh/tests_impl.h
 noinst_HEADERS += src/modules/ecdh/bench_impl.h
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/ecdh/bench_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/ecdh/bench_impl.h
index 82060f886..ad665d57a 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/ecdh/bench_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/ecdh/bench_impl.h
@@ -10,8 +10,8 @@
 #include "../../../include/secp256k1_ecdh.h"
 
 typedef struct {
-    rustsecp256k1_v0_8_1_context *ctx;
-    rustsecp256k1_v0_8_1_pubkey point;
+    rustsecp256k1_v0_9_0_context *ctx;
+    rustsecp256k1_v0_9_0_pubkey point;
     unsigned char scalar[32];
 } bench_ecdh_data;
 
@@ -29,7 +29,7 @@ static void bench_ecdh_setup(void* arg) {
     for (i = 0; i < 32; i++) {
         data->scalar[i] = i + 1;
     }
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(data->ctx, &data->point, point, sizeof(point)) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(data->ctx, &data->point, point, sizeof(point)) == 1);
 }
 
 static void bench_ecdh(void* arg, int iters) {
@@ -38,20 +38,20 @@ static void bench_ecdh(void* arg, int iters) {
     bench_ecdh_data *data = (bench_ecdh_data*)arg;
 
     for (i = 0; i < iters; i++) {
-        CHECK(rustsecp256k1_v0_8_1_ecdh(data->ctx, res, &data->point, data->scalar, NULL, NULL) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdh(data->ctx, res, &data->point, data->scalar, NULL, NULL) == 1);
     }
 }
 
-void run_ecdh_bench(int iters, int argc, char** argv) {
+static void run_ecdh_bench(int iters, int argc, char** argv) {
     bench_ecdh_data data;
     int d = argc == 1;
 
     /* create a context with no capabilities */
-    data.ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_FLAGS_TYPE_CONTEXT);
+    data.ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_FLAGS_TYPE_CONTEXT);
 
     if (d || have_flag(argc, argv, "ecdh")) run_benchmark("ecdh", bench_ecdh, bench_ecdh_setup, NULL, &data, 10, iters);
 
-    rustsecp256k1_v0_8_1_context_destroy(data.ctx);
+    rustsecp256k1_v0_9_0_context_destroy(data.ctx);
 }
 
 #endif /* SECP256K1_MODULE_ECDH_BENCH_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/ecdh/main_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/ecdh/main_impl.h
index 5e1db7573..3a1a27107 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/ecdh/main_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/ecdh/main_impl.h
@@ -12,26 +12,26 @@
 
 static int ecdh_hash_function_sha256(unsigned char *output, const unsigned char *x32, const unsigned char *y32, void *data) {
     unsigned char version = (y32[31] & 0x01) | 0x02;
-    rustsecp256k1_v0_8_1_sha256 sha;
+    rustsecp256k1_v0_9_0_sha256 sha;
     (void)data;
 
-    rustsecp256k1_v0_8_1_sha256_initialize(&sha);
-    rustsecp256k1_v0_8_1_sha256_write(&sha, &version, 1);
-    rustsecp256k1_v0_8_1_sha256_write(&sha, x32, 32);
-    rustsecp256k1_v0_8_1_sha256_finalize(&sha, output);
+    rustsecp256k1_v0_9_0_sha256_initialize(&sha);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, &version, 1);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, x32, 32);
+    rustsecp256k1_v0_9_0_sha256_finalize(&sha, output);
 
     return 1;
 }
 
-const rustsecp256k1_v0_8_1_ecdh_hash_function rustsecp256k1_v0_8_1_ecdh_hash_function_sha256 = ecdh_hash_function_sha256;
-const rustsecp256k1_v0_8_1_ecdh_hash_function rustsecp256k1_v0_8_1_ecdh_hash_function_default = ecdh_hash_function_sha256;
+const rustsecp256k1_v0_9_0_ecdh_hash_function rustsecp256k1_v0_9_0_ecdh_hash_function_sha256 = ecdh_hash_function_sha256;
+const rustsecp256k1_v0_9_0_ecdh_hash_function rustsecp256k1_v0_9_0_ecdh_hash_function_default = ecdh_hash_function_sha256;
 
-int rustsecp256k1_v0_8_1_ecdh(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *output, const rustsecp256k1_v0_8_1_pubkey *point, const unsigned char *scalar, rustsecp256k1_v0_8_1_ecdh_hash_function hashfp, void *data) {
+int rustsecp256k1_v0_9_0_ecdh(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *output, const rustsecp256k1_v0_9_0_pubkey *point, const unsigned char *scalar, rustsecp256k1_v0_9_0_ecdh_hash_function hashfp, void *data) {
     int ret = 0;
     int overflow = 0;
-    rustsecp256k1_v0_8_1_gej res;
-    rustsecp256k1_v0_8_1_ge pt;
-    rustsecp256k1_v0_8_1_scalar s;
+    rustsecp256k1_v0_9_0_gej res;
+    rustsecp256k1_v0_9_0_ge pt;
+    rustsecp256k1_v0_9_0_scalar s;
     unsigned char x[32];
     unsigned char y[32];
 
@@ -41,29 +41,29 @@ int rustsecp256k1_v0_8_1_ecdh(const rustsecp256k1_v0_8_1_context* ctx, unsigned
     ARG_CHECK(scalar != NULL);
 
     if (hashfp == NULL) {
-        hashfp = rustsecp256k1_v0_8_1_ecdh_hash_function_default;
+        hashfp = rustsecp256k1_v0_9_0_ecdh_hash_function_default;
     }
 
-    rustsecp256k1_v0_8_1_pubkey_load(ctx, &pt, point);
-    rustsecp256k1_v0_8_1_scalar_set_b32(&s, scalar, &overflow);
+    rustsecp256k1_v0_9_0_pubkey_load(ctx, &pt, point);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&s, scalar, &overflow);
 
-    overflow |= rustsecp256k1_v0_8_1_scalar_is_zero(&s);
-    rustsecp256k1_v0_8_1_scalar_cmov(&s, &rustsecp256k1_v0_8_1_scalar_one, overflow);
+    overflow |= rustsecp256k1_v0_9_0_scalar_is_zero(&s);
+    rustsecp256k1_v0_9_0_scalar_cmov(&s, &rustsecp256k1_v0_9_0_scalar_one, overflow);
 
-    rustsecp256k1_v0_8_1_ecmult_const(&res, &pt, &s, 256);
-    rustsecp256k1_v0_8_1_ge_set_gej(&pt, &res);
+    rustsecp256k1_v0_9_0_ecmult_const(&res, &pt, &s);
+    rustsecp256k1_v0_9_0_ge_set_gej(&pt, &res);
 
     /* Compute a hash of the point */
-    rustsecp256k1_v0_8_1_fe_normalize(&pt.x);
-    rustsecp256k1_v0_8_1_fe_normalize(&pt.y);
-    rustsecp256k1_v0_8_1_fe_get_b32(x, &pt.x);
-    rustsecp256k1_v0_8_1_fe_get_b32(y, &pt.y);
+    rustsecp256k1_v0_9_0_fe_normalize(&pt.x);
+    rustsecp256k1_v0_9_0_fe_normalize(&pt.y);
+    rustsecp256k1_v0_9_0_fe_get_b32(x, &pt.x);
+    rustsecp256k1_v0_9_0_fe_get_b32(y, &pt.y);
 
     ret = hashfp(output, x, y, data);
 
     memset(x, 0, 32);
     memset(y, 0, 32);
-    rustsecp256k1_v0_8_1_scalar_clear(&s);
+    rustsecp256k1_v0_9_0_scalar_clear(&s);
 
     return !!ret & !overflow;
 }
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/ecdh/tests_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/ecdh/tests_impl.h
index 832eeb9b2..03fc1b06a 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/ecdh/tests_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/ecdh/tests_impl.h
@@ -7,7 +7,7 @@
 #ifndef SECP256K1_MODULE_ECDH_TESTS_H
 #define SECP256K1_MODULE_ECDH_TESTS_H
 
-int ecdh_hash_function_test_fail(unsigned char *output, const unsigned char *x, const unsigned char *y, void *data) {
+static int ecdh_hash_function_test_fail(unsigned char *output, const unsigned char *x, const unsigned char *y, void *data) {
     (void)output;
     (void)x;
     (void)y;
@@ -15,7 +15,7 @@ int ecdh_hash_function_test_fail(unsigned char *output, const unsigned char *x,
     return 0;
 }
 
-int ecdh_hash_function_custom(unsigned char *output, const unsigned char *x, const unsigned char *y, void *data) {
+static int ecdh_hash_function_custom(unsigned char *output, const unsigned char *x, const unsigned char *y, void *data) {
     (void)data;
     /* Save x and y as uncompressed public key */
     output[0] = 0x04;
@@ -24,77 +24,77 @@ int ecdh_hash_function_custom(unsigned char *output, const unsigned char *x, con
     return 1;
 }
 
-void test_ecdh_api(void) {
+static void test_ecdh_api(void) {
     /* Setup context that just counts errors */
-    rustsecp256k1_v0_8_1_context *tctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
-    rustsecp256k1_v0_8_1_pubkey point;
+    rustsecp256k1_v0_9_0_context *tctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
+    rustsecp256k1_v0_9_0_pubkey point;
     unsigned char res[32];
     unsigned char s_one[32] = { 0 };
     int32_t ecount = 0;
     s_one[31] = 1;
 
-    rustsecp256k1_v0_8_1_context_set_error_callback(tctx, counting_illegal_callback_fn, &ecount);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(tctx, counting_illegal_callback_fn, &ecount);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(tctx, &point, s_one) == 1);
+    rustsecp256k1_v0_9_0_context_set_error_callback(tctx, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(tctx, counting_illegal_callback_fn, &ecount);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(tctx, &point, s_one) == 1);
 
     /* Check all NULLs are detected */
-    CHECK(rustsecp256k1_v0_8_1_ecdh(tctx, res, &point, s_one, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(tctx, res, &point, s_one, NULL, NULL) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_ecdh(tctx, NULL, &point, s_one, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(tctx, NULL, &point, s_one, NULL, NULL) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdh(tctx, res, NULL, s_one, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(tctx, res, NULL, s_one, NULL, NULL) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ecdh(tctx, res, &point, NULL, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(tctx, res, &point, NULL, NULL, NULL) == 0);
     CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_ecdh(tctx, res, &point, s_one, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(tctx, res, &point, s_one, NULL, NULL) == 1);
     CHECK(ecount == 3);
 
     /* Cleanup */
-    rustsecp256k1_v0_8_1_context_destroy(tctx);
+    rustsecp256k1_v0_9_0_context_destroy(tctx);
 }
 
-void test_ecdh_generator_basepoint(void) {
+static void test_ecdh_generator_basepoint(void) {
     unsigned char s_one[32] = { 0 };
-    rustsecp256k1_v0_8_1_pubkey point[2];
+    rustsecp256k1_v0_9_0_pubkey point[2];
     int i;
 
     s_one[31] = 1;
     /* Check against pubkey creation when the basepoint is the generator */
-    for (i = 0; i < 2 * count; ++i) {
-        rustsecp256k1_v0_8_1_sha256 sha;
+    for (i = 0; i < 2 * COUNT; ++i) {
+        rustsecp256k1_v0_9_0_sha256 sha;
         unsigned char s_b32[32];
         unsigned char output_ecdh[65];
         unsigned char output_ser[32];
         unsigned char point_ser[65];
         size_t point_ser_len = sizeof(point_ser);
-        rustsecp256k1_v0_8_1_scalar s;
+        rustsecp256k1_v0_9_0_scalar s;
 
         random_scalar_order(&s);
-        rustsecp256k1_v0_8_1_scalar_get_b32(s_b32, &s);
+        rustsecp256k1_v0_9_0_scalar_get_b32(s_b32, &s);
 
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &point[0], s_one) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &point[1], s_b32) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &point[0], s_one) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &point[1], s_b32) == 1);
 
         /* compute using ECDH function with custom hash function */
-        CHECK(rustsecp256k1_v0_8_1_ecdh(ctx, output_ecdh, &point[0], s_b32, ecdh_hash_function_custom, NULL) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdh(CTX, output_ecdh, &point[0], s_b32, ecdh_hash_function_custom, NULL) == 1);
         /* compute "explicitly" */
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, point_ser, &point_ser_len, &point[1], SECP256K1_EC_UNCOMPRESSED) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, point_ser, &point_ser_len, &point[1], SECP256K1_EC_UNCOMPRESSED) == 1);
         /* compare */
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(output_ecdh, point_ser, 65) == 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(output_ecdh, point_ser, 65) == 0);
 
         /* compute using ECDH function with default hash function */
-        CHECK(rustsecp256k1_v0_8_1_ecdh(ctx, output_ecdh, &point[0], s_b32, NULL, NULL) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdh(CTX, output_ecdh, &point[0], s_b32, NULL, NULL) == 1);
         /* compute "explicitly" */
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, point_ser, &point_ser_len, &point[1], SECP256K1_EC_COMPRESSED) == 1);
-        rustsecp256k1_v0_8_1_sha256_initialize(&sha);
-        rustsecp256k1_v0_8_1_sha256_write(&sha, point_ser, point_ser_len);
-        rustsecp256k1_v0_8_1_sha256_finalize(&sha, output_ser);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, point_ser, &point_ser_len, &point[1], SECP256K1_EC_COMPRESSED) == 1);
+        rustsecp256k1_v0_9_0_sha256_initialize(&sha);
+        rustsecp256k1_v0_9_0_sha256_write(&sha, point_ser, point_ser_len);
+        rustsecp256k1_v0_9_0_sha256_finalize(&sha, output_ser);
         /* compare */
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(output_ecdh, output_ser, 32) == 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(output_ecdh, output_ser, 32) == 0);
     }
 }
 
-void test_bad_scalar(void) {
+static void test_bad_scalar(void) {
     unsigned char s_zero[32] = { 0 };
     unsigned char s_overflow[32] = {
         0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
@@ -104,29 +104,29 @@ void test_bad_scalar(void) {
     };
     unsigned char s_rand[32] = { 0 };
     unsigned char output[32];
-    rustsecp256k1_v0_8_1_scalar rand;
-    rustsecp256k1_v0_8_1_pubkey point;
+    rustsecp256k1_v0_9_0_scalar rand;
+    rustsecp256k1_v0_9_0_pubkey point;
 
     /* Create random point */
     random_scalar_order(&rand);
-    rustsecp256k1_v0_8_1_scalar_get_b32(s_rand, &rand);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &point, s_rand) == 1);
+    rustsecp256k1_v0_9_0_scalar_get_b32(s_rand, &rand);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &point, s_rand) == 1);
 
     /* Try to multiply it by bad values */
-    CHECK(rustsecp256k1_v0_8_1_ecdh(ctx, output, &point, s_zero, NULL, NULL) == 0);
-    CHECK(rustsecp256k1_v0_8_1_ecdh(ctx, output, &point, s_overflow, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(CTX, output, &point, s_zero, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(CTX, output, &point, s_overflow, NULL, NULL) == 0);
     /* ...and a good one */
     s_overflow[31] -= 1;
-    CHECK(rustsecp256k1_v0_8_1_ecdh(ctx, output, &point, s_overflow, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(CTX, output, &point, s_overflow, NULL, NULL) == 1);
 
     /* Hash function failure results in ecdh failure */
-    CHECK(rustsecp256k1_v0_8_1_ecdh(ctx, output, &point, s_overflow, ecdh_hash_function_test_fail, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(CTX, output, &point, s_overflow, ecdh_hash_function_test_fail, NULL) == 0);
 }
 
 /** Test that ECDH(sG, 1/s) == ECDH((1/s)G, s) == ECDH(G, 1) for a few random s. */
-void test_result_basepoint(void) {
-    rustsecp256k1_v0_8_1_pubkey point;
-    rustsecp256k1_v0_8_1_scalar rand;
+static void test_result_basepoint(void) {
+    rustsecp256k1_v0_9_0_pubkey point;
+    rustsecp256k1_v0_9_0_scalar rand;
     unsigned char s[32];
     unsigned char s_inv[32];
     unsigned char out[32];
@@ -136,26 +136,26 @@ void test_result_basepoint(void) {
 
     unsigned char s_one[32] = { 0 };
     s_one[31] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &point, s_one) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdh(ctx, out_base, &point, s_one, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &point, s_one) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdh(CTX, out_base, &point, s_one, NULL, NULL) == 1);
 
-    for (i = 0; i < 2 * count; i++) {
+    for (i = 0; i < 2 * COUNT; i++) {
         random_scalar_order(&rand);
-        rustsecp256k1_v0_8_1_scalar_get_b32(s, &rand);
-        rustsecp256k1_v0_8_1_scalar_inverse(&rand, &rand);
-        rustsecp256k1_v0_8_1_scalar_get_b32(s_inv, &rand);
+        rustsecp256k1_v0_9_0_scalar_get_b32(s, &rand);
+        rustsecp256k1_v0_9_0_scalar_inverse(&rand, &rand);
+        rustsecp256k1_v0_9_0_scalar_get_b32(s_inv, &rand);
 
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &point, s) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdh(ctx, out, &point, s_inv, NULL, NULL) == 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(out, out_base, 32) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &point, s) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdh(CTX, out, &point, s_inv, NULL, NULL) == 1);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, out_base, 32) == 0);
 
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &point, s_inv) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdh(ctx, out_inv, &point, s, NULL, NULL) == 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(out_inv, out_base, 32) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &point, s_inv) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdh(CTX, out_inv, &point, s, NULL, NULL) == 1);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out_inv, out_base, 32) == 0);
     }
 }
 
-void run_ecdh_tests(void) {
+static void run_ecdh_tests(void) {
     test_ecdh_api();
     test_ecdh_generator_basepoint();
     test_bad_scalar();
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/ellswift/Makefile.am.include b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/Makefile.am.include
new file mode 100644
index 000000000..4e0045e33
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/Makefile.am.include
@@ -0,0 +1,5 @@
+include_HEADERS += include/rustsecp256k1_v0_9_0_ellswift.h
+noinst_HEADERS += src/modules/ellswift/bench_impl.h
+noinst_HEADERS += src/modules/ellswift/main_impl.h
+noinst_HEADERS += src/modules/ellswift/tests_impl.h
+noinst_HEADERS += src/modules/ellswift/tests_exhaustive_impl.h
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/ellswift/bench_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/bench_impl.h
new file mode 100644
index 000000000..e9ec83e5b
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/bench_impl.h
@@ -0,0 +1,106 @@
+/***********************************************************************
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_ELLSWIFT_BENCH_H
+#define SECP256K1_MODULE_ELLSWIFT_BENCH_H
+
+#include "../../../include/secp256k1_ellswift.h"
+
+typedef struct {
+    rustsecp256k1_v0_9_0_context *ctx;
+    rustsecp256k1_v0_9_0_pubkey point[256];
+    unsigned char rnd64[64];
+} bench_ellswift_data;
+
+static void bench_ellswift_setup(void *arg) {
+    int i;
+    bench_ellswift_data *data = (bench_ellswift_data*)arg;
+    static const unsigned char init[64] = {
+        0x78, 0x1f, 0xb7, 0xd4, 0x67, 0x7f, 0x08, 0x68,
+        0xdb, 0xe3, 0x1d, 0x7f, 0x1b, 0xb0, 0xf6, 0x9e,
+        0x0a, 0x64, 0xca, 0x32, 0x9e, 0xc6, 0x20, 0x79,
+        0x03, 0xf3, 0xd0, 0x46, 0x7a, 0x0f, 0xd2, 0x21,
+        0xb0, 0x2c, 0x46, 0xd8, 0xba, 0xca, 0x26, 0x4f,
+        0x8f, 0x8c, 0xd4, 0xdd, 0x2d, 0x04, 0xbe, 0x30,
+        0x48, 0x51, 0x1e, 0xd4, 0x16, 0xfd, 0x42, 0x85,
+        0x62, 0xc9, 0x02, 0xf9, 0x89, 0x84, 0xff, 0xdc
+    };
+    memcpy(data->rnd64, init, 64);
+    for (i = 0; i < 256; ++i) {
+        int j;
+        CHECK(rustsecp256k1_v0_9_0_ellswift_decode(data->ctx, &data->point[i], data->rnd64));
+        for (j = 0; j < 64; ++j) {
+            data->rnd64[j] += 1;
+        }
+    }
+    CHECK(rustsecp256k1_v0_9_0_ellswift_encode(data->ctx, data->rnd64, &data->point[255], init + 16));
+}
+
+static void bench_ellswift_encode(void *arg, int iters) {
+    int i;
+    bench_ellswift_data *data = (bench_ellswift_data*)arg;
+
+    for (i = 0; i < iters; i++) {
+        CHECK(rustsecp256k1_v0_9_0_ellswift_encode(data->ctx, data->rnd64, &data->point[i & 255], data->rnd64 + 16));
+    }
+}
+
+static void bench_ellswift_create(void *arg, int iters) {
+    int i;
+    bench_ellswift_data *data = (bench_ellswift_data*)arg;
+
+    for (i = 0; i < iters; i++) {
+        unsigned char buf[64];
+        CHECK(rustsecp256k1_v0_9_0_ellswift_create(data->ctx, buf, data->rnd64, data->rnd64 + 32));
+        memcpy(data->rnd64, buf, 64);
+    }
+}
+
+static void bench_ellswift_decode(void *arg, int iters) {
+    int i;
+    rustsecp256k1_v0_9_0_pubkey out;
+    size_t len;
+    bench_ellswift_data *data = (bench_ellswift_data*)arg;
+
+    for (i = 0; i < iters; i++) {
+        CHECK(rustsecp256k1_v0_9_0_ellswift_decode(data->ctx, &out, data->rnd64) == 1);
+        len = 33;
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(data->ctx, data->rnd64 + (i % 32), &len, &out, SECP256K1_EC_COMPRESSED));
+    }
+}
+
+static void bench_ellswift_xdh(void *arg, int iters) {
+    int i;
+    bench_ellswift_data *data = (bench_ellswift_data*)arg;
+
+    for (i = 0; i < iters; i++) {
+        int party = i & 1;
+        CHECK(rustsecp256k1_v0_9_0_ellswift_xdh(data->ctx,
+                                     data->rnd64 + (i % 33),
+                                     data->rnd64,
+                                     data->rnd64,
+                                     data->rnd64 + ((i + 16) % 33),
+                                     party,
+                                     rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_bip324,
+                                     NULL) == 1);
+    }
+}
+
+void run_ellswift_bench(int iters, int argc, char **argv) {
+    bench_ellswift_data data;
+    int d = argc == 1;
+
+    /* create a context with signing capabilities */
+    data.ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
+
+    if (d || have_flag(argc, argv, "ellswift") || have_flag(argc, argv, "encode") || have_flag(argc, argv, "ellswift_encode")) run_benchmark("ellswift_encode", bench_ellswift_encode, bench_ellswift_setup, NULL, &data, 10, iters);
+    if (d || have_flag(argc, argv, "ellswift") || have_flag(argc, argv, "decode") || have_flag(argc, argv, "ellswift_decode")) run_benchmark("ellswift_decode", bench_ellswift_decode, bench_ellswift_setup, NULL, &data, 10, iters);
+    if (d || have_flag(argc, argv, "ellswift") || have_flag(argc, argv, "keygen") || have_flag(argc, argv, "ellswift_keygen")) run_benchmark("ellswift_keygen", bench_ellswift_create, bench_ellswift_setup, NULL, &data, 10, iters);
+    if (d || have_flag(argc, argv, "ellswift") || have_flag(argc, argv, "ecdh") || have_flag(argc, argv, "ellswift_ecdh")) run_benchmark("ellswift_ecdh", bench_ellswift_xdh, bench_ellswift_setup, NULL, &data, 10, iters);
+
+    rustsecp256k1_v0_9_0_context_destroy(data.ctx);
+}
+
+#endif
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/ellswift/main_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/main_impl.h
new file mode 100644
index 000000000..4205d20fe
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/main_impl.h
@@ -0,0 +1,589 @@
+/***********************************************************************
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_ELLSWIFT_MAIN_H
+#define SECP256K1_MODULE_ELLSWIFT_MAIN_H
+
+#include "../../../include/secp256k1.h"
+#include "../../../include/secp256k1_ellswift.h"
+#include "../../eckey.h"
+#include "../../hash.h"
+
+/** c1 = (sqrt(-3)-1)/2 */
+static const rustsecp256k1_v0_9_0_fe rustsecp256k1_v0_9_0_ellswift_c1 = SECP256K1_FE_CONST(0x851695d4, 0x9a83f8ef, 0x919bb861, 0x53cbcb16, 0x630fb68a, 0xed0a766a, 0x3ec693d6, 0x8e6afa40);
+/** c2 = (-sqrt(-3)-1)/2 = -(c1+1) */
+static const rustsecp256k1_v0_9_0_fe rustsecp256k1_v0_9_0_ellswift_c2 = SECP256K1_FE_CONST(0x7ae96a2b, 0x657c0710, 0x6e64479e, 0xac3434e9, 0x9cf04975, 0x12f58995, 0xc1396c28, 0x719501ee);
+/** c3 = (-sqrt(-3)+1)/2 = -c1 = c2+1 */
+static const rustsecp256k1_v0_9_0_fe rustsecp256k1_v0_9_0_ellswift_c3 = SECP256K1_FE_CONST(0x7ae96a2b, 0x657c0710, 0x6e64479e, 0xac3434e9, 0x9cf04975, 0x12f58995, 0xc1396c28, 0x719501ef);
+/** c4 = (sqrt(-3)+1)/2 = -c2 = c1+1 */
+static const rustsecp256k1_v0_9_0_fe rustsecp256k1_v0_9_0_ellswift_c4 = SECP256K1_FE_CONST(0x851695d4, 0x9a83f8ef, 0x919bb861, 0x53cbcb16, 0x630fb68a, 0xed0a766a, 0x3ec693d6, 0x8e6afa41);
+
+/** Decode ElligatorSwift encoding (u, t) to a fraction xn/xd representing a curve X coordinate. */
+static void rustsecp256k1_v0_9_0_ellswift_xswiftec_frac_var(rustsecp256k1_v0_9_0_fe *xn, rustsecp256k1_v0_9_0_fe *xd, const rustsecp256k1_v0_9_0_fe *u, const rustsecp256k1_v0_9_0_fe *t) {
+    /* The implemented algorithm is the following (all operations in GF(p)):
+     *
+     * - Let c0 = sqrt(-3) = 0xa2d2ba93507f1df233770c2a797962cc61f6d15da14ecd47d8d27ae1cd5f852.
+     * - If u = 0, set u = 1.
+     * - If t = 0, set t = 1.
+     * - If u^3+7+t^2 = 0, set t = 2*t.
+     * - Let X = (u^3+7-t^2)/(2*t).
+     * - Let Y = (X+t)/(c0*u).
+     * - If x3 = u+4*Y^2 is a valid x coordinate, return it.
+     * - If x2 = (-X/Y-u)/2 is a valid x coordinate, return it.
+     * - Return x1 = (X/Y-u)/2 (which is now guaranteed to be a valid x coordinate).
+     *
+     * Introducing s=t^2, g=u^3+7, and simplifying x1=-(x2+u) we get:
+     *
+     * - Let c0 = ...
+     * - If u = 0, set u = 1.
+     * - If t = 0, set t = 1.
+     * - Let s = t^2
+     * - Let g = u^3+7
+     * - If g+s = 0, set t = 2*t, s = 4*s
+     * - Let X = (g-s)/(2*t).
+     * - Let Y = (X+t)/(c0*u) = (g+s)/(2*c0*t*u).
+     * - If x3 = u+4*Y^2 is a valid x coordinate, return it.
+     * - If x2 = (-X/Y-u)/2 is a valid x coordinate, return it.
+     * - Return x1 = -(x2+u).
+     *
+     * Now substitute Y^2 = -(g+s)^2/(12*s*u^2) and X/Y = c0*u*(g-s)/(g+s). This
+     * means X and Y do not need to be evaluated explicitly anymore.
+     *
+     * - ...
+     * - If g+s = 0, set s = 4*s.
+     * - If x3 = u-(g+s)^2/(3*s*u^2) is a valid x coordinate, return it.
+     * - If x2 = (-c0*u*(g-s)/(g+s)-u)/2 is a valid x coordinate, return it.
+     * - Return x1 = -(x2+u).
+     *
+     * Simplifying x2 using 2 additional constants:
+     *
+     * - Let c1 = (c0-1)/2 = 0x851695d49a83f8ef919bb86153cbcb16630fb68aed0a766a3ec693d68e6afa40.
+     * - Let c2 = (-c0-1)/2 = 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee.
+     * - ...
+     * - If x2 = u*(c1*s+c2*g)/(g+s) is a valid x coordinate, return it.
+     * - ...
+     *
+     * Writing x3 as a fraction:
+     *
+     * - ...
+     * - If x3 = (3*s*u^3-(g+s)^2)/(3*s*u^2) ...
+     * - ...
+
+     * Overall, we get:
+     *
+     * - Let c1 = 0x851695d49a83f8ef919bb86153cbcb16630fb68aed0a766a3ec693d68e6afa40.
+     * - Let c2 = 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee.
+     * - If u = 0, set u = 1.
+     * - If t = 0, set s = 1, else set s = t^2.
+     * - Let g = u^3+7.
+     * - If g+s = 0, set s = 4*s.
+     * - If x3 = (3*s*u^3-(g+s)^2)/(3*s*u^2) is a valid x coordinate, return it.
+     * - If x2 = u*(c1*s+c2*g)/(g+s) is a valid x coordinate, return it.
+     * - Return x1 = -(x2+u).
+     */
+    rustsecp256k1_v0_9_0_fe u1, s, g, p, d, n, l;
+    u1 = *u;
+    if (EXPECT(rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&u1), 0)) u1 = rustsecp256k1_v0_9_0_fe_one;
+    rustsecp256k1_v0_9_0_fe_sqr(&s, t);
+    if (EXPECT(rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(t), 0)) s = rustsecp256k1_v0_9_0_fe_one;
+    rustsecp256k1_v0_9_0_fe_sqr(&l, &u1);                                   /* l = u^2 */
+    rustsecp256k1_v0_9_0_fe_mul(&g, &l, &u1);                               /* g = u^3 */
+    rustsecp256k1_v0_9_0_fe_add_int(&g, SECP256K1_B);                       /* g = u^3 + 7 */
+    p = g;                                                       /* p = g */
+    rustsecp256k1_v0_9_0_fe_add(&p, &s);                                    /* p = g+s */
+    if (EXPECT(rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&p), 0)) {
+        rustsecp256k1_v0_9_0_fe_mul_int(&s, 4);
+        /* Recompute p = g+s */
+        p = g;                                                   /* p = g */
+        rustsecp256k1_v0_9_0_fe_add(&p, &s);                                /* p = g+s */
+    }
+    rustsecp256k1_v0_9_0_fe_mul(&d, &s, &l);                                /* d = s*u^2 */
+    rustsecp256k1_v0_9_0_fe_mul_int(&d, 3);                                 /* d = 3*s*u^2 */
+    rustsecp256k1_v0_9_0_fe_sqr(&l, &p);                                    /* l = (g+s)^2 */
+    rustsecp256k1_v0_9_0_fe_negate(&l, &l, 1);                              /* l = -(g+s)^2 */
+    rustsecp256k1_v0_9_0_fe_mul(&n, &d, &u1);                               /* n = 3*s*u^3 */
+    rustsecp256k1_v0_9_0_fe_add(&n, &l);                                    /* n = 3*s*u^3-(g+s)^2 */
+    if (rustsecp256k1_v0_9_0_ge_x_frac_on_curve_var(&n, &d)) {
+        /* Return x3 = n/d = (3*s*u^3-(g+s)^2)/(3*s*u^2) */
+        *xn = n;
+        *xd = d;
+        return;
+    }
+    *xd = p;
+    rustsecp256k1_v0_9_0_fe_mul(&l, &rustsecp256k1_v0_9_0_ellswift_c1, &s);            /* l = c1*s */
+    rustsecp256k1_v0_9_0_fe_mul(&n, &rustsecp256k1_v0_9_0_ellswift_c2, &g);            /* n = c2*g */
+    rustsecp256k1_v0_9_0_fe_add(&n, &l);                                    /* n = c1*s+c2*g */
+    rustsecp256k1_v0_9_0_fe_mul(&n, &n, &u1);                               /* n = u*(c1*s+c2*g) */
+    /* Possible optimization: in the invocation below, p^2 = (g+s)^2 is computed,
+     * which we already have computed above. This could be deduplicated. */
+    if (rustsecp256k1_v0_9_0_ge_x_frac_on_curve_var(&n, &p)) {
+        /* Return x2 = n/p = u*(c1*s+c2*g)/(g+s) */
+        *xn = n;
+        return;
+    }
+    rustsecp256k1_v0_9_0_fe_mul(&l, &p, &u1);                               /* l = u*(g+s) */
+    rustsecp256k1_v0_9_0_fe_add(&n, &l);                                    /* n = u*(c1*s+c2*g)+u*(g+s) */
+    rustsecp256k1_v0_9_0_fe_negate(xn, &n, 2);                              /* n = -u*(c1*s+c2*g)-u*(g+s) */
+#ifdef VERIFY
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_ge_x_frac_on_curve_var(xn, &p));
+#endif
+    /* Return x3 = n/p = -(u*(c1*s+c2*g)/(g+s)+u) */
+}
+
+/** Decode ElligatorSwift encoding (u, t) to X coordinate. */
+static void rustsecp256k1_v0_9_0_ellswift_xswiftec_var(rustsecp256k1_v0_9_0_fe *x, const rustsecp256k1_v0_9_0_fe *u, const rustsecp256k1_v0_9_0_fe *t) {
+    rustsecp256k1_v0_9_0_fe xn, xd;
+    rustsecp256k1_v0_9_0_ellswift_xswiftec_frac_var(&xn, &xd, u, t);
+    rustsecp256k1_v0_9_0_fe_inv_var(&xd, &xd);
+    rustsecp256k1_v0_9_0_fe_mul(x, &xn, &xd);
+}
+
+/** Decode ElligatorSwift encoding (u, t) to point P. */
+static void rustsecp256k1_v0_9_0_ellswift_swiftec_var(rustsecp256k1_v0_9_0_ge *p, const rustsecp256k1_v0_9_0_fe *u, const rustsecp256k1_v0_9_0_fe *t) {
+    rustsecp256k1_v0_9_0_fe x;
+    rustsecp256k1_v0_9_0_ellswift_xswiftec_var(&x, u, t);
+    rustsecp256k1_v0_9_0_ge_set_xo_var(p, &x, rustsecp256k1_v0_9_0_fe_is_odd(t));
+}
+
+/* Try to complete an ElligatorSwift encoding (u, t) for X coordinate x, given u and x.
+ *
+ * There may be up to 8 distinct t values such that (u, t) decodes back to x, but also
+ * fewer, or none at all. Each such partial inverse can be accessed individually using a
+ * distinct input argument c (in range 0-7), and some or all of these may return failure.
+ * The following guarantees exist:
+ * - Given (x, u), no two distinct c values give the same successful result t.
+ * - Every successful result maps back to x through rustsecp256k1_v0_9_0_ellswift_xswiftec_var.
+ * - Given (x, u), all t values that map back to x can be reached by combining the
+ *   successful results from this function over all c values, with the exception of:
+ *   - this function cannot be called with u=0
+ *   - no result with t=0 will be returned
+ *   - no result for which u^3 + t^2 + 7 = 0 will be returned.
+ *
+ * The rather unusual encoding of bits in c (a large "if" based on the middle bit, and then
+ * using the low and high bits to pick signs of square roots) is to match the paper's
+ * encoding more closely: c=0 through c=3 match branches 1..4 in the paper, while c=4 through
+ * c=7 are copies of those with an additional negation of sqrt(w).
+ */
+static int rustsecp256k1_v0_9_0_ellswift_xswiftec_inv_var(rustsecp256k1_v0_9_0_fe *t, const rustsecp256k1_v0_9_0_fe *x_in, const rustsecp256k1_v0_9_0_fe *u_in, int c) {
+    /* The implemented algorithm is this (all arithmetic, except involving c, is mod p):
+     *
+     * - If (c & 2) = 0:
+     *   - If (-x-u) is a valid X coordinate, fail.
+     *   - Let s=-(u^3+7)/(u^2+u*x+x^2).
+     *   - If s is not square, fail.
+     *   - Let v=x.
+     * - If (c & 2) = 2:
+     *   - Let s=x-u.
+     *   - If s is not square, fail.
+     *   - Let r=sqrt(-s*(4*(u^3+7)+3*u^2*s)); fail if it doesn't exist.
+     *   - If (c & 1) = 1 and r = 0, fail.
+     *   - If s=0, fail.
+     *   - Let v=(r/s-u)/2.
+     * - Let w=sqrt(s).
+     * - If (c & 5) = 0: return -w*(c3*u + v).
+     * - If (c & 5) = 1: return  w*(c4*u + v).
+     * - If (c & 5) = 4: return  w*(c3*u + v).
+     * - If (c & 5) = 5: return -w*(c4*u + v).
+     */
+    rustsecp256k1_v0_9_0_fe x = *x_in, u = *u_in, g, v, s, m, r, q;
+    int ret;
+
+    rustsecp256k1_v0_9_0_fe_normalize_weak(&x);
+    rustsecp256k1_v0_9_0_fe_normalize_weak(&u);
+
+#ifdef VERIFY
+    VERIFY_CHECK(c >= 0 && c < 8);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_ge_x_on_curve_var(&x));
+#endif
+
+    if (!(c & 2)) {
+        /* c is in {0, 1, 4, 5}. In this case we look for an inverse under the x1 (if c=0 or
+         * c=4) formula, or x2 (if c=1 or c=5) formula. */
+
+        /* If -u-x is a valid X coordinate, fail. This would yield an encoding that roundtrips
+         * back under the x3 formula instead (which has priority over x1 and x2, so the decoding
+         * would not match x). */
+        m = x;                                          /* m = x */
+        rustsecp256k1_v0_9_0_fe_add(&m, &u);                       /* m = u+x */
+        rustsecp256k1_v0_9_0_fe_negate(&m, &m, 2);                 /* m = -u-x */
+        /* Test if (-u-x) is a valid X coordinate. If so, fail. */
+        if (rustsecp256k1_v0_9_0_ge_x_on_curve_var(&m)) return 0;
+
+        /* Let s = -(u^3 + 7)/(u^2 + u*x + x^2) [first part] */
+        rustsecp256k1_v0_9_0_fe_sqr(&s, &m);                       /* s = (u+x)^2 */
+        rustsecp256k1_v0_9_0_fe_negate(&s, &s, 1);                 /* s = -(u+x)^2 */
+        rustsecp256k1_v0_9_0_fe_mul(&m, &u, &x);                   /* m = u*x */
+        rustsecp256k1_v0_9_0_fe_add(&s, &m);                       /* s = -(u^2 + u*x + x^2) */
+
+        /* Note that at this point, s = 0 is impossible. If it were the case:
+         *             s = -(u^2 + u*x + x^2) = 0
+         * =>                 u^2 + u*x + x^2 = 0
+         * =>   (u + 2*x) * (u^2 + u*x + x^2) = 0
+         * => 2*x^3 + 3*x^2*u + 3*x*u^2 + u^3 = 0
+         * =>                 (x + u)^3 + x^3 = 0
+         * =>                             x^3 = -(x + u)^3
+         * =>                         x^3 + B = (-u - x)^3 + B
+         *
+         * However, we know x^3 + B is square (because x is on the curve) and
+         * that (-u-x)^3 + B is not square (the rustsecp256k1_v0_9_0_ge_x_on_curve_var(&m)
+         * test above would have failed). This is a contradiction, and thus the
+         * assumption s=0 is false. */
+#ifdef VERIFY
+        VERIFY_CHECK(!rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&s));
+#endif
+
+        /* If s is not square, fail. We have not fully computed s yet, but s is square iff
+         * -(u^3+7)*(u^2+u*x+x^2) is square (because a/b is square iff a*b is square and b is
+         * nonzero). */
+        rustsecp256k1_v0_9_0_fe_sqr(&g, &u);                       /* g = u^2 */
+        rustsecp256k1_v0_9_0_fe_mul(&g, &g, &u);                   /* g = u^3 */
+        rustsecp256k1_v0_9_0_fe_add_int(&g, SECP256K1_B);          /* g = u^3+7 */
+        rustsecp256k1_v0_9_0_fe_mul(&m, &s, &g);                   /* m = -(u^3 + 7)*(u^2 + u*x + x^2) */
+        if (!rustsecp256k1_v0_9_0_fe_is_square_var(&m)) return 0;
+
+        /* Let s = -(u^3 + 7)/(u^2 + u*x + x^2) [second part] */
+        rustsecp256k1_v0_9_0_fe_inv_var(&s, &s);                   /* s = -1/(u^2 + u*x + x^2) [no div by 0] */
+        rustsecp256k1_v0_9_0_fe_mul(&s, &s, &g);                   /* s = -(u^3 + 7)/(u^2 + u*x + x^2) */
+
+        /* Let v = x. */
+        v = x;
+    } else {
+        /* c is in {2, 3, 6, 7}. In this case we look for an inverse under the x3 formula. */
+
+        /* Let s = x-u. */
+        rustsecp256k1_v0_9_0_fe_negate(&m, &u, 1);                 /* m = -u */
+        s = m;                                          /* s = -u */
+        rustsecp256k1_v0_9_0_fe_add(&s, &x);                       /* s = x-u */
+
+        /* If s is not square, fail. */
+        if (!rustsecp256k1_v0_9_0_fe_is_square_var(&s)) return 0;
+
+        /* Let r = sqrt(-s*(4*(u^3+7)+3*u^2*s)); fail if it doesn't exist. */
+        rustsecp256k1_v0_9_0_fe_sqr(&g, &u);                       /* g = u^2 */
+        rustsecp256k1_v0_9_0_fe_mul(&q, &s, &g);                   /* q = s*u^2 */
+        rustsecp256k1_v0_9_0_fe_mul_int(&q, 3);                    /* q = 3*s*u^2 */
+        rustsecp256k1_v0_9_0_fe_mul(&g, &g, &u);                   /* g = u^3 */
+        rustsecp256k1_v0_9_0_fe_mul_int(&g, 4);                    /* g = 4*u^3 */
+        rustsecp256k1_v0_9_0_fe_add_int(&g, 4 * SECP256K1_B);      /* g = 4*(u^3+7) */
+        rustsecp256k1_v0_9_0_fe_add(&q, &g);                       /* q = 4*(u^3+7)+3*s*u^2 */
+        rustsecp256k1_v0_9_0_fe_mul(&q, &q, &s);                   /* q = s*(4*(u^3+7)+3*u^2*s) */
+        rustsecp256k1_v0_9_0_fe_negate(&q, &q, 1);                 /* q = -s*(4*(u^3+7)+3*u^2*s) */
+        if (!rustsecp256k1_v0_9_0_fe_is_square_var(&q)) return 0;
+        ret = rustsecp256k1_v0_9_0_fe_sqrt(&r, &q);                /* r = sqrt(-s*(4*(u^3+7)+3*u^2*s)) */
+        VERIFY_CHECK(ret);
+
+        /* If (c & 1) = 1 and r = 0, fail. */
+        if (EXPECT((c & 1) && rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&r), 0)) return 0;
+
+        /* If s = 0, fail. */
+        if (EXPECT(rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&s), 0)) return 0;
+
+        /* Let v = (r/s-u)/2. */
+        rustsecp256k1_v0_9_0_fe_inv_var(&v, &s);                   /* v = 1/s [no div by 0] */
+        rustsecp256k1_v0_9_0_fe_mul(&v, &v, &r);                   /* v = r/s */
+        rustsecp256k1_v0_9_0_fe_add(&v, &m);                       /* v = r/s-u */
+        rustsecp256k1_v0_9_0_fe_half(&v);                          /* v = (r/s-u)/2 */
+    }
+
+    /* Let w = sqrt(s). */
+    ret = rustsecp256k1_v0_9_0_fe_sqrt(&m, &s);                    /* m = sqrt(s) = w */
+    VERIFY_CHECK(ret);
+
+    /* Return logic. */
+    if ((c & 5) == 0 || (c & 5) == 5) {
+        rustsecp256k1_v0_9_0_fe_negate(&m, &m, 1);                 /* m = -w */
+    }
+    /* Now m = {-w if c&5=0 or c&5=5; w otherwise}. */
+    rustsecp256k1_v0_9_0_fe_mul(&u, &u, c&1 ? &rustsecp256k1_v0_9_0_ellswift_c4 : &rustsecp256k1_v0_9_0_ellswift_c3);
+    /* u = {c4 if c&1=1; c3 otherwise}*u */
+    rustsecp256k1_v0_9_0_fe_add(&u, &v);                           /* u = {c4 if c&1=1; c3 otherwise}*u + v */
+    rustsecp256k1_v0_9_0_fe_mul(t, &m, &u);
+    return 1;
+}
+
+/** Use SHA256 as a PRNG, returning SHA256(hasher || cnt).
+ *
+ * hasher is a SHA256 object to which an incrementing 4-byte counter is written to generate randomness.
+ * Writing 13 bytes (4 bytes for counter, plus 9 bytes for the SHA256 padding) cannot cross a
+ * 64-byte block size boundary (to make sure it only triggers a single SHA256 compression). */
+static void rustsecp256k1_v0_9_0_ellswift_prng(unsigned char* out32, const rustsecp256k1_v0_9_0_sha256 *hasher, uint32_t cnt) {
+    rustsecp256k1_v0_9_0_sha256 hash = *hasher;
+    unsigned char buf4[4];
+#ifdef VERIFY
+    size_t blocks = hash.bytes >> 6;
+#endif
+    buf4[0] = cnt;
+    buf4[1] = cnt >> 8;
+    buf4[2] = cnt >> 16;
+    buf4[3] = cnt >> 24;
+    rustsecp256k1_v0_9_0_sha256_write(&hash, buf4, 4);
+    rustsecp256k1_v0_9_0_sha256_finalize(&hash, out32);
+#ifdef VERIFY
+    /* Writing and finalizing together should trigger exactly one SHA256 compression. */
+    VERIFY_CHECK(((hash.bytes) >> 6) == (blocks + 1));
+#endif
+}
+
+/** Find an ElligatorSwift encoding (u, t) for X coordinate x, and random Y coordinate.
+ *
+ * u32 is the 32-byte big endian encoding of u; t is the output field element t that still
+ * needs encoding.
+ *
+ * hasher is a hasher in the rustsecp256k1_v0_9_0_ellswift_prng sense, with the same restrictions. */
+static void rustsecp256k1_v0_9_0_ellswift_xelligatorswift_var(unsigned char *u32, rustsecp256k1_v0_9_0_fe *t, const rustsecp256k1_v0_9_0_fe *x, const rustsecp256k1_v0_9_0_sha256 *hasher) {
+    /* Pool of 3-bit branch values. */
+    unsigned char branch_hash[32];
+    /* Number of 3-bit values in branch_hash left. */
+    int branches_left = 0;
+    /* Field elements u and branch values are extracted from RNG based on hasher for consecutive
+     * values of cnt. cnt==0 is first used to populate a pool of 64 4-bit branch values. The 64
+     * cnt values that follow are used to generate field elements u. cnt==65 (and multiples
+     * thereof) are used to repopulate the pool and start over, if that were ever necessary.
+     * On average, 4 iterations are needed. */
+    uint32_t cnt = 0;
+    while (1) {
+        int branch;
+        rustsecp256k1_v0_9_0_fe u;
+        /* If the pool of branch values is empty, populate it. */
+        if (branches_left == 0) {
+            rustsecp256k1_v0_9_0_ellswift_prng(branch_hash, hasher, cnt++);
+            branches_left = 64;
+        }
+        /* Take a 3-bit branch value from the branch pool (top bit is discarded). */
+        --branches_left;
+        branch = (branch_hash[branches_left >> 1] >> ((branches_left & 1) << 2)) & 7;
+        /* Compute a new u value by hashing. */
+        rustsecp256k1_v0_9_0_ellswift_prng(u32, hasher, cnt++);
+        /* overflow is not a problem (we prefer uniform u32 over uniform u). */
+        rustsecp256k1_v0_9_0_fe_set_b32_mod(&u, u32);
+        /* Since u is the output of a hash, it should practically never be 0. We could apply the
+         * u=0 to u=1 correction here too to deal with that case still, but it's such a low
+         * probability event that we do not bother. */
+#ifdef VERIFY
+        VERIFY_CHECK(!rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&u));
+#endif
+        /* Find a remainder t, and return it if found. */
+        if (EXPECT(rustsecp256k1_v0_9_0_ellswift_xswiftec_inv_var(t, x, &u, branch), 0)) break;
+    }
+}
+
+/** Find an ElligatorSwift encoding (u, t) for point P.
+ *
+ * This is similar rustsecp256k1_v0_9_0_ellswift_xelligatorswift_var, except it takes a full group element p
+ * as input, and returns an encoding that matches the provided Y coordinate rather than a random
+ * one.
+ */
+static void rustsecp256k1_v0_9_0_ellswift_elligatorswift_var(unsigned char *u32, rustsecp256k1_v0_9_0_fe *t, const rustsecp256k1_v0_9_0_ge *p, const rustsecp256k1_v0_9_0_sha256 *hasher) {
+    rustsecp256k1_v0_9_0_ellswift_xelligatorswift_var(u32, t, &p->x, hasher);
+    rustsecp256k1_v0_9_0_fe_normalize_var(t);
+    if (rustsecp256k1_v0_9_0_fe_is_odd(t) != rustsecp256k1_v0_9_0_fe_is_odd(&p->y)) {
+        rustsecp256k1_v0_9_0_fe_negate(t, t, 1);
+        rustsecp256k1_v0_9_0_fe_normalize_var(t);
+    }
+}
+
+/** Set hash state to the BIP340 tagged hash midstate for "rustsecp256k1_v0_9_0_ellswift_encode". */
+static void rustsecp256k1_v0_9_0_ellswift_sha256_init_encode(rustsecp256k1_v0_9_0_sha256* hash) {
+    rustsecp256k1_v0_9_0_sha256_initialize(hash);
+    hash->s[0] = 0xd1a6524bul;
+    hash->s[1] = 0x028594b3ul;
+    hash->s[2] = 0x96e42f4eul;
+    hash->s[3] = 0x1037a177ul;
+    hash->s[4] = 0x1b8fcb8bul;
+    hash->s[5] = 0x56023885ul;
+    hash->s[6] = 0x2560ede1ul;
+    hash->s[7] = 0xd626b715ul;
+
+    hash->bytes = 64;
+}
+
+int rustsecp256k1_v0_9_0_ellswift_encode(const rustsecp256k1_v0_9_0_context *ctx, unsigned char *ell64, const rustsecp256k1_v0_9_0_pubkey *pubkey, const unsigned char *rnd32) {
+    rustsecp256k1_v0_9_0_ge p;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(ell64 != NULL);
+    ARG_CHECK(pubkey != NULL);
+    ARG_CHECK(rnd32 != NULL);
+
+    if (rustsecp256k1_v0_9_0_pubkey_load(ctx, &p, pubkey)) {
+        rustsecp256k1_v0_9_0_fe t;
+        unsigned char p64[64] = {0};
+        size_t ser_size;
+        int ser_ret;
+        rustsecp256k1_v0_9_0_sha256 hash;
+
+        /* Set up hasher state; the used RNG is H(pubkey || "\x00"*31 || rnd32 || cnt++), using
+         * BIP340 tagged hash with tag "rustsecp256k1_v0_9_0_ellswift_encode". */
+        rustsecp256k1_v0_9_0_ellswift_sha256_init_encode(&hash);
+        ser_ret = rustsecp256k1_v0_9_0_eckey_pubkey_serialize(&p, p64, &ser_size, 1);
+        VERIFY_CHECK(ser_ret && ser_size == 33);
+        rustsecp256k1_v0_9_0_sha256_write(&hash, p64, sizeof(p64));
+        rustsecp256k1_v0_9_0_sha256_write(&hash, rnd32, 32);
+
+        /* Compute ElligatorSwift encoding and construct output. */
+        rustsecp256k1_v0_9_0_ellswift_elligatorswift_var(ell64, &t, &p, &hash); /* puts u in ell64[0..32] */
+        rustsecp256k1_v0_9_0_fe_get_b32(ell64 + 32, &t); /* puts t in ell64[32..64] */
+        return 1;
+    }
+    /* Only reached in case the provided pubkey is invalid. */
+    memset(ell64, 0, 64);
+    return 0;
+}
+
+/** Set hash state to the BIP340 tagged hash midstate for "rustsecp256k1_v0_9_0_ellswift_create". */
+static void rustsecp256k1_v0_9_0_ellswift_sha256_init_create(rustsecp256k1_v0_9_0_sha256* hash) {
+    rustsecp256k1_v0_9_0_sha256_initialize(hash);
+    hash->s[0] = 0xd29e1bf5ul;
+    hash->s[1] = 0xf7025f42ul;
+    hash->s[2] = 0x9b024773ul;
+    hash->s[3] = 0x094cb7d5ul;
+    hash->s[4] = 0xe59ed789ul;
+    hash->s[5] = 0x03bc9786ul;
+    hash->s[6] = 0x68335b35ul;
+    hash->s[7] = 0x4e363b53ul;
+
+    hash->bytes = 64;
+}
+
+int rustsecp256k1_v0_9_0_ellswift_create(const rustsecp256k1_v0_9_0_context *ctx, unsigned char *ell64, const unsigned char *seckey32, const unsigned char *auxrnd32) {
+    rustsecp256k1_v0_9_0_ge p;
+    rustsecp256k1_v0_9_0_fe t;
+    rustsecp256k1_v0_9_0_sha256 hash;
+    rustsecp256k1_v0_9_0_scalar seckey_scalar;
+    int ret;
+    static const unsigned char zero32[32] = {0};
+
+    /* Sanity check inputs. */
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(ell64 != NULL);
+    memset(ell64, 0, 64);
+    ARG_CHECK(rustsecp256k1_v0_9_0_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(seckey32 != NULL);
+
+    /* Compute (affine) public key */
+    ret = rustsecp256k1_v0_9_0_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &seckey_scalar, &p, seckey32);
+    rustsecp256k1_v0_9_0_declassify(ctx, &p, sizeof(p)); /* not constant time in produced pubkey */
+    rustsecp256k1_v0_9_0_fe_normalize_var(&p.x);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&p.y);
+
+    /* Set up hasher state. The used RNG is H(privkey || "\x00"*32 [|| auxrnd32] || cnt++),
+     * using BIP340 tagged hash with tag "rustsecp256k1_v0_9_0_ellswift_create". */
+    rustsecp256k1_v0_9_0_ellswift_sha256_init_create(&hash);
+    rustsecp256k1_v0_9_0_sha256_write(&hash, seckey32, 32);
+    rustsecp256k1_v0_9_0_sha256_write(&hash, zero32, sizeof(zero32));
+    rustsecp256k1_v0_9_0_declassify(ctx, &hash, sizeof(hash)); /* private key is hashed now */
+    if (auxrnd32) rustsecp256k1_v0_9_0_sha256_write(&hash, auxrnd32, 32);
+
+    /* Compute ElligatorSwift encoding and construct output. */
+    rustsecp256k1_v0_9_0_ellswift_elligatorswift_var(ell64, &t, &p, &hash); /* puts u in ell64[0..32] */
+    rustsecp256k1_v0_9_0_fe_get_b32(ell64 + 32, &t); /* puts t in ell64[32..64] */
+
+    rustsecp256k1_v0_9_0_memczero(ell64, 64, !ret);
+    rustsecp256k1_v0_9_0_scalar_clear(&seckey_scalar);
+
+    return ret;
+}
+
+int rustsecp256k1_v0_9_0_ellswift_decode(const rustsecp256k1_v0_9_0_context *ctx, rustsecp256k1_v0_9_0_pubkey *pubkey, const unsigned char *ell64) {
+    rustsecp256k1_v0_9_0_fe u, t;
+    rustsecp256k1_v0_9_0_ge p;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(pubkey != NULL);
+    ARG_CHECK(ell64 != NULL);
+
+    rustsecp256k1_v0_9_0_fe_set_b32_mod(&u, ell64);
+    rustsecp256k1_v0_9_0_fe_set_b32_mod(&t, ell64 + 32);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&t);
+    rustsecp256k1_v0_9_0_ellswift_swiftec_var(&p, &u, &t);
+    rustsecp256k1_v0_9_0_pubkey_save(pubkey, &p);
+    return 1;
+}
+
+static int ellswift_xdh_hash_function_prefix(unsigned char *output, const unsigned char *x32, const unsigned char *ell_a64, const unsigned char *ell_b64, void *data) {
+    rustsecp256k1_v0_9_0_sha256 sha;
+
+    rustsecp256k1_v0_9_0_sha256_initialize(&sha);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, data, 64);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, ell_a64, 64);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, ell_b64, 64);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, x32, 32);
+    rustsecp256k1_v0_9_0_sha256_finalize(&sha, output);
+
+    return 1;
+}
+
+/** Set hash state to the BIP340 tagged hash midstate for "bip324_ellswift_xonly_ecdh". */
+static void rustsecp256k1_v0_9_0_ellswift_sha256_init_bip324(rustsecp256k1_v0_9_0_sha256* hash) {
+    rustsecp256k1_v0_9_0_sha256_initialize(hash);
+    hash->s[0] = 0x8c12d730ul;
+    hash->s[1] = 0x827bd392ul;
+    hash->s[2] = 0x9e4fb2eeul;
+    hash->s[3] = 0x207b373eul;
+    hash->s[4] = 0x2292bd7aul;
+    hash->s[5] = 0xaa5441bcul;
+    hash->s[6] = 0x15c3779ful;
+    hash->s[7] = 0xcfb52549ul;
+
+    hash->bytes = 64;
+}
+
+static int ellswift_xdh_hash_function_bip324(unsigned char* output, const unsigned char *x32, const unsigned char *ell_a64, const unsigned char *ell_b64, void *data) {
+    rustsecp256k1_v0_9_0_sha256 sha;
+
+    (void)data;
+
+    rustsecp256k1_v0_9_0_ellswift_sha256_init_bip324(&sha);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, ell_a64, 64);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, ell_b64, 64);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, x32, 32);
+    rustsecp256k1_v0_9_0_sha256_finalize(&sha, output);
+
+    return 1;
+}
+
+const rustsecp256k1_v0_9_0_ellswift_xdh_hash_function rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_prefix = ellswift_xdh_hash_function_prefix;
+const rustsecp256k1_v0_9_0_ellswift_xdh_hash_function rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_bip324 = ellswift_xdh_hash_function_bip324;
+
+int rustsecp256k1_v0_9_0_ellswift_xdh(const rustsecp256k1_v0_9_0_context *ctx, unsigned char *output, const unsigned char *ell_a64, const unsigned char *ell_b64, const unsigned char *seckey32, int party, rustsecp256k1_v0_9_0_ellswift_xdh_hash_function hashfp, void *data) {
+    int ret = 0;
+    int overflow;
+    rustsecp256k1_v0_9_0_scalar s;
+    rustsecp256k1_v0_9_0_fe xn, xd, px, u, t;
+    unsigned char sx[32];
+    const unsigned char* theirs64;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(output != NULL);
+    ARG_CHECK(ell_a64 != NULL);
+    ARG_CHECK(ell_b64 != NULL);
+    ARG_CHECK(seckey32 != NULL);
+    ARG_CHECK(hashfp != NULL);
+
+    /* Load remote public key (as fraction). */
+    theirs64 = party ? ell_a64 : ell_b64;
+    rustsecp256k1_v0_9_0_fe_set_b32_mod(&u, theirs64);
+    rustsecp256k1_v0_9_0_fe_set_b32_mod(&t, theirs64 + 32);
+    rustsecp256k1_v0_9_0_ellswift_xswiftec_frac_var(&xn, &xd, &u, &t);
+
+    /* Load private key (using one if invalid). */
+    rustsecp256k1_v0_9_0_scalar_set_b32(&s, seckey32, &overflow);
+    overflow = rustsecp256k1_v0_9_0_scalar_is_zero(&s);
+    rustsecp256k1_v0_9_0_scalar_cmov(&s, &rustsecp256k1_v0_9_0_scalar_one, overflow);
+
+    /* Compute shared X coordinate. */
+    rustsecp256k1_v0_9_0_ecmult_const_xonly(&px, &xn, &xd, &s, 1);
+    rustsecp256k1_v0_9_0_fe_normalize(&px);
+    rustsecp256k1_v0_9_0_fe_get_b32(sx, &px);
+
+    /* Invoke hasher */
+    ret = hashfp(output, sx, ell_a64, ell_b64, data);
+
+    memset(sx, 0, 32);
+    rustsecp256k1_v0_9_0_fe_clear(&px);
+    rustsecp256k1_v0_9_0_scalar_clear(&s);
+
+    return !!ret & !overflow;
+}
+
+#endif
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/ellswift/tests_exhaustive_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/tests_exhaustive_impl.h
new file mode 100644
index 000000000..577145838
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/tests_exhaustive_impl.h
@@ -0,0 +1,39 @@
+/***********************************************************************
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_ELLSWIFT_TESTS_EXHAUSTIVE_H
+#define SECP256K1_MODULE_ELLSWIFT_TESTS_EXHAUSTIVE_H
+
+#include "../../../include/secp256k1_ellswift.h"
+#include "main_impl.h"
+
+static void test_exhaustive_ellswift(const rustsecp256k1_v0_9_0_context *ctx, const rustsecp256k1_v0_9_0_ge *group) {
+    int i;
+
+    /* Note that SwiftEC/ElligatorSwift are inherently curve operations, not
+     * group operations, and this test only checks the curve points which are in
+     * a tiny subgroup. In that sense it can't be really seen as exhaustive as
+     * it doesn't (and for computational reasons obviously cannot) test the
+     * entire domain ellswift operates under. */
+    for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) {
+        rustsecp256k1_v0_9_0_scalar scalar_i;
+        unsigned char sec32[32];
+        unsigned char ell64[64];
+        rustsecp256k1_v0_9_0_pubkey pub_decoded;
+        rustsecp256k1_v0_9_0_ge ge_decoded;
+
+        /* Construct ellswift pubkey from exhaustive loop scalar i. */
+        rustsecp256k1_v0_9_0_scalar_set_int(&scalar_i, i);
+        rustsecp256k1_v0_9_0_scalar_get_b32(sec32, &scalar_i);
+        CHECK(rustsecp256k1_v0_9_0_ellswift_create(ctx, ell64, sec32, NULL));
+
+        /* Decode ellswift pubkey and check that it matches the precomputed group element. */
+        rustsecp256k1_v0_9_0_ellswift_decode(ctx, &pub_decoded, ell64);
+        rustsecp256k1_v0_9_0_pubkey_load(ctx, &ge_decoded, &pub_decoded);
+        ge_equals_ge(&ge_decoded, &group[i]);
+    }
+}
+
+#endif
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/ellswift/tests_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/tests_impl.h
new file mode 100644
index 000000000..4adf62950
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/modules/ellswift/tests_impl.h
@@ -0,0 +1,436 @@
+/***********************************************************************
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_ELLSWIFT_TESTS_H
+#define SECP256K1_MODULE_ELLSWIFT_TESTS_H
+
+#include "../../../include/secp256k1_ellswift.h"
+
+struct ellswift_xswiftec_inv_test {
+    int enc_bitmap;
+    rustsecp256k1_v0_9_0_fe u;
+    rustsecp256k1_v0_9_0_fe x;
+    rustsecp256k1_v0_9_0_fe encs[8];
+};
+
+struct ellswift_decode_test {
+    unsigned char enc[64];
+    rustsecp256k1_v0_9_0_fe x;
+    int odd_y;
+};
+
+struct ellswift_xdh_test {
+    unsigned char priv_ours[32];
+    unsigned char ellswift_ours[64];
+    unsigned char ellswift_theirs[64];
+    int initiating;
+    unsigned char shared_secret[32];
+};
+
+/* Set of (point, encodings) test vectors, selected to maximize branch coverage, part of the BIP324
+ * test vectors. Created using an independent implementation, and tested decoding against paper
+ * authors' code. */
+static const struct ellswift_xswiftec_inv_test ellswift_xswiftec_inv_tests[] = {
+    {0xcc, SECP256K1_FE_CONST(0x05ff6bda, 0xd900fc32, 0x61bc7fe3, 0x4e2fb0f5, 0x69f06e09, 0x1ae437d3, 0xa52e9da0, 0xcbfb9590), SECP256K1_FE_CONST(0x80cdf637, 0x74ec7022, 0xc89a5a85, 0x58e373a2, 0x79170285, 0xe0ab2741, 0x2dbce510, 0xbdfe23fc), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x45654798, 0xece071ba, 0x79286d04, 0xf7f3eb1c, 0x3f1d17dd, 0x883610f2, 0xad2efd82, 0xa287466b), SECP256K1_FE_CONST(0x0aeaa886, 0xf6b76c71, 0x58452418, 0xcbf5033a, 0xdc5747e9, 0xe9b5d3b2, 0x303db969, 0x36528557), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0xba9ab867, 0x131f8e45, 0x86d792fb, 0x080c14e3, 0xc0e2e822, 0x77c9ef0d, 0x52d1027c, 0x5d78b5c4), SECP256K1_FE_CONST(0xf5155779, 0x0948938e, 0xa7badbe7, 0x340afcc5, 0x23a8b816, 0x164a2c4d, 0xcfc24695, 0xc9ad76d8)}},
+    {0x33, SECP256K1_FE_CONST(0x1737a85f, 0x4c8d146c, 0xec96e3ff, 0xdca76d99, 0x03dcf3bd, 0x53061868, 0xd478c78c, 0x63c2aa9e), SECP256K1_FE_CONST(0x39e48dd1, 0x50d2f429, 0xbe088dfd, 0x5b61882e, 0x7e840748, 0x3702ae9a, 0x5ab35927, 0xb15f85ea), {SECP256K1_FE_CONST(0x1be8cc0b, 0x04be0c68, 0x1d0c6a68, 0xf733f82c, 0x6c896e0c, 0x8a262fcd, 0x392918e3, 0x03a7abf4), SECP256K1_FE_CONST(0x605b5814, 0xbf9b8cb0, 0x66667c9e, 0x5480d22d, 0xc5b6c92f, 0x14b4af3e, 0xe0a9eb83, 0xb03685e3), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0xe41733f4, 0xfb41f397, 0xe2f39597, 0x08cc07d3, 0x937691f3, 0x75d9d032, 0xc6d6e71b, 0xfc58503b), SECP256K1_FE_CONST(0x9fa4a7eb, 0x4064734f, 0x99998361, 0xab7f2dd2, 0x3a4936d0, 0xeb4b50c1, 0x1f56147b, 0x4fc9764c), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x00, SECP256K1_FE_CONST(0x1aaa1cce, 0xbf9c7241, 0x91033df3, 0x66b36f69, 0x1c4d902c, 0x228033ff, 0x4516d122, 0xb2564f68), SECP256K1_FE_CONST(0xc7554125, 0x9d3ba98f, 0x207eaa30, 0xc69634d1, 0x87d0b6da, 0x594e719e, 0x420f4898, 0x638fc5b0), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x33, SECP256K1_FE_CONST(0x2323a1d0, 0x79b0fd72, 0xfc8bb62e, 0xc34230a8, 0x15cb0596, 0xc2bfac99, 0x8bd6b842, 0x60f5dc26), SECP256K1_FE_CONST(0x239342df, 0xb675500a, 0x34a19631, 0x0b8d87d5, 0x4f49dcac, 0x9da50c17, 0x43ceab41, 0xa7b249ff), {SECP256K1_FE_CONST(0xf63580b8, 0xaa49c484, 0x6de56e39, 0xe1b3e73f, 0x171e881e, 0xba8c66f6, 0x14e67e5c, 0x975dfc07), SECP256K1_FE_CONST(0xb6307b33, 0x2e699f1c, 0xf77841d9, 0x0af25365, 0x404deb7f, 0xed5edb30, 0x90db49e6, 0x42a156b6), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x09ca7f47, 0x55b63b7b, 0x921a91c6, 0x1e4c18c0, 0xe8e177e1, 0x45739909, 0xeb1981a2, 0x68a20028), SECP256K1_FE_CONST(0x49cf84cc, 0xd19660e3, 0x0887be26, 0xf50dac9a, 0xbfb21480, 0x12a124cf, 0x6f24b618, 0xbd5ea579), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x33, SECP256K1_FE_CONST(0x2dc90e64, 0x0cb646ae, 0x9164c0b5, 0xa9ef0169, 0xfebe34dc, 0x4437d6e4, 0x6acb0e27, 0xe219d1e8), SECP256K1_FE_CONST(0xd236f19b, 0xf349b951, 0x6e9b3f4a, 0x5610fe96, 0x0141cb23, 0xbbc8291b, 0x9534f1d7, 0x1de62a47), {SECP256K1_FE_CONST(0xe69df7d9, 0xc026c366, 0x00ebdf58, 0x80726758, 0x47c0c431, 0xc8eb7306, 0x82533e96, 0x4b6252c9), SECP256K1_FE_CONST(0x4f18bbdf, 0x7c2d6c5f, 0x818c1880, 0x2fa35cd0, 0x69eaa79f, 0xff74e4fc, 0x837c80d9, 0x3fece2f8), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x19620826, 0x3fd93c99, 0xff1420a7, 0x7f8d98a7, 0xb83f3bce, 0x37148cf9, 0x7dacc168, 0xb49da966), SECP256K1_FE_CONST(0xb0e74420, 0x83d293a0, 0x7e73e77f, 0xd05ca32f, 0x96155860, 0x008b1b03, 0x7c837f25, 0xc0131937), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0xcc, SECP256K1_FE_CONST(0x3edd7b39, 0x80e2f2f3, 0x4d1409a2, 0x07069f88, 0x1fda5f96, 0xf08027ac, 0x4465b63d, 0xc278d672), SECP256K1_FE_CONST(0x053a98de, 0x4a27b196, 0x1155822b, 0x3a3121f0, 0x3b2a1445, 0x8bd80eb4, 0xa560c4c7, 0xa85c149c), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0xb3dae4b7, 0xdcf858e4, 0xc6968057, 0xcef2b156, 0x46543152, 0x6538199c, 0xf52dc1b2, 0xd62fda30), SECP256K1_FE_CONST(0x4aa77dd5, 0x5d6b6d3c, 0xfa10cc9d, 0x0fe42f79, 0x232e4575, 0x661049ae, 0x36779c1d, 0x0c666d88), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x4c251b48, 0x2307a71b, 0x39697fa8, 0x310d4ea9, 0xb9abcead, 0x9ac7e663, 0x0ad23e4c, 0x29d021ff), SECP256K1_FE_CONST(0xb558822a, 0xa29492c3, 0x05ef3362, 0xf01bd086, 0xdcd1ba8a, 0x99efb651, 0xc98863e1, 0xf3998ea7)}},
+    {0x00, SECP256K1_FE_CONST(0x4295737e, 0xfcb1da6f, 0xb1d96b9c, 0xa7dcd1e3, 0x20024b37, 0xa736c494, 0x8b625981, 0x73069f70), SECP256K1_FE_CONST(0xfa7ffe4f, 0x25f88362, 0x831c087a, 0xfe2e8a9b, 0x0713e2ca, 0xc1ddca6a, 0x383205a2, 0x66f14307), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0xff, SECP256K1_FE_CONST(0x587c1a0c, 0xee91939e, 0x7f784d23, 0xb963004a, 0x3bf44f5d, 0x4e32a008, 0x1995ba20, 0xb0fca59e), SECP256K1_FE_CONST(0x2ea98853, 0x0715e8d1, 0x0363907f, 0xf2512452, 0x4d471ba2, 0x454d5ce3, 0xbe3f0419, 0x4dfd3a3c), {SECP256K1_FE_CONST(0xcfd5a094, 0xaa0b9b88, 0x91b76c6a, 0xb9438f66, 0xaa1c095a, 0x65f9f701, 0x35e81712, 0x92245e74), SECP256K1_FE_CONST(0xa89057d7, 0xc6563f0d, 0x6efa19ae, 0x84412b8a, 0x7b47e791, 0xa191ecdf, 0xdf2af84f, 0xd97bc339), SECP256K1_FE_CONST(0x475d0ae9, 0xef46920d, 0xf07b3411, 0x7be5a081, 0x7de1023e, 0x3cc32689, 0xe9be145b, 0x406b0aef), SECP256K1_FE_CONST(0xa0759178, 0xad802324, 0x54f827ef, 0x05ea3e72, 0xad8d7541, 0x8e6d4cc1, 0xcd4f5306, 0xc5e7c453), SECP256K1_FE_CONST(0x302a5f6b, 0x55f46477, 0x6e489395, 0x46bc7099, 0x55e3f6a5, 0x9a0608fe, 0xca17e8ec, 0x6ddb9dbb), SECP256K1_FE_CONST(0x576fa828, 0x39a9c0f2, 0x9105e651, 0x7bbed475, 0x84b8186e, 0x5e6e1320, 0x20d507af, 0x268438f6), SECP256K1_FE_CONST(0xb8a2f516, 0x10b96df2, 0x0f84cbee, 0x841a5f7e, 0x821efdc1, 0xc33cd976, 0x1641eba3, 0xbf94f140), SECP256K1_FE_CONST(0x5f8a6e87, 0x527fdcdb, 0xab07d810, 0xfa15c18d, 0x52728abe, 0x7192b33e, 0x32b0acf8, 0x3a1837dc)}},
+    {0xcc, SECP256K1_FE_CONST(0x5fa88b33, 0x65a635cb, 0xbcee003c, 0xce9ef51d, 0xd1a310de, 0x277e441a, 0xbccdb7be, 0x1e4ba249), SECP256K1_FE_CONST(0x79461ff6, 0x2bfcbcac, 0x4249ba84, 0xdd040f2c, 0xec3c63f7, 0x25204dc7, 0xf464c16b, 0xf0ff3170), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x6bb700e1, 0xf4d7e236, 0xe8d193ff, 0x4a76c1b3, 0xbcd4e2b2, 0x5acac3d5, 0x1c8dac65, 0x3fe909a0), SECP256K1_FE_CONST(0xf4c73410, 0x633da7f6, 0x3a4f1d55, 0xaec6dd32, 0xc4c6d89e, 0xe74075ed, 0xb5515ed9, 0x0da9e683), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x9448ff1e, 0x0b281dc9, 0x172e6c00, 0xb5893e4c, 0x432b1d4d, 0xa5353c2a, 0xe3725399, 0xc016f28f), SECP256K1_FE_CONST(0x0b38cbef, 0x9cc25809, 0xc5b0e2aa, 0x513922cd, 0x3b392761, 0x18bf8a12, 0x4aaea125, 0xf25615ac)}},
+    {0xcc, SECP256K1_FE_CONST(0x6fb31c75, 0x31f03130, 0xb42b155b, 0x952779ef, 0xbb46087d, 0xd9807d24, 0x1a48eac6, 0x3c3d96d6), SECP256K1_FE_CONST(0x56f81be7, 0x53e8d4ae, 0x4940ea6f, 0x46f6ec9f, 0xda66a6f9, 0x6cc95f50, 0x6cb2b574, 0x90e94260), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x59059774, 0x795bdb7a, 0x837fbe11, 0x40a5fa59, 0x984f48af, 0x8df95d57, 0xdd6d1c05, 0x437dcec1), SECP256K1_FE_CONST(0x22a644db, 0x79376ad4, 0xe7b3a009, 0xe58b3f13, 0x137c54fd, 0xf911122c, 0xc93667c4, 0x7077d784), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0xa6fa688b, 0x86a42485, 0x7c8041ee, 0xbf5a05a6, 0x67b0b750, 0x7206a2a8, 0x2292e3f9, 0xbc822d6e), SECP256K1_FE_CONST(0xdd59bb24, 0x86c8952b, 0x184c5ff6, 0x1a74c0ec, 0xec83ab02, 0x06eeedd3, 0x36c9983a, 0x8f8824ab)}},
+    {0x00, SECP256K1_FE_CONST(0x704cd226, 0xe71cb682, 0x6a590e80, 0xdac90f2d, 0x2f5830f0, 0xfdf135a3, 0xeae3965b, 0xff25ff12), SECP256K1_FE_CONST(0x138e0afa, 0x68936ee6, 0x70bd2b8d, 0xb53aedbb, 0x7bea2a85, 0x97388b24, 0xd0518edd, 0x22ad66ec), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x33, SECP256K1_FE_CONST(0x725e9147, 0x92cb8c89, 0x49e7e116, 0x8b7cdd8a, 0x8094c91c, 0x6ec2202c, 0xcd53a6a1, 0x8771edeb), SECP256K1_FE_CONST(0x8da16eb8, 0x6d347376, 0xb6181ee9, 0x74832275, 0x7f6b36e3, 0x913ddfd3, 0x32ac595d, 0x788e0e44), {SECP256K1_FE_CONST(0xdd357786, 0xb9f68733, 0x30391aa5, 0x62580965, 0x4e43116e, 0x82a5a5d8, 0x2ffd1d66, 0x24101fc4), SECP256K1_FE_CONST(0xa0b7efca, 0x01814594, 0xc59c9aae, 0x8e497001, 0x86ca5d95, 0xe88bcc80, 0x399044d9, 0xc2d8613d), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x22ca8879, 0x460978cc, 0xcfc6e55a, 0x9da7f69a, 0xb1bcee91, 0x7d5a5a27, 0xd002e298, 0xdbefdc6b), SECP256K1_FE_CONST(0x5f481035, 0xfe7eba6b, 0x3a636551, 0x71b68ffe, 0x7935a26a, 0x1774337f, 0xc66fbb25, 0x3d279af2), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x00, SECP256K1_FE_CONST(0x78fe6b71, 0x7f2ea4a3, 0x2708d79c, 0x151bf503, 0xa5312a18, 0xc0963437, 0xe865cc6e, 0xd3f6ae97), SECP256K1_FE_CONST(0x8701948e, 0x80d15b5c, 0xd8f72863, 0xeae40afc, 0x5aced5e7, 0x3f69cbc8, 0x179a3390, 0x2c094d98), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x44, SECP256K1_FE_CONST(0x7c37bb9c, 0x5061dc07, 0x413f11ac, 0xd5a34006, 0xe64c5c45, 0x7fdb9a43, 0x8f217255, 0xa961f50d), SECP256K1_FE_CONST(0x5c1a76b4, 0x4568eb59, 0xd6789a74, 0x42d9ed7c, 0xdc6226b7, 0x752b4ff8, 0xeaf8e1a9, 0x5736e507), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0xb94d30cd, 0x7dbff60b, 0x64620c17, 0xca0fafaa, 0x40b3d1f5, 0x2d077a60, 0xa2e0cafd, 0x145086c2), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x46b2cf32, 0x824009f4, 0x9b9df3e8, 0x35f05055, 0xbf4c2e0a, 0xd2f8859f, 0x5d1f3501, 0xebaf756d), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x00, SECP256K1_FE_CONST(0x82388888, 0x967f82a6, 0xb444438a, 0x7d44838e, 0x13c0d478, 0xb9ca060d, 0xa95a41fb, 0x94303de6), SECP256K1_FE_CONST(0x29e96541, 0x70628fec, 0x8b497289, 0x8b113cf9, 0x8807f460, 0x9274f4f3, 0x140d0674, 0x157c90a0), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x33, SECP256K1_FE_CONST(0x91298f57, 0x70af7a27, 0xf0a47188, 0xd24c3b7b, 0xf98ab299, 0x0d84b0b8, 0x98507e3c, 0x561d6472), SECP256K1_FE_CONST(0x144f4ccb, 0xd9a74698, 0xa88cbf6f, 0xd00ad886, 0xd339d29e, 0xa19448f2, 0xc572cac0, 0xa07d5562), {SECP256K1_FE_CONST(0xe6a0ffa3, 0x807f09da, 0xdbe71e0f, 0x4be4725f, 0x2832e76c, 0xad8dc1d9, 0x43ce8393, 0x75eff248), SECP256K1_FE_CONST(0x837b8e68, 0xd4917544, 0x764ad090, 0x3cb11f86, 0x15d2823c, 0xefbb06d8, 0x9049dbab, 0xc69befda), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x195f005c, 0x7f80f625, 0x2418e1f0, 0xb41b8da0, 0xd7cd1893, 0x52723e26, 0xbc317c6b, 0x8a1009e7), SECP256K1_FE_CONST(0x7c847197, 0x2b6e8abb, 0x89b52f6f, 0xc34ee079, 0xea2d7dc3, 0x1044f927, 0x6fb62453, 0x39640c55), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x00, SECP256K1_FE_CONST(0xb682f3d0, 0x3bbb5dee, 0x4f54b5eb, 0xfba931b4, 0xf52f6a19, 0x1e5c2f48, 0x3c73c66e, 0x9ace97e1), SECP256K1_FE_CONST(0x904717bf, 0x0bc0cb78, 0x73fcdc38, 0xaa97f19e, 0x3a626309, 0x72acff92, 0xb24cc6dd, 0xa197cb96), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x77, SECP256K1_FE_CONST(0xc17ec69e, 0x665f0fb0, 0xdbab48d9, 0xc2f94d12, 0xec8a9d7e, 0xacb58084, 0x83309180, 0x1eb0b80b), SECP256K1_FE_CONST(0x147756e6, 0x6d96e31c, 0x426d3cc8, 0x5ed0c4cf, 0xbef6341d, 0xd8b28558, 0x5aa574ea, 0x0204b55e), {SECP256K1_FE_CONST(0x6f4aea43, 0x1a0043bd, 0xd03134d6, 0xd9159119, 0xce034b88, 0xc32e50e8, 0xe36c4ee4, 0x5eac7ae9), SECP256K1_FE_CONST(0xfd5be16d, 0x4ffa2690, 0x126c67c3, 0xef7cb9d2, 0x9b74d397, 0xc78b06b3, 0x605fda34, 0xdc9696a6), SECP256K1_FE_CONST(0x5e9c6079, 0x2a2f000e, 0x45c6250f, 0x296f875e, 0x174efc0e, 0x9703e628, 0x706103a9, 0xdd2d82c7), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x90b515bc, 0xe5ffbc42, 0x2fcecb29, 0x26ea6ee6, 0x31fcb477, 0x3cd1af17, 0x1c93b11a, 0xa1538146), SECP256K1_FE_CONST(0x02a41e92, 0xb005d96f, 0xed93983c, 0x1083462d, 0x648b2c68, 0x3874f94c, 0x9fa025ca, 0x23696589), SECP256K1_FE_CONST(0xa1639f86, 0xd5d0fff1, 0xba39daf0, 0xd69078a1, 0xe8b103f1, 0x68fc19d7, 0x8f9efc55, 0x22d27968), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0xcc, SECP256K1_FE_CONST(0xc25172fc, 0x3f29b6fc, 0x4a1155b8, 0x57523315, 0x5486b274, 0x64b74b8b, 0x260b499a, 0x3f53cb14), SECP256K1_FE_CONST(0x1ea9cbdb, 0x35cf6e03, 0x29aa31b0, 0xbb0a702a, 0x65123ed0, 0x08655a93, 0xb7dcd528, 0x0e52e1ab), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x7422edc7, 0x843136af, 0x0053bb88, 0x54448a82, 0x99994f9d, 0xdcefd3a9, 0xa92d4546, 0x2c59298a), SECP256K1_FE_CONST(0x78c7774a, 0x266f8b97, 0xea23d05d, 0x064f033c, 0x77319f92, 0x3f6b78bc, 0xe4e20bf0, 0x5fa5398d), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x8bdd1238, 0x7bcec950, 0xffac4477, 0xabbb757d, 0x6666b062, 0x23102c56, 0x56d2bab8, 0xd3a6d2a5), SECP256K1_FE_CONST(0x873888b5, 0xd9907468, 0x15dc2fa2, 0xf9b0fcc3, 0x88ce606d, 0xc0948743, 0x1b1df40e, 0xa05ac2a2)}},
+    {0x00, SECP256K1_FE_CONST(0xcab6626f, 0x832a4b12, 0x80ba7add, 0x2fc5322f, 0xf011caed, 0xedf7ff4d, 0xb6735d50, 0x26dc0367), SECP256K1_FE_CONST(0x2b2bef08, 0x52c6f7c9, 0x5d72ac99, 0xa23802b8, 0x75029cd5, 0x73b248d1, 0xf1b3fc80, 0x33788eb6), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x33, SECP256K1_FE_CONST(0xd8621b4f, 0xfc85b9ed, 0x56e99d8d, 0xd1dd24ae, 0xdcecb147, 0x63b861a1, 0x7112dc77, 0x1a104fd2), SECP256K1_FE_CONST(0x812cabe9, 0x72a22aa6, 0x7c7da0c9, 0x4d8a9362, 0x96eb9949, 0xd70c37cb, 0x2b248757, 0x4cb3ce58), {SECP256K1_FE_CONST(0xfbc5febc, 0x6fdbc9ae, 0x3eb88a93, 0xb982196e, 0x8b6275a6, 0xd5a73c17, 0x387e000c, 0x711bd0e3), SECP256K1_FE_CONST(0x8724c96b, 0xd4e5527f, 0x2dd195a5, 0x1c468d2d, 0x211ba2fa, 0xc7cbe0b4, 0xb3434253, 0x409fb42d), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x043a0143, 0x90243651, 0xc147756c, 0x467de691, 0x749d8a59, 0x2a58c3e8, 0xc781fff2, 0x8ee42b4c), SECP256K1_FE_CONST(0x78db3694, 0x2b1aad80, 0xd22e6a5a, 0xe3b972d2, 0xdee45d05, 0x38341f4b, 0x4cbcbdab, 0xbf604802), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x00, SECP256K1_FE_CONST(0xda463164, 0xc6f4bf71, 0x29ee5f0e, 0xc00f65a6, 0x75a8adf1, 0xbd931b39, 0xb64806af, 0xdcda9a22), SECP256K1_FE_CONST(0x25b9ce9b, 0x390b408e, 0xd611a0f1, 0x3ff09a59, 0x8a57520e, 0x426ce4c6, 0x49b7f94f, 0x2325620d), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0xcc, SECP256K1_FE_CONST(0xdafc971e, 0x4a3a7b6d, 0xcfb42a08, 0xd9692d82, 0xad9e7838, 0x523fcbda, 0x1d4827e1, 0x4481ae2d), SECP256K1_FE_CONST(0x250368e1, 0xb5c58492, 0x304bd5f7, 0x2696d27d, 0x526187c7, 0xadc03425, 0xe2b7d81d, 0xbb7e4e02), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x370c28f1, 0xbe665efa, 0xcde6aa43, 0x6bf86fe2, 0x1e6e314c, 0x1e53dd04, 0x0e6c73a4, 0x6b4c8c49), SECP256K1_FE_CONST(0xcd8acee9, 0x8ffe5653, 0x1a84d7eb, 0x3e48fa40, 0x34206ce8, 0x25ace907, 0xd0edf0ea, 0xeb5e9ca2), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0xc8f3d70e, 0x4199a105, 0x321955bc, 0x9407901d, 0xe191ceb3, 0xe1ac22fb, 0xf1938c5a, 0x94b36fe6), SECP256K1_FE_CONST(0x32753116, 0x7001a9ac, 0xe57b2814, 0xc1b705bf, 0xcbdf9317, 0xda5316f8, 0x2f120f14, 0x14a15f8d)}},
+    {0x44, SECP256K1_FE_CONST(0xe0294c8b, 0xc1a36b41, 0x66ee92bf, 0xa70a5c34, 0x976fa982, 0x9405efea, 0x8f9cd54d, 0xcb29b99e), SECP256K1_FE_CONST(0xae9690d1, 0x3b8d20a0, 0xfbbf37be, 0xd8474f67, 0xa04e142f, 0x56efd787, 0x70a76b35, 0x9165d8a1), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0xdcd45d93, 0x5613916a, 0xf167b029, 0x058ba3a7, 0x00d37150, 0xb9df3472, 0x8cb05412, 0xc16d4182), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x232ba26c, 0xa9ec6e95, 0x0e984fd6, 0xfa745c58, 0xff2c8eaf, 0x4620cb8d, 0x734fabec, 0x3e92baad), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0x00, SECP256K1_FE_CONST(0xe148441c, 0xd7b92b8b, 0x0e4fa3bd, 0x68712cfd, 0x0d709ad1, 0x98cace61, 0x1493c10e, 0x97f5394e), SECP256K1_FE_CONST(0x164a6397, 0x94d74c53, 0xafc4d329, 0x4e79cdb3, 0xcd25f99f, 0x6df45c00, 0x0f758aba, 0x54d699c0), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0xff, SECP256K1_FE_CONST(0xe4b00ec9, 0x7aadcca9, 0x7644d3b0, 0xc8a931b1, 0x4ce7bcf7, 0xbc877954, 0x6d6e35aa, 0x5937381c), SECP256K1_FE_CONST(0x94e9588d, 0x41647b3f, 0xcc772dc8, 0xd83c67ce, 0x3be00353, 0x8517c834, 0x103d2cd4, 0x9d62ef4d), {SECP256K1_FE_CONST(0xc88d25f4, 0x1407376b, 0xb2c03a7f, 0xffeb3ec7, 0x811cc434, 0x91a0c3aa, 0xc0378cdc, 0x78357bee), SECP256K1_FE_CONST(0x51c02636, 0xce00c234, 0x5ecd89ad, 0xb6089fe4, 0xd5e18ac9, 0x24e3145e, 0x6669501c, 0xd37a00d4), SECP256K1_FE_CONST(0x205b3512, 0xdb40521c, 0xb200952e, 0x67b46f67, 0xe09e7839, 0xe0de4400, 0x4138329e, 0xbd9138c5), SECP256K1_FE_CONST(0x58aab390, 0xab6fb55c, 0x1d1b8089, 0x7a207ce9, 0x4a78fa5b, 0x4aa61a33, 0x398bcae9, 0xadb20d3e), SECP256K1_FE_CONST(0x3772da0b, 0xebf8c894, 0x4d3fc580, 0x0014c138, 0x7ee33bcb, 0x6e5f3c55, 0x3fc87322, 0x87ca8041), SECP256K1_FE_CONST(0xae3fd9c9, 0x31ff3dcb, 0xa1327652, 0x49f7601b, 0x2a1e7536, 0xdb1ceba1, 0x9996afe2, 0x2c85fb5b), SECP256K1_FE_CONST(0xdfa4caed, 0x24bfade3, 0x4dff6ad1, 0x984b9098, 0x1f6187c6, 0x1f21bbff, 0xbec7cd60, 0x426ec36a), SECP256K1_FE_CONST(0xa7554c6f, 0x54904aa3, 0xe2e47f76, 0x85df8316, 0xb58705a4, 0xb559e5cc, 0xc6743515, 0x524deef1)}},
+    {0x00, SECP256K1_FE_CONST(0xe5bbb9ef, 0x360d0a50, 0x1618f006, 0x7d36dceb, 0x75f5be9a, 0x620232aa, 0x9fd5139d, 0x0863fde5), SECP256K1_FE_CONST(0xe5bbb9ef, 0x360d0a50, 0x1618f006, 0x7d36dceb, 0x75f5be9a, 0x620232aa, 0x9fd5139d, 0x0863fde5), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0xff, SECP256K1_FE_CONST(0xe6bcb5c3, 0xd63467d4, 0x90bfa54f, 0xbbc6092a, 0x7248c25e, 0x11b248dc, 0x2964a6e1, 0x5edb1457), SECP256K1_FE_CONST(0x19434a3c, 0x29cb982b, 0x6f405ab0, 0x4439f6d5, 0x8db73da1, 0xee4db723, 0xd69b591d, 0xa124e7d8), {SECP256K1_FE_CONST(0x67119877, 0x832ab8f4, 0x59a82165, 0x6d8261f5, 0x44a553b8, 0x9ae4f25c, 0x52a97134, 0xb70f3426), SECP256K1_FE_CONST(0xffee02f5, 0xe649c07f, 0x0560eff1, 0x867ec7b3, 0x2d0e595e, 0x9b1c0ea6, 0xe2a4fc70, 0xc97cd71f), SECP256K1_FE_CONST(0xb5e0c189, 0xeb5b4bac, 0xd025b744, 0x4d74178b, 0xe8d5246c, 0xfa4a9a20, 0x7964a057, 0xee969992), SECP256K1_FE_CONST(0x5746e459, 0x1bf7f4c3, 0x044609ea, 0x372e9086, 0x03975d27, 0x9fdef834, 0x9f0b08d3, 0x2f07619d), SECP256K1_FE_CONST(0x98ee6788, 0x7cd5470b, 0xa657de9a, 0x927d9e0a, 0xbb5aac47, 0x651b0da3, 0xad568eca, 0x48f0c809), SECP256K1_FE_CONST(0x0011fd0a, 0x19b63f80, 0xfa9f100e, 0x7981384c, 0xd2f1a6a1, 0x64e3f159, 0x1d5b038e, 0x36832510), SECP256K1_FE_CONST(0x4a1f3e76, 0x14a4b453, 0x2fda48bb, 0xb28be874, 0x172adb93, 0x05b565df, 0x869b5fa7, 0x1169629d), SECP256K1_FE_CONST(0xa8b91ba6, 0xe4080b3c, 0xfbb9f615, 0xc8d16f79, 0xfc68a2d8, 0x602107cb, 0x60f4f72b, 0xd0f89a92)}},
+    {0x33, SECP256K1_FE_CONST(0xf28fba64, 0xaf766845, 0xeb2f4302, 0x456e2b9f, 0x8d80affe, 0x57e7aae4, 0x2738d7cd, 0xdb1c2ce6), SECP256K1_FE_CONST(0xf28fba64, 0xaf766845, 0xeb2f4302, 0x456e2b9f, 0x8d80affe, 0x57e7aae4, 0x2738d7cd, 0xdb1c2ce6), {SECP256K1_FE_CONST(0x4f867ad8, 0xbb3d8404, 0x09d26b67, 0x307e6210, 0x0153273f, 0x72fa4b74, 0x84becfa1, 0x4ebe7408), SECP256K1_FE_CONST(0x5bbc4f59, 0xe452cc5f, 0x22a99144, 0xb10ce898, 0x9a89a995, 0xec3cea1c, 0x91ae10e8, 0xf721bb5d), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0xb0798527, 0x44c27bfb, 0xf62d9498, 0xcf819def, 0xfeacd8c0, 0x8d05b48b, 0x7b41305d, 0xb1418827), SECP256K1_FE_CONST(0xa443b0a6, 0x1bad33a0, 0xdd566ebb, 0x4ef31767, 0x6576566a, 0x13c315e3, 0x6e51ef16, 0x08de40d2), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+    {0xcc, SECP256K1_FE_CONST(0xf455605b, 0xc85bf48e, 0x3a908c31, 0x023faf98, 0x381504c6, 0xc6d3aeb9, 0xede55f8d, 0xd528924d), SECP256K1_FE_CONST(0xd31fbcd5, 0xcdb798f6, 0xc00db669, 0x2f8fe896, 0x7fa9c79d, 0xd10958f4, 0xa194f013, 0x74905e99), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0x0c00c571, 0x5b56fe63, 0x2d814ad8, 0xa77f8e66, 0x628ea47a, 0x6116834f, 0x8c1218f3, 0xa03cbd50), SECP256K1_FE_CONST(0xdf88e44f, 0xac84fa52, 0xdf4d59f4, 0x8819f18f, 0x6a8cd415, 0x1d162afa, 0xf773166f, 0x57c7ff46), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0xf3ff3a8e, 0xa4a9019c, 0xd27eb527, 0x58807199, 0x9d715b85, 0x9ee97cb0, 0x73ede70b, 0x5fc33edf), SECP256K1_FE_CONST(0x20771bb0, 0x537b05ad, 0x20b2a60b, 0x77e60e70, 0x95732bea, 0xe2e9d505, 0x088ce98f, 0xa837fce9)}},
+    {0xff, SECP256K1_FE_CONST(0xf58cd4d9, 0x830bad32, 0x2699035e, 0x8246007d, 0x4be27e19, 0xb6f53621, 0x317b4f30, 0x9b3daa9d), SECP256K1_FE_CONST(0x78ec2b3d, 0xc0948de5, 0x60148bbc, 0x7c6dc963, 0x3ad5df70, 0xa5a5750c, 0xbed72180, 0x4f082a3b), {SECP256K1_FE_CONST(0x6c4c580b, 0x76c75940, 0x43569f9d, 0xae16dc28, 0x01c16a1f, 0xbe128608, 0x81b75f8e, 0xf929bce5), SECP256K1_FE_CONST(0x94231355, 0xe7385c5f, 0x25ca436a, 0xa6419147, 0x1aea4393, 0xd6e86ab7, 0xa35fe2af, 0xacaefd0d), SECP256K1_FE_CONST(0xdff2a195, 0x1ada6db5, 0x74df8340, 0x48149da3, 0x397a75b8, 0x29abf58c, 0x7e69db1b, 0x41ac0989), SECP256K1_FE_CONST(0xa52b66d3, 0xc9070355, 0x48028bf8, 0x04711bf4, 0x22aba95f, 0x1a666fc8, 0x6f4648e0, 0x5f29caae), SECP256K1_FE_CONST(0x93b3a7f4, 0x8938a6bf, 0xbca96062, 0x51e923d7, 0xfe3e95e0, 0x41ed79f7, 0x7e48a070, 0x06d63f4a), SECP256K1_FE_CONST(0x6bdcecaa, 0x18c7a3a0, 0xda35bc95, 0x59be6eb8, 0xe515bc6c, 0x29179548, 0x5ca01d4f, 0x5350ff22), SECP256K1_FE_CONST(0x200d5e6a, 0xe525924a, 0x8b207cbf, 0xb7eb625c, 0xc6858a47, 0xd6540a73, 0x819624e3, 0xbe53f2a6), SECP256K1_FE_CONST(0x5ad4992c, 0x36f8fcaa, 0xb7fd7407, 0xfb8ee40b, 0xdd5456a0, 0xe5999037, 0x90b9b71e, 0xa0d63181)}},
+    {0x00, SECP256K1_FE_CONST(0xfd7d912a, 0x40f182a3, 0x588800d6, 0x9ebfb504, 0x8766da20, 0x6fd7ebc8, 0xd2436c81, 0xcbef6421), SECP256K1_FE_CONST(0x8d37c862, 0x054debe7, 0x31694536, 0xff46b273, 0xec122b35, 0xa9bf1445, 0xac3c4ff9, 0xf262c952), {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0), SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)}},
+};
+
+/* Set of (encoding, xcoord) test vectors, selected to maximize branch coverage, part of the BIP324
+ * test vectors. Created using an independent implementation, and tested decoding against the paper
+ * authors' code. */
+static const struct ellswift_decode_test ellswift_decode_tests[] = {
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0xedd1fd3e, 0x327ce90c, 0xc7a35426, 0x14289aee, 0x9682003e, 0x9cf7dcc9, 0xcf2ca974, 0x3be5aa0c), 0},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xd3, 0x47, 0x5b, 0xf7, 0x65, 0x5b, 0x0f, 0xb2, 0xd8, 0x52, 0x92, 0x10, 0x35, 0xb2, 0xef, 0x60, 0x7f, 0x49, 0x06, 0x9b, 0x97, 0x45, 0x4e, 0x67, 0x95, 0x25, 0x10, 0x62, 0x74, 0x17, 0x71}, SECP256K1_FE_CONST(0xb5da00b7, 0x3cd65605, 0x20e7c364, 0x086e7cd2, 0x3a34bf60, 0xd0e707be, 0x9fc34d4c, 0xd5fdfa2c), 1},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x82, 0x27, 0x7c, 0x4a, 0x71, 0xf9, 0xd2, 0x2e, 0x66, 0xec, 0xe5, 0x23, 0xf8, 0xfa, 0x08, 0x74, 0x1a, 0x7c, 0x09, 0x12, 0xc6, 0x6a, 0x69, 0xce, 0x68, 0x51, 0x4b, 0xfd, 0x35, 0x15, 0xb4, 0x9f}, SECP256K1_FE_CONST(0xf482f2e2, 0x41753ad0, 0xfb89150d, 0x8491dc1e, 0x34ff0b8a, 0xcfbb442c, 0xfe999e2e, 0x5e6fd1d2), 1},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84, 0x21, 0xcc, 0x93, 0x0e, 0x77, 0xc9, 0xf5, 0x14, 0xb6, 0x91, 0x5c, 0x3d, 0xbe, 0x2a, 0x94, 0xc6, 0xd8, 0xf6, 0x90, 0xb5, 0xb7, 0x39, 0x86, 0x4b, 0xa6, 0x78, 0x9f, 0xb8, 0xa5, 0x5d, 0xd0}, SECP256K1_FE_CONST(0x9f59c402, 0x75f5085a, 0x006f05da, 0xe77eb98c, 0x6fd0db1a, 0xb4a72ac4, 0x7eae90a4, 0xfc9e57e0), 0},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xbd, 0xe7, 0x0d, 0xf5, 0x19, 0x39, 0xb9, 0x4c, 0x9c, 0x24, 0x97, 0x9f, 0xa7, 0xdd, 0x04, 0xeb, 0xd9, 0xb3, 0x57, 0x2d, 0xa7, 0x80, 0x22, 0x90, 0x43, 0x8a, 0xf2, 0xa6, 0x81, 0x89, 0x54, 0x41}, SECP256K1_FE_CONST(0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaa9, 0xfffffd6b), 1},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd1, 0x9c, 0x18, 0x2d, 0x27, 0x59, 0xcd, 0x99, 0x82, 0x42, 0x28, 0xd9, 0x47, 0x99, 0xf8, 0xc6, 0x55, 0x7c, 0x38, 0xa1, 0xc0, 0xd6, 0x77, 0x9b, 0x9d, 0x4b, 0x72, 0x9c, 0x6f, 0x1c, 0xcc, 0x42}, SECP256K1_FE_CONST(0x70720db7, 0xe238d041, 0x21f5b1af, 0xd8cc5ad9, 0xd18944c6, 0xbdc94881, 0xf502b7a3, 0xaf3aecff), 0},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0xedd1fd3e, 0x327ce90c, 0xc7a35426, 0x14289aee, 0x9682003e, 0x9cf7dcc9, 0xcf2ca974, 0x3be5aa0c), 0},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x26, 0x64, 0xbb, 0xd5}, SECP256K1_FE_CONST(0x50873db3, 0x1badcc71, 0x890e4f67, 0x753a6575, 0x7f97aaa7, 0xdd5f1e82, 0xb753ace3, 0x2219064b), 0},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x70, 0x28, 0xde, 0x7d}, SECP256K1_FE_CONST(0x1eea9cc5, 0x9cfcf2fa, 0x151ac6c2, 0x74eea411, 0x0feb4f7b, 0x68c59657, 0x32e9992e, 0x976ef68e), 0},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xcb, 0xcf, 0xb7, 0xe7}, SECP256K1_FE_CONST(0x12303941, 0xaedc2088, 0x80735b1f, 0x1795c8e5, 0x5be520ea, 0x93e10335, 0x7b5d2adb, 0x7ed59b8e), 0},
+    {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xf3, 0x11, 0x3a, 0xd9}, SECP256K1_FE_CONST(0x7eed6b70, 0xe7b0767c, 0x7d7feac0, 0x4e57aa2a, 0x12fef5e0, 0xf48f878f, 0xcbb88b3b, 0x6b5e0783), 0},
+    {{0x0a, 0x2d, 0x2b, 0xa9, 0x35, 0x07, 0xf1, 0xdf, 0x23, 0x37, 0x70, 0xc2, 0xa7, 0x97, 0x96, 0x2c, 0xc6, 0x1f, 0x6d, 0x15, 0xda, 0x14, 0xec, 0xd4, 0x7d, 0x8d, 0x27, 0xae, 0x1c, 0xd5, 0xf8, 0x53, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x532167c1, 0x1200b08c, 0x0e84a354, 0xe74dcc40, 0xf8b25f4f, 0xe686e308, 0x69526366, 0x278a0688), 0},
+    {{0x0a, 0x2d, 0x2b, 0xa9, 0x35, 0x07, 0xf1, 0xdf, 0x23, 0x37, 0x70, 0xc2, 0xa7, 0x97, 0x96, 0x2c, 0xc6, 0x1f, 0x6d, 0x15, 0xda, 0x14, 0xec, 0xd4, 0x7d, 0x8d, 0x27, 0xae, 0x1c, 0xd5, 0xf8, 0x53, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x532167c1, 0x1200b08c, 0x0e84a354, 0xe74dcc40, 0xf8b25f4f, 0xe686e308, 0x69526366, 0x278a0688), 0},
+    {{0x0f, 0xfd, 0xe9, 0xca, 0x81, 0xd7, 0x51, 0xe9, 0xcd, 0xaf, 0xfc, 0x1a, 0x50, 0x77, 0x92, 0x45, 0x32, 0x0b, 0x28, 0x99, 0x6d, 0xba, 0xf3, 0x2f, 0x82, 0x2f, 0x20, 0x11, 0x7c, 0x22, 0xfb, 0xd6, 0xc7, 0x4d, 0x99, 0xef, 0xce, 0xaa, 0x55, 0x0f, 0x1a, 0xd1, 0xc0, 0xf4, 0x3f, 0x46, 0xe7, 0xff, 0x1e, 0xe3, 0xbd, 0x01, 0x62, 0xb7, 0xbf, 0x55, 0xf2, 0x96, 0x5d, 0xa9, 0xc3, 0x45, 0x06, 0x46}, SECP256K1_FE_CONST(0x74e880b3, 0xffd18fe3, 0xcddf7902, 0x522551dd, 0xf97fa4a3, 0x5a3cfda8, 0x197f9470, 0x81a57b8f), 0},
+    {{0x0f, 0xfd, 0xe9, 0xca, 0x81, 0xd7, 0x51, 0xe9, 0xcd, 0xaf, 0xfc, 0x1a, 0x50, 0x77, 0x92, 0x45, 0x32, 0x0b, 0x28, 0x99, 0x6d, 0xba, 0xf3, 0x2f, 0x82, 0x2f, 0x20, 0x11, 0x7c, 0x22, 0xfb, 0xd6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x15, 0x6c, 0xa8, 0x96}, SECP256K1_FE_CONST(0x377b643f, 0xce2271f6, 0x4e5c8101, 0x566107c1, 0xbe498074, 0x50917838, 0x04f65478, 0x1ac9217c), 1},
+    {{0x12, 0x36, 0x58, 0x44, 0x4f, 0x32, 0xbe, 0x8f, 0x02, 0xea, 0x20, 0x34, 0xaf, 0xa7, 0xef, 0x4b, 0xbe, 0x8a, 0xdc, 0x91, 0x8c, 0xeb, 0x49, 0xb1, 0x27, 0x73, 0xb6, 0x25, 0xf4, 0x90, 0xb3, 0x68, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x8d, 0xc5, 0xfe, 0x11}, SECP256K1_FE_CONST(0xed16d65c, 0xf3a9538f, 0xcb2c139f, 0x1ecbc143, 0xee148271, 0x20cbc265, 0x9e667256, 0x800b8142), 0},
+    {{0x14, 0x6f, 0x92, 0x46, 0x4d, 0x15, 0xd3, 0x6e, 0x35, 0x38, 0x2b, 0xd3, 0xca, 0x5b, 0x0f, 0x97, 0x6c, 0x95, 0xcb, 0x08, 0xac, 0xdc, 0xf2, 0xd5, 0xb3, 0x57, 0x06, 0x17, 0x99, 0x08, 0x39, 0xd7, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x31, 0x45, 0xe9, 0x3b}, SECP256K1_FE_CONST(0x0d5cd840, 0x427f941f, 0x65193079, 0xab8e2e83, 0x024ef2ee, 0x7ca558d8, 0x8879ffd8, 0x79fb6657), 0},
+    {{0x15, 0xfd, 0xf5, 0xcf, 0x09, 0xc9, 0x07, 0x59, 0xad, 0xd2, 0x27, 0x2d, 0x57, 0x4d, 0x2b, 0xb5, 0xfe, 0x14, 0x29, 0xf9, 0xf3, 0xc1, 0x4c, 0x65, 0xe3, 0x19, 0x4b, 0xf6, 0x1b, 0x82, 0xaa, 0x73, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x04, 0xcf, 0xd9, 0x06}, SECP256K1_FE_CONST(0x16d0e439, 0x46aec93f, 0x62d57eb8, 0xcde68951, 0xaf136cf4, 0xb307938d, 0xd1447411, 0xe07bffe1), 1},
+    {{0x1f, 0x67, 0xed, 0xf7, 0x79, 0xa8, 0xa6, 0x49, 0xd6, 0xde, 0xf6, 0x00, 0x35, 0xf2, 0xfa, 0x22, 0xd0, 0x22, 0xdd, 0x35, 0x90, 0x79, 0xa1, 0xa1, 0x44, 0x07, 0x3d, 0x84, 0xf1, 0x9b, 0x92, 0xd5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x025661f9, 0xaba9d15c, 0x3118456b, 0xbe980e3e, 0x1b8ba2e0, 0x47c737a4, 0xeb48a040, 0xbb566f6c), 0},
+    {{0x1f, 0x67, 0xed, 0xf7, 0x79, 0xa8, 0xa6, 0x49, 0xd6, 0xde, 0xf6, 0x00, 0x35, 0xf2, 0xfa, 0x22, 0xd0, 0x22, 0xdd, 0x35, 0x90, 0x79, 0xa1, 0xa1, 0x44, 0x07, 0x3d, 0x84, 0xf1, 0x9b, 0x92, 0xd5, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x025661f9, 0xaba9d15c, 0x3118456b, 0xbe980e3e, 0x1b8ba2e0, 0x47c737a4, 0xeb48a040, 0xbb566f6c), 0},
+    {{0x1f, 0xe1, 0xe5, 0xef, 0x3f, 0xce, 0xb5, 0xc1, 0x35, 0xab, 0x77, 0x41, 0x33, 0x3c, 0xe5, 0xa6, 0xe8, 0x0d, 0x68, 0x16, 0x76, 0x53, 0xf6, 0xb2, 0xb2, 0x4b, 0xcb, 0xcf, 0xaa, 0xaf, 0xf5, 0x07, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x98bec3b2, 0xa351fa96, 0xcfd191c1, 0x77835193, 0x1b9e9ba9, 0xad1149f6, 0xd9eadca8, 0x0981b801), 0},
+    {{0x40, 0x56, 0xa3, 0x4a, 0x21, 0x0e, 0xec, 0x78, 0x92, 0xe8, 0x82, 0x06, 0x75, 0xc8, 0x60, 0x09, 0x9f, 0x85, 0x7b, 0x26, 0xaa, 0xd8, 0x54, 0x70, 0xee, 0x6d, 0x3c, 0xf1, 0x30, 0x4a, 0x9d, 0xcf, 0x37, 0x5e, 0x70, 0x37, 0x42, 0x71, 0xf2, 0x0b, 0x13, 0xc9, 0x98, 0x6e, 0xd7, 0xd3, 0xc1, 0x77, 0x99, 0x69, 0x8c, 0xfc, 0x43, 0x5d, 0xbe, 0xd3, 0xa9, 0xf3, 0x4b, 0x38, 0xc8, 0x23, 0xc2, 0xb4}, SECP256K1_FE_CONST(0x868aac20, 0x03b29dbc, 0xad1a3e80, 0x3855e078, 0xa89d1654, 0x3ac64392, 0xd1224172, 0x98cec76e), 0},
+    {{0x41, 0x97, 0xec, 0x37, 0x23, 0xc6, 0x54, 0xcf, 0xdd, 0x32, 0xab, 0x07, 0x55, 0x06, 0x64, 0x8b, 0x2f, 0xf5, 0x07, 0x03, 0x62, 0xd0, 0x1a, 0x4f, 0xff, 0x14, 0xb3, 0x36, 0xb7, 0x8f, 0x96, 0x3f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xb3, 0xab, 0x1e, 0x95}, SECP256K1_FE_CONST(0xba5a6314, 0x502a8952, 0xb8f456e0, 0x85928105, 0xf665377a, 0x8ce27726, 0xa5b0eb7e, 0xc1ac0286), 0},
+    {{0x47, 0xeb, 0x3e, 0x20, 0x8f, 0xed, 0xcd, 0xf8, 0x23, 0x4c, 0x94, 0x21, 0xe9, 0xcd, 0x9a, 0x7a, 0xe8, 0x73, 0xbf, 0xbd, 0xbc, 0x39, 0x37, 0x23, 0xd1, 0xba, 0x1e, 0x1e, 0x6a, 0x8e, 0x6b, 0x24, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7c, 0xd1, 0x2c, 0xb1}, SECP256K1_FE_CONST(0xd192d520, 0x07e541c9, 0x807006ed, 0x0468df77, 0xfd214af0, 0xa795fe11, 0x9359666f, 0xdcf08f7c), 0},
+    {{0x5e, 0xb9, 0x69, 0x6a, 0x23, 0x36, 0xfe, 0x2c, 0x3c, 0x66, 0x6b, 0x02, 0xc7, 0x55, 0xdb, 0x4c, 0x0c, 0xfd, 0x62, 0x82, 0x5c, 0x7b, 0x58, 0x9a, 0x7b, 0x7b, 0xb4, 0x42, 0xe1, 0x41, 0xc1, 0xd6, 0x93, 0x41, 0x3f, 0x00, 0x52, 0xd4, 0x9e, 0x64, 0xab, 0xec, 0x6d, 0x58, 0x31, 0xd6, 0x6c, 0x43, 0x61, 0x28, 0x30, 0xa1, 0x7d, 0xf1, 0xfe, 0x43, 0x83, 0xdb, 0x89, 0x64, 0x68, 0x10, 0x02, 0x21}, SECP256K1_FE_CONST(0xef6e1da6, 0xd6c7627e, 0x80f7a723, 0x4cb08a02, 0x2c1ee1cf, 0x29e4d0f9, 0x642ae924, 0xcef9eb38), 1},
+    {{0x7b, 0xf9, 0x6b, 0x7b, 0x6d, 0xa1, 0x5d, 0x34, 0x76, 0xa2, 0xb1, 0x95, 0x93, 0x4b, 0x69, 0x0a, 0x3a, 0x3d, 0xe3, 0xe8, 0xab, 0x84, 0x74, 0x85, 0x68, 0x63, 0xb0, 0xde, 0x3a, 0xf9, 0x0b, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x50851dfc, 0x9f418c31, 0x4a437295, 0xb24feeea, 0x27af3d0c, 0xd2308348, 0xfda6e21c, 0x463e46ff), 0},
+    {{0x7b, 0xf9, 0x6b, 0x7b, 0x6d, 0xa1, 0x5d, 0x34, 0x76, 0xa2, 0xb1, 0x95, 0x93, 0x4b, 0x69, 0x0a, 0x3a, 0x3d, 0xe3, 0xe8, 0xab, 0x84, 0x74, 0x85, 0x68, 0x63, 0xb0, 0xde, 0x3a, 0xf9, 0x0b, 0x0e, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x50851dfc, 0x9f418c31, 0x4a437295, 0xb24feeea, 0x27af3d0c, 0xd2308348, 0xfda6e21c, 0x463e46ff), 0},
+    {{0x85, 0x1b, 0x1c, 0xa9, 0x45, 0x49, 0x37, 0x1c, 0x4f, 0x1f, 0x71, 0x87, 0x32, 0x1d, 0x39, 0xbf, 0x51, 0xc6, 0xb7, 0xfb, 0x61, 0xf7, 0xcb, 0xf0, 0x27, 0xc9, 0xda, 0x62, 0x02, 0x1b, 0x7a, 0x65, 0xfc, 0x54, 0xc9, 0x68, 0x37, 0xfb, 0x22, 0xb3, 0x62, 0xed, 0xa6, 0x3e, 0xc5, 0x2e, 0xc8, 0x3d, 0x81, 0xbe, 0xdd, 0x16, 0x0c, 0x11, 0xb2, 0x2d, 0x96, 0x5d, 0x9f, 0x4a, 0x6d, 0x64, 0xd2, 0x51}, SECP256K1_FE_CONST(0x3e731051, 0xe12d3323, 0x7eb324f2, 0xaa5b16bb, 0x868eb49a, 0x1aa1fadc, 0x19b6e876, 0x1b5a5f7b), 1},
+    {{0x94, 0x3c, 0x2f, 0x77, 0x51, 0x08, 0xb7, 0x37, 0xfe, 0x65, 0xa9, 0x53, 0x1e, 0x19, 0xf2, 0xfc, 0x2a, 0x19, 0x7f, 0x56, 0x03, 0xe3, 0xa2, 0x88, 0x1d, 0x1d, 0x83, 0xe4, 0x00, 0x8f, 0x91, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x311c61f0, 0xab2f32b7, 0xb1f0223f, 0xa72f0a78, 0x752b8146, 0xe46107f8, 0x876dd9c4, 0xf92b2942), 0},
+    {{0x94, 0x3c, 0x2f, 0x77, 0x51, 0x08, 0xb7, 0x37, 0xfe, 0x65, 0xa9, 0x53, 0x1e, 0x19, 0xf2, 0xfc, 0x2a, 0x19, 0x7f, 0x56, 0x03, 0xe3, 0xa2, 0x88, 0x1d, 0x1d, 0x83, 0xe4, 0x00, 0x8f, 0x91, 0x25, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x311c61f0, 0xab2f32b7, 0xb1f0223f, 0xa72f0a78, 0x752b8146, 0xe46107f8, 0x876dd9c4, 0xf92b2942), 0},
+    {{0xa0, 0xf1, 0x84, 0x92, 0x18, 0x3e, 0x61, 0xe8, 0x06, 0x3e, 0x57, 0x36, 0x06, 0x59, 0x14, 0x21, 0xb0, 0x6b, 0xc3, 0x51, 0x36, 0x31, 0x57, 0x8a, 0x73, 0xa3, 0x9c, 0x1c, 0x33, 0x06, 0x23, 0x9f, 0x2f, 0x32, 0x90, 0x4f, 0x0d, 0x2a, 0x33, 0xec, 0xca, 0x8a, 0x54, 0x51, 0x70, 0x5b, 0xb5, 0x37, 0xd3, 0xbf, 0x44, 0xe0, 0x71, 0x22, 0x60, 0x25, 0xcd, 0xbf, 0xd2, 0x49, 0xfe, 0x0f, 0x7a, 0xd6}, SECP256K1_FE_CONST(0x97a09cf1, 0xa2eae7c4, 0x94df3c6f, 0x8a9445bf, 0xb8c09d60, 0x832f9b0b, 0x9d5eabe2, 0x5fbd14b9), 0},
+    {{0xa1, 0xed, 0x0a, 0x0b, 0xd7, 0x9d, 0x8a, 0x23, 0xcf, 0xe4, 0xec, 0x5f, 0xef, 0x5b, 0xa5, 0xcc, 0xcf, 0xd8, 0x44, 0xe4, 0xff, 0x5c, 0xb4, 0xb0, 0xf2, 0xe7, 0x16, 0x27, 0x34, 0x1f, 0x1c, 0x5b, 0x17, 0xc4, 0x99, 0x24, 0x9e, 0x0a, 0xc0, 0x8d, 0x5d, 0x11, 0xea, 0x1c, 0x2c, 0x8c, 0xa7, 0x00, 0x16, 0x16, 0x55, 0x9a, 0x79, 0x94, 0xea, 0xde, 0xc9, 0xca, 0x10, 0xfb, 0x4b, 0x85, 0x16, 0xdc}, SECP256K1_FE_CONST(0x65a89640, 0x744192cd, 0xac64b2d2, 0x1ddf989c, 0xdac75007, 0x25b645be, 0xf8e2200a, 0xe39691f2), 0},
+    {{0xba, 0x94, 0x59, 0x4a, 0x43, 0x27, 0x21, 0xaa, 0x35, 0x80, 0xb8, 0x4c, 0x16, 0x1d, 0x0d, 0x13, 0x4b, 0xc3, 0x54, 0xb6, 0x90, 0x40, 0x4d, 0x7c, 0xd4, 0xec, 0x57, 0xc1, 0x6d, 0x3f, 0xbe, 0x98, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xea, 0x50, 0x7d, 0xd7}, SECP256K1_FE_CONST(0x5e0d7656, 0x4aae92cb, 0x347e01a6, 0x2afd389a, 0x9aa401c7, 0x6c8dd227, 0x543dc9cd, 0x0efe685a), 0},
+    {{0xbc, 0xaf, 0x72, 0x19, 0xf2, 0xf6, 0xfb, 0xf5, 0x5f, 0xe5, 0xe0, 0x62, 0xdc, 0xe0, 0xe4, 0x8c, 0x18, 0xf6, 0x81, 0x03, 0xf1, 0x0b, 0x81, 0x98, 0xe9, 0x74, 0xc1, 0x84, 0x75, 0x0e, 0x1b, 0xe3, 0x93, 0x20, 0x16, 0xcb, 0xf6, 0x9c, 0x44, 0x71, 0xbd, 0x1f, 0x65, 0x6c, 0x6a, 0x10, 0x7f, 0x19, 0x73, 0xde, 0x4a, 0xf7, 0x08, 0x6d, 0xb8, 0x97, 0x27, 0x70, 0x60, 0xe2, 0x56, 0x77, 0xf1, 0x9a}, SECP256K1_FE_CONST(0x2d97f96c, 0xac882dfe, 0x73dc44db, 0x6ce0f1d3, 0x1d624135, 0x8dd5d74e, 0xb3d3b500, 0x03d24c2b), 0},
+    {{0xbc, 0xaf, 0x72, 0x19, 0xf2, 0xf6, 0xfb, 0xf5, 0x5f, 0xe5, 0xe0, 0x62, 0xdc, 0xe0, 0xe4, 0x8c, 0x18, 0xf6, 0x81, 0x03, 0xf1, 0x0b, 0x81, 0x98, 0xe9, 0x74, 0xc1, 0x84, 0x75, 0x0e, 0x1b, 0xe3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x65, 0x07, 0xd0, 0x9a}, SECP256K1_FE_CONST(0xe7008afe, 0x6e8cbd50, 0x55df120b, 0xd748757c, 0x686dadb4, 0x1cce75e4, 0xaddcc5e0, 0x2ec02b44), 1},
+    {{0xc5, 0x98, 0x1b, 0xae, 0x27, 0xfd, 0x84, 0x40, 0x1c, 0x72, 0xa1, 0x55, 0xe5, 0x70, 0x7f, 0xbb, 0x81, 0x1b, 0x2b, 0x62, 0x06, 0x45, 0xd1, 0x02, 0x8e, 0xa2, 0x70, 0xcb, 0xe0, 0xee, 0x22, 0x5d, 0x4b, 0x62, 0xaa, 0x4d, 0xca, 0x65, 0x06, 0xc1, 0xac, 0xdb, 0xec, 0xc0, 0x55, 0x25, 0x69, 0xb4, 0xb2, 0x14, 0x36, 0xa5, 0x69, 0x2e, 0x25, 0xd9, 0x0d, 0x3b, 0xc2, 0xeb, 0x7c, 0xe2, 0x40, 0x78}, SECP256K1_FE_CONST(0x948b40e7, 0x181713bc, 0x018ec170, 0x2d3d054d, 0x15746c59, 0xa7020730, 0xdd13ecf9, 0x85a010d7), 0},
+    {{0xc8, 0x94, 0xce, 0x48, 0xbf, 0xec, 0x43, 0x30, 0x14, 0xb9, 0x31, 0xa6, 0xad, 0x42, 0x26, 0xd7, 0xdb, 0xd8, 0xea, 0xa7, 0xb6, 0xe3, 0xfa, 0xa8, 0xd0, 0xef, 0x94, 0x05, 0x2b, 0xcf, 0x8c, 0xff, 0x33, 0x6e, 0xeb, 0x39, 0x19, 0xe2, 0xb4, 0xef, 0xb7, 0x46, 0xc7, 0xf7, 0x1b, 0xbc, 0xa7, 0xe9, 0x38, 0x32, 0x30, 0xfb, 0xbc, 0x48, 0xff, 0xaf, 0xe7, 0x7e, 0x8b, 0xcc, 0x69, 0x54, 0x24, 0x71}, SECP256K1_FE_CONST(0xf1c91acd, 0xc2525330, 0xf9b53158, 0x434a4d43, 0xa1c547cf, 0xf29f1550, 0x6f5da4eb, 0x4fe8fa5a), 1},
+    {{0xcb, 0xb0, 0xde, 0xab, 0x12, 0x57, 0x54, 0xf1, 0xfd, 0xb2, 0x03, 0x8b, 0x04, 0x34, 0xed, 0x9c, 0xb3, 0xfb, 0x53, 0xab, 0x73, 0x53, 0x91, 0x12, 0x99, 0x94, 0xa5, 0x35, 0xd9, 0x25, 0xf6, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x872d81ed, 0x8831d999, 0x8b67cb71, 0x05243edb, 0xf86c10ed, 0xfebb786c, 0x110b02d0, 0x7b2e67cd), 0},
+    {{0xd9, 0x17, 0xb7, 0x86, 0xda, 0xc3, 0x56, 0x70, 0xc3, 0x30, 0xc9, 0xc5, 0xae, 0x59, 0x71, 0xdf, 0xb4, 0x95, 0xc8, 0xae, 0x52, 0x3e, 0xd9, 0x7e, 0xe2, 0x42, 0x01, 0x17, 0xb1, 0x71, 0xf4, 0x1e, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x20, 0x01, 0xf6, 0xf6}, SECP256K1_FE_CONST(0xe45b71e1, 0x10b831f2, 0xbdad8651, 0x994526e5, 0x8393fde4, 0x328b1ec0, 0x4d598971, 0x42584691), 1},
+    {{0xe2, 0x8b, 0xd8, 0xf5, 0x92, 0x9b, 0x46, 0x7e, 0xb7, 0x0e, 0x04, 0x33, 0x23, 0x74, 0xff, 0xb7, 0xe7, 0x18, 0x02, 0x18, 0xad, 0x16, 0xea, 0xa4, 0x6b, 0x71, 0x61, 0xaa, 0x67, 0x9e, 0xb4, 0x26, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x66b8c980, 0xa75c72e5, 0x98d383a3, 0x5a62879f, 0x844242ad, 0x1e73ff12, 0xedaa59f4, 0xe58632b5), 0},
+    {{0xe2, 0x8b, 0xd8, 0xf5, 0x92, 0x9b, 0x46, 0x7e, 0xb7, 0x0e, 0x04, 0x33, 0x23, 0x74, 0xff, 0xb7, 0xe7, 0x18, 0x02, 0x18, 0xad, 0x16, 0xea, 0xa4, 0x6b, 0x71, 0x61, 0xaa, 0x67, 0x9e, 0xb4, 0x26, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x66b8c980, 0xa75c72e5, 0x98d383a3, 0x5a62879f, 0x844242ad, 0x1e73ff12, 0xedaa59f4, 0xe58632b5), 0},
+    {{0xe7, 0xee, 0x58, 0x14, 0xc1, 0x70, 0x6b, 0xf8, 0xa8, 0x93, 0x96, 0xa9, 0xb0, 0x32, 0xbc, 0x01, 0x4c, 0x2c, 0xac, 0x9c, 0x12, 0x11, 0x27, 0xdb, 0xf6, 0xc9, 0x92, 0x78, 0xf8, 0xbb, 0x53, 0xd1, 0xdf, 0xd0, 0x4d, 0xbc, 0xda, 0x8e, 0x35, 0x24, 0x66, 0xb6, 0xfc, 0xd5, 0xf2, 0xde, 0xa3, 0xe1, 0x7d, 0x5e, 0x13, 0x31, 0x15, 0x88, 0x6e, 0xda, 0x20, 0xdb, 0x8a, 0x12, 0xb5, 0x4d, 0xe7, 0x1b}, SECP256K1_FE_CONST(0xe842c6e3, 0x529b2342, 0x70a5e977, 0x44edc34a, 0x04d7ba94, 0xe44b6d25, 0x23c9cf01, 0x95730a50), 1},
+    {{0xf2, 0x92, 0xe4, 0x68, 0x25, 0xf9, 0x22, 0x5a, 0xd2, 0x3d, 0xc0, 0x57, 0xc1, 0xd9, 0x1c, 0x4f, 0x57, 0xfc, 0xb1, 0x38, 0x6f, 0x29, 0xef, 0x10, 0x48, 0x1c, 0xb1, 0xd2, 0x25, 0x18, 0x59, 0x3f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x70, 0x11, 0xc9, 0x89}, SECP256K1_FE_CONST(0x3cea2c53, 0xb8b01701, 0x66ac7da6, 0x7194694a, 0xdacc84d5, 0x6389225e, 0x330134da, 0xb85a4d55), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0xedd1fd3e, 0x327ce90c, 0xc7a35426, 0x14289aee, 0x9682003e, 0x9cf7dcc9, 0xcf2ca974, 0x3be5aa0c), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0x01, 0xd3, 0x47, 0x5b, 0xf7, 0x65, 0x5b, 0x0f, 0xb2, 0xd8, 0x52, 0x92, 0x10, 0x35, 0xb2, 0xef, 0x60, 0x7f, 0x49, 0x06, 0x9b, 0x97, 0x45, 0x4e, 0x67, 0x95, 0x25, 0x10, 0x62, 0x74, 0x17, 0x71}, SECP256K1_FE_CONST(0xb5da00b7, 0x3cd65605, 0x20e7c364, 0x086e7cd2, 0x3a34bf60, 0xd0e707be, 0x9fc34d4c, 0xd5fdfa2c), 1},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0x42, 0x18, 0xf2, 0x0a, 0xe6, 0xc6, 0x46, 0xb3, 0x63, 0xdb, 0x68, 0x60, 0x58, 0x22, 0xfb, 0x14, 0x26, 0x4c, 0xa8, 0xd2, 0x58, 0x7f, 0xdd, 0x6f, 0xbc, 0x75, 0x0d, 0x58, 0x7e, 0x76, 0xa7, 0xee}, SECP256K1_FE_CONST(0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaa9, 0xfffffd6b), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0x82, 0x27, 0x7c, 0x4a, 0x71, 0xf9, 0xd2, 0x2e, 0x66, 0xec, 0xe5, 0x23, 0xf8, 0xfa, 0x08, 0x74, 0x1a, 0x7c, 0x09, 0x12, 0xc6, 0x6a, 0x69, 0xce, 0x68, 0x51, 0x4b, 0xfd, 0x35, 0x15, 0xb4, 0x9f}, SECP256K1_FE_CONST(0xf482f2e2, 0x41753ad0, 0xfb89150d, 0x8491dc1e, 0x34ff0b8a, 0xcfbb442c, 0xfe999e2e, 0x5e6fd1d2), 1},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0x84, 0x21, 0xcc, 0x93, 0x0e, 0x77, 0xc9, 0xf5, 0x14, 0xb6, 0x91, 0x5c, 0x3d, 0xbe, 0x2a, 0x94, 0xc6, 0xd8, 0xf6, 0x90, 0xb5, 0xb7, 0x39, 0x86, 0x4b, 0xa6, 0x78, 0x9f, 0xb8, 0xa5, 0x5d, 0xd0}, SECP256K1_FE_CONST(0x9f59c402, 0x75f5085a, 0x006f05da, 0xe77eb98c, 0x6fd0db1a, 0xb4a72ac4, 0x7eae90a4, 0xfc9e57e0), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0xd1, 0x9c, 0x18, 0x2d, 0x27, 0x59, 0xcd, 0x99, 0x82, 0x42, 0x28, 0xd9, 0x47, 0x99, 0xf8, 0xc6, 0x55, 0x7c, 0x38, 0xa1, 0xc0, 0xd6, 0x77, 0x9b, 0x9d, 0x4b, 0x72, 0x9c, 0x6f, 0x1c, 0xcc, 0x42}, SECP256K1_FE_CONST(0x70720db7, 0xe238d041, 0x21f5b1af, 0xd8cc5ad9, 0xd18944c6, 0xbdc94881, 0xf502b7a3, 0xaf3aecff), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0xedd1fd3e, 0x327ce90c, 0xc7a35426, 0x14289aee, 0x9682003e, 0x9cf7dcc9, 0xcf2ca974, 0x3be5aa0c), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x26, 0x64, 0xbb, 0xd5}, SECP256K1_FE_CONST(0x50873db3, 0x1badcc71, 0x890e4f67, 0x753a6575, 0x7f97aaa7, 0xdd5f1e82, 0xb753ace3, 0x2219064b), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x70, 0x28, 0xde, 0x7d}, SECP256K1_FE_CONST(0x1eea9cc5, 0x9cfcf2fa, 0x151ac6c2, 0x74eea411, 0x0feb4f7b, 0x68c59657, 0x32e9992e, 0x976ef68e), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xcb, 0xcf, 0xb7, 0xe7}, SECP256K1_FE_CONST(0x12303941, 0xaedc2088, 0x80735b1f, 0x1795c8e5, 0x5be520ea, 0x93e10335, 0x7b5d2adb, 0x7ed59b8e), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xf3, 0x11, 0x3a, 0xd9}, SECP256K1_FE_CONST(0x7eed6b70, 0xe7b0767c, 0x7d7feac0, 0x4e57aa2a, 0x12fef5e0, 0xf48f878f, 0xcbb88b3b, 0x6b5e0783), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x13, 0xce, 0xa4, 0xa7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x64998443, 0x5b62b4a2, 0x5d40c613, 0x3e8d9ab8, 0xc53d4b05, 0x9ee8a154, 0xa3be0fcf, 0x4e892edb), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x13, 0xce, 0xa4, 0xa7, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x64998443, 0x5b62b4a2, 0x5d40c613, 0x3e8d9ab8, 0xc53d4b05, 0x9ee8a154, 0xa3be0fcf, 0x4e892edb), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x15, 0x02, 0x8c, 0x59, 0x00, 0x63, 0xf6, 0x4d, 0x5a, 0x7f, 0x1c, 0x14, 0x91, 0x5c, 0xd6, 0x1e, 0xac, 0x88, 0x6a, 0xb2, 0x95, 0xbe, 0xbd, 0x91, 0x99, 0x25, 0x04, 0xcf, 0x77, 0xed, 0xb0, 0x28, 0xbd, 0xd6, 0x26, 0x7f}, SECP256K1_FE_CONST(0x3fde5713, 0xf8282eea, 0xd7d39d42, 0x01f44a7c, 0x85a5ac8a, 0x0681f35e, 0x54085c6b, 0x69543374), 1},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x27, 0x15, 0xde, 0x86, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x3524f77f, 0xa3a6eb43, 0x89c3cb5d, 0x27f1f914, 0x62086429, 0xcd6c0cb0, 0xdf43ea8f, 0x1e7b3fb4), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x27, 0x15, 0xde, 0x86, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x3524f77f, 0xa3a6eb43, 0x89c3cb5d, 0x27f1f914, 0x62086429, 0xcd6c0cb0, 0xdf43ea8f, 0x1e7b3fb4), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x2c, 0x2c, 0x57, 0x09, 0xe7, 0x15, 0x6c, 0x41, 0x77, 0x17, 0xf2, 0xfe, 0xab, 0x14, 0x71, 0x41, 0xec, 0x3d, 0xa1, 0x9f, 0xb7, 0x59, 0x57, 0x5c, 0xc6, 0xe3, 0x7b, 0x2e, 0xa5, 0xac, 0x93, 0x09, 0xf2, 0x6f, 0x0f, 0x66}, SECP256K1_FE_CONST(0xd2469ab3, 0xe04acbb2, 0x1c65a180, 0x9f39caaf, 0xe7a77c13, 0xd10f9dd3, 0x8f391c01, 0xdc499c52), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3a, 0x08, 0xcc, 0x1e, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xf7, 0x60, 0xe9, 0xf0}, SECP256K1_FE_CONST(0x38e2a5ce, 0x6a93e795, 0xe16d2c39, 0x8bc99f03, 0x69202ce2, 0x1e8f09d5, 0x6777b40f, 0xc512bccc), 1},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3e, 0x91, 0x25, 0x7d, 0x93, 0x20, 0x16, 0xcb, 0xf6, 0x9c, 0x44, 0x71, 0xbd, 0x1f, 0x65, 0x6c, 0x6a, 0x10, 0x7f, 0x19, 0x73, 0xde, 0x4a, 0xf7, 0x08, 0x6d, 0xb8, 0x97, 0x27, 0x70, 0x60, 0xe2, 0x56, 0x77, 0xf1, 0x9a}, SECP256K1_FE_CONST(0x864b3dc9, 0x02c37670, 0x9c10a93a, 0xd4bbe29f, 0xce0012f3, 0xdc8672c6, 0x286bba28, 0xd7d6d6fc), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x79, 0x5d, 0x6c, 0x1c, 0x32, 0x2c, 0xad, 0xf5, 0x99, 0xdb, 0xb8, 0x64, 0x81, 0x52, 0x2b, 0x3c, 0xc5, 0x5f, 0x15, 0xa6, 0x79, 0x32, 0xdb, 0x2a, 0xfa, 0x01, 0x11, 0xd9, 0xed, 0x69, 0x81, 0xbc, 0xd1, 0x24, 0xbf, 0x44}, SECP256K1_FE_CONST(0x766dfe4a, 0x700d9bee, 0x288b903a, 0xd58870e3, 0xd4fe2f0e, 0xf780bcac, 0x5c823f32, 0x0d9a9bef), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x8e, 0x42, 0x6f, 0x03, 0x92, 0x38, 0x90, 0x78, 0xc1, 0x2b, 0x1a, 0x89, 0xe9, 0x54, 0x2f, 0x05, 0x93, 0xbc, 0x96, 0xb6, 0xbf, 0xde, 0x82, 0x24, 0xf8, 0x65, 0x4e, 0xf5, 0xd5, 0xcd, 0xa9, 0x35, 0xa3, 0x58, 0x21, 0x94}, SECP256K1_FE_CONST(0xfaec7bc1, 0x987b6323, 0x3fbc5f95, 0x6edbf37d, 0x54404e74, 0x61c58ab8, 0x631bc68e, 0x451a0478), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x91, 0x19, 0x21, 0x39, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x45, 0xf0, 0xf1, 0xeb}, SECP256K1_FE_CONST(0xec29a50b, 0xae138dbf, 0x7d8e2482, 0x5006bb5f, 0xc1a2cc12, 0x43ba335b, 0xc6116fb9, 0xe498ec1f), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x98, 0xeb, 0x9a, 0xb7, 0x6e, 0x84, 0x49, 0x9c, 0x48, 0x3b, 0x3b, 0xf0, 0x62, 0x14, 0xab, 0xfe, 0x06, 0x5d, 0xdd, 0xf4, 0x3b, 0x86, 0x01, 0xde, 0x59, 0x6d, 0x63, 0xb9, 0xe4, 0x5a, 0x16, 0x6a, 0x58, 0x05, 0x41, 0xfe}, SECP256K1_FE_CONST(0x1e0ff2de, 0xe9b09b13, 0x6292a9e9, 0x10f0d6ac, 0x3e552a64, 0x4bba39e6, 0x4e9dd3e3, 0xbbd3d4d4), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x9b, 0x77, 0xb7, 0xf2, 0xc7, 0x4d, 0x99, 0xef, 0xce, 0xaa, 0x55, 0x0f, 0x1a, 0xd1, 0xc0, 0xf4, 0x3f, 0x46, 0xe7, 0xff, 0x1e, 0xe3, 0xbd, 0x01, 0x62, 0xb7, 0xbf, 0x55, 0xf2, 0x96, 0x5d, 0xa9, 0xc3, 0x45, 0x06, 0x46}, SECP256K1_FE_CONST(0x8b7dd5c3, 0xedba9ee9, 0x7b70eff4, 0x38f22dca, 0x9849c825, 0x4a2f3345, 0xa0a572ff, 0xeaae0928), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x9b, 0x77, 0xb7, 0xf2, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x15, 0x6c, 0xa8, 0x96}, SECP256K1_FE_CONST(0x0881950c, 0x8f51d6b9, 0xa6387465, 0xd5f12609, 0xef1bb254, 0x12a08a74, 0xcb2dfb20, 0x0c74bfbf), 1},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xa2, 0xf5, 0xcd, 0x83, 0x88, 0x16, 0xc1, 0x6c, 0x4f, 0xe8, 0xa1, 0x66, 0x1d, 0x60, 0x6f, 0xdb, 0x13, 0xcf, 0x9a, 0xf0, 0x4b, 0x97, 0x9a, 0x2e, 0x15, 0x9a, 0x09, 0x40, 0x9e, 0xbc, 0x86, 0x45, 0xd5, 0x8f, 0xde, 0x02}, SECP256K1_FE_CONST(0x2f083207, 0xb9fd9b55, 0x0063c31c, 0xd62b8746, 0xbd543bdc, 0x5bbf10e3, 0xa35563e9, 0x27f440c8), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xb1, 0x3f, 0x75, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x4f51e0be, 0x078e0cdd, 0xab274215, 0x6adba7e7, 0xa148e731, 0x57072fd6, 0x18cd6094, 0x2b146bd0), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xb1, 0x3f, 0x75, 0xc0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x4f51e0be, 0x078e0cdd, 0xab274215, 0x6adba7e7, 0xa148e731, 0x57072fd6, 0x18cd6094, 0x2b146bd0), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xe7, 0xbc, 0x1f, 0x8d, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, SECP256K1_FE_CONST(0x16c2ccb5, 0x4352ff4b, 0xd794f6ef, 0xd613c721, 0x97ab7082, 0xda5b563b, 0xdf9cb3ed, 0xaafe74c2), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xe7, 0xbc, 0x1f, 0x8d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f}, SECP256K1_FE_CONST(0x16c2ccb5, 0x4352ff4b, 0xd794f6ef, 0xd613c721, 0x97ab7082, 0xda5b563b, 0xdf9cb3ed, 0xaafe74c2), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xef, 0x64, 0xd1, 0x62, 0x75, 0x05, 0x46, 0xce, 0x42, 0xb0, 0x43, 0x13, 0x61, 0xe5, 0x2d, 0x4f, 0x52, 0x42, 0xd8, 0xf2, 0x4f, 0x33, 0xe6, 0xb1, 0xf9, 0x9b, 0x59, 0x16, 0x47, 0xcb, 0xc8, 0x08, 0xf4, 0x62, 0xaf, 0x51}, SECP256K1_FE_CONST(0xd41244d1, 0x1ca4f652, 0x40687759, 0xf95ca9ef, 0xbab767ed, 0xedb38fd1, 0x8c36e18c, 0xd3b6f6a9), 1},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xf0, 0xe5, 0xbe, 0x52, 0x37, 0x2d, 0xd6, 0xe8, 0x94, 0xb2, 0xa3, 0x26, 0xfc, 0x36, 0x05, 0xa6, 0xe8, 0xf3, 0xc6, 0x9c, 0x71, 0x0b, 0xf2, 0x7d, 0x63, 0x0d, 0xfe, 0x20, 0x04, 0x98, 0x8b, 0x78, 0xeb, 0x6e, 0xab, 0x36}, SECP256K1_FE_CONST(0x64bf84dd, 0x5e03670f, 0xdb24c0f5, 0xd3c2c365, 0x736f51db, 0x6c92d950, 0x10716ad2, 0xd36134c8), 0},
+    {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xfb, 0xb9, 0x82, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xf6, 0xd6, 0xdb, 0x1f}, SECP256K1_FE_CONST(0x1c92ccdf, 0xcf4ac550, 0xc28db57c, 0xff0c8515, 0xcb26936c, 0x786584a7, 0x0114008d, 0x6c33a34b), 0},
+};
+
+/* Set of expected ellswift_xdh BIP324 shared secrets, given private key, encodings, initiating,
+ * taken from the BIP324 test vectors. Created using an independent implementation, and tested
+ * against the paper authors' decoding code. */
+static const struct ellswift_xdh_test ellswift_xdh_tests_bip324[] = {
+    {{0x61, 0x06, 0x2e, 0xa5, 0x07, 0x1d, 0x80, 0x0b, 0xbf, 0xd5, 0x9e, 0x2e, 0x8b, 0x53, 0xd4, 0x7d, 0x19, 0x4b, 0x09, 0x5a, 0xe5, 0xa4, 0xdf, 0x04, 0x93, 0x6b, 0x49, 0x77, 0x2e, 0xf0, 0xd4, 0xd7}, {0xec, 0x0a, 0xdf, 0xf2, 0x57, 0xbb, 0xfe, 0x50, 0x0c, 0x18, 0x8c, 0x80, 0xb4, 0xfd, 0xd6, 0x40, 0xf6, 0xb4, 0x5a, 0x48, 0x2b, 0xbc, 0x15, 0xfc, 0x7c, 0xef, 0x59, 0x31, 0xde, 0xff, 0x0a, 0xa1, 0x86, 0xf6, 0xeb, 0x9b, 0xba, 0x7b, 0x85, 0xdc, 0x4d, 0xcc, 0x28, 0xb2, 0x87, 0x22, 0xde, 0x1e, 0x3d, 0x91, 0x08, 0xb9, 0x85, 0xe2, 0x96, 0x70, 0x45, 0x66, 0x8f, 0x66, 0x09, 0x8e, 0x47, 0x5b}, {0xa4, 0xa9, 0x4d, 0xfc, 0xe6, 0x9b, 0x4a, 0x2a, 0x0a, 0x09, 0x93, 0x13, 0xd1, 0x0f, 0x9f, 0x7e, 0x7d, 0x64, 0x9d, 0x60, 0x50, 0x1c, 0x9e, 0x1d, 0x27, 0x4c, 0x30, 0x0e, 0x0d, 0x89, 0xaa, 0xfa, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x8f, 0xaf, 0x88, 0xd5}, 1, {0xc6, 0x99, 0x2a, 0x11, 0x7f, 0x5e, 0xdb, 0xea, 0x70, 0xc3, 0xf5, 0x11, 0xd3, 0x2d, 0x26, 0xb9, 0x79, 0x8b, 0xe4, 0xb8, 0x1a, 0x62, 0xea, 0xee, 0x1a, 0x5a, 0xca, 0xa8, 0x45, 0x9a, 0x35, 0x92}},
+    {{0x1f, 0x9c, 0x58, 0x1b, 0x35, 0x23, 0x18, 0x38, 0xf0, 0xf1, 0x7c, 0xf0, 0xc9, 0x79, 0x83, 0x5b, 0xac, 0xcb, 0x7f, 0x3a, 0xbb, 0xbb, 0x96, 0xff, 0xcc, 0x31, 0x8a, 0xb7, 0x1e, 0x6e, 0x12, 0x6f}, {0xa1, 0x85, 0x5e, 0x10, 0xe9, 0x4e, 0x00, 0xba, 0xa2, 0x30, 0x41, 0xd9, 0x16, 0xe2, 0x59, 0xf7, 0x04, 0x4e, 0x49, 0x1d, 0xa6, 0x17, 0x12, 0x69, 0x69, 0x47, 0x63, 0xf0, 0x18, 0xc7, 0xe6, 0x36, 0x93, 0xd2, 0x95, 0x75, 0xdc, 0xb4, 0x64, 0xac, 0x81, 0x6b, 0xaa, 0x1b, 0xe3, 0x53, 0xba, 0x12, 0xe3, 0x87, 0x6c, 0xba, 0x76, 0x28, 0xbd, 0x0b, 0xd8, 0xe7, 0x55, 0xe7, 0x21, 0xeb, 0x01, 0x40}, {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, 0, {0xa0, 0x13, 0x8f, 0x56, 0x4f, 0x74, 0xd0, 0xad, 0x70, 0xbc, 0x33, 0x7d, 0xac, 0xc9, 0xd0, 0xbf, 0x1d, 0x23, 0x49, 0x36, 0x4c, 0xaf, 0x11, 0x88, 0xa1, 0xe6, 0xe8, 0xdd, 0xb3, 0xb7, 0xb1, 0x84}},
+    {{0x02, 0x86, 0xc4, 0x1c, 0xd3, 0x09, 0x13, 0xdb, 0x0f, 0xdf, 0xf7, 0xa6, 0x4e, 0xbd, 0xa5, 0xc8, 0xe3, 0xe7, 0xce, 0xf1, 0x0f, 0x2a, 0xeb, 0xc0, 0x0a, 0x76, 0x50, 0x44, 0x3c, 0xf4, 0xc6, 0x0d}, {0xd1, 0xee, 0x8a, 0x93, 0xa0, 0x11, 0x30, 0xcb, 0xf2, 0x99, 0x24, 0x9a, 0x25, 0x8f, 0x94, 0xfe, 0xb5, 0xf4, 0x69, 0xe7, 0xd0, 0xf2, 0xf2, 0x8f, 0x69, 0xee, 0x5e, 0x9a, 0xa8, 0xf9, 0xb5, 0x4a, 0x60, 0xf2, 0xc3, 0xff, 0x2d, 0x02, 0x36, 0x34, 0xec, 0x7f, 0x41, 0x27, 0xa9, 0x6c, 0xc1, 0x16, 0x62, 0xe4, 0x02, 0x89, 0x4c, 0xf1, 0xf6, 0x94, 0xfb, 0x9a, 0x7e, 0xaa, 0x5f, 0x1d, 0x92, 0x44}, {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x22, 0xd5, 0xe4, 0x41, 0x52, 0x4d, 0x57, 0x1a, 0x52, 0xb3, 0xde, 0xf1, 0x26, 0x18, 0x9d, 0x3f, 0x41, 0x68, 0x90, 0xa9, 0x9d, 0x4d, 0xa6, 0xed, 0xe2, 0xb0, 0xcd, 0xe1, 0x76, 0x0c, 0xe2, 0xc3, 0xf9, 0x84, 0x57, 0xae}, 1, {0x25, 0x0b, 0x93, 0x57, 0x0d, 0x41, 0x11, 0x49, 0x10, 0x5a, 0xb8, 0xcb, 0x0b, 0xc5, 0x07, 0x99, 0x14, 0x90, 0x63, 0x06, 0x36, 0x8c, 0x23, 0xe9, 0xd7, 0x7c, 0x2a, 0x33, 0x26, 0x5b, 0x99, 0x4c}},
+    {{0x6c, 0x77, 0x43, 0x2d, 0x1f, 0xda, 0x31, 0xe9, 0xf9, 0x42, 0xf8, 0xaf, 0x44, 0x60, 0x7e, 0x10, 0xf3, 0xad, 0x38, 0xa6, 0x5f, 0x8a, 0x4b, 0xdd, 0xae, 0x82, 0x3e, 0x5e, 0xff, 0x90, 0xdc, 0x38}, {0xd2, 0x68, 0x50, 0x70, 0xc1, 0xe6, 0x37, 0x6e, 0x63, 0x3e, 0x82, 0x52, 0x96, 0x63, 0x4f, 0xd4, 0x61, 0xfa, 0x9e, 0x5b, 0xdf, 0x21, 0x09, 0xbc, 0xeb, 0xd7, 0x35, 0xe5, 0xa9, 0x1f, 0x3e, 0x58, 0x7c, 0x5c, 0xb7, 0x82, 0xab, 0xb7, 0x97, 0xfb, 0xf6, 0xbb, 0x50, 0x74, 0xfd, 0x15, 0x42, 0xa4, 0x74, 0xf2, 0xa4, 0x5b, 0x67, 0x37, 0x63, 0xec, 0x2d, 0xb7, 0xfb, 0x99, 0xb7, 0x37, 0xbb, 0xb9}, {0x56, 0xbd, 0x0c, 0x06, 0xf1, 0x03, 0x52, 0xc3, 0xa1, 0xa9, 0xf4, 0xb4, 0xc9, 0x2f, 0x6f, 0xa2, 0xb2, 0x6d, 0xf1, 0x24, 0xb5, 0x78, 0x78, 0x35, 0x3c, 0x1f, 0xc6, 0x91, 0xc5, 0x1a, 0xbe, 0xa7, 0x7c, 0x88, 0x17, 0xda, 0xee, 0xb9, 0xfa, 0x54, 0x6b, 0x77, 0xc8, 0xda, 0xf7, 0x9d, 0x89, 0xb2, 0x2b, 0x0e, 0x1b, 0x87, 0x57, 0x4e, 0xce, 0x42, 0x37, 0x1f, 0x00, 0x23, 0x7a, 0xa9, 0xd8, 0x3a}, 0, {0x19, 0x18, 0xb7, 0x41, 0xef, 0x5f, 0x9d, 0x1d, 0x76, 0x70, 0xb0, 0x50, 0xc1, 0x52, 0xb4, 0xa4, 0xea, 0xd2, 0xc3, 0x1b, 0xe9, 0xae, 0xcb, 0x06, 0x81, 0xc0, 0xcd, 0x43, 0x24, 0x15, 0x08, 0x53}},
+    {{0xa6, 0xec, 0x25, 0x12, 0x7c, 0xa1, 0xaa, 0x4c, 0xf1, 0x6b, 0x20, 0x08, 0x4b, 0xa1, 0xe6, 0x51, 0x6b, 0xaa, 0xe4, 0xd3, 0x24, 0x22, 0x28, 0x8e, 0x9b, 0x36, 0xd8, 0xbd, 0xdd, 0x2d, 0xe3, 0x5a}, {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x05, 0x3d, 0x7e, 0xcc, 0xa5, 0x3e, 0x33, 0xe1, 0x85, 0xa8, 0xb9, 0xbe, 0x4e, 0x76, 0x99, 0xa9, 0x7c, 0x6f, 0xf4, 0xc7, 0x95, 0x52, 0x2e, 0x59, 0x18, 0xab, 0x7c, 0xd6, 0xb6, 0x88, 0x4f, 0x67, 0xe6, 0x83, 0xf3, 0xdc}, {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xa7, 0x73, 0x0b, 0xe3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, 1, {0xdd, 0x21, 0x0a, 0xa6, 0x62, 0x9f, 0x20, 0xbb, 0x32, 0x8e, 0x5d, 0x89, 0xda, 0xa6, 0xeb, 0x2a, 0xc3, 0xd1, 0xc6, 0x58, 0xa7, 0x25, 0x53, 0x6f, 0xf1, 0x54, 0xf3, 0x1b, 0x53, 0x6c, 0x23, 0xb2}},
+    {{0x0a, 0xf9, 0x52, 0x65, 0x9e, 0xd7, 0x6f, 0x80, 0xf5, 0x85, 0x96, 0x6b, 0x95, 0xab, 0x6e, 0x6f, 0xd6, 0x86, 0x54, 0x67, 0x28, 0x27, 0x87, 0x86, 0x84, 0xc8, 0xb5, 0x47, 0xb1, 0xb9, 0x4f, 0x5a}, {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xc8, 0x10, 0x17, 0xfd, 0x92, 0xfd, 0x31, 0x63, 0x7c, 0x26, 0xc9, 0x06, 0xb4, 0x20, 0x92, 0xe1, 0x1c, 0xc0, 0xd3, 0xaf, 0xae, 0x8d, 0x90, 0x19, 0xd2, 0x57, 0x8a, 0xf2, 0x27, 0x35, 0xce, 0x7b, 0xc4, 0x69, 0xc7, 0x2d}, {0x96, 0x52, 0xd7, 0x8b, 0xae, 0xfc, 0x02, 0x8c, 0xd3, 0x7a, 0x6a, 0x92, 0x62, 0x5b, 0x8b, 0x8f, 0x85, 0xfd, 0xe1, 0xe4, 0xc9, 0x44, 0xad, 0x3f, 0x20, 0xe1, 0x98, 0xbe, 0xf8, 0xc0, 0x2f, 0x19, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xf2, 0xe9, 0x18, 0x70}, 0, {0x35, 0x68, 0xf2, 0xae, 0xa2, 0xe1, 0x4e, 0xf4, 0xee, 0x4a, 0x3c, 0x2a, 0x8b, 0x8d, 0x31, 0xbc, 0x5e, 0x31, 0x87, 0xba, 0x86, 0xdb, 0x10, 0x73, 0x9b, 0x4f, 0xf8, 0xec, 0x92, 0xff, 0x66, 0x55}},
+    {{0xf9, 0x0e, 0x08, 0x0c, 0x64, 0xb0, 0x58, 0x24, 0xc5, 0xa2, 0x4b, 0x25, 0x01, 0xd5, 0xae, 0xaf, 0x08, 0xaf, 0x38, 0x72, 0xee, 0x86, 0x0a, 0xa8, 0x0b, 0xdc, 0xd4, 0x30, 0xf7, 0xb6, 0x34, 0x94}, {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x11, 0x51, 0x73, 0x76, 0x5d, 0xc2, 0x02, 0xcf, 0x02, 0x9a, 0xd3, 0xf1, 0x54, 0x79, 0x73, 0x5d, 0x57, 0x69, 0x7a, 0xf1, 0x2b, 0x01, 0x31, 0xdd, 0x21, 0x43, 0x0d, 0x57, 0x72, 0xe4, 0xef, 0x11, 0x47, 0x4d, 0x58, 0xb9}, {0x12, 0xa5, 0x0f, 0x3f, 0xaf, 0xea, 0x7c, 0x1e, 0xea, 0xda, 0x4c, 0xf8, 0xd3, 0x37, 0x77, 0x70, 0x4b, 0x77, 0x36, 0x14, 0x53, 0xaf, 0xc8, 0x3b, 0xda, 0x91, 0xee, 0xf3, 0x49, 0xae, 0x04, 0x4d, 0x20, 0x12, 0x6c, 0x62, 0x00, 0x54, 0x7e, 0xa5, 0xa6, 0x91, 0x17, 0x76, 0xc0, 0x5d, 0xee, 0x2a, 0x7f, 0x1a, 0x9b, 0xa7, 0xdf, 0xba, 0xbb, 0xbd, 0x27, 0x3c, 0x3e, 0xf2, 0x9e, 0xf4, 0x6e, 0x46}, 1, {0xe2, 0x54, 0x61, 0xfb, 0x0e, 0x4c, 0x16, 0x2e, 0x18, 0x12, 0x3e, 0xcd, 0xe8, 0x83, 0x42, 0xd5, 0x4d, 0x44, 0x96, 0x31, 0xe9, 0xb7, 0x5a, 0x26, 0x6f, 0xd9, 0x26, 0x0c, 0x2b, 0xb2, 0xf4, 0x1d}},
+};
+
+/** This is a hasher for ellswift_xdh which just returns the shared X coordinate.
+ *
+ * This is generally a bad idea as it means changes to the encoding of the
+ * exchanged public keys do not affect the shared secret. However, it's used here
+ * in tests to be able to verify the X coordinate through other means.
+ */
+static int ellswift_xdh_hash_x32(unsigned char *output, const unsigned char *x32, const unsigned char *ell_a64, const unsigned char *ell_b64, void *data) {
+    (void)ell_a64;
+    (void)ell_b64;
+    (void)data;
+    memcpy(output, x32, 32);
+    return 1;
+}
+
+void run_ellswift_tests(void) {
+    int i = 0;
+    /* Test vectors. */
+    for (i = 0; (unsigned)i < sizeof(ellswift_xswiftec_inv_tests) / sizeof(ellswift_xswiftec_inv_tests[0]); ++i) {
+        const struct ellswift_xswiftec_inv_test *testcase = &ellswift_xswiftec_inv_tests[i];
+        int c;
+        for (c = 0; c < 8; ++c) {
+            rustsecp256k1_v0_9_0_fe t;
+            int ret = rustsecp256k1_v0_9_0_ellswift_xswiftec_inv_var(&t, &testcase->x, &testcase->u, c);
+            CHECK(ret == ((testcase->enc_bitmap >> c) & 1));
+            if (ret) {
+                rustsecp256k1_v0_9_0_fe x2;
+                CHECK(check_fe_equal(&t, &testcase->encs[c]));
+                rustsecp256k1_v0_9_0_ellswift_xswiftec_var(&x2, &testcase->u, &testcase->encs[c]);
+                CHECK(check_fe_equal(&testcase->x, &x2));
+            }
+        }
+    }
+    for (i = 0; (unsigned)i < sizeof(ellswift_decode_tests) / sizeof(ellswift_decode_tests[0]); ++i) {
+        const struct ellswift_decode_test *testcase = &ellswift_decode_tests[i];
+        rustsecp256k1_v0_9_0_pubkey pubkey;
+        rustsecp256k1_v0_9_0_ge ge;
+        int ret;
+        ret = rustsecp256k1_v0_9_0_ellswift_decode(CTX, &pubkey, testcase->enc);
+        CHECK(ret);
+        ret = rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey);
+        CHECK(ret);
+        CHECK(check_fe_equal(&testcase->x, &ge.x));
+        CHECK(rustsecp256k1_v0_9_0_fe_is_odd(&ge.y) == testcase->odd_y);
+    }
+    for (i = 0; (unsigned)i < sizeof(ellswift_xdh_tests_bip324) / sizeof(ellswift_xdh_tests_bip324[0]); ++i) {
+        const struct ellswift_xdh_test *test = &ellswift_xdh_tests_bip324[i];
+        unsigned char shared_secret[32];
+        int ret;
+        int party = !test->initiating;
+        const unsigned char* ell_a64 = party ? test->ellswift_theirs : test->ellswift_ours;
+        const unsigned char* ell_b64 = party ? test->ellswift_ours   : test->ellswift_theirs;
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, shared_secret,
+                                     ell_a64, ell_b64,
+                                     test->priv_ours,
+                                     party,
+                                     rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_bip324,
+                                     NULL);
+        CHECK(ret);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(shared_secret, test->shared_secret, 32) == 0);
+    }
+    /* Verify that rustsecp256k1_v0_9_0_ellswift_encode + decode roundtrips. */
+    for (i = 0; i < 1000 * COUNT; i++) {
+        unsigned char rnd32[32];
+        unsigned char ell64[64];
+        rustsecp256k1_v0_9_0_ge g, g2;
+        rustsecp256k1_v0_9_0_pubkey pubkey, pubkey2;
+        /* Generate random public key and random randomizer. */
+        random_group_element_test(&g);
+        rustsecp256k1_v0_9_0_pubkey_save(&pubkey, &g);
+        rustsecp256k1_v0_9_0_testrand256(rnd32);
+        /* Convert the public key to ElligatorSwift and back. */
+        rustsecp256k1_v0_9_0_ellswift_encode(CTX, ell64, &pubkey, rnd32);
+        rustsecp256k1_v0_9_0_ellswift_decode(CTX, &pubkey2, ell64);
+        rustsecp256k1_v0_9_0_pubkey_load(CTX, &g2, &pubkey2);
+        /* Compare with original. */
+        ge_equals_ge(&g, &g2);
+    }
+    /* Verify the behavior of rustsecp256k1_v0_9_0_ellswift_create */
+    for (i = 0; i < 400 * COUNT; i++) {
+        unsigned char auxrnd32[32], sec32[32];
+        rustsecp256k1_v0_9_0_scalar sec;
+        rustsecp256k1_v0_9_0_gej res;
+        rustsecp256k1_v0_9_0_ge dec;
+        rustsecp256k1_v0_9_0_pubkey pub;
+        unsigned char ell64[64];
+        int ret;
+        /* Generate random secret key and random randomizer. */
+        if (i & 1) rustsecp256k1_v0_9_0_testrand256_test(auxrnd32);
+        random_scalar_order_test(&sec);
+        rustsecp256k1_v0_9_0_scalar_get_b32(sec32, &sec);
+        /* Construct ElligatorSwift-encoded public keys for that key. */
+        ret = rustsecp256k1_v0_9_0_ellswift_create(CTX, ell64, sec32, (i & 1) ? auxrnd32 : NULL);
+        CHECK(ret);
+        /* Decode it, and compare with traditionally-computed public key. */
+        rustsecp256k1_v0_9_0_ellswift_decode(CTX, &pub, ell64);
+        rustsecp256k1_v0_9_0_pubkey_load(CTX, &dec, &pub);
+        rustsecp256k1_v0_9_0_ecmult(&res, NULL, &rustsecp256k1_v0_9_0_scalar_zero, &sec);
+        ge_equals_gej(&dec, &res);
+    }
+    /* Verify that rustsecp256k1_v0_9_0_ellswift_xdh computes the right shared X coordinate. */
+    for (i = 0; i < 800 * COUNT; i++) {
+        unsigned char ell64[64], sec32[32], share32[32];
+        rustsecp256k1_v0_9_0_scalar sec;
+        rustsecp256k1_v0_9_0_ge dec, res;
+        rustsecp256k1_v0_9_0_fe share_x;
+        rustsecp256k1_v0_9_0_gej decj, resj;
+        rustsecp256k1_v0_9_0_pubkey pub;
+        int ret;
+        /* Generate random secret key. */
+        random_scalar_order_test(&sec);
+        rustsecp256k1_v0_9_0_scalar_get_b32(sec32, &sec);
+        /* Generate random ElligatorSwift encoding for the remote key and decode it. */
+        rustsecp256k1_v0_9_0_testrand256_test(ell64);
+        rustsecp256k1_v0_9_0_testrand256_test(ell64 + 32);
+        rustsecp256k1_v0_9_0_ellswift_decode(CTX, &pub, ell64);
+        rustsecp256k1_v0_9_0_pubkey_load(CTX, &dec, &pub);
+        rustsecp256k1_v0_9_0_gej_set_ge(&decj, &dec);
+        /* Compute the X coordinate of seckey*pubkey using ellswift_xdh. Note that we
+         * pass ell64 as claimed (but incorrect) encoding for sec32 here; this works
+         * because the "hasher" function we use here ignores the ell64 arguments. */
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32, ell64, ell64, sec32, i & 1, &ellswift_xdh_hash_x32, NULL);
+        CHECK(ret);
+        (void)rustsecp256k1_v0_9_0_fe_set_b32_limit(&share_x, share32); /* no overflow is possible */
+        rustsecp256k1_v0_9_0_fe_verify(&share_x);
+        /* Compute seckey*pubkey directly. */
+        rustsecp256k1_v0_9_0_ecmult(&resj, &decj, &sec, NULL);
+        rustsecp256k1_v0_9_0_ge_set_gej(&res, &resj);
+        /* Compare. */
+        CHECK(check_fe_equal(&res.x, &share_x));
+    }
+    /* Verify the joint behavior of rustsecp256k1_v0_9_0_ellswift_xdh */
+    for (i = 0; i < 200 * COUNT; i++) {
+        unsigned char auxrnd32a[32], auxrnd32b[32], auxrnd32a_bad[32], auxrnd32b_bad[32];
+        unsigned char sec32a[32], sec32b[32], sec32a_bad[32], sec32b_bad[32];
+        rustsecp256k1_v0_9_0_scalar seca, secb;
+        unsigned char ell64a[64], ell64b[64], ell64a_bad[64], ell64b_bad[64];
+        unsigned char share32a[32], share32b[32], share32_bad[32];
+        unsigned char prefix64[64];
+        rustsecp256k1_v0_9_0_ellswift_xdh_hash_function hash_function;
+        void* data;
+        int ret;
+
+        /* Pick hasher to use. */
+        if ((i % 3) == 0) {
+            hash_function = ellswift_xdh_hash_x32;
+            data = NULL;
+        } else if ((i % 3) == 1) {
+            hash_function = rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_bip324;
+            data = NULL;
+        } else {
+            hash_function = rustsecp256k1_v0_9_0_ellswift_xdh_hash_function_prefix;
+            rustsecp256k1_v0_9_0_testrand256_test(prefix64);
+            rustsecp256k1_v0_9_0_testrand256_test(prefix64 + 32);
+            data = prefix64;
+        }
+
+        /* Generate random secret keys and random randomizers. */
+        rustsecp256k1_v0_9_0_testrand256_test(auxrnd32a);
+        rustsecp256k1_v0_9_0_testrand256_test(auxrnd32b);
+        random_scalar_order_test(&seca);
+        /* Draw secb uniformly at random to make sure that the secret keys
+         * differ */
+        random_scalar_order(&secb);
+        rustsecp256k1_v0_9_0_scalar_get_b32(sec32a, &seca);
+        rustsecp256k1_v0_9_0_scalar_get_b32(sec32b, &secb);
+
+        /* Construct ElligatorSwift-encoded public keys for those keys. */
+        /* For A: */
+        ret = rustsecp256k1_v0_9_0_ellswift_create(CTX, ell64a, sec32a, auxrnd32a);
+        CHECK(ret);
+        /* For B: */
+        ret = rustsecp256k1_v0_9_0_ellswift_create(CTX, ell64b, sec32b, auxrnd32b);
+        CHECK(ret);
+
+        /* Compute the shared secret both ways and compare with each other. */
+        /* For A: */
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32a, ell64a, ell64b, sec32a, 0, hash_function, data);
+        CHECK(ret);
+        /* For B: */
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32b, ell64a, ell64b, sec32b, 1, hash_function, data);
+        CHECK(ret);
+        /* And compare: */
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(share32a, share32b, 32) == 0);
+
+        /* Verify that the shared secret doesn't match if other side's public key is incorrect. */
+        /* For A (using a bad public key for B): */
+        memcpy(ell64b_bad, ell64b, sizeof(ell64a_bad));
+        rustsecp256k1_v0_9_0_testrand_flip(ell64b_bad, sizeof(ell64b_bad));
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32_bad, ell64a, ell64b_bad, sec32a, 0, hash_function, data);
+        CHECK(ret); /* Mismatching encodings don't get detected by rustsecp256k1_v0_9_0_ellswift_xdh. */
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(share32_bad, share32a, 32) != 0);
+        /* For B (using a bad public key for A): */
+        memcpy(ell64a_bad, ell64a, sizeof(ell64a_bad));
+        rustsecp256k1_v0_9_0_testrand_flip(ell64a_bad, sizeof(ell64a_bad));
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32_bad, ell64a_bad, ell64b, sec32b, 1, hash_function, data);
+        CHECK(ret);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(share32_bad, share32b, 32) != 0);
+
+        /* Verify that the shared secret doesn't match if the private key is incorrect. */
+        /* For A: */
+        memcpy(sec32a_bad, sec32a, sizeof(sec32a_bad));
+        rustsecp256k1_v0_9_0_testrand_flip(sec32a_bad, sizeof(sec32a_bad));
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32_bad, ell64a, ell64b, sec32a_bad, 0, hash_function, data);
+        CHECK(!ret || rustsecp256k1_v0_9_0_memcmp_var(share32_bad, share32a, 32) != 0);
+        /* For B: */
+        memcpy(sec32b_bad, sec32b, sizeof(sec32b_bad));
+        rustsecp256k1_v0_9_0_testrand_flip(sec32b_bad, sizeof(sec32b_bad));
+        ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32_bad, ell64a, ell64b, sec32b_bad, 1, hash_function, data);
+        CHECK(!ret || rustsecp256k1_v0_9_0_memcmp_var(share32_bad, share32b, 32) != 0);
+
+        if (hash_function != ellswift_xdh_hash_x32) {
+            /* Verify that the shared secret doesn't match when a different encoding of the same public key is used. */
+            /* For A (changing B's public key): */
+            memcpy(auxrnd32b_bad, auxrnd32b, sizeof(auxrnd32b_bad));
+            rustsecp256k1_v0_9_0_testrand_flip(auxrnd32b_bad, sizeof(auxrnd32b_bad));
+            ret = rustsecp256k1_v0_9_0_ellswift_create(CTX, ell64b_bad, sec32b, auxrnd32b_bad);
+            CHECK(ret);
+            ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32_bad, ell64a, ell64b_bad, sec32a, 0, hash_function, data);
+            CHECK(ret);
+            CHECK(rustsecp256k1_v0_9_0_memcmp_var(share32_bad, share32a, 32) != 0);
+            /* For B (changing A's public key): */
+            memcpy(auxrnd32a_bad, auxrnd32a, sizeof(auxrnd32a_bad));
+            rustsecp256k1_v0_9_0_testrand_flip(auxrnd32a_bad, sizeof(auxrnd32a_bad));
+            ret = rustsecp256k1_v0_9_0_ellswift_create(CTX, ell64a_bad, sec32a, auxrnd32a_bad);
+            CHECK(ret);
+            ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32_bad, ell64a_bad, ell64b, sec32b, 1, hash_function, data);
+            CHECK(ret);
+            CHECK(rustsecp256k1_v0_9_0_memcmp_var(share32_bad, share32b, 32) != 0);
+
+            /* Verify that swapping sides changes the shared secret. */
+            /* For A (claiming to be B): */
+            ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32_bad, ell64a, ell64b, sec32a, 1, hash_function, data);
+            CHECK(ret);
+            CHECK(rustsecp256k1_v0_9_0_memcmp_var(share32_bad, share32a, 32) != 0);
+            /* For B (claiming to be A): */
+            ret = rustsecp256k1_v0_9_0_ellswift_xdh(CTX, share32_bad, ell64a, ell64b, sec32b, 0, hash_function, data);
+            CHECK(ret);
+            CHECK(rustsecp256k1_v0_9_0_memcmp_var(share32_bad, share32b, 32) != 0);
+        }
+    }
+
+    /* Test hash initializers. */
+    {
+        rustsecp256k1_v0_9_0_sha256 sha, sha_optimized;
+        static const unsigned char encode_tag[25] = "rustsecp256k1_v0_9_0_ellswift_encode";
+        static const unsigned char create_tag[25] = "rustsecp256k1_v0_9_0_ellswift_create";
+        static const unsigned char bip324_tag[26] = "bip324_ellswift_xonly_ecdh";
+
+        /* Check that hash initialized by
+         * rustsecp256k1_v0_9_0_ellswift_sha256_init_encode has the expected
+         * state. */
+        rustsecp256k1_v0_9_0_sha256_initialize_tagged(&sha, encode_tag, sizeof(encode_tag));
+        rustsecp256k1_v0_9_0_ellswift_sha256_init_encode(&sha_optimized);
+        test_sha256_eq(&sha, &sha_optimized);
+
+        /* Check that hash initialized by
+         * rustsecp256k1_v0_9_0_ellswift_sha256_init_create has the expected
+         * state. */
+        rustsecp256k1_v0_9_0_sha256_initialize_tagged(&sha, create_tag, sizeof(create_tag));
+        rustsecp256k1_v0_9_0_ellswift_sha256_init_create(&sha_optimized);
+        test_sha256_eq(&sha, &sha_optimized);
+
+        /* Check that hash initialized by
+         * rustsecp256k1_v0_9_0_ellswift_sha256_init_bip324 has the expected
+         * state. */
+        rustsecp256k1_v0_9_0_sha256_initialize_tagged(&sha, bip324_tag, sizeof(bip324_tag));
+        rustsecp256k1_v0_9_0_ellswift_sha256_init_bip324(&sha_optimized);
+        test_sha256_eq(&sha, &sha_optimized);
+    }
+}
+
+#endif
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/Makefile.am.include b/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/Makefile.am.include
index 97ac7f12b..f66e175f6 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/Makefile.am.include
+++ b/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/Makefile.am.include
@@ -1,4 +1,4 @@
-include_HEADERS += include/rustsecp256k1_v0_8_1_extrakeys.h
+include_HEADERS += include/rustsecp256k1_v0_9_0_extrakeys.h
 noinst_HEADERS += src/modules/extrakeys/tests_impl.h
 noinst_HEADERS += src/modules/extrakeys/tests_exhaustive_impl.h
 noinst_HEADERS += src/modules/extrakeys/main_impl.h
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/main_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/main_impl.h
index 2250b177a..77ba1566a 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/main_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/main_impl.h
@@ -9,55 +9,56 @@
 
 #include "../../../include/secp256k1.h"
 #include "../../../include/secp256k1_extrakeys.h"
+#include "../../util.h"
 
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_xonly_pubkey_load(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ge *ge, const rustsecp256k1_v0_8_1_xonly_pubkey *pubkey) {
-    return rustsecp256k1_v0_8_1_pubkey_load(ctx, ge, (const rustsecp256k1_v0_8_1_pubkey *) pubkey);
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_xonly_pubkey_load(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ge *ge, const rustsecp256k1_v0_9_0_xonly_pubkey *pubkey) {
+    return rustsecp256k1_v0_9_0_pubkey_load(ctx, ge, (const rustsecp256k1_v0_9_0_pubkey *) pubkey);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_xonly_pubkey_save(rustsecp256k1_v0_8_1_xonly_pubkey *pubkey, rustsecp256k1_v0_8_1_ge *ge) {
-    rustsecp256k1_v0_8_1_pubkey_save((rustsecp256k1_v0_8_1_pubkey *) pubkey, ge);
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_xonly_pubkey_save(rustsecp256k1_v0_9_0_xonly_pubkey *pubkey, rustsecp256k1_v0_9_0_ge *ge) {
+    rustsecp256k1_v0_9_0_pubkey_save((rustsecp256k1_v0_9_0_pubkey *) pubkey, ge);
 }
 
-int rustsecp256k1_v0_8_1_xonly_pubkey_parse(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_xonly_pubkey *pubkey, const unsigned char *input32) {
-    rustsecp256k1_v0_8_1_ge pk;
-    rustsecp256k1_v0_8_1_fe x;
+int rustsecp256k1_v0_9_0_xonly_pubkey_parse(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_xonly_pubkey *pubkey, const unsigned char *input32) {
+    rustsecp256k1_v0_9_0_ge pk;
+    rustsecp256k1_v0_9_0_fe x;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(pubkey != NULL);
     memset(pubkey, 0, sizeof(*pubkey));
     ARG_CHECK(input32 != NULL);
 
-    if (!rustsecp256k1_v0_8_1_fe_set_b32(&x, input32)) {
+    if (!rustsecp256k1_v0_9_0_fe_set_b32_limit(&x, input32)) {
         return 0;
     }
-    if (!rustsecp256k1_v0_8_1_ge_set_xo_var(&pk, &x, 0)) {
+    if (!rustsecp256k1_v0_9_0_ge_set_xo_var(&pk, &x, 0)) {
         return 0;
     }
-    if (!rustsecp256k1_v0_8_1_ge_is_in_correct_subgroup(&pk)) {
+    if (!rustsecp256k1_v0_9_0_ge_is_in_correct_subgroup(&pk)) {
         return 0;
     }
-    rustsecp256k1_v0_8_1_xonly_pubkey_save(pubkey, &pk);
+    rustsecp256k1_v0_9_0_xonly_pubkey_save(pubkey, &pk);
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_xonly_pubkey_serialize(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *output32, const rustsecp256k1_v0_8_1_xonly_pubkey *pubkey) {
-    rustsecp256k1_v0_8_1_ge pk;
+int rustsecp256k1_v0_9_0_xonly_pubkey_serialize(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *output32, const rustsecp256k1_v0_9_0_xonly_pubkey *pubkey) {
+    rustsecp256k1_v0_9_0_ge pk;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(output32 != NULL);
     memset(output32, 0, 32);
     ARG_CHECK(pubkey != NULL);
 
-    if (!rustsecp256k1_v0_8_1_xonly_pubkey_load(ctx, &pk, pubkey)) {
+    if (!rustsecp256k1_v0_9_0_xonly_pubkey_load(ctx, &pk, pubkey)) {
         return 0;
     }
-    rustsecp256k1_v0_8_1_fe_get_b32(output32, &pk.x);
+    rustsecp256k1_v0_9_0_fe_get_b32(output32, &pk.x);
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_xonly_pubkey_cmp(const rustsecp256k1_v0_8_1_context* ctx, const rustsecp256k1_v0_8_1_xonly_pubkey* pk0, const rustsecp256k1_v0_8_1_xonly_pubkey* pk1) {
+int rustsecp256k1_v0_9_0_xonly_pubkey_cmp(const rustsecp256k1_v0_9_0_context* ctx, const rustsecp256k1_v0_9_0_xonly_pubkey* pk0, const rustsecp256k1_v0_9_0_xonly_pubkey* pk1) {
     unsigned char out[2][32];
-    const rustsecp256k1_v0_8_1_xonly_pubkey* pk[2];
+    const rustsecp256k1_v0_9_0_xonly_pubkey* pk[2];
     int i;
 
     VERIFY_CHECK(ctx != NULL);
@@ -70,7 +71,7 @@ int rustsecp256k1_v0_8_1_xonly_pubkey_cmp(const rustsecp256k1_v0_8_1_context* ct
          * pubkeys are involved and prevents edge cases such as sorting
          * algorithms that use this function and do not terminate as a
          * result. */
-        if (!rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, out[i], pk[i])) {
+        if (!rustsecp256k1_v0_9_0_xonly_pubkey_serialize(ctx, out[i], pk[i])) {
             /* Note that xonly_pubkey_serialize should already set the output to
              * zero in that case, but it's not guaranteed by the API, we can't
              * test it and writing a VERIFY_CHECK is more complex than
@@ -78,44 +79,44 @@ int rustsecp256k1_v0_8_1_xonly_pubkey_cmp(const rustsecp256k1_v0_8_1_context* ct
             memset(out[i], 0, sizeof(out[i]));
         }
     }
-    return rustsecp256k1_v0_8_1_memcmp_var(out[0], out[1], sizeof(out[1]));
+    return rustsecp256k1_v0_9_0_memcmp_var(out[0], out[1], sizeof(out[1]));
 }
 
 /** Keeps a group element as is if it has an even Y and otherwise negates it.
  *  y_parity is set to 0 in the former case and to 1 in the latter case.
  *  Requires that the coordinates of r are normalized. */
-static int rustsecp256k1_v0_8_1_extrakeys_ge_even_y(rustsecp256k1_v0_8_1_ge *r) {
+static int rustsecp256k1_v0_9_0_extrakeys_ge_even_y(rustsecp256k1_v0_9_0_ge *r) {
     int y_parity = 0;
-    VERIFY_CHECK(!rustsecp256k1_v0_8_1_ge_is_infinity(r));
+    VERIFY_CHECK(!rustsecp256k1_v0_9_0_ge_is_infinity(r));
 
-    if (rustsecp256k1_v0_8_1_fe_is_odd(&r->y)) {
-        rustsecp256k1_v0_8_1_fe_negate(&r->y, &r->y, 1);
+    if (rustsecp256k1_v0_9_0_fe_is_odd(&r->y)) {
+        rustsecp256k1_v0_9_0_fe_negate(&r->y, &r->y, 1);
         y_parity = 1;
     }
     return y_parity;
 }
 
-int rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_xonly_pubkey *xonly_pubkey, int *pk_parity, const rustsecp256k1_v0_8_1_pubkey *pubkey) {
-    rustsecp256k1_v0_8_1_ge pk;
+int rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_xonly_pubkey *xonly_pubkey, int *pk_parity, const rustsecp256k1_v0_9_0_pubkey *pubkey) {
+    rustsecp256k1_v0_9_0_ge pk;
     int tmp;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(xonly_pubkey != NULL);
     ARG_CHECK(pubkey != NULL);
 
-    if (!rustsecp256k1_v0_8_1_pubkey_load(ctx, &pk, pubkey)) {
+    if (!rustsecp256k1_v0_9_0_pubkey_load(ctx, &pk, pubkey)) {
         return 0;
     }
-    tmp = rustsecp256k1_v0_8_1_extrakeys_ge_even_y(&pk);
+    tmp = rustsecp256k1_v0_9_0_extrakeys_ge_even_y(&pk);
     if (pk_parity != NULL) {
         *pk_parity = tmp;
     }
-    rustsecp256k1_v0_8_1_xonly_pubkey_save(xonly_pubkey, &pk);
+    rustsecp256k1_v0_9_0_xonly_pubkey_save(xonly_pubkey, &pk);
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_pubkey *output_pubkey, const rustsecp256k1_v0_8_1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
-    rustsecp256k1_v0_8_1_ge pk;
+int rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_pubkey *output_pubkey, const rustsecp256k1_v0_9_0_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
+    rustsecp256k1_v0_9_0_ge pk;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(output_pubkey != NULL);
@@ -123,16 +124,16 @@ int rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(const rustsecp256k1_v0_8_1_conte
     ARG_CHECK(internal_pubkey != NULL);
     ARG_CHECK(tweak32 != NULL);
 
-    if (!rustsecp256k1_v0_8_1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
-        || !rustsecp256k1_v0_8_1_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
+    if (!rustsecp256k1_v0_9_0_xonly_pubkey_load(ctx, &pk, internal_pubkey)
+        || !rustsecp256k1_v0_9_0_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
         return 0;
     }
-    rustsecp256k1_v0_8_1_pubkey_save(output_pubkey, &pk);
+    rustsecp256k1_v0_9_0_pubkey_save(output_pubkey, &pk);
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(const rustsecp256k1_v0_8_1_context* ctx, const unsigned char *tweaked_pubkey32, int tweaked_pk_parity, const rustsecp256k1_v0_8_1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
-    rustsecp256k1_v0_8_1_ge pk;
+int rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(const rustsecp256k1_v0_9_0_context* ctx, const unsigned char *tweaked_pubkey32, int tweaked_pk_parity, const rustsecp256k1_v0_9_0_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
+    rustsecp256k1_v0_9_0_ge pk;
     unsigned char pk_expected32[32];
 
     VERIFY_CHECK(ctx != NULL);
@@ -140,31 +141,31 @@ int rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(const rustsecp256k1_v0_8_1
     ARG_CHECK(tweaked_pubkey32 != NULL);
     ARG_CHECK(tweak32 != NULL);
 
-    if (!rustsecp256k1_v0_8_1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
-        || !rustsecp256k1_v0_8_1_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
+    if (!rustsecp256k1_v0_9_0_xonly_pubkey_load(ctx, &pk, internal_pubkey)
+        || !rustsecp256k1_v0_9_0_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
         return 0;
     }
-    rustsecp256k1_v0_8_1_fe_normalize_var(&pk.x);
-    rustsecp256k1_v0_8_1_fe_normalize_var(&pk.y);
-    rustsecp256k1_v0_8_1_fe_get_b32(pk_expected32, &pk.x);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&pk.x);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&pk.y);
+    rustsecp256k1_v0_9_0_fe_get_b32(pk_expected32, &pk.x);
 
-    return rustsecp256k1_v0_8_1_memcmp_var(&pk_expected32, tweaked_pubkey32, 32) == 0
-            && rustsecp256k1_v0_8_1_fe_is_odd(&pk.y) == tweaked_pk_parity;
+    return rustsecp256k1_v0_9_0_memcmp_var(&pk_expected32, tweaked_pubkey32, 32) == 0
+            && rustsecp256k1_v0_9_0_fe_is_odd(&pk.y) == tweaked_pk_parity;
 }
 
-static void rustsecp256k1_v0_8_1_keypair_save(rustsecp256k1_v0_8_1_keypair *keypair, const rustsecp256k1_v0_8_1_scalar *sk, rustsecp256k1_v0_8_1_ge *pk) {
-    rustsecp256k1_v0_8_1_scalar_get_b32(&keypair->data[0], sk);
-    rustsecp256k1_v0_8_1_pubkey_save((rustsecp256k1_v0_8_1_pubkey *)&keypair->data[32], pk);
+static void rustsecp256k1_v0_9_0_keypair_save(rustsecp256k1_v0_9_0_keypair *keypair, const rustsecp256k1_v0_9_0_scalar *sk, rustsecp256k1_v0_9_0_ge *pk) {
+    rustsecp256k1_v0_9_0_scalar_get_b32(&keypair->data[0], sk);
+    rustsecp256k1_v0_9_0_pubkey_save((rustsecp256k1_v0_9_0_pubkey *)&keypair->data[32], pk);
 }
 
 
-static int rustsecp256k1_v0_8_1_keypair_seckey_load(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_scalar *sk, const rustsecp256k1_v0_8_1_keypair *keypair) {
+static int rustsecp256k1_v0_9_0_keypair_seckey_load(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_scalar *sk, const rustsecp256k1_v0_9_0_keypair *keypair) {
     int ret;
 
-    ret = rustsecp256k1_v0_8_1_scalar_set_b32_seckey(sk, &keypair->data[0]);
+    ret = rustsecp256k1_v0_9_0_scalar_set_b32_seckey(sk, &keypair->data[0]);
     /* We can declassify ret here because sk is only zero if a keypair function
      * failed (which zeroes the keypair) and its return value is ignored. */
-    rustsecp256k1_v0_8_1_declassify(ctx, &ret, sizeof(ret));
+    rustsecp256k1_v0_9_0_declassify(ctx, &ret, sizeof(ret));
     ARG_CHECK(ret);
     return ret;
 }
@@ -172,45 +173,45 @@ static int rustsecp256k1_v0_8_1_keypair_seckey_load(const rustsecp256k1_v0_8_1_c
 /* Load a keypair into pk and sk (if non-NULL). This function declassifies pk
  * and ARG_CHECKs that the keypair is not invalid. It always initializes sk and
  * pk with dummy values. */
-static int rustsecp256k1_v0_8_1_keypair_load(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_scalar *sk, rustsecp256k1_v0_8_1_ge *pk, const rustsecp256k1_v0_8_1_keypair *keypair) {
+static int rustsecp256k1_v0_9_0_keypair_load(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_scalar *sk, rustsecp256k1_v0_9_0_ge *pk, const rustsecp256k1_v0_9_0_keypair *keypair) {
     int ret;
-    const rustsecp256k1_v0_8_1_pubkey *pubkey = (const rustsecp256k1_v0_8_1_pubkey *)&keypair->data[32];
+    const rustsecp256k1_v0_9_0_pubkey *pubkey = (const rustsecp256k1_v0_9_0_pubkey *)&keypair->data[32];
 
     /* Need to declassify the pubkey because pubkey_load ARG_CHECKs if it's
      * invalid. */
-    rustsecp256k1_v0_8_1_declassify(ctx, pubkey, sizeof(*pubkey));
-    ret = rustsecp256k1_v0_8_1_pubkey_load(ctx, pk, pubkey);
+    rustsecp256k1_v0_9_0_declassify(ctx, pubkey, sizeof(*pubkey));
+    ret = rustsecp256k1_v0_9_0_pubkey_load(ctx, pk, pubkey);
     if (sk != NULL) {
-        ret = ret && rustsecp256k1_v0_8_1_keypair_seckey_load(ctx, sk, keypair);
+        ret = ret && rustsecp256k1_v0_9_0_keypair_seckey_load(ctx, sk, keypair);
     }
     if (!ret) {
-        *pk = rustsecp256k1_v0_8_1_ge_const_g;
+        *pk = rustsecp256k1_v0_9_0_ge_const_g;
         if (sk != NULL) {
-            *sk = rustsecp256k1_v0_8_1_scalar_one;
+            *sk = rustsecp256k1_v0_9_0_scalar_one;
         }
     }
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_keypair_create(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_keypair *keypair, const unsigned char *seckey32) {
-    rustsecp256k1_v0_8_1_scalar sk;
-    rustsecp256k1_v0_8_1_ge pk;
+int rustsecp256k1_v0_9_0_keypair_create(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_keypair *keypair, const unsigned char *seckey32) {
+    rustsecp256k1_v0_9_0_scalar sk;
+    rustsecp256k1_v0_9_0_ge pk;
     int ret = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(keypair != NULL);
     memset(keypair, 0, sizeof(*keypair));
-    ARG_CHECK(rustsecp256k1_v0_8_1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(rustsecp256k1_v0_9_0_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
     ARG_CHECK(seckey32 != NULL);
 
-    ret = rustsecp256k1_v0_8_1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &sk, &pk, seckey32);
-    rustsecp256k1_v0_8_1_keypair_save(keypair, &sk, &pk);
-    rustsecp256k1_v0_8_1_memczero(keypair, sizeof(*keypair), !ret);
+    ret = rustsecp256k1_v0_9_0_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &sk, &pk, seckey32);
+    rustsecp256k1_v0_9_0_keypair_save(keypair, &sk, &pk);
+    rustsecp256k1_v0_9_0_memczero(keypair, sizeof(*keypair), !ret);
 
-    rustsecp256k1_v0_8_1_scalar_clear(&sk);
+    rustsecp256k1_v0_9_0_scalar_clear(&sk);
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_keypair_sec(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *seckey, const rustsecp256k1_v0_8_1_keypair *keypair) {
+int rustsecp256k1_v0_9_0_keypair_sec(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *seckey, const rustsecp256k1_v0_9_0_keypair *keypair) {
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(seckey != NULL);
     memset(seckey, 0, 32);
@@ -220,7 +221,7 @@ int rustsecp256k1_v0_8_1_keypair_sec(const rustsecp256k1_v0_8_1_context* ctx, un
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_keypair_pub(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_pubkey *pubkey, const rustsecp256k1_v0_8_1_keypair *keypair) {
+int rustsecp256k1_v0_9_0_keypair_pub(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_pubkey *pubkey, const rustsecp256k1_v0_9_0_keypair *keypair) {
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(pubkey != NULL);
     memset(pubkey, 0, sizeof(*pubkey));
@@ -230,8 +231,8 @@ int rustsecp256k1_v0_8_1_keypair_pub(const rustsecp256k1_v0_8_1_context* ctx, ru
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_keypair_xonly_pub(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_xonly_pubkey *pubkey, int *pk_parity, const rustsecp256k1_v0_8_1_keypair *keypair) {
-    rustsecp256k1_v0_8_1_ge pk;
+int rustsecp256k1_v0_9_0_keypair_xonly_pub(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_xonly_pubkey *pubkey, int *pk_parity, const rustsecp256k1_v0_9_0_keypair *keypair) {
+    rustsecp256k1_v0_9_0_ge pk;
     int tmp;
 
     VERIFY_CHECK(ctx != NULL);
@@ -239,21 +240,21 @@ int rustsecp256k1_v0_8_1_keypair_xonly_pub(const rustsecp256k1_v0_8_1_context* c
     memset(pubkey, 0, sizeof(*pubkey));
     ARG_CHECK(keypair != NULL);
 
-    if (!rustsecp256k1_v0_8_1_keypair_load(ctx, NULL, &pk, keypair)) {
+    if (!rustsecp256k1_v0_9_0_keypair_load(ctx, NULL, &pk, keypair)) {
         return 0;
     }
-    tmp = rustsecp256k1_v0_8_1_extrakeys_ge_even_y(&pk);
+    tmp = rustsecp256k1_v0_9_0_extrakeys_ge_even_y(&pk);
     if (pk_parity != NULL) {
         *pk_parity = tmp;
     }
-    rustsecp256k1_v0_8_1_xonly_pubkey_save(pubkey, &pk);
+    rustsecp256k1_v0_9_0_xonly_pubkey_save(pubkey, &pk);
 
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_keypair *keypair, const unsigned char *tweak32) {
-    rustsecp256k1_v0_8_1_ge pk;
-    rustsecp256k1_v0_8_1_scalar sk;
+int rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_keypair *keypair, const unsigned char *tweak32) {
+    rustsecp256k1_v0_9_0_ge pk;
+    rustsecp256k1_v0_9_0_scalar sk;
     int y_parity;
     int ret;
 
@@ -261,23 +262,23 @@ int rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(const rustsecp256k1_v0_8_1_cont
     ARG_CHECK(keypair != NULL);
     ARG_CHECK(tweak32 != NULL);
 
-    ret = rustsecp256k1_v0_8_1_keypair_load(ctx, &sk, &pk, keypair);
+    ret = rustsecp256k1_v0_9_0_keypair_load(ctx, &sk, &pk, keypair);
     memset(keypair, 0, sizeof(*keypair));
 
-    y_parity = rustsecp256k1_v0_8_1_extrakeys_ge_even_y(&pk);
+    y_parity = rustsecp256k1_v0_9_0_extrakeys_ge_even_y(&pk);
     if (y_parity == 1) {
-        rustsecp256k1_v0_8_1_scalar_negate(&sk, &sk);
+        rustsecp256k1_v0_9_0_scalar_negate(&sk, &sk);
     }
 
-    ret &= rustsecp256k1_v0_8_1_ec_seckey_tweak_add_helper(&sk, tweak32);
-    ret &= rustsecp256k1_v0_8_1_ec_pubkey_tweak_add_helper(&pk, tweak32);
+    ret &= rustsecp256k1_v0_9_0_ec_seckey_tweak_add_helper(&sk, tweak32);
+    ret &= rustsecp256k1_v0_9_0_ec_pubkey_tweak_add_helper(&pk, tweak32);
 
-    rustsecp256k1_v0_8_1_declassify(ctx, &ret, sizeof(ret));
+    rustsecp256k1_v0_9_0_declassify(ctx, &ret, sizeof(ret));
     if (ret) {
-        rustsecp256k1_v0_8_1_keypair_save(keypair, &sk, &pk);
+        rustsecp256k1_v0_9_0_keypair_save(keypair, &sk, &pk);
     }
 
-    rustsecp256k1_v0_8_1_scalar_clear(&sk);
+    rustsecp256k1_v0_9_0_scalar_clear(&sk);
     return ret;
 }
 
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/tests_exhaustive_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/tests_exhaustive_impl.h
index 9e56e9d32..fd97b5660 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/tests_exhaustive_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/tests_exhaustive_impl.h
@@ -10,54 +10,54 @@
 #include "../../../include/secp256k1_extrakeys.h"
 #include "main_impl.h"
 
-static void test_exhaustive_extrakeys(const rustsecp256k1_v0_8_1_context *ctx, const rustsecp256k1_v0_8_1_ge* group) {
-    rustsecp256k1_v0_8_1_keypair keypair[EXHAUSTIVE_TEST_ORDER - 1];
-    rustsecp256k1_v0_8_1_pubkey pubkey[EXHAUSTIVE_TEST_ORDER - 1];
-    rustsecp256k1_v0_8_1_xonly_pubkey xonly_pubkey[EXHAUSTIVE_TEST_ORDER - 1];
+static void test_exhaustive_extrakeys(const rustsecp256k1_v0_9_0_context *ctx, const rustsecp256k1_v0_9_0_ge* group) {
+    rustsecp256k1_v0_9_0_keypair keypair[EXHAUSTIVE_TEST_ORDER - 1];
+    rustsecp256k1_v0_9_0_pubkey pubkey[EXHAUSTIVE_TEST_ORDER - 1];
+    rustsecp256k1_v0_9_0_xonly_pubkey xonly_pubkey[EXHAUSTIVE_TEST_ORDER - 1];
     int parities[EXHAUSTIVE_TEST_ORDER - 1];
     unsigned char xonly_pubkey_bytes[EXHAUSTIVE_TEST_ORDER - 1][32];
     int i;
 
     for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) {
-        rustsecp256k1_v0_8_1_fe fe;
-        rustsecp256k1_v0_8_1_scalar scalar_i;
+        rustsecp256k1_v0_9_0_fe fe;
+        rustsecp256k1_v0_9_0_scalar scalar_i;
         unsigned char buf[33];
         int parity;
 
-        rustsecp256k1_v0_8_1_scalar_set_int(&scalar_i, i);
-        rustsecp256k1_v0_8_1_scalar_get_b32(buf, &scalar_i);
+        rustsecp256k1_v0_9_0_scalar_set_int(&scalar_i, i);
+        rustsecp256k1_v0_9_0_scalar_get_b32(buf, &scalar_i);
 
         /* Construct pubkey and keypair. */
-        CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair[i - 1], buf));
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey[i - 1], buf));
+        CHECK(rustsecp256k1_v0_9_0_keypair_create(ctx, &keypair[i - 1], buf));
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(ctx, &pubkey[i - 1], buf));
 
         /* Construct serialized xonly_pubkey from keypair. */
-        CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &xonly_pubkey[i - 1], &parities[i - 1], &keypair[i - 1]));
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, xonly_pubkey_bytes[i - 1], &xonly_pubkey[i - 1]));
+        CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(ctx, &xonly_pubkey[i - 1], &parities[i - 1], &keypair[i - 1]));
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(ctx, xonly_pubkey_bytes[i - 1], &xonly_pubkey[i - 1]));
 
         /* Parse the xonly_pubkey back and verify it matches the previously serialized value. */
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &xonly_pubkey[i - 1], xonly_pubkey_bytes[i - 1]));
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, buf, &xonly_pubkey[i - 1]));
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(xonly_pubkey_bytes[i - 1], buf, 32) == 0);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(ctx, &xonly_pubkey[i - 1], xonly_pubkey_bytes[i - 1]));
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(ctx, buf, &xonly_pubkey[i - 1]));
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(xonly_pubkey_bytes[i - 1], buf, 32) == 0);
 
         /* Construct the xonly_pubkey from the pubkey, and verify it matches the same. */
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pubkey[i - 1], &parity, &pubkey[i - 1]));
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(ctx, &xonly_pubkey[i - 1], &parity, &pubkey[i - 1]));
         CHECK(parity == parities[i - 1]);
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, buf, &xonly_pubkey[i - 1]));
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(xonly_pubkey_bytes[i - 1], buf, 32) == 0);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(ctx, buf, &xonly_pubkey[i - 1]));
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(xonly_pubkey_bytes[i - 1], buf, 32) == 0);
 
         /* Compare the xonly_pubkey bytes against the precomputed group. */
-        rustsecp256k1_v0_8_1_fe_set_b32(&fe, xonly_pubkey_bytes[i - 1]);
-        CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&fe, &group[i].x));
+        rustsecp256k1_v0_9_0_fe_set_b32_mod(&fe, xonly_pubkey_bytes[i - 1]);
+        CHECK(rustsecp256k1_v0_9_0_fe_equal(&fe, &group[i].x));
 
         /* Check the parity against the precomputed group. */
         fe = group[i].y;
-        rustsecp256k1_v0_8_1_fe_normalize_var(&fe);
-        CHECK(rustsecp256k1_v0_8_1_fe_is_odd(&fe) == parities[i - 1]);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&fe);
+        CHECK(rustsecp256k1_v0_9_0_fe_is_odd(&fe) == parities[i - 1]);
 
         /* Verify that the higher half is identical to the lower half mirrored. */
         if (i > EXHAUSTIVE_TEST_ORDER / 2) {
-            CHECK(rustsecp256k1_v0_8_1_memcmp_var(xonly_pubkey_bytes[i - 1], xonly_pubkey_bytes[EXHAUSTIVE_TEST_ORDER - i - 1], 32) == 0);
+            CHECK(rustsecp256k1_v0_9_0_memcmp_var(xonly_pubkey_bytes[i - 1], xonly_pubkey_bytes[EXHAUSTIVE_TEST_ORDER - i - 1], 32) == 0);
             CHECK(parities[i - 1] == 1 - parities[EXHAUSTIVE_TEST_ORDER - i - 1]);
         }
     }
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/tests_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/tests_impl.h
index bdc35639c..7adc5cb0d 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/tests_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/extrakeys/tests_impl.h
@@ -9,17 +9,17 @@
 
 #include "../../../include/secp256k1_extrakeys.h"
 
-static void set_counting_callbacks(rustsecp256k1_v0_8_1_context *ctx0, int *ecount) {
-    rustsecp256k1_v0_8_1_context_set_error_callback(ctx0, counting_illegal_callback_fn, ecount);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx0, counting_illegal_callback_fn, ecount);
+static void set_counting_callbacks(rustsecp256k1_v0_9_0_context *ctx0, int *ecount) {
+    rustsecp256k1_v0_9_0_context_set_error_callback(ctx0, counting_illegal_callback_fn, ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(ctx0, counting_illegal_callback_fn, ecount);
 }
 
-void test_xonly_pubkey(void) {
-    rustsecp256k1_v0_8_1_pubkey pk;
-    rustsecp256k1_v0_8_1_xonly_pubkey xonly_pk, xonly_pk_tmp;
-    rustsecp256k1_v0_8_1_ge pk1;
-    rustsecp256k1_v0_8_1_ge pk2;
-    rustsecp256k1_v0_8_1_fe y;
+static void test_xonly_pubkey(void) {
+    rustsecp256k1_v0_9_0_pubkey pk;
+    rustsecp256k1_v0_9_0_xonly_pubkey xonly_pk, xonly_pk_tmp;
+    rustsecp256k1_v0_9_0_ge pk1;
+    rustsecp256k1_v0_9_0_ge pk2;
+    rustsecp256k1_v0_9_0_fe y;
     unsigned char sk[32];
     unsigned char xy_sk[32];
     unsigned char buf32[32];
@@ -30,105 +30,105 @@ void test_xonly_pubkey(void) {
 
     int ecount;
 
-    set_counting_callbacks(ctx, &ecount);
+    set_counting_callbacks(CTX, &ecount);
 
-    rustsecp256k1_v0_8_1_testrand256(sk);
+    rustsecp256k1_v0_9_0_testrand256(sk);
     memset(ones32, 0xFF, 32);
-    rustsecp256k1_v0_8_1_testrand256(xy_sk);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pk, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk) == 1);
+    rustsecp256k1_v0_9_0_testrand256(xy_sk);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pk, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 1);
 
     /* Test xonly_pubkey_from_pubkey */
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, NULL, &pk_parity, &pk) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, NULL, &pk_parity, &pk) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, NULL, &pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, NULL, &pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, NULL) == 0);
     CHECK(ecount == 2);
     memset(&pk, 0, sizeof(pk));
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 0);
     CHECK(ecount == 3);
 
     /* Choose a secret key such that the resulting pubkey and xonly_pubkey match. */
     memset(sk, 0, sizeof(sk));
     sk[0] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pk, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pk, &xonly_pk, sizeof(pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pk, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pk, &xonly_pk, sizeof(pk)) == 0);
     CHECK(pk_parity == 0);
 
     /* Choose a secret key such that pubkey and xonly_pubkey are each others
      * negation. */
     sk[0] = 2;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pk, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&xonly_pk, &pk, sizeof(xonly_pk)) != 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pk, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&xonly_pk, &pk, sizeof(xonly_pk)) != 0);
     CHECK(pk_parity == 1);
-    rustsecp256k1_v0_8_1_pubkey_load(ctx, &pk1, &pk);
-    rustsecp256k1_v0_8_1_pubkey_load(ctx, &pk2, (rustsecp256k1_v0_8_1_pubkey *) &xonly_pk);
-    CHECK(rustsecp256k1_v0_8_1_fe_equal(&pk1.x, &pk2.x) == 1);
-    rustsecp256k1_v0_8_1_fe_negate(&y, &pk2.y, 1);
-    CHECK(rustsecp256k1_v0_8_1_fe_equal(&pk1.y, &y) == 1);
+    rustsecp256k1_v0_9_0_pubkey_load(CTX, &pk1, &pk);
+    rustsecp256k1_v0_9_0_pubkey_load(CTX, &pk2, (rustsecp256k1_v0_9_0_pubkey *) &xonly_pk);
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&pk1.x, &pk2.x) == 1);
+    rustsecp256k1_v0_9_0_fe_negate(&y, &pk2.y, 1);
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&pk1.y, &y) == 1);
 
     /* Test xonly_pubkey_serialize and xonly_pubkey_parse */
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, NULL, &xonly_pk) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, NULL, &xonly_pk) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, buf32, NULL) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(buf32, zeros64, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, buf32, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(buf32, zeros64, 32) == 0);
     CHECK(ecount == 2);
     {
         /* A pubkey filled with 0s will fail to serialize due to pubkey_load
          * special casing. */
-        rustsecp256k1_v0_8_1_xonly_pubkey pk_tmp;
+        rustsecp256k1_v0_9_0_xonly_pubkey pk_tmp;
         memset(&pk_tmp, 0, sizeof(pk_tmp));
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, buf32, &pk_tmp) == 0);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, buf32, &pk_tmp) == 0);
     }
     /* pubkey_load called illegal callback */
     CHECK(ecount == 3);
 
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, buf32, &xonly_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, buf32, &xonly_pk) == 1);
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, NULL, buf32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, NULL, buf32) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &xonly_pk, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &xonly_pk, NULL) == 0);
     CHECK(ecount == 2);
 
     /* Serialization and parse roundtrip */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, NULL, &pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, buf32, &xonly_pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &xonly_pk_tmp, buf32) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&xonly_pk, &xonly_pk_tmp, sizeof(xonly_pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, NULL, &pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, buf32, &xonly_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &xonly_pk_tmp, buf32) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&xonly_pk, &xonly_pk_tmp, sizeof(xonly_pk)) == 0);
 
     /* Test parsing invalid field elements */
     memset(&xonly_pk, 1, sizeof(xonly_pk));
     /* Overflowing field element */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &xonly_pk, ones32) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&xonly_pk, zeros64, sizeof(xonly_pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &xonly_pk, ones32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&xonly_pk, zeros64, sizeof(xonly_pk)) == 0);
     memset(&xonly_pk, 1, sizeof(xonly_pk));
     /* There's no point with x-coordinate 0 on secp256k1 */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &xonly_pk, zeros64) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&xonly_pk, zeros64, sizeof(xonly_pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &xonly_pk, zeros64) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&xonly_pk, zeros64, sizeof(xonly_pk)) == 0);
     /* If a random 32-byte string can not be parsed with ec_pubkey_parse
      * (because interpreted as X coordinate it does not correspond to a point on
      * the curve) then xonly_pubkey_parse should fail as well. */
-    for (i = 0; i < count; i++) {
+    for (i = 0; i < COUNT; i++) {
         unsigned char rand33[33];
-        rustsecp256k1_v0_8_1_testrand256(&rand33[1]);
+        rustsecp256k1_v0_9_0_testrand256(&rand33[1]);
         rand33[0] = SECP256K1_TAG_PUBKEY_EVEN;
-        if (!rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pk, rand33, 33)) {
+        if (!rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pk, rand33, 33)) {
             memset(&xonly_pk, 1, sizeof(xonly_pk));
-            CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &xonly_pk, &rand33[1]) == 0);
-            CHECK(rustsecp256k1_v0_8_1_memcmp_var(&xonly_pk, zeros64, sizeof(xonly_pk)) == 0);
+            CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &xonly_pk, &rand33[1]) == 0);
+            CHECK(rustsecp256k1_v0_9_0_memcmp_var(&xonly_pk, zeros64, sizeof(xonly_pk)) == 0);
         } else {
-            CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &xonly_pk, &rand33[1]) == 1);
+            CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &xonly_pk, &rand33[1]) == 1);
         }
     }
     CHECK(ecount == 2);
 }
 
-void test_xonly_pubkey_comparison(void) {
+static void test_xonly_pubkey_comparison(void) {
     unsigned char pk1_ser[32] = {
         0x58, 0x84, 0xb3, 0xa2, 0x4b, 0x97, 0x37, 0x88, 0x92, 0x38, 0xa6, 0x26, 0x62, 0x52, 0x35, 0x11,
         0xd0, 0x9a, 0xa1, 0x1b, 0x80, 0x0b, 0x5e, 0x93, 0x80, 0x26, 0x11, 0xef, 0x67, 0x4b, 0xd9, 0x23
@@ -137,108 +137,108 @@ void test_xonly_pubkey_comparison(void) {
         0xde, 0x36, 0x0e, 0x87, 0x59, 0x8f, 0x3c, 0x01, 0x36, 0x2a, 0x2a, 0xb8, 0xc6, 0xf4, 0x5e, 0x4d,
         0xb2, 0xc2, 0xd5, 0x03, 0xa7, 0xf9, 0xf1, 0x4f, 0xa8, 0xfa, 0x95, 0xa8, 0xe9, 0x69, 0x76, 0x1c
     };
-    rustsecp256k1_v0_8_1_xonly_pubkey pk1;
-    rustsecp256k1_v0_8_1_xonly_pubkey pk2;
+    rustsecp256k1_v0_9_0_xonly_pubkey pk1;
+    rustsecp256k1_v0_9_0_xonly_pubkey pk2;
     int ecount = 0;
 
-    set_counting_callbacks(ctx, &ecount);
+    set_counting_callbacks(CTX, &ecount);
 
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &pk1, pk1_ser) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &pk2, pk2_ser) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &pk1, pk1_ser) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &pk2, pk2_ser) == 1);
 
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_cmp(ctx, NULL, &pk2) < 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_cmp(CTX, NULL, &pk2) < 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_cmp(ctx, &pk1, NULL) > 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_cmp(CTX, &pk1, NULL) > 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_cmp(ctx, &pk1, &pk2) < 0);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_cmp(ctx, &pk2, &pk1) > 0);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_cmp(ctx, &pk1, &pk1) == 0);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_cmp(ctx, &pk2, &pk2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_cmp(CTX, &pk1, &pk2) < 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_cmp(CTX, &pk2, &pk1) > 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_cmp(CTX, &pk1, &pk1) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_cmp(CTX, &pk2, &pk2) == 0);
     CHECK(ecount == 2);
     memset(&pk1, 0, sizeof(pk1)); /* illegal pubkey */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_cmp(ctx, &pk1, &pk2) < 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_cmp(CTX, &pk1, &pk2) < 0);
     CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_cmp(ctx, &pk1, &pk1) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_cmp(CTX, &pk1, &pk1) == 0);
     CHECK(ecount == 5);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_cmp(ctx, &pk2, &pk1) > 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_cmp(CTX, &pk2, &pk1) > 0);
     CHECK(ecount == 6);
 }
 
-void test_xonly_pubkey_tweak(void) {
+static void test_xonly_pubkey_tweak(void) {
     unsigned char zeros64[64] = { 0 };
     unsigned char overflows[32];
     unsigned char sk[32];
-    rustsecp256k1_v0_8_1_pubkey internal_pk;
-    rustsecp256k1_v0_8_1_xonly_pubkey internal_xonly_pk;
-    rustsecp256k1_v0_8_1_pubkey output_pk;
+    rustsecp256k1_v0_9_0_pubkey internal_pk;
+    rustsecp256k1_v0_9_0_xonly_pubkey internal_xonly_pk;
+    rustsecp256k1_v0_9_0_pubkey output_pk;
     int pk_parity;
     unsigned char tweak[32];
     int i;
 
     int ecount;
 
-    set_counting_callbacks(ctx, &ecount);
+    set_counting_callbacks(CTX, &ecount);
 
     memset(overflows, 0xff, sizeof(overflows));
-    rustsecp256k1_v0_8_1_testrand256(tweak);
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &internal_pk, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
+    rustsecp256k1_v0_9_0_testrand256(tweak);
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &internal_pk, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
 
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, tweak) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, NULL, &internal_xonly_pk, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, NULL, &internal_xonly_pk, tweak) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, NULL, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, NULL, tweak) == 0);
     CHECK(ecount == 2);
     /* NULL internal_xonly_pk zeroes the output_pk */
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, NULL) == 0);
     CHECK(ecount == 3);
     /* NULL tweak zeroes the output_pk */
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
 
     /* Invalid tweak zeroes the output_pk */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, overflows) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&output_pk, zeros64, sizeof(output_pk))  == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, overflows) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&output_pk, zeros64, sizeof(output_pk))  == 0);
 
     /* A zero tweak is fine */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, zeros64) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, zeros64) == 1);
 
     /* Fails if the resulting key was infinity */
-    for (i = 0; i < count; i++) {
-        rustsecp256k1_v0_8_1_scalar scalar_tweak;
+    for (i = 0; i < COUNT; i++) {
+        rustsecp256k1_v0_9_0_scalar scalar_tweak;
         /* Because sk may be negated before adding, we need to try with tweak =
          * sk as well as tweak = -sk. */
-        rustsecp256k1_v0_8_1_scalar_set_b32(&scalar_tweak, sk, NULL);
-        rustsecp256k1_v0_8_1_scalar_negate(&scalar_tweak, &scalar_tweak);
-        rustsecp256k1_v0_8_1_scalar_get_b32(tweak, &scalar_tweak);
-        CHECK((rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, sk) == 0)
-              || (rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, tweak) == 0));
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
+        rustsecp256k1_v0_9_0_scalar_set_b32(&scalar_tweak, sk, NULL);
+        rustsecp256k1_v0_9_0_scalar_negate(&scalar_tweak, &scalar_tweak);
+        rustsecp256k1_v0_9_0_scalar_get_b32(tweak, &scalar_tweak);
+        CHECK((rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, sk) == 0)
+              || (rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 0));
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
     }
 
     /* Invalid pk with a valid tweak */
     memset(&internal_xonly_pk, 0, sizeof(internal_xonly_pk));
-    rustsecp256k1_v0_8_1_testrand256(tweak);
+    rustsecp256k1_v0_9_0_testrand256(tweak);
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&output_pk, zeros64, sizeof(output_pk))  == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&output_pk, zeros64, sizeof(output_pk))  == 0);
 }
 
-void test_xonly_pubkey_tweak_check(void) {
+static void test_xonly_pubkey_tweak_check(void) {
     unsigned char zeros64[64] = { 0 };
     unsigned char overflows[32];
     unsigned char sk[32];
-    rustsecp256k1_v0_8_1_pubkey internal_pk;
-    rustsecp256k1_v0_8_1_xonly_pubkey internal_xonly_pk;
-    rustsecp256k1_v0_8_1_pubkey output_pk;
-    rustsecp256k1_v0_8_1_xonly_pubkey output_xonly_pk;
+    rustsecp256k1_v0_9_0_pubkey internal_pk;
+    rustsecp256k1_v0_9_0_xonly_pubkey internal_xonly_pk;
+    rustsecp256k1_v0_9_0_pubkey output_pk;
+    rustsecp256k1_v0_9_0_xonly_pubkey output_xonly_pk;
     unsigned char output_pk32[32];
     unsigned char buf32[32];
     int pk_parity;
@@ -246,50 +246,50 @@ void test_xonly_pubkey_tweak_check(void) {
 
     int ecount;
 
-    set_counting_callbacks(ctx, &ecount);
+    set_counting_callbacks(CTX, &ecount);
 
     memset(overflows, 0xff, sizeof(overflows));
-    rustsecp256k1_v0_8_1_testrand256(tweak);
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &internal_pk, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
+    rustsecp256k1_v0_9_0_testrand256(tweak);
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &internal_pk, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
 
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, tweak) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &output_xonly_pk, &pk_parity, &output_pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, buf32, &output_xonly_pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &output_xonly_pk, &pk_parity, &output_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, buf32, &output_xonly_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, NULL, pk_parity, &internal_xonly_pk, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, NULL, pk_parity, &internal_xonly_pk, tweak) == 0);
     CHECK(ecount == 1);
     /* invalid pk_parity value */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, buf32, 2, &internal_xonly_pk, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, buf32, 2, &internal_xonly_pk, tweak) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, buf32, pk_parity, NULL, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, NULL, tweak) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, buf32, pk_parity, &internal_xonly_pk, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, NULL) == 0);
     CHECK(ecount == 3);
 
     memset(tweak, 1, sizeof(tweak));
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &internal_xonly_pk, NULL, &internal_pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, tweak) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &output_xonly_pk, &pk_parity, &output_pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, output_pk32, &output_xonly_pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, output_pk32, pk_parity, &internal_xonly_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &internal_xonly_pk, NULL, &internal_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &output_xonly_pk, &pk_parity, &output_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, output_pk32, &output_xonly_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, output_pk32, pk_parity, &internal_xonly_pk, tweak) == 1);
 
     /* Wrong pk_parity */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, output_pk32, !pk_parity, &internal_xonly_pk, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, output_pk32, !pk_parity, &internal_xonly_pk, tweak) == 0);
     /* Wrong public key */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, buf32, &internal_xonly_pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, buf32, pk_parity, &internal_xonly_pk, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, buf32, &internal_xonly_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, tweak) == 0);
 
     /* Overflowing tweak not allowed */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, output_pk32, pk_parity, &internal_xonly_pk, overflows) == 0);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk, &internal_xonly_pk, overflows) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, output_pk32, pk_parity, &internal_xonly_pk, overflows) == 0);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, overflows) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
     CHECK(ecount == 3);
 }
 
@@ -297,259 +297,260 @@ void test_xonly_pubkey_tweak_check(void) {
  * additional pubkeys by calling tweak_add. Then verifies every tweak starting
  * from the last pubkey. */
 #define N_PUBKEYS 32
-void test_xonly_pubkey_tweak_recursive(void) {
+static void test_xonly_pubkey_tweak_recursive(void) {
     unsigned char sk[32];
-    rustsecp256k1_v0_8_1_pubkey pk[N_PUBKEYS];
+    rustsecp256k1_v0_9_0_pubkey pk[N_PUBKEYS];
     unsigned char pk_serialized[32];
     unsigned char tweak[N_PUBKEYS - 1][32];
     int i;
 
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pk[0], sk) == 1);
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pk[0], sk) == 1);
     /* Add tweaks */
     for (i = 0; i < N_PUBKEYS - 1; i++) {
-        rustsecp256k1_v0_8_1_xonly_pubkey xonly_pk;
+        rustsecp256k1_v0_9_0_xonly_pubkey xonly_pk;
         memset(tweak[i], i + 1, sizeof(tweak[i]));
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, NULL, &pk[i]) == 1);
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &pk[i + 1], &xonly_pk, tweak[i]) == 1);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, NULL, &pk[i]) == 1);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &pk[i + 1], &xonly_pk, tweak[i]) == 1);
     }
 
     /* Verify tweaks */
     for (i = N_PUBKEYS - 1; i > 0; i--) {
-        rustsecp256k1_v0_8_1_xonly_pubkey xonly_pk;
+        rustsecp256k1_v0_9_0_xonly_pubkey xonly_pk;
         int pk_parity;
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk[i]) == 1);
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, pk_serialized, &xonly_pk) == 1);
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, NULL, &pk[i - 1]) == 1);
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, pk_serialized, pk_parity, &xonly_pk, tweak[i - 1]) == 1);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk[i]) == 1);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, pk_serialized, &xonly_pk) == 1);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, NULL, &pk[i - 1]) == 1);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, pk_serialized, pk_parity, &xonly_pk, tweak[i - 1]) == 1);
     }
 }
 #undef N_PUBKEYS
 
-void test_keypair(void) {
+static void test_keypair(void) {
     unsigned char sk[32];
     unsigned char sk_tmp[32];
     unsigned char zeros96[96] = { 0 };
     unsigned char overflows[32];
-    rustsecp256k1_v0_8_1_keypair keypair;
-    rustsecp256k1_v0_8_1_pubkey pk, pk_tmp;
-    rustsecp256k1_v0_8_1_xonly_pubkey xonly_pk, xonly_pk_tmp;
+    rustsecp256k1_v0_9_0_keypair keypair;
+    rustsecp256k1_v0_9_0_pubkey pk, pk_tmp;
+    rustsecp256k1_v0_9_0_xonly_pubkey xonly_pk, xonly_pk_tmp;
     int pk_parity, pk_parity_tmp;
     int ecount;
-    rustsecp256k1_v0_8_1_context *sttc = rustsecp256k1_v0_8_1_context_clone(rustsecp256k1_v0_8_1_context_static);
 
-    set_counting_callbacks(ctx, &ecount);
-    set_counting_callbacks(sttc, &ecount);
+    set_counting_callbacks(CTX, &ecount);
+    set_counting_callbacks(STATIC_CTX, &ecount);
 
     CHECK(sizeof(zeros96) == sizeof(keypair));
     memset(overflows, 0xFF, sizeof(overflows));
 
     /* Test keypair_create */
     ecount = 0;
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &keypair, sizeof(keypair)) != 0);
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &keypair, sizeof(keypair)) != 0);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &keypair, sizeof(keypair)) != 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &keypair, sizeof(keypair)) != 0);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, NULL, sk) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, NULL, sk) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, NULL) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(sttc, &keypair, sk) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(STATIC_CTX, &keypair, sk) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
     CHECK(ecount == 3);
 
     /* Invalid secret key */
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, zeros96) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, overflows) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, zeros96) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, overflows) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
 
     /* Test keypair_pub */
     ecount = 0;
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_pub(ctx, &pk, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_pub(ctx, NULL, &keypair) == 0);
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_pub(CTX, &pk, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_pub(CTX, NULL, &keypair) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_pub(ctx, &pk, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_pub(CTX, &pk, NULL) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &pk, sizeof(pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &pk, sizeof(pk)) == 0);
 
     /* Using an invalid keypair is fine for keypair_pub */
     memset(&keypair, 0, sizeof(keypair));
-    CHECK(rustsecp256k1_v0_8_1_keypair_pub(ctx, &pk, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &pk, sizeof(pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_pub(CTX, &pk, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &pk, sizeof(pk)) == 0);
 
     /* keypair holds the same pubkey as pubkey_create */
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pk, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_pub(ctx, &pk_tmp, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pk, &pk_tmp, sizeof(pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pk, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_pub(CTX, &pk_tmp, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pk, &pk_tmp, sizeof(pk)) == 0);
 
     /** Test keypair_xonly_pub **/
     ecount = 0;
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &xonly_pk, &pk_parity, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, NULL, &pk_parity, &keypair) == 0);
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, NULL, &pk_parity, &keypair) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &xonly_pk, NULL, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &xonly_pk, &pk_parity, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &xonly_pk, NULL, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, NULL) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &xonly_pk, sizeof(xonly_pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &xonly_pk, sizeof(xonly_pk)) == 0);
     /* Using an invalid keypair will set the xonly_pk to 0 (first reset
      * xonly_pk). */
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &xonly_pk, &pk_parity, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, &keypair) == 1);
     memset(&keypair, 0, sizeof(keypair));
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &xonly_pk, &pk_parity, &keypair) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, &xonly_pk, sizeof(xonly_pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, &keypair) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, &xonly_pk, sizeof(xonly_pk)) == 0);
     CHECK(ecount == 3);
 
     /** keypair holds the same xonly pubkey as pubkey_create **/
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pk, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey(ctx, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &xonly_pk_tmp, &pk_parity_tmp, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&xonly_pk, &xonly_pk_tmp, sizeof(pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pk, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &xonly_pk_tmp, &pk_parity_tmp, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&xonly_pk, &xonly_pk_tmp, sizeof(pk)) == 0);
     CHECK(pk_parity == pk_parity_tmp);
 
     /* Test keypair_seckey */
     ecount = 0;
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_sec(ctx, sk_tmp, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_sec(ctx, NULL, &keypair) == 0);
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_sec(CTX, sk_tmp, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_sec(CTX, NULL, &keypair) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_sec(ctx, sk_tmp, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_sec(CTX, sk_tmp, NULL) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, sk_tmp, sizeof(sk_tmp)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, sk_tmp, sizeof(sk_tmp)) == 0);
 
     /* keypair returns the same seckey it got */
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_sec(ctx, sk_tmp, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(sk, sk_tmp, sizeof(sk_tmp)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_sec(CTX, sk_tmp, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(sk, sk_tmp, sizeof(sk_tmp)) == 0);
 
 
     /* Using an invalid keypair is fine for keypair_seckey */
     memset(&keypair, 0, sizeof(keypair));
-    CHECK(rustsecp256k1_v0_8_1_keypair_sec(ctx, sk_tmp, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros96, sk_tmp, sizeof(sk_tmp)) == 0);
-    rustsecp256k1_v0_8_1_context_destroy(sttc);
+    CHECK(rustsecp256k1_v0_9_0_keypair_sec(CTX, sk_tmp, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros96, sk_tmp, sizeof(sk_tmp)) == 0);
+
+    rustsecp256k1_v0_9_0_context_set_error_callback(STATIC_CTX, NULL, NULL);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 
-void test_keypair_add(void) {
+static void test_keypair_add(void) {
     unsigned char sk[32];
-    rustsecp256k1_v0_8_1_keypair keypair;
+    rustsecp256k1_v0_9_0_keypair keypair;
     unsigned char overflows[32];
     unsigned char zeros96[96] = { 0 };
     unsigned char tweak[32];
     int i;
     int ecount = 0;
 
-    set_counting_callbacks(ctx, &ecount);
+    set_counting_callbacks(CTX, &ecount);
 
     CHECK(sizeof(zeros96) == sizeof(keypair));
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    rustsecp256k1_v0_8_1_testrand256(tweak);
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    rustsecp256k1_v0_9_0_testrand256(tweak);
     memset(overflows, 0xFF, 32);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
 
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, NULL, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, NULL, tweak) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, NULL) == 0);
     CHECK(ecount == 2);
     /* This does not set the keypair to zeroes */
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&keypair, zeros96, sizeof(keypair)) != 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&keypair, zeros96, sizeof(keypair)) != 0);
 
     /* Invalid tweak zeroes the keypair */
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, overflows) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&keypair, zeros96, sizeof(keypair))  == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, overflows) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&keypair, zeros96, sizeof(keypair))  == 0);
 
     /* A zero tweak is fine */
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, zeros96) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, zeros96) == 1);
 
     /* Fails if the resulting keypair was (sk=0, pk=infinity) */
-    for (i = 0; i < count; i++) {
-        rustsecp256k1_v0_8_1_scalar scalar_tweak;
-        rustsecp256k1_v0_8_1_keypair keypair_tmp;
-        rustsecp256k1_v0_8_1_testrand256(sk);
-        CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
+    for (i = 0; i < COUNT; i++) {
+        rustsecp256k1_v0_9_0_scalar scalar_tweak;
+        rustsecp256k1_v0_9_0_keypair keypair_tmp;
+        rustsecp256k1_v0_9_0_testrand256(sk);
+        CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
         memcpy(&keypair_tmp, &keypair, sizeof(keypair));
         /* Because sk may be negated before adding, we need to try with tweak =
          * sk as well as tweak = -sk. */
-        rustsecp256k1_v0_8_1_scalar_set_b32(&scalar_tweak, sk, NULL);
-        rustsecp256k1_v0_8_1_scalar_negate(&scalar_tweak, &scalar_tweak);
-        rustsecp256k1_v0_8_1_scalar_get_b32(tweak, &scalar_tweak);
-        CHECK((rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, sk) == 0)
-              || (rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair_tmp, tweak) == 0));
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&keypair, zeros96, sizeof(keypair)) == 0
-              || rustsecp256k1_v0_8_1_memcmp_var(&keypair_tmp, zeros96, sizeof(keypair_tmp)) == 0);
+        rustsecp256k1_v0_9_0_scalar_set_b32(&scalar_tweak, sk, NULL);
+        rustsecp256k1_v0_9_0_scalar_negate(&scalar_tweak, &scalar_tweak);
+        rustsecp256k1_v0_9_0_scalar_get_b32(tweak, &scalar_tweak);
+        CHECK((rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, sk) == 0)
+              || (rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair_tmp, tweak) == 0));
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&keypair, zeros96, sizeof(keypair)) == 0
+              || rustsecp256k1_v0_9_0_memcmp_var(&keypair_tmp, zeros96, sizeof(keypair_tmp)) == 0);
     }
 
     /* Invalid keypair with a valid tweak */
     memset(&keypair, 0, sizeof(keypair));
-    rustsecp256k1_v0_8_1_testrand256(tweak);
+    rustsecp256k1_v0_9_0_testrand256(tweak);
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&keypair, zeros96, sizeof(keypair))  == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&keypair, zeros96, sizeof(keypair))  == 0);
     /* Only seckey part of keypair invalid */
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
     memset(&keypair, 0, 32);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 0);
     CHECK(ecount == 2);
     /* Only pubkey part of keypair invalid */
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
     memset(&keypair.data[32], 0, 64);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 0);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 0);
     CHECK(ecount == 3);
 
     /* Check that the keypair_tweak_add implementation is correct */
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    for (i = 0; i < count; i++) {
-        rustsecp256k1_v0_8_1_xonly_pubkey internal_pk;
-        rustsecp256k1_v0_8_1_xonly_pubkey output_pk;
-        rustsecp256k1_v0_8_1_pubkey output_pk_xy;
-        rustsecp256k1_v0_8_1_pubkey output_pk_expected;
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    for (i = 0; i < COUNT; i++) {
+        rustsecp256k1_v0_9_0_xonly_pubkey internal_pk;
+        rustsecp256k1_v0_9_0_xonly_pubkey output_pk;
+        rustsecp256k1_v0_9_0_pubkey output_pk_xy;
+        rustsecp256k1_v0_9_0_pubkey output_pk_expected;
         unsigned char pk32[32];
         unsigned char sk32[32];
         int pk_parity;
 
-        rustsecp256k1_v0_8_1_testrand256(tweak);
-        CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &internal_pk, NULL, &keypair) == 1);
-        CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 1);
-        CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &output_pk, &pk_parity, &keypair) == 1);
+        rustsecp256k1_v0_9_0_testrand256(tweak);
+        CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &internal_pk, NULL, &keypair) == 1);
+        CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
+        CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &output_pk, &pk_parity, &keypair) == 1);
 
         /* Check that it passes xonly_pubkey_tweak_add_check */
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, pk32, &output_pk) == 1);
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, pk32, pk_parity, &internal_pk, tweak) == 1);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, pk32, &output_pk) == 1);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, pk32, pk_parity, &internal_pk, tweak) == 1);
 
         /* Check that the resulting pubkey matches xonly_pubkey_tweak_add */
-        CHECK(rustsecp256k1_v0_8_1_keypair_pub(ctx, &output_pk_xy, &keypair) == 1);
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add(ctx, &output_pk_expected, &internal_pk, tweak) == 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&output_pk_xy, &output_pk_expected, sizeof(output_pk_xy)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_keypair_pub(CTX, &output_pk_xy, &keypair) == 1);
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add(CTX, &output_pk_expected, &internal_pk, tweak) == 1);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&output_pk_xy, &output_pk_expected, sizeof(output_pk_xy)) == 0);
 
         /* Check that the secret key in the keypair is tweaked correctly */
-        CHECK(rustsecp256k1_v0_8_1_keypair_sec(ctx, sk32, &keypair) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &output_pk_expected, sk32) == 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&output_pk_xy, &output_pk_expected, sizeof(output_pk_xy)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_keypair_sec(CTX, sk32, &keypair) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &output_pk_expected, sk32) == 1);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&output_pk_xy, &output_pk_expected, sizeof(output_pk_xy)) == 0);
     }
 }
 
-void run_extrakeys_tests(void) {
+static void run_extrakeys_tests(void) {
     /* xonly key test cases */
     test_xonly_pubkey();
     test_xonly_pubkey_tweak();
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/recovery/Makefile.am.include b/secp256k1-sys/depend/secp256k1/src/modules/recovery/Makefile.am.include
index bb1a5131c..5caeb85ca 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/recovery/Makefile.am.include
+++ b/secp256k1-sys/depend/secp256k1/src/modules/recovery/Makefile.am.include
@@ -1,4 +1,4 @@
-include_HEADERS += include/rustsecp256k1_v0_8_1_recovery.h
+include_HEADERS += include/rustsecp256k1_v0_9_0_recovery.h
 noinst_HEADERS += src/modules/recovery/main_impl.h
 noinst_HEADERS += src/modules/recovery/tests_impl.h
 noinst_HEADERS += src/modules/recovery/tests_exhaustive_impl.h
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/recovery/bench_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/recovery/bench_impl.h
index ce3911b46..30b2556a1 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/recovery/bench_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/recovery/bench_impl.h
@@ -10,24 +10,24 @@
 #include "../../../include/secp256k1_recovery.h"
 
 typedef struct {
-    rustsecp256k1_v0_8_1_context *ctx;
+    rustsecp256k1_v0_9_0_context *ctx;
     unsigned char msg[32];
     unsigned char sig[64];
 } bench_recover_data;
 
-void bench_recover(void* arg, int iters) {
+static void bench_recover(void* arg, int iters) {
     int i;
     bench_recover_data *data = (bench_recover_data*)arg;
-    rustsecp256k1_v0_8_1_pubkey pubkey;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
     unsigned char pubkeyc[33];
 
     for (i = 0; i < iters; i++) {
         int j;
         size_t pubkeylen = 33;
-        rustsecp256k1_v0_8_1_ecdsa_recoverable_signature sig;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(data->ctx, &sig, data->sig, i % 2));
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(data->ctx, &pubkey, &sig, data->msg));
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(data->ctx, pubkeyc, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED));
+        rustsecp256k1_v0_9_0_ecdsa_recoverable_signature sig;
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(data->ctx, &sig, data->sig, i % 2));
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(data->ctx, &pubkey, &sig, data->msg));
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(data->ctx, pubkeyc, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED));
         for (j = 0; j < 32; j++) {
             data->sig[j + 32] = data->msg[j];    /* Move former message to S. */
             data->msg[j] = data->sig[j];         /* Move former R to message. */
@@ -36,7 +36,7 @@ void bench_recover(void* arg, int iters) {
     }
 }
 
-void bench_recover_setup(void* arg) {
+static void bench_recover_setup(void* arg) {
     int i;
     bench_recover_data *data = (bench_recover_data*)arg;
 
@@ -48,15 +48,15 @@ void bench_recover_setup(void* arg) {
     }
 }
 
-void run_recovery_bench(int iters, int argc, char** argv) {
+static void run_recovery_bench(int iters, int argc, char** argv) {
     bench_recover_data data;
     int d = argc == 1;
 
-    data.ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
+    data.ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
 
     if (d || have_flag(argc, argv, "ecdsa") || have_flag(argc, argv, "recover") || have_flag(argc, argv, "ecdsa_recover")) run_benchmark("ecdsa_recover", bench_recover, bench_recover_setup, NULL, &data, 10, iters);
 
-    rustsecp256k1_v0_8_1_context_destroy(data.ctx);
+    rustsecp256k1_v0_9_0_context_destroy(data.ctx);
 }
 
 #endif /* SECP256K1_MODULE_RECOVERY_BENCH_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/recovery/main_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/recovery/main_impl.h
index d26b61a3f..90820257c 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/recovery/main_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/recovery/main_impl.h
@@ -9,34 +9,34 @@
 
 #include "../../../include/secp256k1_recovery.h"
 
-static void rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_load(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_scalar* r, rustsecp256k1_v0_8_1_scalar* s, int* recid, const rustsecp256k1_v0_8_1_ecdsa_recoverable_signature* sig) {
+static void rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_load(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_scalar* r, rustsecp256k1_v0_9_0_scalar* s, int* recid, const rustsecp256k1_v0_9_0_ecdsa_recoverable_signature* sig) {
     (void)ctx;
-    if (sizeof(rustsecp256k1_v0_8_1_scalar) == 32) {
-        /* When the rustsecp256k1_v0_8_1_scalar type is exactly 32 byte, use its
-         * representation inside rustsecp256k1_v0_8_1_ecdsa_signature, as conversion is very fast.
-         * Note that rustsecp256k1_v0_8_1_ecdsa_signature_save must use the same representation. */
+    if (sizeof(rustsecp256k1_v0_9_0_scalar) == 32) {
+        /* When the rustsecp256k1_v0_9_0_scalar type is exactly 32 byte, use its
+         * representation inside rustsecp256k1_v0_9_0_ecdsa_signature, as conversion is very fast.
+         * Note that rustsecp256k1_v0_9_0_ecdsa_signature_save must use the same representation. */
         memcpy(r, &sig->data[0], 32);
         memcpy(s, &sig->data[32], 32);
     } else {
-        rustsecp256k1_v0_8_1_scalar_set_b32(r, &sig->data[0], NULL);
-        rustsecp256k1_v0_8_1_scalar_set_b32(s, &sig->data[32], NULL);
+        rustsecp256k1_v0_9_0_scalar_set_b32(r, &sig->data[0], NULL);
+        rustsecp256k1_v0_9_0_scalar_set_b32(s, &sig->data[32], NULL);
     }
     *recid = sig->data[64];
 }
 
-static void rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_save(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature* sig, const rustsecp256k1_v0_8_1_scalar* r, const rustsecp256k1_v0_8_1_scalar* s, int recid) {
-    if (sizeof(rustsecp256k1_v0_8_1_scalar) == 32) {
+static void rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_save(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature* sig, const rustsecp256k1_v0_9_0_scalar* r, const rustsecp256k1_v0_9_0_scalar* s, int recid) {
+    if (sizeof(rustsecp256k1_v0_9_0_scalar) == 32) {
         memcpy(&sig->data[0], r, 32);
         memcpy(&sig->data[32], s, 32);
     } else {
-        rustsecp256k1_v0_8_1_scalar_get_b32(&sig->data[0], r);
-        rustsecp256k1_v0_8_1_scalar_get_b32(&sig->data[32], s);
+        rustsecp256k1_v0_9_0_scalar_get_b32(&sig->data[0], r);
+        rustsecp256k1_v0_9_0_scalar_get_b32(&sig->data[32], s);
     }
     sig->data[64] = recid;
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ecdsa_recoverable_signature* sig, const unsigned char *input64, int recid) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ecdsa_recoverable_signature* sig, const unsigned char *input64, int recid) {
+    rustsecp256k1_v0_9_0_scalar r, s;
     int ret = 1;
     int overflow = 0;
 
@@ -45,110 +45,110 @@ int rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(const rustsec
     ARG_CHECK(input64 != NULL);
     ARG_CHECK(recid >= 0 && recid <= 3);
 
-    rustsecp256k1_v0_8_1_scalar_set_b32(&r, &input64[0], &overflow);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&r, &input64[0], &overflow);
     ret &= !overflow;
-    rustsecp256k1_v0_8_1_scalar_set_b32(&s, &input64[32], &overflow);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&s, &input64[32], &overflow);
     ret &= !overflow;
     if (ret) {
-        rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_save(sig, &r, &s, recid);
+        rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_save(sig, &r, &s, recid);
     } else {
         memset(sig, 0, sizeof(*sig));
     }
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *output64, int *recid, const rustsecp256k1_v0_8_1_ecdsa_recoverable_signature* sig) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *output64, int *recid, const rustsecp256k1_v0_9_0_ecdsa_recoverable_signature* sig) {
+    rustsecp256k1_v0_9_0_scalar r, s;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(output64 != NULL);
     ARG_CHECK(sig != NULL);
     ARG_CHECK(recid != NULL);
 
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_load(ctx, &r, &s, recid, sig);
-    rustsecp256k1_v0_8_1_scalar_get_b32(&output64[0], &r);
-    rustsecp256k1_v0_8_1_scalar_get_b32(&output64[32], &s);
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_load(ctx, &r, &s, recid, sig);
+    rustsecp256k1_v0_9_0_scalar_get_b32(&output64[0], &r);
+    rustsecp256k1_v0_9_0_scalar_get_b32(&output64[32], &s);
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ecdsa_signature* sig, const rustsecp256k1_v0_8_1_ecdsa_recoverable_signature* sigin) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ecdsa_signature* sig, const rustsecp256k1_v0_9_0_ecdsa_recoverable_signature* sigin) {
+    rustsecp256k1_v0_9_0_scalar r, s;
     int recid;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(sig != NULL);
     ARG_CHECK(sigin != NULL);
 
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, sigin);
-    rustsecp256k1_v0_8_1_ecdsa_signature_save(sig, &r, &s);
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, sigin);
+    rustsecp256k1_v0_9_0_ecdsa_signature_save(sig, &r, &s);
     return 1;
 }
 
-static int rustsecp256k1_v0_8_1_ecdsa_sig_recover(const rustsecp256k1_v0_8_1_scalar *sigr, const rustsecp256k1_v0_8_1_scalar* sigs, rustsecp256k1_v0_8_1_ge *pubkey, const rustsecp256k1_v0_8_1_scalar *message, int recid) {
+static int rustsecp256k1_v0_9_0_ecdsa_sig_recover(const rustsecp256k1_v0_9_0_scalar *sigr, const rustsecp256k1_v0_9_0_scalar* sigs, rustsecp256k1_v0_9_0_ge *pubkey, const rustsecp256k1_v0_9_0_scalar *message, int recid) {
     unsigned char brx[32];
-    rustsecp256k1_v0_8_1_fe fx;
-    rustsecp256k1_v0_8_1_ge x;
-    rustsecp256k1_v0_8_1_gej xj;
-    rustsecp256k1_v0_8_1_scalar rn, u1, u2;
-    rustsecp256k1_v0_8_1_gej qj;
+    rustsecp256k1_v0_9_0_fe fx;
+    rustsecp256k1_v0_9_0_ge x;
+    rustsecp256k1_v0_9_0_gej xj;
+    rustsecp256k1_v0_9_0_scalar rn, u1, u2;
+    rustsecp256k1_v0_9_0_gej qj;
     int r;
 
-    if (rustsecp256k1_v0_8_1_scalar_is_zero(sigr) || rustsecp256k1_v0_8_1_scalar_is_zero(sigs)) {
+    if (rustsecp256k1_v0_9_0_scalar_is_zero(sigr) || rustsecp256k1_v0_9_0_scalar_is_zero(sigs)) {
         return 0;
     }
 
-    rustsecp256k1_v0_8_1_scalar_get_b32(brx, sigr);
-    r = rustsecp256k1_v0_8_1_fe_set_b32(&fx, brx);
+    rustsecp256k1_v0_9_0_scalar_get_b32(brx, sigr);
+    r = rustsecp256k1_v0_9_0_fe_set_b32_limit(&fx, brx);
     (void)r;
     VERIFY_CHECK(r); /* brx comes from a scalar, so is less than the order; certainly less than p */
     if (recid & 2) {
-        if (rustsecp256k1_v0_8_1_fe_cmp_var(&fx, &rustsecp256k1_v0_8_1_ecdsa_const_p_minus_order) >= 0) {
+        if (rustsecp256k1_v0_9_0_fe_cmp_var(&fx, &rustsecp256k1_v0_9_0_ecdsa_const_p_minus_order) >= 0) {
             return 0;
         }
-        rustsecp256k1_v0_8_1_fe_add(&fx, &rustsecp256k1_v0_8_1_ecdsa_const_order_as_fe);
+        rustsecp256k1_v0_9_0_fe_add(&fx, &rustsecp256k1_v0_9_0_ecdsa_const_order_as_fe);
     }
-    if (!rustsecp256k1_v0_8_1_ge_set_xo_var(&x, &fx, recid & 1)) {
+    if (!rustsecp256k1_v0_9_0_ge_set_xo_var(&x, &fx, recid & 1)) {
         return 0;
     }
-    rustsecp256k1_v0_8_1_gej_set_ge(&xj, &x);
-    rustsecp256k1_v0_8_1_scalar_inverse_var(&rn, sigr);
-    rustsecp256k1_v0_8_1_scalar_mul(&u1, &rn, message);
-    rustsecp256k1_v0_8_1_scalar_negate(&u1, &u1);
-    rustsecp256k1_v0_8_1_scalar_mul(&u2, &rn, sigs);
-    rustsecp256k1_v0_8_1_ecmult(&qj, &xj, &u2, &u1);
-    rustsecp256k1_v0_8_1_ge_set_gej_var(pubkey, &qj);
-    return !rustsecp256k1_v0_8_1_gej_is_infinity(&qj);
+    rustsecp256k1_v0_9_0_gej_set_ge(&xj, &x);
+    rustsecp256k1_v0_9_0_scalar_inverse_var(&rn, sigr);
+    rustsecp256k1_v0_9_0_scalar_mul(&u1, &rn, message);
+    rustsecp256k1_v0_9_0_scalar_negate(&u1, &u1);
+    rustsecp256k1_v0_9_0_scalar_mul(&u2, &rn, sigs);
+    rustsecp256k1_v0_9_0_ecmult(&qj, &xj, &u2, &u1);
+    rustsecp256k1_v0_9_0_ge_set_gej_var(pubkey, &qj);
+    return !rustsecp256k1_v0_9_0_gej_is_infinity(&qj);
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ecdsa_recoverable_signature *signature, const unsigned char *msghash32, const unsigned char *seckey, rustsecp256k1_v0_8_1_nonce_function noncefp, const void* noncedata) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ecdsa_recoverable_signature *signature, const unsigned char *msghash32, const unsigned char *seckey, rustsecp256k1_v0_9_0_nonce_function noncefp, const void* noncedata) {
+    rustsecp256k1_v0_9_0_scalar r, s;
     int ret, recid;
     VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(rustsecp256k1_v0_8_1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(rustsecp256k1_v0_9_0_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
     ARG_CHECK(msghash32 != NULL);
     ARG_CHECK(signature != NULL);
     ARG_CHECK(seckey != NULL);
 
-    ret = rustsecp256k1_v0_8_1_ecdsa_sign_inner(ctx, &r, &s, &recid, msghash32, seckey, noncefp, noncedata);
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_save(signature, &r, &s, recid);
+    ret = rustsecp256k1_v0_9_0_ecdsa_sign_inner(ctx, &r, &s, &recid, msghash32, seckey, noncefp, noncedata);
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_save(signature, &r, &s, recid);
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_recover(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_pubkey *pubkey, const rustsecp256k1_v0_8_1_ecdsa_recoverable_signature *signature, const unsigned char *msghash32) {
-    rustsecp256k1_v0_8_1_ge q;
-    rustsecp256k1_v0_8_1_scalar r, s;
-    rustsecp256k1_v0_8_1_scalar m;
+int rustsecp256k1_v0_9_0_ecdsa_recover(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_pubkey *pubkey, const rustsecp256k1_v0_9_0_ecdsa_recoverable_signature *signature, const unsigned char *msghash32) {
+    rustsecp256k1_v0_9_0_ge q;
+    rustsecp256k1_v0_9_0_scalar r, s;
+    rustsecp256k1_v0_9_0_scalar m;
     int recid;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(msghash32 != NULL);
     ARG_CHECK(signature != NULL);
     ARG_CHECK(pubkey != NULL);
 
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, signature);
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, signature);
     VERIFY_CHECK(recid >= 0 && recid < 4);  /* should have been caught in parse_compact */
-    rustsecp256k1_v0_8_1_scalar_set_b32(&m, msghash32, NULL);
-    if (rustsecp256k1_v0_8_1_ecdsa_sig_recover(&r, &s, &q, &m, recid)) {
-        rustsecp256k1_v0_8_1_pubkey_save(pubkey, &q);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&m, msghash32, NULL);
+    if (rustsecp256k1_v0_9_0_ecdsa_sig_recover(&r, &s, &q, &m, recid)) {
+        rustsecp256k1_v0_9_0_pubkey_save(pubkey, &q);
         return 1;
     } else {
         memset(pubkey, 0, sizeof(*pubkey));
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/recovery/tests_exhaustive_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/recovery/tests_exhaustive_impl.h
index ac707420b..ef909b0ce 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/recovery/tests_exhaustive_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/recovery/tests_exhaustive_impl.h
@@ -10,7 +10,7 @@
 #include "main_impl.h"
 #include "../../../include/secp256k1_recovery.h"
 
-void test_exhaustive_recovery_sign(const rustsecp256k1_v0_8_1_context *ctx, const rustsecp256k1_v0_8_1_ge *group) {
+static void test_exhaustive_recovery_sign(const rustsecp256k1_v0_9_0_context *ctx, const rustsecp256k1_v0_9_0_ge *group) {
     int i, j, k;
     uint64_t iter = 0;
 
@@ -20,48 +20,47 @@ void test_exhaustive_recovery_sign(const rustsecp256k1_v0_8_1_context *ctx, cons
             if (skip_section(&iter)) continue;
             for (k = 1; k < EXHAUSTIVE_TEST_ORDER; k++) {  /* nonce */
                 const int starting_k = k;
-                rustsecp256k1_v0_8_1_fe r_dot_y_normalized;
-                rustsecp256k1_v0_8_1_ecdsa_recoverable_signature rsig;
-                rustsecp256k1_v0_8_1_ecdsa_signature sig;
-                rustsecp256k1_v0_8_1_scalar sk, msg, r, s, expected_r;
+                rustsecp256k1_v0_9_0_fe r_dot_y_normalized;
+                rustsecp256k1_v0_9_0_ecdsa_recoverable_signature rsig;
+                rustsecp256k1_v0_9_0_ecdsa_signature sig;
+                rustsecp256k1_v0_9_0_scalar sk, msg, r, s, expected_r;
                 unsigned char sk32[32], msg32[32];
                 int expected_recid;
                 int recid;
                 int overflow;
-                rustsecp256k1_v0_8_1_scalar_set_int(&msg, i);
-                rustsecp256k1_v0_8_1_scalar_set_int(&sk, j);
-                rustsecp256k1_v0_8_1_scalar_get_b32(sk32, &sk);
-                rustsecp256k1_v0_8_1_scalar_get_b32(msg32, &msg);
+                rustsecp256k1_v0_9_0_scalar_set_int(&msg, i);
+                rustsecp256k1_v0_9_0_scalar_set_int(&sk, j);
+                rustsecp256k1_v0_9_0_scalar_get_b32(sk32, &sk);
+                rustsecp256k1_v0_9_0_scalar_get_b32(msg32, &msg);
 
-                rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &rsig, msg32, sk32, rustsecp256k1_v0_8_1_nonce_function_smallint, &k);
+                rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(ctx, &rsig, msg32, sk32, rustsecp256k1_v0_9_0_nonce_function_smallint, &k);
 
                 /* Check directly */
-                rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, &rsig);
+                rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_load(ctx, &r, &s, &recid, &rsig);
                 r_from_k(&expected_r, group, k, &overflow);
                 CHECK(r == expected_r);
                 CHECK((k * s) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER ||
                       (k * (EXHAUSTIVE_TEST_ORDER - s)) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER);
                 /* The recid's second bit is for conveying overflow (R.x value >= group order).
                  * In the actual secp256k1 this is an astronomically unlikely event, but in the
-                 * small group used here, it will be the case for all points except the ones where
-                 * R.x=1 (which the group is specifically selected to have).
+                 * small group used here, it will almost certainly be the case for all points.
                  * Note that this isn't actually useful; full recovery would need to convey
                  * floor(R.x / group_order), but only one bit is used as that is sufficient
                  * in the real group. */
                 expected_recid = overflow ? 2 : 0;
                 r_dot_y_normalized = group[k].y;
-                rustsecp256k1_v0_8_1_fe_normalize(&r_dot_y_normalized);
+                rustsecp256k1_v0_9_0_fe_normalize(&r_dot_y_normalized);
                 /* Also the recovery id is flipped depending if we hit the low-s branch */
                 if ((k * s) % EXHAUSTIVE_TEST_ORDER == (i + r * j) % EXHAUSTIVE_TEST_ORDER) {
-                    expected_recid |= rustsecp256k1_v0_8_1_fe_is_odd(&r_dot_y_normalized);
+                    expected_recid |= rustsecp256k1_v0_9_0_fe_is_odd(&r_dot_y_normalized);
                 } else {
-                    expected_recid |= !rustsecp256k1_v0_8_1_fe_is_odd(&r_dot_y_normalized);
+                    expected_recid |= !rustsecp256k1_v0_9_0_fe_is_odd(&r_dot_y_normalized);
                 }
                 CHECK(recid == expected_recid);
 
                 /* Convert to a standard sig then check */
-                rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(ctx, &sig, &rsig);
-                rustsecp256k1_v0_8_1_ecdsa_signature_load(ctx, &r, &s, &sig);
+                rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(ctx, &sig, &rsig);
+                rustsecp256k1_v0_9_0_ecdsa_signature_load(ctx, &r, &s, &sig);
                 /* Note that we compute expected_r *after* signing -- this is important
                  * because our nonce-computing function function might change k during
                  * signing. */
@@ -79,7 +78,7 @@ void test_exhaustive_recovery_sign(const rustsecp256k1_v0_8_1_context *ctx, cons
     }
 }
 
-void test_exhaustive_recovery_verify(const rustsecp256k1_v0_8_1_context *ctx, const rustsecp256k1_v0_8_1_ge *group) {
+static void test_exhaustive_recovery_verify(const rustsecp256k1_v0_9_0_context *ctx, const rustsecp256k1_v0_9_0_ge *group) {
     /* This is essentially a copy of test_exhaustive_verify, with recovery added */
     int s, r, msg, key;
     uint64_t iter = 0;
@@ -87,41 +86,41 @@ void test_exhaustive_recovery_verify(const rustsecp256k1_v0_8_1_context *ctx, co
         for (r = 1; r < EXHAUSTIVE_TEST_ORDER; r++) {
             for (msg = 1; msg < EXHAUSTIVE_TEST_ORDER; msg++) {
                 for (key = 1; key < EXHAUSTIVE_TEST_ORDER; key++) {
-                    rustsecp256k1_v0_8_1_ge nonconst_ge;
-                    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature rsig;
-                    rustsecp256k1_v0_8_1_ecdsa_signature sig;
-                    rustsecp256k1_v0_8_1_pubkey pk;
-                    rustsecp256k1_v0_8_1_scalar sk_s, msg_s, r_s, s_s;
-                    rustsecp256k1_v0_8_1_scalar s_times_k_s, msg_plus_r_times_sk_s;
+                    rustsecp256k1_v0_9_0_ge nonconst_ge;
+                    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature rsig;
+                    rustsecp256k1_v0_9_0_ecdsa_signature sig;
+                    rustsecp256k1_v0_9_0_pubkey pk;
+                    rustsecp256k1_v0_9_0_scalar sk_s, msg_s, r_s, s_s;
+                    rustsecp256k1_v0_9_0_scalar s_times_k_s, msg_plus_r_times_sk_s;
                     int recid = 0;
                     int k, should_verify;
                     unsigned char msg32[32];
 
                     if (skip_section(&iter)) continue;
 
-                    rustsecp256k1_v0_8_1_scalar_set_int(&s_s, s);
-                    rustsecp256k1_v0_8_1_scalar_set_int(&r_s, r);
-                    rustsecp256k1_v0_8_1_scalar_set_int(&msg_s, msg);
-                    rustsecp256k1_v0_8_1_scalar_set_int(&sk_s, key);
-                    rustsecp256k1_v0_8_1_scalar_get_b32(msg32, &msg_s);
+                    rustsecp256k1_v0_9_0_scalar_set_int(&s_s, s);
+                    rustsecp256k1_v0_9_0_scalar_set_int(&r_s, r);
+                    rustsecp256k1_v0_9_0_scalar_set_int(&msg_s, msg);
+                    rustsecp256k1_v0_9_0_scalar_set_int(&sk_s, key);
+                    rustsecp256k1_v0_9_0_scalar_get_b32(msg32, &msg_s);
 
                     /* Verify by hand */
                     /* Run through every k value that gives us this r and check that *one* works.
                      * Note there could be none, there could be multiple, ECDSA is weird. */
                     should_verify = 0;
                     for (k = 0; k < EXHAUSTIVE_TEST_ORDER; k++) {
-                        rustsecp256k1_v0_8_1_scalar check_x_s;
+                        rustsecp256k1_v0_9_0_scalar check_x_s;
                         r_from_k(&check_x_s, group, k, NULL);
                         if (r_s == check_x_s) {
-                            rustsecp256k1_v0_8_1_scalar_set_int(&s_times_k_s, k);
-                            rustsecp256k1_v0_8_1_scalar_mul(&s_times_k_s, &s_times_k_s, &s_s);
-                            rustsecp256k1_v0_8_1_scalar_mul(&msg_plus_r_times_sk_s, &r_s, &sk_s);
-                            rustsecp256k1_v0_8_1_scalar_add(&msg_plus_r_times_sk_s, &msg_plus_r_times_sk_s, &msg_s);
-                            should_verify |= rustsecp256k1_v0_8_1_scalar_eq(&s_times_k_s, &msg_plus_r_times_sk_s);
+                            rustsecp256k1_v0_9_0_scalar_set_int(&s_times_k_s, k);
+                            rustsecp256k1_v0_9_0_scalar_mul(&s_times_k_s, &s_times_k_s, &s_s);
+                            rustsecp256k1_v0_9_0_scalar_mul(&msg_plus_r_times_sk_s, &r_s, &sk_s);
+                            rustsecp256k1_v0_9_0_scalar_add(&msg_plus_r_times_sk_s, &msg_plus_r_times_sk_s, &msg_s);
+                            should_verify |= rustsecp256k1_v0_9_0_scalar_eq(&s_times_k_s, &msg_plus_r_times_sk_s);
                         }
                     }
                     /* nb we have a "high s" rule */
-                    should_verify &= !rustsecp256k1_v0_8_1_scalar_is_high(&s_s);
+                    should_verify &= !rustsecp256k1_v0_9_0_scalar_is_high(&s_s);
 
                     /* We would like to try recovering the pubkey and checking that it matches,
                      * but pubkey recovery is impossible in the exhaustive tests (the reason
@@ -129,19 +128,19 @@ void test_exhaustive_recovery_verify(const rustsecp256k1_v0_8_1_context *ctx, co
                      * overlap between the sets, so there are no valid signatures). */
 
                     /* Verify by converting to a standard signature and calling verify */
-                    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_save(&rsig, &r_s, &s_s, recid);
-                    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(ctx, &sig, &rsig);
+                    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_save(&rsig, &r_s, &s_s, recid);
+                    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(ctx, &sig, &rsig);
                     memcpy(&nonconst_ge, &group[sk_s], sizeof(nonconst_ge));
-                    rustsecp256k1_v0_8_1_pubkey_save(&pk, &nonconst_ge);
+                    rustsecp256k1_v0_9_0_pubkey_save(&pk, &nonconst_ge);
                     CHECK(should_verify ==
-                          rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pk));
+                          rustsecp256k1_v0_9_0_ecdsa_verify(ctx, &sig, msg32, &pk));
                 }
             }
         }
     }
 }
 
-static void test_exhaustive_recovery(const rustsecp256k1_v0_8_1_context *ctx, const rustsecp256k1_v0_8_1_ge *group) {
+static void test_exhaustive_recovery(const rustsecp256k1_v0_9_0_context *ctx, const rustsecp256k1_v0_9_0_ge *group) {
     test_exhaustive_recovery_sign(ctx, group);
     test_exhaustive_recovery_verify(ctx, group);
 }
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/recovery/tests_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/recovery/tests_impl.h
index 25c7e38c5..7cbdbee64 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/recovery/tests_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/recovery/tests_impl.h
@@ -25,16 +25,15 @@ static int recovery_test_nonce_function(unsigned char *nonce32, const unsigned c
     }
     /* On the next run, return a valid nonce, but flip a coin as to whether or not to fail signing. */
     memset(nonce32, 1, 32);
-    return rustsecp256k1_v0_8_1_testrand_bits(1);
+    return rustsecp256k1_v0_9_0_testrand_bits(1);
 }
 
-void test_ecdsa_recovery_api(void) {
+static void test_ecdsa_recovery_api(void) {
     /* Setup contexts that just count errors */
-    rustsecp256k1_v0_8_1_context *sttc = rustsecp256k1_v0_8_1_context_clone(rustsecp256k1_v0_8_1_context_static);
-    rustsecp256k1_v0_8_1_pubkey pubkey;
-    rustsecp256k1_v0_8_1_pubkey recpubkey;
-    rustsecp256k1_v0_8_1_ecdsa_signature normal_sig;
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature recsig;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
+    rustsecp256k1_v0_9_0_pubkey recpubkey;
+    rustsecp256k1_v0_9_0_ecdsa_signature normal_sig;
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature recsig;
     unsigned char privkey[32] = { 1 };
     unsigned char message[32] = { 2 };
     int32_t ecount = 0;
@@ -46,147 +45,148 @@ void test_ecdsa_recovery_api(void) {
                                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
                                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
-    rustsecp256k1_v0_8_1_context_set_error_callback(ctx, counting_illegal_callback_fn, &ecount);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
-    rustsecp256k1_v0_8_1_context_set_error_callback(sttc, counting_illegal_callback_fn, &ecount);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(sttc, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
 
     /* Construct and verify corresponding public key. */
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, privkey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, privkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, privkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, privkey) == 1);
 
     /* Check bad contexts and NULLs for signing */
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &recsig, message, privkey, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &recsig, message, privkey, NULL, NULL) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, NULL, message, privkey, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, NULL, message, privkey, NULL, NULL) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &recsig, NULL, privkey, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &recsig, NULL, privkey, NULL, NULL) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &recsig, message, NULL, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &recsig, message, NULL, NULL, NULL) == 0);
     CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(sttc, &recsig, message, privkey, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(STATIC_CTX, &recsig, message, privkey, NULL, NULL) == 0);
     CHECK(ecount == 4);
     /* This will fail or succeed randomly, and in either case will not ARG_CHECK failure */
-    rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &recsig, message, privkey, recovery_test_nonce_function, NULL);
+    rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &recsig, message, privkey, recovery_test_nonce_function, NULL);
     CHECK(ecount == 4);
     /* These will all fail, but not in ARG_CHECK way */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &recsig, message, zero_privkey, NULL, NULL) == 0);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &recsig, message, over_privkey, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &recsig, message, zero_privkey, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &recsig, message, over_privkey, NULL, NULL) == 0);
     /* This one will succeed. */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &recsig, message, privkey, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &recsig, message, privkey, NULL, NULL) == 1);
     CHECK(ecount == 4);
 
     /* Check signing with a goofy nonce function */
 
     /* Check bad contexts and NULLs for recovery */
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &recpubkey, &recsig, message) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &recpubkey, &recsig, message) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, NULL, &recsig, message) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, NULL, &recsig, message) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &recpubkey, NULL, message) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &recpubkey, NULL, message) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &recpubkey, &recsig, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &recpubkey, &recsig, NULL) == 0);
     CHECK(ecount == 3);
 
     /* Check NULLs for conversion */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &normal_sig, message, privkey, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &normal_sig, message, privkey, NULL, NULL) == 1);
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(ctx, NULL, &recsig) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(CTX, NULL, &recsig) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(ctx, &normal_sig, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(CTX, &normal_sig, NULL) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(ctx, &normal_sig, &recsig) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(CTX, &normal_sig, &recsig) == 1);
 
     /* Check NULLs for de/serialization */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &recsig, message, privkey, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &recsig, message, privkey, NULL, NULL) == 1);
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact(ctx, NULL, &recid, &recsig) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact(CTX, NULL, &recid, &recsig) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, NULL, &recsig) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact(CTX, sig, NULL, &recsig) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact(CTX, sig, &recid, NULL) == 0);
     CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, &recsig) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact(CTX, sig, &recid, &recsig) == 1);
 
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, NULL, sig, recid) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, NULL, sig, recid) == 0);
     CHECK(ecount == 4);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &recsig, NULL, recid) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, NULL, recid) == 0);
     CHECK(ecount == 5);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &recsig, sig, -1) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, sig, -1) == 0);
     CHECK(ecount == 6);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &recsig, sig, 5) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, sig, 5) == 0);
     CHECK(ecount == 7);
     /* overflow in signature will fail but not affect ecount */
     memcpy(sig, over_privkey, 32);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &recsig, sig, recid) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, sig, recid) == 0);
     CHECK(ecount == 7);
 
     /* cleanup */
-    rustsecp256k1_v0_8_1_context_destroy(sttc);
+    rustsecp256k1_v0_9_0_context_set_error_callback(STATIC_CTX, NULL, NULL);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 
-void test_ecdsa_recovery_end_to_end(void) {
+static void test_ecdsa_recovery_end_to_end(void) {
     unsigned char extra[32] = {0x00};
     unsigned char privkey[32];
     unsigned char message[32];
-    rustsecp256k1_v0_8_1_ecdsa_signature signature[5];
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature rsignature[5];
+    rustsecp256k1_v0_9_0_ecdsa_signature signature[5];
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature rsignature[5];
     unsigned char sig[74];
-    rustsecp256k1_v0_8_1_pubkey pubkey;
-    rustsecp256k1_v0_8_1_pubkey recpubkey;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
+    rustsecp256k1_v0_9_0_pubkey recpubkey;
     int recid = 0;
 
     /* Generate a random key and message. */
     {
-        rustsecp256k1_v0_8_1_scalar msg, key;
+        rustsecp256k1_v0_9_0_scalar msg, key;
         random_scalar_order_test(&msg);
         random_scalar_order_test(&key);
-        rustsecp256k1_v0_8_1_scalar_get_b32(privkey, &key);
-        rustsecp256k1_v0_8_1_scalar_get_b32(message, &msg);
+        rustsecp256k1_v0_9_0_scalar_get_b32(privkey, &key);
+        rustsecp256k1_v0_9_0_scalar_get_b32(message, &msg);
     }
 
     /* Construct and verify corresponding public key. */
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, privkey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, privkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, privkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, privkey) == 1);
 
     /* Serialize/parse compact and verify/recover. */
     extra[0] = 0;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &rsignature[0], message, privkey, NULL, NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &signature[0], message, privkey, NULL, NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &rsignature[4], message, privkey, NULL, NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &rsignature[1], message, privkey, NULL, extra) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &rsignature[0], message, privkey, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &signature[0], message, privkey, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &rsignature[4], message, privkey, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &rsignature[1], message, privkey, NULL, extra) == 1);
     extra[31] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &rsignature[2], message, privkey, NULL, extra) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &rsignature[2], message, privkey, NULL, extra) == 1);
     extra[31] = 0;
     extra[0] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &rsignature[3], message, privkey, NULL, extra) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, &rsignature[4]) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(ctx, &signature[4], &rsignature[4]) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&signature[4], &signature[0], 64) == 0);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[4], message, &pubkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign_recoverable(CTX, &rsignature[3], message, privkey, NULL, extra) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact(CTX, sig, &recid, &rsignature[4]) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(CTX, &signature[4], &rsignature[4]) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&signature[4], &signature[0], 64) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[4], message, &pubkey) == 1);
     memset(&rsignature[4], 0, sizeof(rsignature[4]));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsignature[4], sig, recid) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(ctx, &signature[4], &rsignature[4]) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[4], message, &pubkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsignature[4], sig, recid) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(CTX, &signature[4], &rsignature[4]) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[4], message, &pubkey) == 1);
     /* Parse compact (with recovery id) and recover. */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsignature[4], sig, recid) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &recpubkey, &rsignature[4], message) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, &recpubkey, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsignature[4], sig, recid) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &recpubkey, &rsignature[4], message) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, &recpubkey, sizeof(pubkey)) == 0);
     /* Serialize/destroy/parse signature and verify again. */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, &rsignature[4]) == 1);
-    sig[rustsecp256k1_v0_8_1_testrand_bits(6)] += 1 + rustsecp256k1_v0_8_1_testrand_int(255);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsignature[4], sig, recid) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert(ctx, &signature[4], &rsignature[4]) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[4], message, &pubkey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact(CTX, sig, &recid, &rsignature[4]) == 1);
+    sig[rustsecp256k1_v0_9_0_testrand_bits(6)] += 1 + rustsecp256k1_v0_9_0_testrand_int(255);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsignature[4], sig, recid) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert(CTX, &signature[4], &rsignature[4]) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[4], message, &pubkey) == 0);
     /* Recover again */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &recpubkey, &rsignature[4], message) == 0 ||
-          rustsecp256k1_v0_8_1_memcmp_var(&pubkey, &recpubkey, sizeof(pubkey)) != 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &recpubkey, &rsignature[4], message) == 0 ||
+          rustsecp256k1_v0_9_0_memcmp_var(&pubkey, &recpubkey, sizeof(pubkey)) != 0);
 }
 
 /* Tests several edge cases. */
-void test_ecdsa_recovery_edge_cases(void) {
+static void test_ecdsa_recovery_edge_cases(void) {
     const unsigned char msg32[32] = {
         'T', 'h', 'i', 's', ' ', 'i', 's', ' ',
         'a', ' ', 'v', 'e', 'r', 'y', ' ', 's',
@@ -205,7 +205,7 @@ void test_ecdsa_recovery_edge_cases(void) {
         0x7D, 0xD7, 0x3E, 0x38, 0x7E, 0xE4, 0xFC, 0x86,
         0x6E, 0x1B, 0xE8, 0xEC, 0xC7, 0xDD, 0x95, 0x57
     };
-    rustsecp256k1_v0_8_1_pubkey pubkey;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
     /* signature (r,s) = (4,4), which can be recovered with all 4 recids. */
     const unsigned char sigb64[64] = {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -217,19 +217,19 @@ void test_ecdsa_recovery_edge_cases(void) {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04,
     };
-    rustsecp256k1_v0_8_1_pubkey pubkeyb;
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature rsig;
-    rustsecp256k1_v0_8_1_ecdsa_signature sig;
+    rustsecp256k1_v0_9_0_pubkey pubkeyb;
+    rustsecp256k1_v0_9_0_ecdsa_recoverable_signature rsig;
+    rustsecp256k1_v0_9_0_ecdsa_signature sig;
     int recid;
 
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 0));
-    CHECK(!rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &pubkey, &rsig, msg32));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 1));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &pubkey, &rsig, msg32));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 2));
-    CHECK(!rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &pubkey, &rsig, msg32));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sig64, 3));
-    CHECK(!rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &pubkey, &rsig, msg32));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsig, sig64, 0));
+    CHECK(!rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &pubkey, &rsig, msg32));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsig, sig64, 1));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &pubkey, &rsig, msg32));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsig, sig64, 2));
+    CHECK(!rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &pubkey, &rsig, msg32));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsig, sig64, 3));
+    CHECK(!rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &pubkey, &rsig, msg32));
 
     for (recid = 0; recid < 4; recid++) {
         int i;
@@ -274,40 +274,40 @@ void test_ecdsa_recovery_edge_cases(void) {
             0xE6, 0xAF, 0x48, 0xA0, 0x3B, 0xBF, 0xD2, 0x5E,
             0x8C, 0xD0, 0x36, 0x41, 0x45, 0x02, 0x01, 0x04
         };
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigb64, recid) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &pubkeyb, &rsig, msg32) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder)) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsig, sigb64, recid) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &pubkeyb, &rsig, msg32) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbder, sizeof(sigbder)) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg32, &pubkeyb) == 1);
         for (recid2 = 0; recid2 < 4; recid2++) {
-            rustsecp256k1_v0_8_1_pubkey pubkey2b;
-            CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigb64, recid2) == 1);
-            CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &pubkey2b, &rsig, msg32) == 1);
+            rustsecp256k1_v0_9_0_pubkey pubkey2b;
+            CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsig, sigb64, recid2) == 1);
+            CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &pubkey2b, &rsig, msg32) == 1);
             /* Verifying with (order + r,4) should always fail. */
-            CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbderlong, sizeof(sigbderlong)) == 1);
-            CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
+            CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbderlong, sizeof(sigbderlong)) == 1);
+            CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg32, &pubkeyb) == 0);
         }
         /* DER parsing tests. */
         /* Zero length r/s. */
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigcder_zr, sizeof(sigcder_zr)) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigcder_zs, sizeof(sigcder_zs)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigcder_zr, sizeof(sigcder_zr)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigcder_zs, sizeof(sigcder_zs)) == 0);
         /* Leading zeros. */
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt1, sizeof(sigbderalt1)) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt2, sizeof(sigbderalt2)) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt3, sizeof(sigbderalt3)) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt4, sizeof(sigbderalt4)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbderalt1, sizeof(sigbderalt1)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbderalt2, sizeof(sigbderalt2)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbderalt3, sizeof(sigbderalt3)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbderalt4, sizeof(sigbderalt4)) == 0);
         sigbderalt3[4] = 1;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt3, sizeof(sigbderalt3)) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbderalt3, sizeof(sigbderalt3)) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg32, &pubkeyb) == 0);
         sigbderalt4[7] = 1;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt4, sizeof(sigbderalt4)) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbderalt4, sizeof(sigbderalt4)) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg32, &pubkeyb) == 0);
         /* Damage signature. */
         sigbder[7]++;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder)) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbder, sizeof(sigbder)) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg32, &pubkeyb) == 0);
         sigbder[7]--;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbder, 6) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder) - 1) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbder, 6) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbder, sizeof(sigbder) - 1) == 0);
         for(i = 0; i < 8; i++) {
             int c;
             unsigned char orig = sigbder[i];
@@ -317,7 +317,7 @@ void test_ecdsa_recovery_edge_cases(void) {
                     continue;
                 }
                 sigbder[i] = c;
-                CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder)) == 0 || rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);
+                CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigbder, sizeof(sigbder)) == 0 || rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg32, &pubkeyb) == 0);
             }
             sigbder[i] = orig;
         }
@@ -337,34 +337,34 @@ void test_ecdsa_recovery_edge_cases(void) {
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
         };
-        rustsecp256k1_v0_8_1_pubkey pubkeyc;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigc64, 0) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &pubkeyc, &rsig, msg32) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigcder, sizeof(sigcder)) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pubkeyc) == 1);
+        rustsecp256k1_v0_9_0_pubkey pubkeyc;
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsig, sigc64, 0) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &pubkeyc, &rsig, msg32) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigcder, sizeof(sigcder)) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg32, &pubkeyc) == 1);
         sigcder[4] = 0;
         sigc64[31] = 0;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigc64, 0) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &pubkeyb, &rsig, msg32) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigcder, sizeof(sigcder)) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pubkeyc) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsig, sigc64, 0) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &pubkeyb, &rsig, msg32) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigcder, sizeof(sigcder)) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg32, &pubkeyc) == 0);
         sigcder[4] = 1;
         sigcder[7] = 0;
         sigc64[31] = 1;
         sigc64[63] = 0;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigc64, 0) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_recover(ctx, &pubkeyb, &rsig, msg32) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, sigcder, sizeof(sigcder)) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pubkeyc) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact(CTX, &rsig, sigc64, 0) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_recover(CTX, &pubkeyb, &rsig, msg32) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, sigcder, sizeof(sigcder)) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg32, &pubkeyc) == 0);
     }
 }
 
-void run_recovery_tests(void) {
+static void run_recovery_tests(void) {
     int i;
-    for (i = 0; i < count; i++) {
+    for (i = 0; i < COUNT; i++) {
         test_ecdsa_recovery_api();
     }
-    for (i = 0; i < 64*count; i++) {
+    for (i = 0; i < 64*COUNT; i++) {
         test_ecdsa_recovery_end_to_end();
     }
     test_ecdsa_recovery_edge_cases();
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/Makefile.am.include b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/Makefile.am.include
index a65cd1e1d..bffffa3d9 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/Makefile.am.include
+++ b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/Makefile.am.include
@@ -1,4 +1,4 @@
-include_HEADERS += include/rustsecp256k1_v0_8_1_schnorrsig.h
+include_HEADERS += include/rustsecp256k1_v0_9_0_schnorrsig.h
 noinst_HEADERS += src/modules/schnorrsig/main_impl.h
 noinst_HEADERS += src/modules/schnorrsig/tests_impl.h
 noinst_HEADERS += src/modules/schnorrsig/tests_exhaustive_impl.h
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/bench_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/bench_impl.h
index 99d901aac..ae03a80d7 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/bench_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/bench_impl.h
@@ -12,16 +12,16 @@
 #define MSGLEN 32
 
 typedef struct {
-    rustsecp256k1_v0_8_1_context *ctx;
+    rustsecp256k1_v0_9_0_context *ctx;
     int n;
 
-    const rustsecp256k1_v0_8_1_keypair **keypairs;
+    const rustsecp256k1_v0_9_0_keypair **keypairs;
     const unsigned char **pk;
     const unsigned char **sigs;
     const unsigned char **msgs;
 } bench_schnorrsig_data;
 
-void bench_schnorrsig_sign(void* arg, int iters) {
+static void bench_schnorrsig_sign(void* arg, int iters) {
     bench_schnorrsig_data *data = (bench_schnorrsig_data *)arg;
     int i;
     unsigned char msg[MSGLEN] = {0};
@@ -30,28 +30,28 @@ void bench_schnorrsig_sign(void* arg, int iters) {
     for (i = 0; i < iters; i++) {
         msg[0] = i;
         msg[1] = i >> 8;
-        CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(data->ctx, sig, msg, MSGLEN, data->keypairs[i], NULL));
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(data->ctx, sig, msg, MSGLEN, data->keypairs[i], NULL));
     }
 }
 
-void bench_schnorrsig_verify(void* arg, int iters) {
+static void bench_schnorrsig_verify(void* arg, int iters) {
     bench_schnorrsig_data *data = (bench_schnorrsig_data *)arg;
     int i;
 
     for (i = 0; i < iters; i++) {
-        rustsecp256k1_v0_8_1_xonly_pubkey pk;
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(data->ctx, &pk, data->pk[i]) == 1);
-        CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(data->ctx, data->sigs[i], data->msgs[i], MSGLEN, &pk));
+        rustsecp256k1_v0_9_0_xonly_pubkey pk;
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(data->ctx, &pk, data->pk[i]) == 1);
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(data->ctx, data->sigs[i], data->msgs[i], MSGLEN, &pk));
     }
 }
 
-void run_schnorrsig_bench(int iters, int argc, char** argv) {
+static void run_schnorrsig_bench(int iters, int argc, char** argv) {
     int i;
     bench_schnorrsig_data data;
     int d = argc == 1;
 
-    data.ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
-    data.keypairs = (const rustsecp256k1_v0_8_1_keypair **)malloc(iters * sizeof(rustsecp256k1_v0_8_1_keypair *));
+    data.ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
+    data.keypairs = (const rustsecp256k1_v0_9_0_keypair **)malloc(iters * sizeof(rustsecp256k1_v0_9_0_keypair *));
     data.pk = (const unsigned char **)malloc(iters * sizeof(unsigned char *));
     data.msgs = (const unsigned char **)malloc(iters * sizeof(unsigned char *));
     data.sigs = (const unsigned char **)malloc(iters * sizeof(unsigned char *));
@@ -61,9 +61,9 @@ void run_schnorrsig_bench(int iters, int argc, char** argv) {
         unsigned char sk[32];
         unsigned char *msg = (unsigned char *)malloc(MSGLEN);
         unsigned char *sig = (unsigned char *)malloc(64);
-        rustsecp256k1_v0_8_1_keypair *keypair = (rustsecp256k1_v0_8_1_keypair *)malloc(sizeof(*keypair));
+        rustsecp256k1_v0_9_0_keypair *keypair = (rustsecp256k1_v0_9_0_keypair *)malloc(sizeof(*keypair));
         unsigned char *pk_char = (unsigned char *)malloc(32);
-        rustsecp256k1_v0_8_1_xonly_pubkey pk;
+        rustsecp256k1_v0_9_0_xonly_pubkey pk;
         msg[0] = sk[0] = i;
         msg[1] = sk[1] = i >> 8;
         msg[2] = sk[2] = i >> 16;
@@ -76,10 +76,10 @@ void run_schnorrsig_bench(int iters, int argc, char** argv) {
         data.msgs[i] = msg;
         data.sigs[i] = sig;
 
-        CHECK(rustsecp256k1_v0_8_1_keypair_create(data.ctx, keypair, sk));
-        CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(data.ctx, sig, msg, MSGLEN, keypair, NULL));
-        CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(data.ctx, &pk, NULL, keypair));
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(data.ctx, pk_char, &pk) == 1);
+        CHECK(rustsecp256k1_v0_9_0_keypair_create(data.ctx, keypair, sk));
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(data.ctx, sig, msg, MSGLEN, keypair, NULL));
+        CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(data.ctx, &pk, NULL, keypair));
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(data.ctx, pk_char, &pk) == 1);
     }
 
     if (d || have_flag(argc, argv, "schnorrsig") || have_flag(argc, argv, "sign") || have_flag(argc, argv, "schnorrsig_sign")) run_benchmark("schnorrsig_sign", bench_schnorrsig_sign, NULL, NULL, (void *) &data, 10, iters);
@@ -98,7 +98,7 @@ void run_schnorrsig_bench(int iters, int argc, char** argv) {
     free((void *)data.msgs);
     free((void *)data.sigs);
 
-    rustsecp256k1_v0_8_1_context_destroy(data.ctx);
+    rustsecp256k1_v0_9_0_context_destroy(data.ctx);
 }
 
 #endif
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/main_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/main_impl.h
index b1629f414..7aa554cc3 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/main_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/main_impl.h
@@ -13,8 +13,8 @@
 
 /* Initializes SHA256 with fixed midstate. This midstate was computed by applying
  * SHA256 to SHA256("BIP0340/nonce")||SHA256("BIP0340/nonce"). */
-static void rustsecp256k1_v0_8_1_nonce_function_bip340_sha256_tagged(rustsecp256k1_v0_8_1_sha256 *sha) {
-    rustsecp256k1_v0_8_1_sha256_initialize(sha);
+static void rustsecp256k1_v0_9_0_nonce_function_bip340_sha256_tagged(rustsecp256k1_v0_9_0_sha256 *sha) {
+    rustsecp256k1_v0_9_0_sha256_initialize(sha);
     sha->s[0] = 0x46615b35ul;
     sha->s[1] = 0xf4bfbff7ul;
     sha->s[2] = 0x9f8dc671ul;
@@ -29,8 +29,8 @@ static void rustsecp256k1_v0_8_1_nonce_function_bip340_sha256_tagged(rustsecp256
 
 /* Initializes SHA256 with fixed midstate. This midstate was computed by applying
  * SHA256 to SHA256("BIP0340/aux")||SHA256("BIP0340/aux"). */
-static void rustsecp256k1_v0_8_1_nonce_function_bip340_sha256_tagged_aux(rustsecp256k1_v0_8_1_sha256 *sha) {
-    rustsecp256k1_v0_8_1_sha256_initialize(sha);
+static void rustsecp256k1_v0_9_0_nonce_function_bip340_sha256_tagged_aux(rustsecp256k1_v0_9_0_sha256 *sha) {
+    rustsecp256k1_v0_9_0_sha256_initialize(sha);
     sha->s[0] = 0x24dd3219ul;
     sha->s[1] = 0x4eba7e70ul;
     sha->s[2] = 0xca0fabb9ul;
@@ -50,7 +50,7 @@ static const unsigned char bip340_algo[13] = "BIP0340/nonce";
 static const unsigned char schnorrsig_extraparams_magic[4] = SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC;
 
 static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) {
-    rustsecp256k1_v0_8_1_sha256 sha;
+    rustsecp256k1_v0_9_0_sha256 sha;
     unsigned char masked_key[32];
     int i;
 
@@ -59,9 +59,9 @@ static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *ms
     }
 
     if (data != NULL) {
-        rustsecp256k1_v0_8_1_nonce_function_bip340_sha256_tagged_aux(&sha);
-        rustsecp256k1_v0_8_1_sha256_write(&sha, data, 32);
-        rustsecp256k1_v0_8_1_sha256_finalize(&sha, masked_key);
+        rustsecp256k1_v0_9_0_nonce_function_bip340_sha256_tagged_aux(&sha);
+        rustsecp256k1_v0_9_0_sha256_write(&sha, data, 32);
+        rustsecp256k1_v0_9_0_sha256_finalize(&sha, masked_key);
         for (i = 0; i < 32; i++) {
             masked_key[i] ^= key32[i];
         }
@@ -82,26 +82,26 @@ static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *ms
      * algorithms. If this nonce function is used in BIP-340 signing as defined
      * in the spec, an optimized tagging implementation is used. */
     if (algolen == sizeof(bip340_algo)
-            && rustsecp256k1_v0_8_1_memcmp_var(algo, bip340_algo, algolen) == 0) {
-        rustsecp256k1_v0_8_1_nonce_function_bip340_sha256_tagged(&sha);
+            && rustsecp256k1_v0_9_0_memcmp_var(algo, bip340_algo, algolen) == 0) {
+        rustsecp256k1_v0_9_0_nonce_function_bip340_sha256_tagged(&sha);
     } else {
-        rustsecp256k1_v0_8_1_sha256_initialize_tagged(&sha, algo, algolen);
+        rustsecp256k1_v0_9_0_sha256_initialize_tagged(&sha, algo, algolen);
     }
 
     /* Hash masked-key||pk||msg using the tagged hash as per the spec */
-    rustsecp256k1_v0_8_1_sha256_write(&sha, masked_key, 32);
-    rustsecp256k1_v0_8_1_sha256_write(&sha, xonly_pk32, 32);
-    rustsecp256k1_v0_8_1_sha256_write(&sha, msg, msglen);
-    rustsecp256k1_v0_8_1_sha256_finalize(&sha, nonce32);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, masked_key, 32);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, xonly_pk32, 32);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, msg, msglen);
+    rustsecp256k1_v0_9_0_sha256_finalize(&sha, nonce32);
     return 1;
 }
 
-const rustsecp256k1_v0_8_1_nonce_function_hardened rustsecp256k1_v0_8_1_nonce_function_bip340 = nonce_function_bip340;
+const rustsecp256k1_v0_9_0_nonce_function_hardened rustsecp256k1_v0_9_0_nonce_function_bip340 = nonce_function_bip340;
 
 /* Initializes SHA256 with fixed midstate. This midstate was computed by applying
  * SHA256 to SHA256("BIP0340/challenge")||SHA256("BIP0340/challenge"). */
-static void rustsecp256k1_v0_8_1_schnorrsig_sha256_tagged(rustsecp256k1_v0_8_1_sha256 *sha) {
-    rustsecp256k1_v0_8_1_sha256_initialize(sha);
+static void rustsecp256k1_v0_9_0_schnorrsig_sha256_tagged(rustsecp256k1_v0_9_0_sha256 *sha) {
+    rustsecp256k1_v0_9_0_sha256_initialize(sha);
     sha->s[0] = 0x9cecba11ul;
     sha->s[1] = 0x23925381ul;
     sha->s[2] = 0x11679112ul;
@@ -113,117 +113,117 @@ static void rustsecp256k1_v0_8_1_schnorrsig_sha256_tagged(rustsecp256k1_v0_8_1_s
     sha->bytes = 64;
 }
 
-static void rustsecp256k1_v0_8_1_schnorrsig_challenge(rustsecp256k1_v0_8_1_scalar* e, const unsigned char *r32, const unsigned char *msg, size_t msglen, const unsigned char *pubkey32)
+static void rustsecp256k1_v0_9_0_schnorrsig_challenge(rustsecp256k1_v0_9_0_scalar* e, const unsigned char *r32, const unsigned char *msg, size_t msglen, const unsigned char *pubkey32)
 {
     unsigned char buf[32];
-    rustsecp256k1_v0_8_1_sha256 sha;
+    rustsecp256k1_v0_9_0_sha256 sha;
 
     /* tagged hash(r.x, pk.x, msg) */
-    rustsecp256k1_v0_8_1_schnorrsig_sha256_tagged(&sha);
-    rustsecp256k1_v0_8_1_sha256_write(&sha, r32, 32);
-    rustsecp256k1_v0_8_1_sha256_write(&sha, pubkey32, 32);
-    rustsecp256k1_v0_8_1_sha256_write(&sha, msg, msglen);
-    rustsecp256k1_v0_8_1_sha256_finalize(&sha, buf);
+    rustsecp256k1_v0_9_0_schnorrsig_sha256_tagged(&sha);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, r32, 32);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, pubkey32, 32);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, msg, msglen);
+    rustsecp256k1_v0_9_0_sha256_finalize(&sha, buf);
     /* Set scalar e to the challenge hash modulo the curve order as per
      * BIP340. */
-    rustsecp256k1_v0_8_1_scalar_set_b32(e, buf, NULL);
+    rustsecp256k1_v0_9_0_scalar_set_b32(e, buf, NULL);
 }
 
-static int rustsecp256k1_v0_8_1_schnorrsig_sign_internal(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const rustsecp256k1_v0_8_1_keypair *keypair, rustsecp256k1_v0_8_1_nonce_function_hardened noncefp, void *ndata) {
-    rustsecp256k1_v0_8_1_scalar sk;
-    rustsecp256k1_v0_8_1_scalar e;
-    rustsecp256k1_v0_8_1_scalar k;
-    rustsecp256k1_v0_8_1_gej rj;
-    rustsecp256k1_v0_8_1_ge pk;
-    rustsecp256k1_v0_8_1_ge r;
+static int rustsecp256k1_v0_9_0_schnorrsig_sign_internal(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const rustsecp256k1_v0_9_0_keypair *keypair, rustsecp256k1_v0_9_0_nonce_function_hardened noncefp, void *ndata) {
+    rustsecp256k1_v0_9_0_scalar sk;
+    rustsecp256k1_v0_9_0_scalar e;
+    rustsecp256k1_v0_9_0_scalar k;
+    rustsecp256k1_v0_9_0_gej rj;
+    rustsecp256k1_v0_9_0_ge pk;
+    rustsecp256k1_v0_9_0_ge r;
     unsigned char buf[32] = { 0 };
     unsigned char pk_buf[32];
     unsigned char seckey[32];
     int ret = 1;
 
     VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(rustsecp256k1_v0_8_1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(rustsecp256k1_v0_9_0_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
     ARG_CHECK(sig64 != NULL);
     ARG_CHECK(msg != NULL || msglen == 0);
     ARG_CHECK(keypair != NULL);
 
     if (noncefp == NULL) {
-        noncefp = rustsecp256k1_v0_8_1_nonce_function_bip340;
+        noncefp = rustsecp256k1_v0_9_0_nonce_function_bip340;
     }
 
-    ret &= rustsecp256k1_v0_8_1_keypair_load(ctx, &sk, &pk, keypair);
+    ret &= rustsecp256k1_v0_9_0_keypair_load(ctx, &sk, &pk, keypair);
     /* Because we are signing for a x-only pubkey, the secret key is negated
      * before signing if the point corresponding to the secret key does not
      * have an even Y. */
-    if (rustsecp256k1_v0_8_1_fe_is_odd(&pk.y)) {
-        rustsecp256k1_v0_8_1_scalar_negate(&sk, &sk);
+    if (rustsecp256k1_v0_9_0_fe_is_odd(&pk.y)) {
+        rustsecp256k1_v0_9_0_scalar_negate(&sk, &sk);
     }
 
-    rustsecp256k1_v0_8_1_scalar_get_b32(seckey, &sk);
-    rustsecp256k1_v0_8_1_fe_get_b32(pk_buf, &pk.x);
+    rustsecp256k1_v0_9_0_scalar_get_b32(seckey, &sk);
+    rustsecp256k1_v0_9_0_fe_get_b32(pk_buf, &pk.x);
     ret &= !!noncefp(buf, msg, msglen, seckey, pk_buf, bip340_algo, sizeof(bip340_algo), ndata);
-    rustsecp256k1_v0_8_1_scalar_set_b32(&k, buf, NULL);
-    ret &= !rustsecp256k1_v0_8_1_scalar_is_zero(&k);
-    rustsecp256k1_v0_8_1_scalar_cmov(&k, &rustsecp256k1_v0_8_1_scalar_one, !ret);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&k, buf, NULL);
+    ret &= !rustsecp256k1_v0_9_0_scalar_is_zero(&k);
+    rustsecp256k1_v0_9_0_scalar_cmov(&k, &rustsecp256k1_v0_9_0_scalar_one, !ret);
 
-    rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &k);
-    rustsecp256k1_v0_8_1_ge_set_gej(&r, &rj);
+    rustsecp256k1_v0_9_0_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &k);
+    rustsecp256k1_v0_9_0_ge_set_gej(&r, &rj);
 
     /* We declassify r to allow using it as a branch point. This is fine
      * because r is not a secret. */
-    rustsecp256k1_v0_8_1_declassify(ctx, &r, sizeof(r));
-    rustsecp256k1_v0_8_1_fe_normalize_var(&r.y);
-    if (rustsecp256k1_v0_8_1_fe_is_odd(&r.y)) {
-        rustsecp256k1_v0_8_1_scalar_negate(&k, &k);
+    rustsecp256k1_v0_9_0_declassify(ctx, &r, sizeof(r));
+    rustsecp256k1_v0_9_0_fe_normalize_var(&r.y);
+    if (rustsecp256k1_v0_9_0_fe_is_odd(&r.y)) {
+        rustsecp256k1_v0_9_0_scalar_negate(&k, &k);
     }
-    rustsecp256k1_v0_8_1_fe_normalize_var(&r.x);
-    rustsecp256k1_v0_8_1_fe_get_b32(&sig64[0], &r.x);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&r.x);
+    rustsecp256k1_v0_9_0_fe_get_b32(&sig64[0], &r.x);
 
-    rustsecp256k1_v0_8_1_schnorrsig_challenge(&e, &sig64[0], msg, msglen, pk_buf);
-    rustsecp256k1_v0_8_1_scalar_mul(&e, &e, &sk);
-    rustsecp256k1_v0_8_1_scalar_add(&e, &e, &k);
-    rustsecp256k1_v0_8_1_scalar_get_b32(&sig64[32], &e);
+    rustsecp256k1_v0_9_0_schnorrsig_challenge(&e, &sig64[0], msg, msglen, pk_buf);
+    rustsecp256k1_v0_9_0_scalar_mul(&e, &e, &sk);
+    rustsecp256k1_v0_9_0_scalar_add(&e, &e, &k);
+    rustsecp256k1_v0_9_0_scalar_get_b32(&sig64[32], &e);
 
-    rustsecp256k1_v0_8_1_memczero(sig64, 64, !ret);
-    rustsecp256k1_v0_8_1_scalar_clear(&k);
-    rustsecp256k1_v0_8_1_scalar_clear(&sk);
+    rustsecp256k1_v0_9_0_memczero(sig64, 64, !ret);
+    rustsecp256k1_v0_9_0_scalar_clear(&k);
+    rustsecp256k1_v0_9_0_scalar_clear(&sk);
     memset(seckey, 0, sizeof(seckey));
 
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_schnorrsig_sign32(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const rustsecp256k1_v0_8_1_keypair *keypair, const unsigned char *aux_rand32) {
+int rustsecp256k1_v0_9_0_schnorrsig_sign32(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *sig64, const unsigned char *msg32, const rustsecp256k1_v0_9_0_keypair *keypair, const unsigned char *aux_rand32) {
     /* We cast away const from the passed aux_rand32 argument since we know the default nonce function does not modify it. */
-    return rustsecp256k1_v0_8_1_schnorrsig_sign_internal(ctx, sig64, msg32, 32, keypair, rustsecp256k1_v0_8_1_nonce_function_bip340, (unsigned char*)aux_rand32);
+    return rustsecp256k1_v0_9_0_schnorrsig_sign_internal(ctx, sig64, msg32, 32, keypair, rustsecp256k1_v0_9_0_nonce_function_bip340, (unsigned char*)aux_rand32);
 }
 
-int rustsecp256k1_v0_8_1_schnorrsig_sign(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const rustsecp256k1_v0_8_1_keypair *keypair, const unsigned char *aux_rand32) {
-    return rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig64, msg32, keypair, aux_rand32);
+int rustsecp256k1_v0_9_0_schnorrsig_sign(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *sig64, const unsigned char *msg32, const rustsecp256k1_v0_9_0_keypair *keypair, const unsigned char *aux_rand32) {
+    return rustsecp256k1_v0_9_0_schnorrsig_sign32(ctx, sig64, msg32, keypair, aux_rand32);
 }
 
-int rustsecp256k1_v0_8_1_schnorrsig_sign_custom(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const rustsecp256k1_v0_8_1_keypair *keypair, rustsecp256k1_v0_8_1_schnorrsig_extraparams *extraparams) {
-    rustsecp256k1_v0_8_1_nonce_function_hardened noncefp = NULL;
+int rustsecp256k1_v0_9_0_schnorrsig_sign_custom(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const rustsecp256k1_v0_9_0_keypair *keypair, rustsecp256k1_v0_9_0_schnorrsig_extraparams *extraparams) {
+    rustsecp256k1_v0_9_0_nonce_function_hardened noncefp = NULL;
     void *ndata = NULL;
     VERIFY_CHECK(ctx != NULL);
 
     if (extraparams != NULL) {
-        ARG_CHECK(rustsecp256k1_v0_8_1_memcmp_var(extraparams->magic,
+        ARG_CHECK(rustsecp256k1_v0_9_0_memcmp_var(extraparams->magic,
                                        schnorrsig_extraparams_magic,
                                        sizeof(extraparams->magic)) == 0);
         noncefp = extraparams->noncefp;
         ndata = extraparams->ndata;
     }
-    return rustsecp256k1_v0_8_1_schnorrsig_sign_internal(ctx, sig64, msg, msglen, keypair, noncefp, ndata);
+    return rustsecp256k1_v0_9_0_schnorrsig_sign_internal(ctx, sig64, msg, msglen, keypair, noncefp, ndata);
 }
 
-int rustsecp256k1_v0_8_1_schnorrsig_verify(const rustsecp256k1_v0_8_1_context* ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const rustsecp256k1_v0_8_1_xonly_pubkey *pubkey) {
-    rustsecp256k1_v0_8_1_scalar s;
-    rustsecp256k1_v0_8_1_scalar e;
-    rustsecp256k1_v0_8_1_gej rj;
-    rustsecp256k1_v0_8_1_ge pk;
-    rustsecp256k1_v0_8_1_gej pkj;
-    rustsecp256k1_v0_8_1_fe rx;
-    rustsecp256k1_v0_8_1_ge r;
+int rustsecp256k1_v0_9_0_schnorrsig_verify(const rustsecp256k1_v0_9_0_context* ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const rustsecp256k1_v0_9_0_xonly_pubkey *pubkey) {
+    rustsecp256k1_v0_9_0_scalar s;
+    rustsecp256k1_v0_9_0_scalar e;
+    rustsecp256k1_v0_9_0_gej rj;
+    rustsecp256k1_v0_9_0_ge pk;
+    rustsecp256k1_v0_9_0_gej pkj;
+    rustsecp256k1_v0_9_0_fe rx;
+    rustsecp256k1_v0_9_0_ge r;
     unsigned char buf[32];
     int overflow;
 
@@ -232,36 +232,36 @@ int rustsecp256k1_v0_8_1_schnorrsig_verify(const rustsecp256k1_v0_8_1_context* c
     ARG_CHECK(msg != NULL || msglen == 0);
     ARG_CHECK(pubkey != NULL);
 
-    if (!rustsecp256k1_v0_8_1_fe_set_b32(&rx, &sig64[0])) {
+    if (!rustsecp256k1_v0_9_0_fe_set_b32_limit(&rx, &sig64[0])) {
         return 0;
     }
 
-    rustsecp256k1_v0_8_1_scalar_set_b32(&s, &sig64[32], &overflow);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&s, &sig64[32], &overflow);
     if (overflow) {
         return 0;
     }
 
-    if (!rustsecp256k1_v0_8_1_xonly_pubkey_load(ctx, &pk, pubkey)) {
+    if (!rustsecp256k1_v0_9_0_xonly_pubkey_load(ctx, &pk, pubkey)) {
         return 0;
     }
 
     /* Compute e. */
-    rustsecp256k1_v0_8_1_fe_get_b32(buf, &pk.x);
-    rustsecp256k1_v0_8_1_schnorrsig_challenge(&e, &sig64[0], msg, msglen, buf);
+    rustsecp256k1_v0_9_0_fe_get_b32(buf, &pk.x);
+    rustsecp256k1_v0_9_0_schnorrsig_challenge(&e, &sig64[0], msg, msglen, buf);
 
     /* Compute rj =  s*G + (-e)*pkj */
-    rustsecp256k1_v0_8_1_scalar_negate(&e, &e);
-    rustsecp256k1_v0_8_1_gej_set_ge(&pkj, &pk);
-    rustsecp256k1_v0_8_1_ecmult(&rj, &pkj, &e, &s);
+    rustsecp256k1_v0_9_0_scalar_negate(&e, &e);
+    rustsecp256k1_v0_9_0_gej_set_ge(&pkj, &pk);
+    rustsecp256k1_v0_9_0_ecmult(&rj, &pkj, &e, &s);
 
-    rustsecp256k1_v0_8_1_ge_set_gej_var(&r, &rj);
-    if (rustsecp256k1_v0_8_1_ge_is_infinity(&r)) {
+    rustsecp256k1_v0_9_0_ge_set_gej_var(&r, &rj);
+    if (rustsecp256k1_v0_9_0_ge_is_infinity(&r)) {
         return 0;
     }
 
-    rustsecp256k1_v0_8_1_fe_normalize_var(&r.y);
-    return !rustsecp256k1_v0_8_1_fe_is_odd(&r.y) &&
-           rustsecp256k1_v0_8_1_fe_equal_var(&rx, &r.x);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&r.y);
+    return !rustsecp256k1_v0_9_0_fe_is_odd(&r.y) &&
+           rustsecp256k1_v0_9_0_fe_equal(&rx, &r.x);
 }
 
 #endif
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/tests_exhaustive_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/tests_exhaustive_impl.h
index 61be507f3..9fa9f7e53 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/tests_exhaustive_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/tests_exhaustive_impl.h
@@ -58,12 +58,12 @@ static const unsigned char invalid_pubkey_bytes[][32] = {
 
 #define NUM_INVALID_KEYS (sizeof(invalid_pubkey_bytes) / sizeof(invalid_pubkey_bytes[0]))
 
-static int rustsecp256k1_v0_8_1_hardened_nonce_function_smallint(unsigned char *nonce32, const unsigned char *msg,
+static int rustsecp256k1_v0_9_0_hardened_nonce_function_smallint(unsigned char *nonce32, const unsigned char *msg,
                                                       size_t msglen,
                                                       const unsigned char *key32, const unsigned char *xonly_pk32,
                                                       const unsigned char *algo, size_t algolen,
                                                       void* data) {
-    rustsecp256k1_v0_8_1_scalar s;
+    rustsecp256k1_v0_9_0_scalar s;
     int *idata = data;
     (void)msg;
     (void)msglen;
@@ -71,12 +71,12 @@ static int rustsecp256k1_v0_8_1_hardened_nonce_function_smallint(unsigned char *
     (void)xonly_pk32;
     (void)algo;
     (void)algolen;
-    rustsecp256k1_v0_8_1_scalar_set_int(&s, *idata);
-    rustsecp256k1_v0_8_1_scalar_get_b32(nonce32, &s);
+    rustsecp256k1_v0_9_0_scalar_set_int(&s, *idata);
+    rustsecp256k1_v0_9_0_scalar_get_b32(nonce32, &s);
     return 1;
 }
 
-static void test_exhaustive_schnorrsig_verify(const rustsecp256k1_v0_8_1_context *ctx, const rustsecp256k1_v0_8_1_xonly_pubkey* pubkeys, unsigned char (*xonly_pubkey_bytes)[32], const int* parities) {
+static void test_exhaustive_schnorrsig_verify(const rustsecp256k1_v0_9_0_context *ctx, const rustsecp256k1_v0_9_0_xonly_pubkey* pubkeys, unsigned char (*xonly_pubkey_bytes)[32], const int* parities) {
     int d;
     uint64_t iter = 0;
     /* Iterate over the possible public keys to verify against (through their corresponding DL d). */
@@ -102,28 +102,28 @@ static void test_exhaustive_schnorrsig_verify(const rustsecp256k1_v0_8_1_context
             }
             /* Randomly generate messages until all challenges have been hit. */
             while (e_count_done < EXHAUSTIVE_TEST_ORDER) {
-                rustsecp256k1_v0_8_1_scalar e;
+                rustsecp256k1_v0_9_0_scalar e;
                 unsigned char msg32[32];
-                rustsecp256k1_v0_8_1_testrand256(msg32);
-                rustsecp256k1_v0_8_1_schnorrsig_challenge(&e, sig64, msg32, sizeof(msg32), pk32);
+                rustsecp256k1_v0_9_0_testrand256(msg32);
+                rustsecp256k1_v0_9_0_schnorrsig_challenge(&e, sig64, msg32, sizeof(msg32), pk32);
                 /* Only do work if we hit a challenge we haven't tried before. */
                 if (!e_done[e]) {
                     /* Iterate over the possible valid last 32 bytes in the signature.
                        0..order=that s value; order+1=random bytes */
-                    int count_valid = 0, s;
+                    int count_valid = 0;
+                    unsigned int s;
                     for (s = 0; s <= EXHAUSTIVE_TEST_ORDER + 1; ++s) {
                         int expect_valid, valid;
                         if (s <= EXHAUSTIVE_TEST_ORDER) {
-                            rustsecp256k1_v0_8_1_scalar s_s;
-                            rustsecp256k1_v0_8_1_scalar_set_int(&s_s, s);
-                            rustsecp256k1_v0_8_1_scalar_get_b32(sig64 + 32, &s_s);
+                            memset(sig64 + 32, 0, 32);
+                            rustsecp256k1_v0_9_0_write_be32(sig64 + 60, s);
                             expect_valid = actual_k != -1 && s != EXHAUSTIVE_TEST_ORDER &&
-                                           (s_s == (actual_k + actual_d * e) % EXHAUSTIVE_TEST_ORDER);
+                                           (s == (actual_k + actual_d * e) % EXHAUSTIVE_TEST_ORDER);
                         } else {
-                            rustsecp256k1_v0_8_1_testrand256(sig64 + 32);
+                            rustsecp256k1_v0_9_0_testrand256(sig64 + 32);
                             expect_valid = 0;
                         }
-                        valid = rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig64, msg32, sizeof(msg32), &pubkeys[d - 1]);
+                        valid = rustsecp256k1_v0_9_0_schnorrsig_verify(ctx, sig64, msg32, sizeof(msg32), &pubkeys[d - 1]);
                         CHECK(valid == expect_valid);
                         count_valid += valid;
                     }
@@ -138,10 +138,10 @@ static void test_exhaustive_schnorrsig_verify(const rustsecp256k1_v0_8_1_context
     }
 }
 
-static void test_exhaustive_schnorrsig_sign(const rustsecp256k1_v0_8_1_context *ctx, unsigned char (*xonly_pubkey_bytes)[32], const rustsecp256k1_v0_8_1_keypair* keypairs, const int* parities) {
+static void test_exhaustive_schnorrsig_sign(const rustsecp256k1_v0_9_0_context *ctx, unsigned char (*xonly_pubkey_bytes)[32], const rustsecp256k1_v0_9_0_keypair* keypairs, const int* parities) {
     int d, k;
     uint64_t iter = 0;
-    rustsecp256k1_v0_8_1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
+    rustsecp256k1_v0_9_0_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
 
     /* Loop over keys. */
     for (d = 1; d < EXHAUSTIVE_TEST_ORDER; ++d) {
@@ -155,25 +155,25 @@ static void test_exhaustive_schnorrsig_sign(const rustsecp256k1_v0_8_1_context *
             unsigned char sig64[64];
             int actual_k = k;
             if (skip_section(&iter)) continue;
-            extraparams.noncefp = rustsecp256k1_v0_8_1_hardened_nonce_function_smallint;
+            extraparams.noncefp = rustsecp256k1_v0_9_0_hardened_nonce_function_smallint;
             extraparams.ndata = &k;
             if (parities[k - 1]) actual_k = EXHAUSTIVE_TEST_ORDER - k;
             /* Generate random messages until all challenges have been tried. */
             while (e_count_done < EXHAUSTIVE_TEST_ORDER) {
-                rustsecp256k1_v0_8_1_scalar e;
-                rustsecp256k1_v0_8_1_testrand256(msg32);
-                rustsecp256k1_v0_8_1_schnorrsig_challenge(&e, xonly_pubkey_bytes[k - 1], msg32, sizeof(msg32), xonly_pubkey_bytes[d - 1]);
+                rustsecp256k1_v0_9_0_scalar e;
+                rustsecp256k1_v0_9_0_testrand256(msg32);
+                rustsecp256k1_v0_9_0_schnorrsig_challenge(&e, xonly_pubkey_bytes[k - 1], msg32, sizeof(msg32), xonly_pubkey_bytes[d - 1]);
                 /* Only do work if we hit a challenge we haven't tried before. */
                 if (!e_done[e]) {
-                    rustsecp256k1_v0_8_1_scalar expected_s = (actual_k + e * actual_d) % EXHAUSTIVE_TEST_ORDER;
+                    rustsecp256k1_v0_9_0_scalar expected_s = (actual_k + e * actual_d) % EXHAUSTIVE_TEST_ORDER;
                     unsigned char expected_s_bytes[32];
-                    rustsecp256k1_v0_8_1_scalar_get_b32(expected_s_bytes, &expected_s);
+                    rustsecp256k1_v0_9_0_scalar_get_b32(expected_s_bytes, &expected_s);
                     /* Invoke the real function to construct a signature. */
-                    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig64, msg32, sizeof(msg32), &keypairs[d - 1], &extraparams));
+                    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(ctx, sig64, msg32, sizeof(msg32), &keypairs[d - 1], &extraparams));
                     /* The first 32 bytes must match the xonly pubkey for the specified k. */
-                    CHECK(rustsecp256k1_v0_8_1_memcmp_var(sig64, xonly_pubkey_bytes[k - 1], 32) == 0);
+                    CHECK(rustsecp256k1_v0_9_0_memcmp_var(sig64, xonly_pubkey_bytes[k - 1], 32) == 0);
                     /* The last 32 bytes must match the expected s value. */
-                    CHECK(rustsecp256k1_v0_8_1_memcmp_var(sig64 + 32, expected_s_bytes, 32) == 0);
+                    CHECK(rustsecp256k1_v0_9_0_memcmp_var(sig64 + 32, expected_s_bytes, 32) == 0);
                     /* Don't retry other messages that result in the same challenge. */
                     e_done[e] = 1;
                     ++e_count_done;
@@ -183,28 +183,28 @@ static void test_exhaustive_schnorrsig_sign(const rustsecp256k1_v0_8_1_context *
     }
 }
 
-static void test_exhaustive_schnorrsig(const rustsecp256k1_v0_8_1_context *ctx) {
-    rustsecp256k1_v0_8_1_keypair keypair[EXHAUSTIVE_TEST_ORDER - 1];
-    rustsecp256k1_v0_8_1_xonly_pubkey xonly_pubkey[EXHAUSTIVE_TEST_ORDER - 1];
+static void test_exhaustive_schnorrsig(const rustsecp256k1_v0_9_0_context *ctx) {
+    rustsecp256k1_v0_9_0_keypair keypair[EXHAUSTIVE_TEST_ORDER - 1];
+    rustsecp256k1_v0_9_0_xonly_pubkey xonly_pubkey[EXHAUSTIVE_TEST_ORDER - 1];
     int parity[EXHAUSTIVE_TEST_ORDER - 1];
     unsigned char xonly_pubkey_bytes[EXHAUSTIVE_TEST_ORDER - 1][32];
     unsigned i;
 
     /* Verify that all invalid_pubkey_bytes are actually invalid. */
     for (i = 0; i < NUM_INVALID_KEYS; ++i) {
-        rustsecp256k1_v0_8_1_xonly_pubkey pk;
-        CHECK(!rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &pk, invalid_pubkey_bytes[i]));
+        rustsecp256k1_v0_9_0_xonly_pubkey pk;
+        CHECK(!rustsecp256k1_v0_9_0_xonly_pubkey_parse(ctx, &pk, invalid_pubkey_bytes[i]));
     }
 
     /* Construct keypairs and xonly-pubkeys for the entire group. */
     for (i = 1; i < EXHAUSTIVE_TEST_ORDER; ++i) {
-        rustsecp256k1_v0_8_1_scalar scalar_i;
+        rustsecp256k1_v0_9_0_scalar scalar_i;
         unsigned char buf[32];
-        rustsecp256k1_v0_8_1_scalar_set_int(&scalar_i, i);
-        rustsecp256k1_v0_8_1_scalar_get_b32(buf, &scalar_i);
-        CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair[i - 1], buf));
-        CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &xonly_pubkey[i - 1], &parity[i - 1], &keypair[i - 1]));
-        CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, xonly_pubkey_bytes[i - 1], &xonly_pubkey[i - 1]));
+        rustsecp256k1_v0_9_0_scalar_set_int(&scalar_i, i);
+        rustsecp256k1_v0_9_0_scalar_get_b32(buf, &scalar_i);
+        CHECK(rustsecp256k1_v0_9_0_keypair_create(ctx, &keypair[i - 1], buf));
+        CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(ctx, &xonly_pubkey[i - 1], &parity[i - 1], &keypair[i - 1]));
+        CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(ctx, xonly_pubkey_bytes[i - 1], &xonly_pubkey[i - 1]));
     }
 
     test_exhaustive_schnorrsig_sign(ctx, xonly_pubkey_bytes, keypair, parity);
diff --git a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/tests_impl.h b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/tests_impl.h
index dcf8cdc50..6d7a11e6e 100644
--- a/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/tests_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/modules/schnorrsig/tests_impl.h
@@ -12,32 +12,21 @@
 /* Checks that a bit flip in the n_flip-th argument (that has n_bytes many
  * bytes) changes the hash function
  */
-void nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes, size_t msglen, size_t algolen) {
+static void nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes, size_t msglen, size_t algolen) {
     unsigned char nonces[2][32];
     CHECK(nonce_function_bip340(nonces[0], args[0], msglen, args[1], args[2], args[3], algolen, args[4]) == 1);
-    rustsecp256k1_v0_8_1_testrand_flip(args[n_flip], n_bytes);
+    rustsecp256k1_v0_9_0_testrand_flip(args[n_flip], n_bytes);
     CHECK(nonce_function_bip340(nonces[1], args[0], msglen, args[1], args[2], args[3], algolen, args[4]) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonces[0], nonces[1], 32) != 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonces[0], nonces[1], 32) != 0);
 }
 
-/* Tests for the equality of two sha256 structs. This function only produces a
- * correct result if an integer multiple of 64 many bytes have been written
- * into the hash functions. */
-void test_sha256_eq(const rustsecp256k1_v0_8_1_sha256 *sha1, const rustsecp256k1_v0_8_1_sha256 *sha2) {
-    /* Is buffer fully consumed? */
-    CHECK((sha1->bytes & 0x3F) == 0);
-
-    CHECK(sha1->bytes == sha2->bytes);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(sha1->s, sha2->s, sizeof(sha1->s)) == 0);
-}
-
-void run_nonce_function_bip340_tests(void) {
+static void run_nonce_function_bip340_tests(void) {
     unsigned char tag[13] = "BIP0340/nonce";
     unsigned char aux_tag[11] = "BIP0340/aux";
     unsigned char algo[13] = "BIP0340/nonce";
     size_t algolen = sizeof(algo);
-    rustsecp256k1_v0_8_1_sha256 sha;
-    rustsecp256k1_v0_8_1_sha256 sha_optimized;
+    rustsecp256k1_v0_9_0_sha256 sha;
+    rustsecp256k1_v0_9_0_sha256 sha_optimized;
     unsigned char nonce[32], nonce_z[32];
     unsigned char msg[32];
     size_t msglen = sizeof(msg);
@@ -48,23 +37,23 @@ void run_nonce_function_bip340_tests(void) {
     int i;
 
     /* Check that hash initialized by
-     * rustsecp256k1_v0_8_1_nonce_function_bip340_sha256_tagged has the expected
+     * rustsecp256k1_v0_9_0_nonce_function_bip340_sha256_tagged has the expected
      * state. */
-    rustsecp256k1_v0_8_1_sha256_initialize_tagged(&sha, tag, sizeof(tag));
-    rustsecp256k1_v0_8_1_nonce_function_bip340_sha256_tagged(&sha_optimized);
+    rustsecp256k1_v0_9_0_sha256_initialize_tagged(&sha, tag, sizeof(tag));
+    rustsecp256k1_v0_9_0_nonce_function_bip340_sha256_tagged(&sha_optimized);
     test_sha256_eq(&sha, &sha_optimized);
 
    /* Check that hash initialized by
-    * rustsecp256k1_v0_8_1_nonce_function_bip340_sha256_tagged_aux has the expected
+    * rustsecp256k1_v0_9_0_nonce_function_bip340_sha256_tagged_aux has the expected
     * state. */
-    rustsecp256k1_v0_8_1_sha256_initialize_tagged(&sha, aux_tag, sizeof(aux_tag));
-    rustsecp256k1_v0_8_1_nonce_function_bip340_sha256_tagged_aux(&sha_optimized);
+    rustsecp256k1_v0_9_0_sha256_initialize_tagged(&sha, aux_tag, sizeof(aux_tag));
+    rustsecp256k1_v0_9_0_nonce_function_bip340_sha256_tagged_aux(&sha_optimized);
     test_sha256_eq(&sha, &sha_optimized);
 
-    rustsecp256k1_v0_8_1_testrand256(msg);
-    rustsecp256k1_v0_8_1_testrand256(key);
-    rustsecp256k1_v0_8_1_testrand256(pk);
-    rustsecp256k1_v0_8_1_testrand256(aux_rand);
+    rustsecp256k1_v0_9_0_testrand256(msg);
+    rustsecp256k1_v0_9_0_testrand256(key);
+    rustsecp256k1_v0_9_0_testrand256(pk);
+    rustsecp256k1_v0_9_0_testrand256(aux_rand);
 
     /* Check that a bitflip in an argument results in different nonces. */
     args[0] = msg;
@@ -72,7 +61,7 @@ void run_nonce_function_bip340_tests(void) {
     args[2] = pk;
     args[3] = algo;
     args[4] = aux_rand;
-    for (i = 0; i < count; i++) {
+    for (i = 0; i < COUNT; i++) {
         nonce_function_bip340_bitflip(args, 0, 32, msglen, algolen);
         nonce_function_bip340_bitflip(args, 1, 32, msglen, algolen);
         nonce_function_bip340_bitflip(args, 2, 32, msglen, algolen);
@@ -87,161 +76,169 @@ void run_nonce_function_bip340_tests(void) {
     CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, NULL, 0, NULL) == 0);
     CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
     /* Other algo is fine */
-    rustsecp256k1_v0_8_1_testrand_bytes_test(algo, algolen);
+    rustsecp256k1_v0_9_0_testrand_bytes_test(algo, algolen);
     CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
 
-    for (i = 0; i < count; i++) {
+    for (i = 0; i < COUNT; i++) {
         unsigned char nonce2[32];
-        uint32_t offset = rustsecp256k1_v0_8_1_testrand_int(msglen - 1);
+        uint32_t offset = rustsecp256k1_v0_9_0_testrand_int(msglen - 1);
         size_t msglen_tmp = (msglen + offset) % msglen;
         size_t algolen_tmp;
 
         /* Different msglen gives different nonce */
         CHECK(nonce_function_bip340(nonce2, msg, msglen_tmp, key, pk, algo, algolen, NULL) == 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonce, nonce2, 32) != 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonce, nonce2, 32) != 0);
 
         /* Different algolen gives different nonce */
-        offset = rustsecp256k1_v0_8_1_testrand_int(algolen - 1);
+        offset = rustsecp256k1_v0_9_0_testrand_int(algolen - 1);
         algolen_tmp = (algolen + offset) % algolen;
         CHECK(nonce_function_bip340(nonce2, msg, msglen, key, pk, algo, algolen_tmp, NULL) == 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonce, nonce2, 32) != 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonce, nonce2, 32) != 0);
     }
 
     /* NULL aux_rand argument is allowed, and identical to passing all zero aux_rand. */
     memset(aux_rand, 0, 32);
     CHECK(nonce_function_bip340(nonce_z, msg, msglen, key, pk, algo, algolen, &aux_rand) == 1);
     CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonce_z, nonce, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonce_z, nonce, 32) == 0);
 }
 
-void test_schnorrsig_api(void) {
+static void test_schnorrsig_api(void) {
     unsigned char sk1[32];
     unsigned char sk2[32];
     unsigned char sk3[32];
     unsigned char msg[32];
-    rustsecp256k1_v0_8_1_keypair keypairs[3];
-    rustsecp256k1_v0_8_1_keypair invalid_keypair = {{ 0 }};
-    rustsecp256k1_v0_8_1_xonly_pubkey pk[3];
-    rustsecp256k1_v0_8_1_xonly_pubkey zero_pk;
+    rustsecp256k1_v0_9_0_keypair keypairs[3];
+    rustsecp256k1_v0_9_0_keypair invalid_keypair = {{ 0 }};
+    rustsecp256k1_v0_9_0_xonly_pubkey pk[3];
+    rustsecp256k1_v0_9_0_xonly_pubkey zero_pk;
     unsigned char sig[64];
-    rustsecp256k1_v0_8_1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
-    rustsecp256k1_v0_8_1_schnorrsig_extraparams invalid_extraparams = {{ 0 }, NULL, NULL};
+    rustsecp256k1_v0_9_0_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
+    rustsecp256k1_v0_9_0_schnorrsig_extraparams invalid_extraparams = {{ 0 }, NULL, NULL};
 
     /** setup **/
-    rustsecp256k1_v0_8_1_context *sttc = rustsecp256k1_v0_8_1_context_clone(rustsecp256k1_v0_8_1_context_static);
-    int ecount;
-
-    rustsecp256k1_v0_8_1_context_set_error_callback(ctx, counting_illegal_callback_fn, &ecount);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
-    rustsecp256k1_v0_8_1_context_set_error_callback(sttc, counting_illegal_callback_fn, &ecount);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(sttc, counting_illegal_callback_fn, &ecount);
-
-    rustsecp256k1_v0_8_1_testrand256(sk1);
-    rustsecp256k1_v0_8_1_testrand256(sk2);
-    rustsecp256k1_v0_8_1_testrand256(sk3);
-    rustsecp256k1_v0_8_1_testrand256(msg);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypairs[0], sk1) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypairs[1], sk2) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypairs[2], sk3) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &pk[0], NULL, &keypairs[0]) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &pk[1], NULL, &keypairs[1]) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &pk[2], NULL, &keypairs[2]) == 1);
+    int ecount = 0;
+
+    rustsecp256k1_v0_9_0_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
+
+    rustsecp256k1_v0_9_0_testrand256(sk1);
+    rustsecp256k1_v0_9_0_testrand256(sk2);
+    rustsecp256k1_v0_9_0_testrand256(sk3);
+    rustsecp256k1_v0_9_0_testrand256(msg);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypairs[0], sk1) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypairs[1], sk2) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypairs[2], sk3) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &pk[0], NULL, &keypairs[0]) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &pk[1], NULL, &keypairs[1]) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &pk[2], NULL, &keypairs[2]) == 1);
     memset(&zero_pk, 0, sizeof(zero_pk));
 
     /** main test body **/
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig, msg, &keypairs[0], NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig, msg, &keypairs[0], NULL) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, NULL, msg, &keypairs[0], NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, NULL, msg, &keypairs[0], NULL) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig, NULL, &keypairs[0], NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig, NULL, &keypairs[0], NULL) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig, msg, NULL, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig, msg, NULL, NULL) == 0);
     CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig, msg, &invalid_keypair, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig, msg, &invalid_keypair, NULL) == 0);
     CHECK(ecount == 4);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(sttc, sig, msg, &keypairs[0], NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(STATIC_CTX, sig, msg, &keypairs[0], NULL) == 0);
     CHECK(ecount == 5);
 
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, NULL, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, NULL, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, NULL, sizeof(msg), &keypairs[0], &extraparams) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, NULL, sizeof(msg), &keypairs[0], &extraparams) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, NULL, 0, &keypairs[0], &extraparams) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, NULL, 0, &keypairs[0], &extraparams) == 1);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), NULL, &extraparams) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), NULL, &extraparams) == 0);
     CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &invalid_keypair, &extraparams) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &invalid_keypair, &extraparams) == 0);
     CHECK(ecount == 4);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypairs[0], NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], NULL) == 1);
     CHECK(ecount == 4);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypairs[0], &invalid_extraparams) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], &invalid_extraparams) == 0);
     CHECK(ecount == 5);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(sttc, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(STATIC_CTX, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
     CHECK(ecount == 6);
 
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig, msg, &keypairs[0], NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, msg, sizeof(msg), &pk[0]) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig, msg, &keypairs[0], NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &pk[0]) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, NULL, msg, sizeof(msg), &pk[0]) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, NULL, msg, sizeof(msg), &pk[0]) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, NULL, sizeof(msg), &pk[0]) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, NULL, sizeof(msg), &pk[0]) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, NULL, 0, &pk[0]) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, NULL, 0, &pk[0]) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, msg, sizeof(msg), NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, msg, sizeof(msg), NULL) == 0);
     CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, msg, sizeof(msg), &zero_pk) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &zero_pk) == 0);
     CHECK(ecount == 4);
 
-    rustsecp256k1_v0_8_1_context_destroy(sttc);
+    rustsecp256k1_v0_9_0_context_set_error_callback(STATIC_CTX, NULL, NULL);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 
-/* Checks that hash initialized by rustsecp256k1_v0_8_1_schnorrsig_sha256_tagged has the
+/* Checks that hash initialized by rustsecp256k1_v0_9_0_schnorrsig_sha256_tagged has the
  * expected state. */
-void test_schnorrsig_sha256_tagged(void) {
+static void test_schnorrsig_sha256_tagged(void) {
     unsigned char tag[17] = "BIP0340/challenge";
-    rustsecp256k1_v0_8_1_sha256 sha;
-    rustsecp256k1_v0_8_1_sha256 sha_optimized;
+    rustsecp256k1_v0_9_0_sha256 sha;
+    rustsecp256k1_v0_9_0_sha256 sha_optimized;
 
-    rustsecp256k1_v0_8_1_sha256_initialize_tagged(&sha, (unsigned char *) tag, sizeof(tag));
-    rustsecp256k1_v0_8_1_schnorrsig_sha256_tagged(&sha_optimized);
+    rustsecp256k1_v0_9_0_sha256_initialize_tagged(&sha, (unsigned char *) tag, sizeof(tag));
+    rustsecp256k1_v0_9_0_schnorrsig_sha256_tagged(&sha_optimized);
     test_sha256_eq(&sha, &sha_optimized);
 }
 
 /* Helper function for schnorrsig_bip_vectors
  * Signs the message and checks that it's the same as expected_sig. */
-void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *expected_sig) {
+static void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg, size_t msglen, const unsigned char *expected_sig) {
     unsigned char sig[64];
-    rustsecp256k1_v0_8_1_keypair keypair;
-    rustsecp256k1_v0_8_1_xonly_pubkey pk, pk_expected;
-
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk));
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig, msg32, &keypair, aux_rand));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(sig, expected_sig, 64) == 0);
+    rustsecp256k1_v0_9_0_keypair keypair;
+    rustsecp256k1_v0_9_0_xonly_pubkey pk, pk_expected;
+
+    rustsecp256k1_v0_9_0_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
+    extraparams.ndata = (unsigned char*)aux_rand;
+
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk));
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, msglen, &keypair, &extraparams));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(sig, expected_sig, 64) == 0);
+    if (msglen == 32) {
+        memset(sig, 0, 64);
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig, msg, &keypair, aux_rand));
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(sig, expected_sig, 64) == 0);
+    }
 
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &pk_expected, pk_serialized));
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &pk, NULL, &keypair));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pk, &pk_expected, sizeof(pk)) == 0);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, msg32, 32, &pk));
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &pk_expected, pk_serialized));
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &pk, NULL, &keypair));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pk, &pk_expected, sizeof(pk)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, msg, msglen, &pk));
 }
 
 /* Helper function for schnorrsig_bip_vectors
  * Checks that both verify and verify_batch (TODO) return the same value as expected. */
-void test_schnorrsig_bip_vectors_check_verify(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, int expected) {
-    rustsecp256k1_v0_8_1_xonly_pubkey pk;
+static void test_schnorrsig_bip_vectors_check_verify(const unsigned char *pk_serialized, const unsigned char *msg, size_t msglen, const unsigned char *sig, int expected) {
+    rustsecp256k1_v0_9_0_xonly_pubkey pk;
 
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &pk, pk_serialized));
-    CHECK(expected == rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, msg32, 32, &pk));
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &pk, pk_serialized));
+    CHECK(expected == rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, msg, msglen, &pk));
 }
 
 /* Test vectors according to BIP-340 ("Schnorr Signatures for secp256k1"). See
  * https://github.com/bitcoin/bips/blob/master/bip-0340/test-vectors.csv. */
-void test_schnorrsig_bip_vectors(void) {
+static void test_schnorrsig_bip_vectors(void) {
     {
         /* Test vector 0 */
         const unsigned char sk[32] = {
@@ -256,7 +253,7 @@ void test_schnorrsig_bip_vectors(void) {
             0xB5, 0x31, 0xC8, 0x45, 0x83, 0x6F, 0x99, 0xB0,
             0x86, 0x01, 0xF1, 0x13, 0xBC, 0xE0, 0x36, 0xF9
         };
-        unsigned char aux_rand[32] = {
+        const unsigned char aux_rand[32] = {
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -278,8 +275,8 @@ void test_schnorrsig_bip_vectors(void) {
             0xEB, 0xEE, 0xE8, 0xFD, 0xB2, 0x17, 0x2F, 0x47,
             0x7D, 0xF4, 0x90, 0x0D, 0x31, 0x05, 0x36, 0xC0
         };
-        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
+        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sizeof(msg), sig);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 1);
     }
     {
         /* Test vector 1 */
@@ -295,7 +292,7 @@ void test_schnorrsig_bip_vectors(void) {
             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
         };
-        unsigned char aux_rand[32] = {
+        const unsigned char aux_rand[32] = {
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -317,8 +314,8 @@ void test_schnorrsig_bip_vectors(void) {
             0x89, 0x7E, 0xFC, 0xB6, 0x39, 0xEA, 0x87, 0x1C,
             0xFA, 0x95, 0xF6, 0xDE, 0x33, 0x9E, 0x4B, 0x0A
         };
-        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
+        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sizeof(msg), sig);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 1);
     }
     {
         /* Test vector 2 */
@@ -334,7 +331,7 @@ void test_schnorrsig_bip_vectors(void) {
             0x01, 0x39, 0x71, 0x53, 0x09, 0xB0, 0x86, 0xC9,
             0x60, 0xE1, 0x8F, 0xD9, 0x69, 0x77, 0x4E, 0xB8
         };
-        unsigned char aux_rand[32] = {
+        const unsigned char aux_rand[32] = {
             0xC8, 0x7A, 0xA5, 0x38, 0x24, 0xB4, 0xD7, 0xAE,
             0x2E, 0xB0, 0x35, 0xA2, 0xB5, 0xBB, 0xBC, 0xCC,
             0x08, 0x0E, 0x76, 0xCD, 0xC6, 0xD1, 0x69, 0x2C,
@@ -356,8 +353,8 @@ void test_schnorrsig_bip_vectors(void) {
             0x7A, 0xDE, 0xA9, 0x8D, 0x82, 0xF8, 0x48, 0x1E,
             0x0E, 0x1E, 0x03, 0x67, 0x4A, 0x6F, 0x3F, 0xB7
         };
-        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
+        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sizeof(msg), sig);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 1);
     }
     {
         /* Test vector 3 */
@@ -373,7 +370,7 @@ void test_schnorrsig_bip_vectors(void) {
             0x3A, 0x0D, 0x95, 0xFB, 0xF2, 0x1D, 0x46, 0x8A,
             0x1B, 0x33, 0xF8, 0xC1, 0x60, 0xD8, 0xF5, 0x17
         };
-        unsigned char aux_rand[32] = {
+        const unsigned char aux_rand[32] = {
             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
@@ -395,8 +392,8 @@ void test_schnorrsig_bip_vectors(void) {
             0xF2, 0x5F, 0xD7, 0x88, 0x81, 0xEB, 0xB3, 0x27,
             0x71, 0xFC, 0x59, 0x22, 0xEF, 0xC6, 0x6E, 0xA3
         };
-        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
+        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sizeof(msg), sig);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 1);
     }
     {
         /* Test vector 4 */
@@ -422,7 +419,7 @@ void test_schnorrsig_bip_vectors(void) {
             0x60, 0xCB, 0x71, 0xC0, 0x4E, 0x80, 0xF5, 0x93,
             0x06, 0x0B, 0x07, 0xD2, 0x83, 0x08, 0xD7, 0xF4
         };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 1);
     }
     {
         /* Test vector 5 */
@@ -432,9 +429,9 @@ void test_schnorrsig_bip_vectors(void) {
             0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76, 0x87,
             0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A, 0x34
         };
-        rustsecp256k1_v0_8_1_xonly_pubkey pk_parsed;
+        rustsecp256k1_v0_9_0_xonly_pubkey pk_parsed;
         /* No need to check the signature of the test vector as parsing the pubkey already fails */
-        CHECK(!rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &pk_parsed, pk));
+        CHECK(!rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &pk_parsed, pk));
     }
     {
         /* Test vector 6 */
@@ -460,7 +457,7 @@ void test_schnorrsig_bip_vectors(void) {
             0x7A, 0x73, 0xC6, 0x43, 0xE1, 0x66, 0xBE, 0x5E,
             0xBE, 0xAF, 0xA3, 0x4B, 0x1A, 0xC5, 0x53, 0xE2
         };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 0);
     }
     {
         /* Test vector 7 */
@@ -486,7 +483,7 @@ void test_schnorrsig_bip_vectors(void) {
             0x62, 0x2A, 0x95, 0x4C, 0xFE, 0x54, 0x57, 0x35,
             0xAA, 0xEA, 0x51, 0x34, 0xFC, 0xCD, 0xB2, 0xBD
         };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 0);
     }
     {
         /* Test vector 8 */
@@ -512,7 +509,7 @@ void test_schnorrsig_bip_vectors(void) {
             0xE8, 0xD7, 0xC9, 0x3E, 0x00, 0xC5, 0xED, 0x0C,
             0x18, 0x34, 0xFF, 0x0D, 0x0C, 0x2E, 0x6D, 0xA6
         };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 0);
     }
     {
         /* Test vector 9 */
@@ -538,7 +535,7 @@ void test_schnorrsig_bip_vectors(void) {
             0x4F, 0xB7, 0x34, 0x76, 0xF0, 0xD5, 0x94, 0xDC,
             0xB6, 0x5C, 0x64, 0x25, 0xBD, 0x18, 0x60, 0x51
         };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 0);
     }
     {
         /* Test vector 10 */
@@ -564,7 +561,7 @@ void test_schnorrsig_bip_vectors(void) {
             0xDB, 0xA8, 0x7F, 0x11, 0xAC, 0x67, 0x54, 0xF9,
             0x37, 0x80, 0xD5, 0xA1, 0x83, 0x7C, 0xF1, 0x97
         };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 0);
     }
     {
         /* Test vector 11 */
@@ -590,7 +587,7 @@ void test_schnorrsig_bip_vectors(void) {
             0xD1, 0xD7, 0x13, 0xA8, 0xAE, 0x82, 0xB3, 0x2F,
             0xA7, 0x9D, 0x5F, 0x7F, 0xC4, 0x07, 0xD3, 0x9B
         };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 0);
     }
     {
         /* Test vector 12 */
@@ -616,7 +613,7 @@ void test_schnorrsig_bip_vectors(void) {
             0xD1, 0xD7, 0x13, 0xA8, 0xAE, 0x82, 0xB3, 0x2F,
             0xA7, 0x9D, 0x5F, 0x7F, 0xC4, 0x07, 0xD3, 0x9B
         };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 0);
     }
     {
         /* Test vector 13 */
@@ -642,7 +639,7 @@ void test_schnorrsig_bip_vectors(void) {
             0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,
             0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41
         };
-        test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 0);
     }
     {
         /* Test vector 14 */
@@ -652,9 +649,150 @@ void test_schnorrsig_bip_vectors(void) {
             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
             0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x30
         };
-        rustsecp256k1_v0_8_1_xonly_pubkey pk_parsed;
+        rustsecp256k1_v0_9_0_xonly_pubkey pk_parsed;
         /* No need to check the signature of the test vector as parsing the pubkey already fails */
-        CHECK(!rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &pk_parsed, pk));
+        CHECK(!rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &pk_parsed, pk));
+    }
+    {
+        /* Test vector 15 */
+        const unsigned char sk[32] = {
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+        };
+        const unsigned char pk[32] = {
+            0x77, 0x8C, 0xAA, 0x53, 0xB4, 0x39, 0x3A, 0xC4,
+            0x67, 0x77, 0x4D, 0x09, 0x49, 0x7A, 0x87, 0x22,
+            0x4B, 0xF9, 0xFA, 0xB6, 0xF6, 0xE6, 0x8B, 0x23,
+            0x08, 0x64, 0x97, 0x32, 0x4D, 0x6F, 0xD1, 0x17,
+        };
+        const unsigned char aux_rand[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        };
+        /* const unsigned char msg[0] = {}; */
+        const unsigned char sig[64] = {
+            0x71, 0x53, 0x5D, 0xB1, 0x65, 0xEC, 0xD9, 0xFB,
+            0xBC, 0x04, 0x6E, 0x5F, 0xFA, 0xEA, 0x61, 0x18,
+            0x6B, 0xB6, 0xAD, 0x43, 0x67, 0x32, 0xFC, 0xCC,
+            0x25, 0x29, 0x1A, 0x55, 0x89, 0x54, 0x64, 0xCF,
+            0x60, 0x69, 0xCE, 0x26, 0xBF, 0x03, 0x46, 0x62,
+            0x28, 0xF1, 0x9A, 0x3A, 0x62, 0xDB, 0x8A, 0x64,
+            0x9F, 0x2D, 0x56, 0x0F, 0xAC, 0x65, 0x28, 0x27,
+            0xD1, 0xAF, 0x05, 0x74, 0xE4, 0x27, 0xAB, 0x63,
+        };
+        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, NULL, 0, sig);
+        test_schnorrsig_bip_vectors_check_verify(pk, NULL, 0, sig, 1);
+    }
+    {
+        /* Test vector 16 */
+        const unsigned char sk[32] = {
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+        };
+        const unsigned char pk[32] = {
+            0x77, 0x8C, 0xAA, 0x53, 0xB4, 0x39, 0x3A, 0xC4,
+            0x67, 0x77, 0x4D, 0x09, 0x49, 0x7A, 0x87, 0x22,
+            0x4B, 0xF9, 0xFA, 0xB6, 0xF6, 0xE6, 0x8B, 0x23,
+            0x08, 0x64, 0x97, 0x32, 0x4D, 0x6F, 0xD1, 0x17,
+        };
+        const unsigned char aux_rand[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        };
+        const unsigned char msg[] = { 0x11 };
+        const unsigned char sig[64] = {
+            0x08, 0xA2, 0x0A, 0x0A, 0xFE, 0xF6, 0x41, 0x24,
+            0x64, 0x92, 0x32, 0xE0, 0x69, 0x3C, 0x58, 0x3A,
+            0xB1, 0xB9, 0x93, 0x4A, 0xE6, 0x3B, 0x4C, 0x35,
+            0x11, 0xF3, 0xAE, 0x11, 0x34, 0xC6, 0xA3, 0x03,
+            0xEA, 0x31, 0x73, 0xBF, 0xEA, 0x66, 0x83, 0xBD,
+            0x10, 0x1F, 0xA5, 0xAA, 0x5D, 0xBC, 0x19, 0x96,
+            0xFE, 0x7C, 0xAC, 0xFC, 0x5A, 0x57, 0x7D, 0x33,
+            0xEC, 0x14, 0x56, 0x4C, 0xEC, 0x2B, 0xAC, 0xBF,
+        };
+        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sizeof(msg), sig);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 1);
+    }
+    {
+        /* Test vector 17 */
+        const unsigned char sk[32] = {
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+        };
+        const unsigned char pk[32] = {
+            0x77, 0x8C, 0xAA, 0x53, 0xB4, 0x39, 0x3A, 0xC4,
+            0x67, 0x77, 0x4D, 0x09, 0x49, 0x7A, 0x87, 0x22,
+            0x4B, 0xF9, 0xFA, 0xB6, 0xF6, 0xE6, 0x8B, 0x23,
+            0x08, 0x64, 0x97, 0x32, 0x4D, 0x6F, 0xD1, 0x17,
+        };
+        const unsigned char aux_rand[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        };
+        const unsigned char msg[] = {
+            0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+            0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10,
+            0x11,
+        };
+        const unsigned char sig[64] = {
+            0x51, 0x30, 0xF3, 0x9A, 0x40, 0x59, 0xB4, 0x3B,
+            0xC7, 0xCA, 0xC0, 0x9A, 0x19, 0xEC, 0xE5, 0x2B,
+            0x5D, 0x86, 0x99, 0xD1, 0xA7, 0x1E, 0x3C, 0x52,
+            0xDA, 0x9A, 0xFD, 0xB6, 0xB5, 0x0A, 0xC3, 0x70,
+            0xC4, 0xA4, 0x82, 0xB7, 0x7B, 0xF9, 0x60, 0xF8,
+            0x68, 0x15, 0x40, 0xE2, 0x5B, 0x67, 0x71, 0xEC,
+            0xE1, 0xE5, 0xA3, 0x7F, 0xD8, 0x0E, 0x5A, 0x51,
+            0x89, 0x7C, 0x55, 0x66, 0xA9, 0x7E, 0xA5, 0xA5,
+        };
+        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sizeof(msg), sig);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 1);
+    }
+    {
+        /* Test vector 18 */
+        const unsigned char sk[32] = {
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+            0x03, 0x40, 0x03, 0x40, 0x03, 0x40, 0x03, 0x40,
+        };
+        const unsigned char pk[32] = {
+            0x77, 0x8C, 0xAA, 0x53, 0xB4, 0x39, 0x3A, 0xC4,
+            0x67, 0x77, 0x4D, 0x09, 0x49, 0x7A, 0x87, 0x22,
+            0x4B, 0xF9, 0xFA, 0xB6, 0xF6, 0xE6, 0x8B, 0x23,
+            0x08, 0x64, 0x97, 0x32, 0x4D, 0x6F, 0xD1, 0x17,
+        };
+        const unsigned char aux_rand[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        };
+        const unsigned char sig[64] = {
+            0x40, 0x3B, 0x12, 0xB0, 0xD8, 0x55, 0x5A, 0x34,
+            0x41, 0x75, 0xEA, 0x7E, 0xC7, 0x46, 0x56, 0x63,
+            0x03, 0x32, 0x1E, 0x5D, 0xBF, 0xA8, 0xBE, 0x6F,
+            0x09, 0x16, 0x35, 0x16, 0x3E, 0xCA, 0x79, 0xA8,
+            0x58, 0x5E, 0xD3, 0xE3, 0x17, 0x08, 0x07, 0xE7,
+            0xC0, 0x3B, 0x72, 0x0F, 0xC5, 0x4C, 0x7B, 0x23,
+            0x89, 0x7F, 0xCB, 0xA0, 0xE9, 0xD0, 0xB4, 0xA0,
+            0x68, 0x94, 0xCF, 0xD2, 0x49, 0xF2, 0x23, 0x67,
+        };
+        unsigned char msg[100];
+        memset(msg, 0x99, sizeof(msg));
+        test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sizeof(msg), sig);
+        test_schnorrsig_bip_vectors_check_verify(pk, msg, sizeof(msg), sig, 1);
     }
 }
 
@@ -699,139 +837,139 @@ static int nonce_function_overflowing(unsigned char *nonce32, const unsigned cha
     return 1;
 }
 
-void test_schnorrsig_sign(void) {
+static void test_schnorrsig_sign(void) {
     unsigned char sk[32];
-    rustsecp256k1_v0_8_1_xonly_pubkey pk;
-    rustsecp256k1_v0_8_1_keypair keypair;
+    rustsecp256k1_v0_9_0_xonly_pubkey pk;
+    rustsecp256k1_v0_9_0_keypair keypair;
     const unsigned char msg[32] = "this is a msg for a schnorrsig..";
     unsigned char sig[64];
     unsigned char sig2[64];
     unsigned char zeros64[64] = { 0 };
-    rustsecp256k1_v0_8_1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
+    rustsecp256k1_v0_9_0_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
     unsigned char aux_rand[32];
 
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    rustsecp256k1_v0_8_1_testrand256(aux_rand);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk));
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &pk, NULL, &keypair));
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig, msg, &keypair, NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, msg, sizeof(msg), &pk));
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    rustsecp256k1_v0_9_0_testrand256(aux_rand);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk));
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &pk, NULL, &keypair));
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig, msg, &keypair, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &pk));
     /* Check that deprecated alias gives the same result */
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign(ctx, sig2, msg, &keypair, NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(sig, sig2, sizeof(sig)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign(CTX, sig2, msg, &keypair, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(sig, sig2, sizeof(sig)) == 0);
 
     /* Test different nonce functions */
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, msg, sizeof(msg), &pk));
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &pk));
     memset(sig, 1, sizeof(sig));
     extraparams.noncefp = nonce_function_failing;
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypair, &extraparams) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
     memset(&sig, 1, sizeof(sig));
     extraparams.noncefp = nonce_function_0;
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypair, &extraparams) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
     memset(&sig, 1, sizeof(sig));
     extraparams.noncefp = nonce_function_overflowing;
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, msg, sizeof(msg), &pk));
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &pk));
 
     /* When using the default nonce function, schnorrsig_sign_custom produces
      * the same result as schnorrsig_sign with aux_rand = extraparams.ndata */
     extraparams.noncefp = NULL;
     extraparams.ndata = aux_rand;
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig2, msg, &keypair, extraparams.ndata) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(sig, sig2, sizeof(sig)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig2, msg, &keypair, extraparams.ndata) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(sig, sig2, sizeof(sig)) == 0);
 }
 
 #define N_SIGS 3
 /* Creates N_SIGS valid signatures and verifies them with verify and
  * verify_batch (TODO). Then flips some bits and checks that verification now
  * fails. */
-void test_schnorrsig_sign_verify(void) {
+static void test_schnorrsig_sign_verify(void) {
     unsigned char sk[32];
     unsigned char msg[N_SIGS][32];
     unsigned char sig[N_SIGS][64];
     size_t i;
-    rustsecp256k1_v0_8_1_keypair keypair;
-    rustsecp256k1_v0_8_1_xonly_pubkey pk;
-    rustsecp256k1_v0_8_1_scalar s;
+    rustsecp256k1_v0_9_0_keypair keypair;
+    rustsecp256k1_v0_9_0_xonly_pubkey pk;
+    rustsecp256k1_v0_9_0_scalar s;
 
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk));
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &pk, NULL, &keypair));
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk));
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &pk, NULL, &keypair));
 
     for (i = 0; i < N_SIGS; i++) {
-        rustsecp256k1_v0_8_1_testrand256(msg[i]);
-        CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig[i], msg[i], &keypair, NULL));
-        CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[i], msg[i], sizeof(msg[i]), &pk));
+        rustsecp256k1_v0_9_0_testrand256(msg[i]);
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig[i], msg[i], &keypair, NULL));
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[i], msg[i], sizeof(msg[i]), &pk));
     }
 
     {
         /* Flip a few bits in the signature and in the message and check that
          * verify and verify_batch (TODO) fail */
-        size_t sig_idx = rustsecp256k1_v0_8_1_testrand_int(N_SIGS);
-        size_t byte_idx = rustsecp256k1_v0_8_1_testrand_bits(5);
-        unsigned char xorbyte = rustsecp256k1_v0_8_1_testrand_int(254)+1;
+        size_t sig_idx = rustsecp256k1_v0_9_0_testrand_int(N_SIGS);
+        size_t byte_idx = rustsecp256k1_v0_9_0_testrand_bits(5);
+        unsigned char xorbyte = rustsecp256k1_v0_9_0_testrand_int(254)+1;
         sig[sig_idx][byte_idx] ^= xorbyte;
-        CHECK(!rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
+        CHECK(!rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
         sig[sig_idx][byte_idx] ^= xorbyte;
 
-        byte_idx = rustsecp256k1_v0_8_1_testrand_bits(5);
+        byte_idx = rustsecp256k1_v0_9_0_testrand_bits(5);
         sig[sig_idx][32+byte_idx] ^= xorbyte;
-        CHECK(!rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
+        CHECK(!rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
         sig[sig_idx][32+byte_idx] ^= xorbyte;
 
-        byte_idx = rustsecp256k1_v0_8_1_testrand_bits(5);
+        byte_idx = rustsecp256k1_v0_9_0_testrand_bits(5);
         msg[sig_idx][byte_idx] ^= xorbyte;
-        CHECK(!rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
+        CHECK(!rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
         msg[sig_idx][byte_idx] ^= xorbyte;
 
         /* Check that above bitflips have been reversed correctly */
-        CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
     }
 
     /* Test overflowing s */
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig[0], msg[0], &keypair, NULL));
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[0], msg[0], sizeof(msg[0]), &pk));
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig[0], msg[0], &keypair, NULL));
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[0], msg[0], sizeof(msg[0]), &pk));
     memset(&sig[0][32], 0xFF, 32);
-    CHECK(!rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[0], msg[0], sizeof(msg[0]), &pk));
+    CHECK(!rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[0], msg[0], sizeof(msg[0]), &pk));
 
     /* Test negative s */
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig[0], msg[0], &keypair, NULL));
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[0], msg[0], sizeof(msg[0]), &pk));
-    rustsecp256k1_v0_8_1_scalar_set_b32(&s, &sig[0][32], NULL);
-    rustsecp256k1_v0_8_1_scalar_negate(&s, &s);
-    rustsecp256k1_v0_8_1_scalar_get_b32(&sig[0][32], &s);
-    CHECK(!rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[0], msg[0], sizeof(msg[0]), &pk));
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig[0], msg[0], &keypair, NULL));
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[0], msg[0], sizeof(msg[0]), &pk));
+    rustsecp256k1_v0_9_0_scalar_set_b32(&s, &sig[0][32], NULL);
+    rustsecp256k1_v0_9_0_scalar_negate(&s, &s);
+    rustsecp256k1_v0_9_0_scalar_get_b32(&sig[0][32], &s);
+    CHECK(!rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[0], msg[0], sizeof(msg[0]), &pk));
 
     /* The empty message can be signed & verified */
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig[0], NULL, 0, &keypair, NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[0], NULL, 0, &pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig[0], NULL, 0, &keypair, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[0], NULL, 0, &pk) == 1);
 
     {
         /* Test varying message lengths */
         unsigned char msg_large[32 * 8];
-        uint32_t msglen  = rustsecp256k1_v0_8_1_testrand_int(sizeof(msg_large));
+        uint32_t msglen  = rustsecp256k1_v0_9_0_testrand_int(sizeof(msg_large));
         for (i = 0; i < sizeof(msg_large); i += 32) {
-            rustsecp256k1_v0_8_1_testrand256(&msg_large[i]);
+            rustsecp256k1_v0_9_0_testrand256(&msg_large[i]);
         }
-        CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign_custom(ctx, sig[0], msg_large, msglen, &keypair, NULL) == 1);
-        CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[0], msg_large, msglen, &pk) == 1);
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign_custom(CTX, sig[0], msg_large, msglen, &keypair, NULL) == 1);
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[0], msg_large, msglen, &pk) == 1);
         /* Verification for a random wrong message length fails */
         msglen = (msglen + (sizeof(msg_large) - 1)) % sizeof(msg_large);
-        CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig[0], msg_large, msglen, &pk) == 0);
+        CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig[0], msg_large, msglen, &pk) == 0);
     }
 }
 #undef N_SIGS
 
-void test_schnorrsig_taproot(void) {
+static void test_schnorrsig_taproot(void) {
     unsigned char sk[32];
-    rustsecp256k1_v0_8_1_keypair keypair;
-    rustsecp256k1_v0_8_1_xonly_pubkey internal_pk;
+    rustsecp256k1_v0_9_0_keypair keypair;
+    rustsecp256k1_v0_9_0_xonly_pubkey internal_pk;
     unsigned char internal_pk_bytes[32];
-    rustsecp256k1_v0_8_1_xonly_pubkey output_pk;
+    rustsecp256k1_v0_9_0_xonly_pubkey output_pk;
     unsigned char output_pk_bytes[32];
     unsigned char tweak[32];
     int pk_parity;
@@ -839,37 +977,37 @@ void test_schnorrsig_taproot(void) {
     unsigned char sig[64];
 
     /* Create output key */
-    rustsecp256k1_v0_8_1_testrand256(sk);
-    CHECK(rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, sk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &internal_pk, NULL, &keypair) == 1);
+    rustsecp256k1_v0_9_0_testrand256(sk);
+    CHECK(rustsecp256k1_v0_9_0_keypair_create(CTX, &keypair, sk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &internal_pk, NULL, &keypair) == 1);
     /* In actual taproot the tweak would be hash of internal_pk */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, tweak, &internal_pk) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 1);
-    CHECK(rustsecp256k1_v0_8_1_keypair_xonly_pub(ctx, &output_pk, &pk_parity, &keypair) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, output_pk_bytes, &output_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, tweak, &internal_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_keypair_xonly_pub(CTX, &output_pk, &pk_parity, &keypair) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, output_pk_bytes, &output_pk) == 1);
 
     /* Key spend */
-    rustsecp256k1_v0_8_1_testrand256(msg);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig, msg, &keypair, NULL) == 1);
+    rustsecp256k1_v0_9_0_testrand256(msg);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_sign32(CTX, sig, msg, &keypair, NULL) == 1);
     /* Verify key spend */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &output_pk, output_pk_bytes) == 1);
-    CHECK(rustsecp256k1_v0_8_1_schnorrsig_verify(ctx, sig, msg, sizeof(msg), &output_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &output_pk, output_pk_bytes) == 1);
+    CHECK(rustsecp256k1_v0_9_0_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &output_pk) == 1);
 
     /* Script spend */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_serialize(ctx, internal_pk_bytes, &internal_pk) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_serialize(CTX, internal_pk_bytes, &internal_pk) == 1);
     /* Verify script spend */
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_parse(ctx, &internal_pk, internal_pk_bytes) == 1);
-    CHECK(rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check(ctx, output_pk_bytes, pk_parity, &internal_pk, tweak) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_parse(CTX, &internal_pk, internal_pk_bytes) == 1);
+    CHECK(rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check(CTX, output_pk_bytes, pk_parity, &internal_pk, tweak) == 1);
 }
 
-void run_schnorrsig_tests(void) {
+static void run_schnorrsig_tests(void) {
     int i;
     run_nonce_function_bip340_tests();
 
     test_schnorrsig_api();
     test_schnorrsig_sha256_tagged();
     test_schnorrsig_bip_vectors();
-    for (i = 0; i < count; i++) {
+    for (i = 0; i < COUNT; i++) {
         test_schnorrsig_sign();
         test_schnorrsig_sign_verify();
     }
diff --git a/secp256k1-sys/depend/secp256k1/src/precompute_ecmult.c b/secp256k1-sys/depend/secp256k1/src/precompute_ecmult.c
index 70d28303d..644e573d7 100644
--- a/secp256k1-sys/depend/secp256k1/src/precompute_ecmult.c
+++ b/secp256k1-sys/depend/secp256k1/src/precompute_ecmult.c
@@ -7,12 +7,6 @@
 #include <inttypes.h>
 #include <stdio.h>
 
-/* Autotools creates libsecp256k1-config.h, of which ECMULT_WINDOW_SIZE is needed.
-   ifndef guard so downstream users can define their own if they do not use autotools. */
-#if !defined(ECMULT_WINDOW_SIZE)
-#include "libsecp256k1-config.h"
-#endif
-
 #include "../include/secp256k1.h"
 
 #include "assumptions.h"
@@ -24,11 +18,11 @@
 #include "ecmult.h"
 #include "ecmult_compute_table_impl.h"
 
-static void print_table(FILE *fp, const char *name, int window_g, const rustsecp256k1_v0_8_1_ge_storage* table) {
+static void print_table(FILE *fp, const char *name, int window_g, const rustsecp256k1_v0_9_0_ge_storage* table) {
     int j;
     int i;
 
-    fprintf(fp, "const rustsecp256k1_v0_8_1_ge_storage %s[ECMULT_TABLE_SIZE(WINDOW_G)] = {\n", name);
+    fprintf(fp, "const rustsecp256k1_v0_9_0_ge_storage %s[ECMULT_TABLE_SIZE(WINDOW_G)] = {\n", name);
     fprintf(fp, " S(%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32
                   ",%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32",%"PRIx32")\n",
                 SECP256K1_GE_STORAGE_CONST_GET(table[0]));
@@ -47,13 +41,13 @@ static void print_table(FILE *fp, const char *name, int window_g, const rustsecp
 }
 
 static void print_two_tables(FILE *fp, int window_g) {
-    rustsecp256k1_v0_8_1_ge_storage* table = malloc(ECMULT_TABLE_SIZE(window_g) * sizeof(rustsecp256k1_v0_8_1_ge_storage));
-    rustsecp256k1_v0_8_1_ge_storage* table_128 = malloc(ECMULT_TABLE_SIZE(window_g) * sizeof(rustsecp256k1_v0_8_1_ge_storage));
+    rustsecp256k1_v0_9_0_ge_storage* table = malloc(ECMULT_TABLE_SIZE(window_g) * sizeof(rustsecp256k1_v0_9_0_ge_storage));
+    rustsecp256k1_v0_9_0_ge_storage* table_128 = malloc(ECMULT_TABLE_SIZE(window_g) * sizeof(rustsecp256k1_v0_9_0_ge_storage));
 
-    rustsecp256k1_v0_8_1_ecmult_compute_two_tables(table, table_128, window_g, &rustsecp256k1_v0_8_1_ge_const_g);
+    rustsecp256k1_v0_9_0_ecmult_compute_two_tables(table, table_128, window_g, &rustsecp256k1_v0_9_0_ge_const_g);
 
-    print_table(fp, "rustsecp256k1_v0_8_1_pre_g", window_g, table);
-    print_table(fp, "rustsecp256k1_v0_8_1_pre_g_128", window_g, table_128);
+    print_table(fp, "rustsecp256k1_v0_9_0_pre_g", window_g, table);
+    print_table(fp, "rustsecp256k1_v0_9_0_pre_g_128", window_g, table_128);
 
     free(table);
     free(table_128);
@@ -62,22 +56,19 @@ static void print_two_tables(FILE *fp, int window_g) {
 int main(void) {
     /* Always compute all tables for window sizes up to 15. */
     int window_g = (ECMULT_WINDOW_SIZE < 15) ? 15 : ECMULT_WINDOW_SIZE;
+    const char outfile[] = "src/precomputed_ecmult.c";
     FILE* fp;
 
-    fp = fopen("src/precomputed_ecmult.c","w");
+    fp = fopen(outfile, "w");
     if (fp == NULL) {
-        fprintf(stderr, "Could not open src/precomputed_ecmult.h for writing!\n");
+        fprintf(stderr, "Could not open %s for writing!\n", outfile);
         return -1;
     }
 
     fprintf(fp, "/* This file was automatically generated by precompute_ecmult. */\n");
-    fprintf(fp, "/* This file contains an array rustsecp256k1_v0_8_1_pre_g with odd multiples of the base point G and\n");
-    fprintf(fp, " * an array rustsecp256k1_v0_8_1_pre_g_128 with odd multiples of 2^128*G for accelerating the computation of a*P + b*G.\n");
+    fprintf(fp, "/* This file contains an array rustsecp256k1_v0_9_0_pre_g with odd multiples of the base point G and\n");
+    fprintf(fp, " * an array rustsecp256k1_v0_9_0_pre_g_128 with odd multiples of 2^128*G for accelerating the computation of a*P + b*G.\n");
     fprintf(fp, " */\n");
-    fprintf(fp, "#if defined HAVE_CONFIG_H\n");
-    fprintf(fp, "#    include \"libsecp256k1-config.h\"\n");
-    fprintf(fp, "#endif\n");
-    fprintf(fp, "#include \"../include/secp256k1.h\"\n");
     fprintf(fp, "#include \"group.h\"\n");
     fprintf(fp, "#include \"ecmult.h\"\n");
     fprintf(fp, "#include \"precomputed_ecmult.h\"\n");
diff --git a/secp256k1-sys/depend/secp256k1/src/precompute_ecmult_gen.c b/secp256k1-sys/depend/secp256k1/src/precompute_ecmult_gen.c
index ae1f9c67e..169292766 100644
--- a/secp256k1-sys/depend/secp256k1/src/precompute_ecmult_gen.c
+++ b/secp256k1-sys/depend/secp256k1/src/precompute_ecmult_gen.c
@@ -33,10 +33,6 @@ int main(int argc, char **argv) {
 
     fprintf(fp, "/* This file was automatically generated by precompute_ecmult_gen. */\n");
     fprintf(fp, "/* See ecmult_gen_impl.h for details about the contents of this file. */\n");
-    fprintf(fp, "#if defined HAVE_CONFIG_H\n");
-    fprintf(fp, "#    include \"libsecp256k1-config.h\"\n");
-    fprintf(fp, "#endif\n");
-    fprintf(fp, "#include \"../include/secp256k1.h\"\n");
     fprintf(fp, "#include \"group.h\"\n");
     fprintf(fp, "#include \"ecmult_gen.h\"\n");
     fprintf(fp, "#include \"precomputed_ecmult_gen.h\"\n");
@@ -44,15 +40,15 @@ int main(int argc, char **argv) {
     fprintf(fp, "#    error Cannot compile precomputed_ecmult_gen.c in exhaustive test mode\n");
     fprintf(fp, "#endif /* EXHAUSTIVE_TEST_ORDER */\n");
     fprintf(fp, "#define S(a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p) SECP256K1_GE_STORAGE_CONST(0x##a##u,0x##b##u,0x##c##u,0x##d##u,0x##e##u,0x##f##u,0x##g##u,0x##h##u,0x##i##u,0x##j##u,0x##k##u,0x##l##u,0x##m##u,0x##n##u,0x##o##u,0x##p##u)\n");
-    fprintf(fp, "const rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_ecmult_gen_prec_table[ECMULT_GEN_PREC_N(ECMULT_GEN_PREC_BITS)][ECMULT_GEN_PREC_G(ECMULT_GEN_PREC_BITS)] = {\n");
+    fprintf(fp, "const rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_ecmult_gen_prec_table[ECMULT_GEN_PREC_N(ECMULT_GEN_PREC_BITS)][ECMULT_GEN_PREC_G(ECMULT_GEN_PREC_BITS)] = {\n");
 
     for (bits = 2; bits <= 8; bits *= 2) {
         int g = ECMULT_GEN_PREC_G(bits);
         int n = ECMULT_GEN_PREC_N(bits);
         int inner, outer;
 
-        rustsecp256k1_v0_8_1_ge_storage* table = checked_malloc(&default_error_callback, n * g * sizeof(rustsecp256k1_v0_8_1_ge_storage));
-        rustsecp256k1_v0_8_1_ecmult_gen_compute_table(table, &rustsecp256k1_v0_8_1_ge_const_g, bits);
+        rustsecp256k1_v0_9_0_ge_storage* table = checked_malloc(&default_error_callback, n * g * sizeof(rustsecp256k1_v0_9_0_ge_storage));
+        rustsecp256k1_v0_9_0_ecmult_gen_compute_table(table, &rustsecp256k1_v0_9_0_ge_const_g, bits);
 
         fprintf(fp, "#if ECMULT_GEN_PREC_BITS == %d\n", bits);
         for(outer = 0; outer != n; outer++) {
diff --git a/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult.c b/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult.c
index 8e6c9fd04..5cc74cfc3 100644
--- a/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult.c
+++ b/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult.c
@@ -1,11 +1,7 @@
 /* This file was automatically generated by precompute_ecmult. */
-/* This file contains an array rustsecp256k1_v0_8_1_pre_g with odd multiples of the base point G and
- * an array rustsecp256k1_v0_8_1_pre_g_128 with odd multiples of 2^128*G for accelerating the computation of a*P + b*G.
+/* This file contains an array rustsecp256k1_v0_9_0_pre_g with odd multiples of the base point G and
+ * an array rustsecp256k1_v0_9_0_pre_g_128 with odd multiples of 2^128*G for accelerating the computation of a*P + b*G.
  */
-#if defined HAVE_CONFIG_H
-#    include "libsecp256k1-config.h"
-#endif
-#include "../include/secp256k1.h"
 #include "group.h"
 #include "ecmult.h"
 #include "precomputed_ecmult.h"
@@ -17,7 +13,7 @@
 #    error Cannot compile precomputed_ecmult.c in exhaustive test mode
 #endif /* EXHAUSTIVE_TEST_ORDER */
 #define WINDOW_G ECMULT_WINDOW_SIZE
-const rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_pre_g[ECMULT_TABLE_SIZE(WINDOW_G)] = {
+const rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_pre_g[ECMULT_TABLE_SIZE(WINDOW_G)] = {
  S(79be667e,f9dcbbac,55a06295,ce870b07,29bfcdb,2dce28d9,59f2815b,16f81798,483ada77,26a3c465,5da4fbfc,e1108a8,fd17b448,a6855419,9c47d08f,fb10d4b8)
 #if WINDOW_G > 2
 ,S(f9308a01,9258c310,49344f85,f89d5229,b531c845,836f99b0,8601f113,bce036f9,388f7b0f,632de814,fe337e6,2a37f356,6500a999,34c2231b,6cb9fd75,84b8e672)
@@ -8237,7 +8233,7 @@ const rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_pre_g[ECMULT_TABLE_SI
 ,S(1e70619c,381a6adc,e5d925e0,c9c74f97,3c02ff64,ff2662d7,34efc485,d2bce895,c923f771,f543ffed,42935c28,8474aaaf,80a46ad4,3c579ce0,bb5e663d,668b24b3)
 #endif
 };
-const rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_pre_g_128[ECMULT_TABLE_SIZE(WINDOW_G)] = {
+const rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_pre_g_128[ECMULT_TABLE_SIZE(WINDOW_G)] = {
  S(8f68b9d2,f63b5f33,9239c1ad,981f162e,e88c5678,723ea335,1b7b444c,9ec4c0da,662a9f2d,ba063986,de1d90c2,b6be215d,bbea2cfe,95510bfd,f23cbf79,501fff82)
 #if WINDOW_G > 2
 ,S(38381dbe,2e509f22,8ba93363,f2451f08,fd845cb3,51d954be,18e2b8ed,d23809fa,e4a32d0a,fb917dc,b09405a5,520eb1cc,3681fccb,32d8f24d,bd707518,331fed52)
diff --git a/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult.h b/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult.h
index 95441c2cb..b00f27a16 100644
--- a/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult.h
+++ b/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult.h
@@ -11,21 +11,24 @@
 extern "C" {
 #endif
 
+#include "ecmult.h"
 #include "group.h"
 #if defined(EXHAUSTIVE_TEST_ORDER)
-#if EXHAUSTIVE_TEST_ORDER == 13
+#    if EXHAUSTIVE_TEST_ORDER == 7
+#        define WINDOW_G 3
+#    elif EXHAUSTIVE_TEST_ORDER == 13
 #        define WINDOW_G 4
 #    elif EXHAUSTIVE_TEST_ORDER == 199
 #        define WINDOW_G 8
 #    else
 #        error No known generator for the specified exhaustive test group order.
 #    endif
-static rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_pre_g[ECMULT_TABLE_SIZE(WINDOW_G)];
-static rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_pre_g_128[ECMULT_TABLE_SIZE(WINDOW_G)];
+static rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_pre_g[ECMULT_TABLE_SIZE(WINDOW_G)];
+static rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_pre_g_128[ECMULT_TABLE_SIZE(WINDOW_G)];
 #else /* !defined(EXHAUSTIVE_TEST_ORDER) */
 #    define WINDOW_G ECMULT_WINDOW_SIZE
-extern const rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_pre_g[ECMULT_TABLE_SIZE(WINDOW_G)];
-extern const rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_pre_g_128[ECMULT_TABLE_SIZE(WINDOW_G)];
+extern const rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_pre_g[ECMULT_TABLE_SIZE(WINDOW_G)];
+extern const rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_pre_g_128[ECMULT_TABLE_SIZE(WINDOW_G)];
 #endif /* defined(EXHAUSTIVE_TEST_ORDER) */
 
 #ifdef __cplusplus
diff --git a/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult_gen.c b/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult_gen.c
index 7ffe87915..f073822b2 100644
--- a/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult_gen.c
+++ b/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult_gen.c
@@ -1,9 +1,5 @@
 /* This file was automatically generated by precompute_ecmult_gen. */
 /* See ecmult_gen_impl.h for details about the contents of this file. */
-#if defined HAVE_CONFIG_H
-#    include "libsecp256k1-config.h"
-#endif
-#include "../include/secp256k1.h"
 #include "group.h"
 #include "ecmult_gen.h"
 #include "precomputed_ecmult_gen.h"
@@ -11,7 +7,7 @@
 #    error Cannot compile precomputed_ecmult_gen.c in exhaustive test mode
 #endif /* EXHAUSTIVE_TEST_ORDER */
 #define S(a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p) SECP256K1_GE_STORAGE_CONST(0x##a##u,0x##b##u,0x##c##u,0x##d##u,0x##e##u,0x##f##u,0x##g##u,0x##h##u,0x##i##u,0x##j##u,0x##k##u,0x##l##u,0x##m##u,0x##n##u,0x##o##u,0x##p##u)
-const rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_ecmult_gen_prec_table[ECMULT_GEN_PREC_N(ECMULT_GEN_PREC_BITS)][ECMULT_GEN_PREC_G(ECMULT_GEN_PREC_BITS)] = {
+const rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_ecmult_gen_prec_table[ECMULT_GEN_PREC_N(ECMULT_GEN_PREC_BITS)][ECMULT_GEN_PREC_G(ECMULT_GEN_PREC_BITS)] = {
 #if ECMULT_GEN_PREC_BITS == 2
 {S(3a9ed373,6eed3eec,9aeb5ac0,21b54652,56817b1f,8de6cd0,fbcee548,ba044bb5,7bcc5928,bdc9c023,dfc663b8,9e4f6969,ab751798,8e600ec1,d242010c,45c7974a),
 S(e44d7675,c3cb2857,4e133c01,a74f4afc,5ce684f8,4a789711,603f7c4f,50abef58,25bcb62f,fe2e2ce2,196ad86c,a006e20,8c64d21b,b25320a3,b5574b9c,1e1bfb4b),
diff --git a/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult_gen.h b/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult_gen.h
index 7c4d56933..253a37b06 100644
--- a/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult_gen.h
+++ b/secp256k1-sys/depend/secp256k1/src/precomputed_ecmult_gen.h
@@ -14,9 +14,9 @@ extern "C" {
 #include "group.h"
 #include "ecmult_gen.h"
 #ifdef EXHAUSTIVE_TEST_ORDER
-static rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_ecmult_gen_prec_table[ECMULT_GEN_PREC_N(ECMULT_GEN_PREC_BITS)][ECMULT_GEN_PREC_G(ECMULT_GEN_PREC_BITS)];
+static rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_ecmult_gen_prec_table[ECMULT_GEN_PREC_N(ECMULT_GEN_PREC_BITS)][ECMULT_GEN_PREC_G(ECMULT_GEN_PREC_BITS)];
 #else
-extern const rustsecp256k1_v0_8_1_ge_storage rustsecp256k1_v0_8_1_ecmult_gen_prec_table[ECMULT_GEN_PREC_N(ECMULT_GEN_PREC_BITS)][ECMULT_GEN_PREC_G(ECMULT_GEN_PREC_BITS)];
+extern const rustsecp256k1_v0_9_0_ge_storage rustsecp256k1_v0_9_0_ecmult_gen_prec_table[ECMULT_GEN_PREC_N(ECMULT_GEN_PREC_BITS)][ECMULT_GEN_PREC_G(ECMULT_GEN_PREC_BITS)];
 #endif /* defined(EXHAUSTIVE_TEST_ORDER) */
 
 #ifdef __cplusplus
diff --git a/secp256k1-sys/depend/secp256k1/src/scalar.h b/secp256k1-sys/depend/secp256k1/src/scalar.h
index 6936c19d8..63a89ab94 100644
--- a/secp256k1-sys/depend/secp256k1/src/scalar.h
+++ b/secp256k1-sys/depend/secp256k1/src/scalar.h
@@ -9,10 +9,6 @@
 
 #include "util.h"
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
-
 #if defined(EXHAUSTIVE_TEST_ORDER)
 #include "scalar_low.h"
 #elif defined(SECP256K1_WIDEMUL_INT128)
@@ -24,82 +20,86 @@
 #endif
 
 /** Clear a scalar to prevent the leak of sensitive data. */
-static void rustsecp256k1_v0_8_1_scalar_clear(rustsecp256k1_v0_8_1_scalar *r);
+static void rustsecp256k1_v0_9_0_scalar_clear(rustsecp256k1_v0_9_0_scalar *r);
 
 /** Access bits from a scalar. All requested bits must belong to the same 32-bit limb. */
-static unsigned int rustsecp256k1_v0_8_1_scalar_get_bits(const rustsecp256k1_v0_8_1_scalar *a, unsigned int offset, unsigned int count);
+static unsigned int rustsecp256k1_v0_9_0_scalar_get_bits(const rustsecp256k1_v0_9_0_scalar *a, unsigned int offset, unsigned int count);
 
 /** Access bits from a scalar. Not constant time. */
-static unsigned int rustsecp256k1_v0_8_1_scalar_get_bits_var(const rustsecp256k1_v0_8_1_scalar *a, unsigned int offset, unsigned int count);
+static unsigned int rustsecp256k1_v0_9_0_scalar_get_bits_var(const rustsecp256k1_v0_9_0_scalar *a, unsigned int offset, unsigned int count);
 
 /** Set a scalar from a big endian byte array. The scalar will be reduced modulo group order `n`.
  * In:      bin:        pointer to a 32-byte array.
  * Out:     r:          scalar to be set.
  *          overflow:   non-zero if the scalar was bigger or equal to `n` before reduction, zero otherwise (can be NULL).
  */
-static void rustsecp256k1_v0_8_1_scalar_set_b32(rustsecp256k1_v0_8_1_scalar *r, const unsigned char *bin, int *overflow);
+static void rustsecp256k1_v0_9_0_scalar_set_b32(rustsecp256k1_v0_9_0_scalar *r, const unsigned char *bin, int *overflow);
 
 /** Set a scalar from a big endian byte array and returns 1 if it is a valid
  *  seckey and 0 otherwise. */
-static int rustsecp256k1_v0_8_1_scalar_set_b32_seckey(rustsecp256k1_v0_8_1_scalar *r, const unsigned char *bin);
+static int rustsecp256k1_v0_9_0_scalar_set_b32_seckey(rustsecp256k1_v0_9_0_scalar *r, const unsigned char *bin);
 
 /** Set a scalar to an unsigned integer. */
-static void rustsecp256k1_v0_8_1_scalar_set_int(rustsecp256k1_v0_8_1_scalar *r, unsigned int v);
+static void rustsecp256k1_v0_9_0_scalar_set_int(rustsecp256k1_v0_9_0_scalar *r, unsigned int v);
 
 /** Convert a scalar to a byte array. */
-static void rustsecp256k1_v0_8_1_scalar_get_b32(unsigned char *bin, const rustsecp256k1_v0_8_1_scalar* a);
+static void rustsecp256k1_v0_9_0_scalar_get_b32(unsigned char *bin, const rustsecp256k1_v0_9_0_scalar* a);
 
 /** Add two scalars together (modulo the group order). Returns whether it overflowed. */
-static int rustsecp256k1_v0_8_1_scalar_add(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b);
+static int rustsecp256k1_v0_9_0_scalar_add(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b);
 
 /** Conditionally add a power of two to a scalar. The result is not allowed to overflow. */
-static void rustsecp256k1_v0_8_1_scalar_cadd_bit(rustsecp256k1_v0_8_1_scalar *r, unsigned int bit, int flag);
+static void rustsecp256k1_v0_9_0_scalar_cadd_bit(rustsecp256k1_v0_9_0_scalar *r, unsigned int bit, int flag);
 
 /** Multiply two scalars (modulo the group order). */
-static void rustsecp256k1_v0_8_1_scalar_mul(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b);
+static void rustsecp256k1_v0_9_0_scalar_mul(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b);
 
 /** Shift a scalar right by some amount strictly between 0 and 16, returning
  *  the low bits that were shifted off */
-static int rustsecp256k1_v0_8_1_scalar_shr_int(rustsecp256k1_v0_8_1_scalar *r, int n);
+static int rustsecp256k1_v0_9_0_scalar_shr_int(rustsecp256k1_v0_9_0_scalar *r, int n);
 
 /** Compute the inverse of a scalar (modulo the group order). */
-static void rustsecp256k1_v0_8_1_scalar_inverse(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a);
+static void rustsecp256k1_v0_9_0_scalar_inverse(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a);
 
 /** Compute the inverse of a scalar (modulo the group order), without constant-time guarantee. */
-static void rustsecp256k1_v0_8_1_scalar_inverse_var(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a);
+static void rustsecp256k1_v0_9_0_scalar_inverse_var(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a);
 
 /** Compute the complement of a scalar (modulo the group order). */
-static void rustsecp256k1_v0_8_1_scalar_negate(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a);
+static void rustsecp256k1_v0_9_0_scalar_negate(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a);
 
 /** Check whether a scalar equals zero. */
-static int rustsecp256k1_v0_8_1_scalar_is_zero(const rustsecp256k1_v0_8_1_scalar *a);
+static int rustsecp256k1_v0_9_0_scalar_is_zero(const rustsecp256k1_v0_9_0_scalar *a);
 
 /** Check whether a scalar equals one. */
-static int rustsecp256k1_v0_8_1_scalar_is_one(const rustsecp256k1_v0_8_1_scalar *a);
+static int rustsecp256k1_v0_9_0_scalar_is_one(const rustsecp256k1_v0_9_0_scalar *a);
 
 /** Check whether a scalar, considered as an nonnegative integer, is even. */
-static int rustsecp256k1_v0_8_1_scalar_is_even(const rustsecp256k1_v0_8_1_scalar *a);
+static int rustsecp256k1_v0_9_0_scalar_is_even(const rustsecp256k1_v0_9_0_scalar *a);
 
 /** Check whether a scalar is higher than the group order divided by 2. */
-static int rustsecp256k1_v0_8_1_scalar_is_high(const rustsecp256k1_v0_8_1_scalar *a);
+static int rustsecp256k1_v0_9_0_scalar_is_high(const rustsecp256k1_v0_9_0_scalar *a);
 
 /** Conditionally negate a number, in constant time.
  * Returns -1 if the number was negated, 1 otherwise */
-static int rustsecp256k1_v0_8_1_scalar_cond_negate(rustsecp256k1_v0_8_1_scalar *a, int flag);
+static int rustsecp256k1_v0_9_0_scalar_cond_negate(rustsecp256k1_v0_9_0_scalar *a, int flag);
 
 /** Compare two scalars. */
-static int rustsecp256k1_v0_8_1_scalar_eq(const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b);
+static int rustsecp256k1_v0_9_0_scalar_eq(const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b);
 
 /** Find r1 and r2 such that r1+r2*2^128 = k. */
-static void rustsecp256k1_v0_8_1_scalar_split_128(rustsecp256k1_v0_8_1_scalar *r1, rustsecp256k1_v0_8_1_scalar *r2, const rustsecp256k1_v0_8_1_scalar *k);
-/** Find r1 and r2 such that r1+r2*lambda = k,
- * where r1 and r2 or their negations are maximum 128 bits long (see rustsecp256k1_v0_8_1_ge_mul_lambda). */
-static void rustsecp256k1_v0_8_1_scalar_split_lambda(rustsecp256k1_v0_8_1_scalar *r1, rustsecp256k1_v0_8_1_scalar *r2, const rustsecp256k1_v0_8_1_scalar *k);
+static void rustsecp256k1_v0_9_0_scalar_split_128(rustsecp256k1_v0_9_0_scalar *r1, rustsecp256k1_v0_9_0_scalar *r2, const rustsecp256k1_v0_9_0_scalar *k);
+/** Find r1 and r2 such that r1+r2*lambda = k, where r1 and r2 or their
+ *  negations are maximum 128 bits long (see rustsecp256k1_v0_9_0_ge_mul_lambda). It is
+ *  required that r1, r2, and k all point to different objects. */
+static void rustsecp256k1_v0_9_0_scalar_split_lambda(rustsecp256k1_v0_9_0_scalar * SECP256K1_RESTRICT r1, rustsecp256k1_v0_9_0_scalar * SECP256K1_RESTRICT r2, const rustsecp256k1_v0_9_0_scalar * SECP256K1_RESTRICT k);
 
 /** Multiply a and b (without taking the modulus!), divide by 2**shift, and round to the nearest integer. Shift must be at least 256. */
-static void rustsecp256k1_v0_8_1_scalar_mul_shift_var(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b, unsigned int shift);
+static void rustsecp256k1_v0_9_0_scalar_mul_shift_var(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b, unsigned int shift);
 
 /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time.  Both *r and *a must be initialized.*/
-static void rustsecp256k1_v0_8_1_scalar_cmov(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, int flag);
+static void rustsecp256k1_v0_9_0_scalar_cmov(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, int flag);
+
+/** Check invariants on a scalar (no-op unless VERIFY is enabled). */
+static void rustsecp256k1_v0_9_0_scalar_verify(const rustsecp256k1_v0_9_0_scalar *r);
 
 #endif /* SECP256K1_SCALAR_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/scalar_4x64.h b/secp256k1-sys/depend/secp256k1/src/scalar_4x64.h
index de40e3897..336992bf0 100644
--- a/secp256k1-sys/depend/secp256k1/src/scalar_4x64.h
+++ b/secp256k1-sys/depend/secp256k1/src/scalar_4x64.h
@@ -12,7 +12,7 @@
 /** A scalar modulo the group order of the secp256k1 curve. */
 typedef struct {
     uint64_t d[4];
-} rustsecp256k1_v0_8_1_scalar;
+} rustsecp256k1_v0_9_0_scalar;
 
 #define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
 
diff --git a/secp256k1-sys/depend/secp256k1/src/scalar_4x64_impl.h b/secp256k1-sys/depend/secp256k1/src/scalar_4x64_impl.h
index daead747d..af9ebabeb 100644
--- a/secp256k1-sys/depend/secp256k1/src/scalar_4x64_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/scalar_4x64_impl.h
@@ -7,8 +7,10 @@
 #ifndef SECP256K1_SCALAR_REPR_IMPL_H
 #define SECP256K1_SCALAR_REPR_IMPL_H
 
+#include "checkmem.h"
 #include "int128.h"
 #include "modinv64_impl.h"
+#include "util.h"
 
 /* Limbs of the secp256k1 order. */
 #define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
@@ -27,37 +29,43 @@
 #define SECP256K1_N_H_2 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
 #define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL)
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_clear(rustsecp256k1_v0_8_1_scalar *r) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_scalar_clear(rustsecp256k1_v0_9_0_scalar *r) {
     r->d[0] = 0;
     r->d[1] = 0;
     r->d[2] = 0;
     r->d[3] = 0;
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_set_int(rustsecp256k1_v0_8_1_scalar *r, unsigned int v) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_scalar_set_int(rustsecp256k1_v0_9_0_scalar *r, unsigned int v) {
     r->d[0] = v;
     r->d[1] = 0;
     r->d[2] = 0;
     r->d[3] = 0;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-SECP256K1_INLINE static unsigned int rustsecp256k1_v0_8_1_scalar_get_bits(const rustsecp256k1_v0_8_1_scalar *a, unsigned int offset, unsigned int count) {
+SECP256K1_INLINE static unsigned int rustsecp256k1_v0_9_0_scalar_get_bits(const rustsecp256k1_v0_9_0_scalar *a, unsigned int offset, unsigned int count) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
     VERIFY_CHECK((offset + count - 1) >> 6 == offset >> 6);
+
     return (a->d[offset >> 6] >> (offset & 0x3F)) & ((((uint64_t)1) << count) - 1);
 }
 
-SECP256K1_INLINE static unsigned int rustsecp256k1_v0_8_1_scalar_get_bits_var(const rustsecp256k1_v0_8_1_scalar *a, unsigned int offset, unsigned int count) {
+SECP256K1_INLINE static unsigned int rustsecp256k1_v0_9_0_scalar_get_bits_var(const rustsecp256k1_v0_9_0_scalar *a, unsigned int offset, unsigned int count) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
     VERIFY_CHECK(count < 32);
     VERIFY_CHECK(offset + count <= 256);
+
     if ((offset + count - 1) >> 6 == offset >> 6) {
-        return rustsecp256k1_v0_8_1_scalar_get_bits(a, offset, count);
+        return rustsecp256k1_v0_9_0_scalar_get_bits(a, offset, count);
     } else {
         VERIFY_CHECK((offset >> 6) + 1 < 4);
         return ((a->d[offset >> 6] >> (offset & 0x3F)) | (a->d[(offset >> 6) + 1] << (64 - (offset & 0x3F)))) & ((((uint64_t)1) << count) - 1);
     }
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_check_overflow(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_check_overflow(const rustsecp256k1_v0_9_0_scalar *a) {
     int yes = 0;
     int no = 0;
     no |= (a->d[3] < SECP256K1_N_3); /* No need for a > check. */
@@ -69,112 +77,139 @@ SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_check_overflow(const rus
     return yes;
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_reduce(rustsecp256k1_v0_8_1_scalar *r, unsigned int overflow) {
-    rustsecp256k1_v0_8_1_uint128 t;
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_reduce(rustsecp256k1_v0_9_0_scalar *r, unsigned int overflow) {
+    rustsecp256k1_v0_9_0_uint128 t;
     VERIFY_CHECK(overflow <= 1);
-    rustsecp256k1_v0_8_1_u128_from_u64(&t, r->d[0]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, overflow * SECP256K1_N_C_0);
-    r->d[0] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, r->d[1]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, overflow * SECP256K1_N_C_1);
-    r->d[1] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, r->d[2]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, overflow * SECP256K1_N_C_2);
-    r->d[2] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, r->d[3]);
-    r->d[3] = rustsecp256k1_v0_8_1_u128_to_u64(&t);
+
+    rustsecp256k1_v0_9_0_u128_from_u64(&t, r->d[0]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, overflow * SECP256K1_N_C_0);
+    r->d[0] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, r->d[1]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, overflow * SECP256K1_N_C_1);
+    r->d[1] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, r->d[2]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, overflow * SECP256K1_N_C_2);
+    r->d[2] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, r->d[3]);
+    r->d[3] = rustsecp256k1_v0_9_0_u128_to_u64(&t);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return overflow;
 }
 
-static int rustsecp256k1_v0_8_1_scalar_add(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+static int rustsecp256k1_v0_9_0_scalar_add(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
     int overflow;
-    rustsecp256k1_v0_8_1_uint128 t;
-    rustsecp256k1_v0_8_1_u128_from_u64(&t, a->d[0]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, b->d[0]);
-    r->d[0] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, a->d[1]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, b->d[1]);
-    r->d[1] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, a->d[2]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, b->d[2]);
-    r->d[2] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, a->d[3]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, b->d[3]);
-    r->d[3] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    overflow = rustsecp256k1_v0_8_1_u128_to_u64(&t) + rustsecp256k1_v0_8_1_scalar_check_overflow(r);
+    rustsecp256k1_v0_9_0_uint128 t;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
+
+    rustsecp256k1_v0_9_0_u128_from_u64(&t, a->d[0]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, b->d[0]);
+    r->d[0] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, a->d[1]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, b->d[1]);
+    r->d[1] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, a->d[2]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, b->d[2]);
+    r->d[2] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, a->d[3]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, b->d[3]);
+    r->d[3] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    overflow = rustsecp256k1_v0_9_0_u128_to_u64(&t) + rustsecp256k1_v0_9_0_scalar_check_overflow(r);
     VERIFY_CHECK(overflow == 0 || overflow == 1);
-    rustsecp256k1_v0_8_1_scalar_reduce(r, overflow);
+    rustsecp256k1_v0_9_0_scalar_reduce(r, overflow);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return overflow;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_cadd_bit(rustsecp256k1_v0_8_1_scalar *r, unsigned int bit, int flag) {
-    rustsecp256k1_v0_8_1_uint128 t;
+static void rustsecp256k1_v0_9_0_scalar_cadd_bit(rustsecp256k1_v0_9_0_scalar *r, unsigned int bit, int flag) {
+    rustsecp256k1_v0_9_0_uint128 t;
+    volatile int vflag = flag;
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     VERIFY_CHECK(bit < 256);
-    bit += ((uint32_t) flag - 1) & 0x100;  /* forcing (bit >> 6) > 3 makes this a noop */
-    rustsecp256k1_v0_8_1_u128_from_u64(&t, r->d[0]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 0)) << (bit & 0x3F));
-    r->d[0] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, r->d[1]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 1)) << (bit & 0x3F));
-    r->d[1] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, r->d[2]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 2)) << (bit & 0x3F));
-    r->d[2] = rustsecp256k1_v0_8_1_u128_to_u64(&t); rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, r->d[3]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 3)) << (bit & 0x3F));
-    r->d[3] = rustsecp256k1_v0_8_1_u128_to_u64(&t);
+
+    bit += ((uint32_t) vflag - 1) & 0x100;  /* forcing (bit >> 6) > 3 makes this a noop */
+    rustsecp256k1_v0_9_0_u128_from_u64(&t, r->d[0]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 0)) << (bit & 0x3F));
+    r->d[0] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, r->d[1]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 1)) << (bit & 0x3F));
+    r->d[1] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, r->d[2]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 2)) << (bit & 0x3F));
+    r->d[2] = rustsecp256k1_v0_9_0_u128_to_u64(&t); rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, r->d[3]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 3)) << (bit & 0x3F));
+    r->d[3] = rustsecp256k1_v0_9_0_u128_to_u64(&t);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 #ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_u128_hi_u64(&t) == 0);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_u128_hi_u64(&t) == 0);
 #endif
 }
 
-static void rustsecp256k1_v0_8_1_scalar_set_b32(rustsecp256k1_v0_8_1_scalar *r, const unsigned char *b32, int *overflow) {
+static void rustsecp256k1_v0_9_0_scalar_set_b32(rustsecp256k1_v0_9_0_scalar *r, const unsigned char *b32, int *overflow) {
     int over;
-    r->d[0] = (uint64_t)b32[31] | (uint64_t)b32[30] << 8 | (uint64_t)b32[29] << 16 | (uint64_t)b32[28] << 24 | (uint64_t)b32[27] << 32 | (uint64_t)b32[26] << 40 | (uint64_t)b32[25] << 48 | (uint64_t)b32[24] << 56;
-    r->d[1] = (uint64_t)b32[23] | (uint64_t)b32[22] << 8 | (uint64_t)b32[21] << 16 | (uint64_t)b32[20] << 24 | (uint64_t)b32[19] << 32 | (uint64_t)b32[18] << 40 | (uint64_t)b32[17] << 48 | (uint64_t)b32[16] << 56;
-    r->d[2] = (uint64_t)b32[15] | (uint64_t)b32[14] << 8 | (uint64_t)b32[13] << 16 | (uint64_t)b32[12] << 24 | (uint64_t)b32[11] << 32 | (uint64_t)b32[10] << 40 | (uint64_t)b32[9] << 48 | (uint64_t)b32[8] << 56;
-    r->d[3] = (uint64_t)b32[7] | (uint64_t)b32[6] << 8 | (uint64_t)b32[5] << 16 | (uint64_t)b32[4] << 24 | (uint64_t)b32[3] << 32 | (uint64_t)b32[2] << 40 | (uint64_t)b32[1] << 48 | (uint64_t)b32[0] << 56;
-    over = rustsecp256k1_v0_8_1_scalar_reduce(r, rustsecp256k1_v0_8_1_scalar_check_overflow(r));
+    r->d[0] = rustsecp256k1_v0_9_0_read_be64(&b32[24]);
+    r->d[1] = rustsecp256k1_v0_9_0_read_be64(&b32[16]);
+    r->d[2] = rustsecp256k1_v0_9_0_read_be64(&b32[8]);
+    r->d[3] = rustsecp256k1_v0_9_0_read_be64(&b32[0]);
+    over = rustsecp256k1_v0_9_0_scalar_reduce(r, rustsecp256k1_v0_9_0_scalar_check_overflow(r));
     if (overflow) {
         *overflow = over;
     }
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_scalar_get_b32(unsigned char *bin, const rustsecp256k1_v0_8_1_scalar* a) {
-    bin[0] = a->d[3] >> 56; bin[1] = a->d[3] >> 48; bin[2] = a->d[3] >> 40; bin[3] = a->d[3] >> 32; bin[4] = a->d[3] >> 24; bin[5] = a->d[3] >> 16; bin[6] = a->d[3] >> 8; bin[7] = a->d[3];
-    bin[8] = a->d[2] >> 56; bin[9] = a->d[2] >> 48; bin[10] = a->d[2] >> 40; bin[11] = a->d[2] >> 32; bin[12] = a->d[2] >> 24; bin[13] = a->d[2] >> 16; bin[14] = a->d[2] >> 8; bin[15] = a->d[2];
-    bin[16] = a->d[1] >> 56; bin[17] = a->d[1] >> 48; bin[18] = a->d[1] >> 40; bin[19] = a->d[1] >> 32; bin[20] = a->d[1] >> 24; bin[21] = a->d[1] >> 16; bin[22] = a->d[1] >> 8; bin[23] = a->d[1];
-    bin[24] = a->d[0] >> 56; bin[25] = a->d[0] >> 48; bin[26] = a->d[0] >> 40; bin[27] = a->d[0] >> 32; bin[28] = a->d[0] >> 24; bin[29] = a->d[0] >> 16; bin[30] = a->d[0] >> 8; bin[31] = a->d[0];
+static void rustsecp256k1_v0_9_0_scalar_get_b32(unsigned char *bin, const rustsecp256k1_v0_9_0_scalar* a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
+    rustsecp256k1_v0_9_0_write_be64(&bin[0],  a->d[3]);
+    rustsecp256k1_v0_9_0_write_be64(&bin[8],  a->d[2]);
+    rustsecp256k1_v0_9_0_write_be64(&bin[16], a->d[1]);
+    rustsecp256k1_v0_9_0_write_be64(&bin[24], a->d[0]);
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_is_zero(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_is_zero(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return (a->d[0] | a->d[1] | a->d[2] | a->d[3]) == 0;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_negate(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a) {
-    uint64_t nonzero = 0xFFFFFFFFFFFFFFFFULL * (rustsecp256k1_v0_8_1_scalar_is_zero(a) == 0);
-    rustsecp256k1_v0_8_1_uint128 t;
-    rustsecp256k1_v0_8_1_u128_from_u64(&t, ~a->d[0]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, SECP256K1_N_0 + 1);
-    r->d[0] = rustsecp256k1_v0_8_1_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, ~a->d[1]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, SECP256K1_N_1);
-    r->d[1] = rustsecp256k1_v0_8_1_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, ~a->d[2]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, SECP256K1_N_2);
-    r->d[2] = rustsecp256k1_v0_8_1_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, ~a->d[3]);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, SECP256K1_N_3);
-    r->d[3] = rustsecp256k1_v0_8_1_u128_to_u64(&t) & nonzero;
-}
-
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_is_one(const rustsecp256k1_v0_8_1_scalar *a) {
+static void rustsecp256k1_v0_9_0_scalar_negate(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a) {
+    uint64_t nonzero = 0xFFFFFFFFFFFFFFFFULL * (rustsecp256k1_v0_9_0_scalar_is_zero(a) == 0);
+    rustsecp256k1_v0_9_0_uint128 t;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
+    rustsecp256k1_v0_9_0_u128_from_u64(&t, ~a->d[0]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, SECP256K1_N_0 + 1);
+    r->d[0] = rustsecp256k1_v0_9_0_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, ~a->d[1]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, SECP256K1_N_1);
+    r->d[1] = rustsecp256k1_v0_9_0_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, ~a->d[2]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, SECP256K1_N_2);
+    r->d[2] = rustsecp256k1_v0_9_0_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, ~a->d[3]);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, SECP256K1_N_3);
+    r->d[3] = rustsecp256k1_v0_9_0_u128_to_u64(&t) & nonzero;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
+}
+
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_is_one(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3]) == 0;
 }
 
-static int rustsecp256k1_v0_8_1_scalar_is_high(const rustsecp256k1_v0_8_1_scalar *a) {
+static int rustsecp256k1_v0_9_0_scalar_is_high(const rustsecp256k1_v0_9_0_scalar *a) {
     int yes = 0;
     int no = 0;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     no |= (a->d[3] < SECP256K1_N_H_3);
     yes |= (a->d[3] > SECP256K1_N_H_3) & ~no;
     no |= (a->d[2] < SECP256K1_N_H_2) & ~yes; /* No need for a > check. */
@@ -184,24 +219,29 @@ static int rustsecp256k1_v0_8_1_scalar_is_high(const rustsecp256k1_v0_8_1_scalar
     return yes;
 }
 
-static int rustsecp256k1_v0_8_1_scalar_cond_negate(rustsecp256k1_v0_8_1_scalar *r, int flag) {
+static int rustsecp256k1_v0_9_0_scalar_cond_negate(rustsecp256k1_v0_9_0_scalar *r, int flag) {
     /* If we are flag = 0, mask = 00...00 and this is a no-op;
-     * if we are flag = 1, mask = 11...11 and this is identical to rustsecp256k1_v0_8_1_scalar_negate */
-    uint64_t mask = !flag - 1;
-    uint64_t nonzero = (rustsecp256k1_v0_8_1_scalar_is_zero(r) != 0) - 1;
-    rustsecp256k1_v0_8_1_uint128 t;
-    rustsecp256k1_v0_8_1_u128_from_u64(&t, r->d[0] ^ mask);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, (SECP256K1_N_0 + 1) & mask);
-    r->d[0] = rustsecp256k1_v0_8_1_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, r->d[1] ^ mask);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, SECP256K1_N_1 & mask);
-    r->d[1] = rustsecp256k1_v0_8_1_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, r->d[2] ^ mask);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, SECP256K1_N_2 & mask);
-    r->d[2] = rustsecp256k1_v0_8_1_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_8_1_u128_rshift(&t, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, r->d[3] ^ mask);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&t, SECP256K1_N_3 & mask);
-    r->d[3] = rustsecp256k1_v0_8_1_u128_to_u64(&t) & nonzero;
+     * if we are flag = 1, mask = 11...11 and this is identical to rustsecp256k1_v0_9_0_scalar_negate */
+    volatile int vflag = flag;
+    uint64_t mask = -vflag;
+    uint64_t nonzero = (rustsecp256k1_v0_9_0_scalar_is_zero(r) != 0) - 1;
+    rustsecp256k1_v0_9_0_uint128 t;
+    rustsecp256k1_v0_9_0_scalar_verify(r);
+
+    rustsecp256k1_v0_9_0_u128_from_u64(&t, r->d[0] ^ mask);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, (SECP256K1_N_0 + 1) & mask);
+    r->d[0] = rustsecp256k1_v0_9_0_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, r->d[1] ^ mask);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, SECP256K1_N_1 & mask);
+    r->d[1] = rustsecp256k1_v0_9_0_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, r->d[2] ^ mask);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, SECP256K1_N_2 & mask);
+    r->d[2] = rustsecp256k1_v0_9_0_u128_to_u64(&t) & nonzero; rustsecp256k1_v0_9_0_u128_rshift(&t, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, r->d[3] ^ mask);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&t, SECP256K1_N_3 & mask);
+    r->d[3] = rustsecp256k1_v0_9_0_u128_to_u64(&t) & nonzero;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return 2 * (mask == 0) - 1;
 }
 
@@ -211,10 +251,10 @@ static int rustsecp256k1_v0_8_1_scalar_cond_negate(rustsecp256k1_v0_8_1_scalar *
 #define muladd(a,b) { \
     uint64_t tl, th; \
     { \
-        rustsecp256k1_v0_8_1_uint128 t; \
-        rustsecp256k1_v0_8_1_u128_mul(&t, a, b); \
-        th = rustsecp256k1_v0_8_1_u128_hi_u64(&t);  /* at most 0xFFFFFFFFFFFFFFFE */ \
-        tl = rustsecp256k1_v0_8_1_u128_to_u64(&t); \
+        rustsecp256k1_v0_9_0_uint128 t; \
+        rustsecp256k1_v0_9_0_u128_mul(&t, a, b); \
+        th = rustsecp256k1_v0_9_0_u128_hi_u64(&t);  /* at most 0xFFFFFFFFFFFFFFFE */ \
+        tl = rustsecp256k1_v0_9_0_u128_to_u64(&t); \
     } \
     c0 += tl;                 /* overflow is handled on the next line */ \
     th += (c0 < tl);          /* at most 0xFFFFFFFFFFFFFFFF */ \
@@ -227,10 +267,10 @@ static int rustsecp256k1_v0_8_1_scalar_cond_negate(rustsecp256k1_v0_8_1_scalar *
 #define muladd_fast(a,b) { \
     uint64_t tl, th; \
     { \
-        rustsecp256k1_v0_8_1_uint128 t; \
-        rustsecp256k1_v0_8_1_u128_mul(&t, a, b); \
-        th = rustsecp256k1_v0_8_1_u128_hi_u64(&t);  /* at most 0xFFFFFFFFFFFFFFFE */ \
-        tl = rustsecp256k1_v0_8_1_u128_to_u64(&t); \
+        rustsecp256k1_v0_9_0_uint128 t; \
+        rustsecp256k1_v0_9_0_u128_mul(&t, a, b); \
+        th = rustsecp256k1_v0_9_0_u128_hi_u64(&t);  /* at most 0xFFFFFFFFFFFFFFFE */ \
+        tl = rustsecp256k1_v0_9_0_u128_to_u64(&t); \
     } \
     c0 += tl;                 /* overflow is handled on the next line */ \
     th += (c0 < tl);          /* at most 0xFFFFFFFFFFFFFFFF */ \
@@ -271,7 +311,7 @@ static int rustsecp256k1_v0_8_1_scalar_cond_negate(rustsecp256k1_v0_8_1_scalar *
     VERIFY_CHECK(c2 == 0); \
 }
 
-static void rustsecp256k1_v0_8_1_scalar_reduce_512(rustsecp256k1_v0_8_1_scalar *r, const uint64_t *l) {
+static void rustsecp256k1_v0_9_0_scalar_reduce_512(rustsecp256k1_v0_9_0_scalar *r, const uint64_t *l) {
 #ifdef USE_ASM_X86_64
     /* Reduce 512 bits into 385. */
     uint64_t m0, m1, m2, m3, m4, m5, m6;
@@ -379,7 +419,7 @@ static void rustsecp256k1_v0_8_1_scalar_reduce_512(rustsecp256k1_v0_8_1_scalar *
     "movq %%r10, %q5\n"
     /* extract m6 */
     "movq %%r8, %q6\n"
-    : "=g"(m0), "=g"(m1), "=g"(m2), "=g"(m3), "=g"(m4), "=g"(m5), "=g"(m6)
+    : "=&g"(m0), "=&g"(m1), "=&g"(m2), "=g"(m3), "=g"(m4), "=g"(m5), "=g"(m6)
     : "S"(l), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
     : "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc");
 
@@ -508,7 +548,7 @@ static void rustsecp256k1_v0_8_1_scalar_reduce_512(rustsecp256k1_v0_8_1_scalar *
     : "g"(p0), "g"(p1), "g"(p2), "g"(p3), "g"(p4), "D"(r), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
     : "rax", "rdx", "r8", "r9", "r10", "cc", "memory");
 #else
-    rustsecp256k1_v0_8_1_uint128 c128;
+    rustsecp256k1_v0_9_0_uint128 c128;
     uint64_t c, c0, c1, c2;
     uint64_t n0 = l[4], n1 = l[5], n2 = l[6], n3 = l[7];
     uint64_t m0, m1, m2, m3, m4, m5;
@@ -566,25 +606,25 @@ static void rustsecp256k1_v0_8_1_scalar_reduce_512(rustsecp256k1_v0_8_1_scalar *
 
     /* Reduce 258 bits into 256. */
     /* r[0..3] = p[0..3] + p[4] * SECP256K1_N_C. */
-    rustsecp256k1_v0_8_1_u128_from_u64(&c128, p0);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c128, SECP256K1_N_C_0, p4);
-    r->d[0] = rustsecp256k1_v0_8_1_u128_to_u64(&c128); rustsecp256k1_v0_8_1_u128_rshift(&c128, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&c128, p1);
-    rustsecp256k1_v0_8_1_u128_accum_mul(&c128, SECP256K1_N_C_1, p4);
-    r->d[1] = rustsecp256k1_v0_8_1_u128_to_u64(&c128); rustsecp256k1_v0_8_1_u128_rshift(&c128, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&c128, p2);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&c128, p4);
-    r->d[2] = rustsecp256k1_v0_8_1_u128_to_u64(&c128); rustsecp256k1_v0_8_1_u128_rshift(&c128, 64);
-    rustsecp256k1_v0_8_1_u128_accum_u64(&c128, p3);
-    r->d[3] = rustsecp256k1_v0_8_1_u128_to_u64(&c128);
-    c = rustsecp256k1_v0_8_1_u128_hi_u64(&c128);
+    rustsecp256k1_v0_9_0_u128_from_u64(&c128, p0);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c128, SECP256K1_N_C_0, p4);
+    r->d[0] = rustsecp256k1_v0_9_0_u128_to_u64(&c128); rustsecp256k1_v0_9_0_u128_rshift(&c128, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&c128, p1);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&c128, SECP256K1_N_C_1, p4);
+    r->d[1] = rustsecp256k1_v0_9_0_u128_to_u64(&c128); rustsecp256k1_v0_9_0_u128_rshift(&c128, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&c128, p2);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&c128, p4);
+    r->d[2] = rustsecp256k1_v0_9_0_u128_to_u64(&c128); rustsecp256k1_v0_9_0_u128_rshift(&c128, 64);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&c128, p3);
+    r->d[3] = rustsecp256k1_v0_9_0_u128_to_u64(&c128);
+    c = rustsecp256k1_v0_9_0_u128_hi_u64(&c128);
 #endif
 
     /* Final reduction of r. */
-    rustsecp256k1_v0_8_1_scalar_reduce(r, c + rustsecp256k1_v0_8_1_scalar_check_overflow(r));
+    rustsecp256k1_v0_9_0_scalar_reduce(r, c + rustsecp256k1_v0_9_0_scalar_check_overflow(r));
 }
 
-static void rustsecp256k1_v0_8_1_scalar_mul_512(uint64_t l[8], const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+static void rustsecp256k1_v0_9_0_scalar_mul_512(uint64_t l[8], const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
 #ifdef USE_ASM_X86_64
     const uint64_t *pb = b->d;
     __asm__ __volatile__(
@@ -758,25 +798,36 @@ static void rustsecp256k1_v0_8_1_scalar_mul_512(uint64_t l[8], const rustsecp256
 #undef extract
 #undef extract_fast
 
-static void rustsecp256k1_v0_8_1_scalar_mul(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+static void rustsecp256k1_v0_9_0_scalar_mul(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
     uint64_t l[8];
-    rustsecp256k1_v0_8_1_scalar_mul_512(l, a, b);
-    rustsecp256k1_v0_8_1_scalar_reduce_512(r, l);
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
+
+    rustsecp256k1_v0_9_0_scalar_mul_512(l, a, b);
+    rustsecp256k1_v0_9_0_scalar_reduce_512(r, l);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static int rustsecp256k1_v0_8_1_scalar_shr_int(rustsecp256k1_v0_8_1_scalar *r, int n) {
+static int rustsecp256k1_v0_9_0_scalar_shr_int(rustsecp256k1_v0_9_0_scalar *r, int n) {
     int ret;
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     VERIFY_CHECK(n > 0);
     VERIFY_CHECK(n < 16);
+
     ret = r->d[0] & ((1 << n) - 1);
     r->d[0] = (r->d[0] >> n) + (r->d[1] << (64 - n));
     r->d[1] = (r->d[1] >> n) + (r->d[2] << (64 - n));
     r->d[2] = (r->d[2] >> n) + (r->d[3] << (64 - n));
     r->d[3] = (r->d[3] >> n);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return ret;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_split_128(rustsecp256k1_v0_8_1_scalar *r1, rustsecp256k1_v0_8_1_scalar *r2, const rustsecp256k1_v0_8_1_scalar *k) {
+static void rustsecp256k1_v0_9_0_scalar_split_128(rustsecp256k1_v0_9_0_scalar *r1, rustsecp256k1_v0_9_0_scalar *r2, const rustsecp256k1_v0_9_0_scalar *k) {
+    rustsecp256k1_v0_9_0_scalar_verify(k);
+
     r1->d[0] = k->d[0];
     r1->d[1] = k->d[1];
     r1->d[2] = 0;
@@ -785,19 +836,28 @@ static void rustsecp256k1_v0_8_1_scalar_split_128(rustsecp256k1_v0_8_1_scalar *r
     r2->d[1] = k->d[3];
     r2->d[2] = 0;
     r2->d[3] = 0;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r1);
+    rustsecp256k1_v0_9_0_scalar_verify(r2);
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_eq(const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_eq(const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
+
     return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3])) == 0;
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_mul_shift_var(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b, unsigned int shift) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_scalar_mul_shift_var(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b, unsigned int shift) {
     uint64_t l[8];
     unsigned int shiftlimbs;
     unsigned int shiftlow;
     unsigned int shifthigh;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
     VERIFY_CHECK(shift >= 256);
-    rustsecp256k1_v0_8_1_scalar_mul_512(l, a, b);
+
+    rustsecp256k1_v0_9_0_scalar_mul_512(l, a, b);
     shiftlimbs = shift >> 6;
     shiftlow = shift & 0x3F;
     shifthigh = 64 - shiftlow;
@@ -805,24 +865,31 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_mul_shift_var(rustsecp2
     r->d[1] = shift < 448 ? (l[1 + shiftlimbs] >> shiftlow | (shift < 384 && shiftlow ? (l[2 + shiftlimbs] << shifthigh) : 0)) : 0;
     r->d[2] = shift < 384 ? (l[2 + shiftlimbs] >> shiftlow | (shift < 320 && shiftlow ? (l[3 + shiftlimbs] << shifthigh) : 0)) : 0;
     r->d[3] = shift < 320 ? (l[3 + shiftlimbs] >> shiftlow) : 0;
-    rustsecp256k1_v0_8_1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 6] >> ((shift - 1) & 0x3f)) & 1);
+    rustsecp256k1_v0_9_0_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 6] >> ((shift - 1) & 0x3f)) & 1);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_scalar_cmov(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, int flag) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_scalar_cmov(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, int flag) {
     uint64_t mask0, mask1;
-    VG_CHECK_VERIFY(r->d, sizeof(r->d));
-    mask0 = flag + ~((uint64_t)0);
+    volatile int vflag = flag;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    SECP256K1_CHECKMEM_CHECK_VERIFY(r->d, sizeof(r->d));
+
+    mask0 = vflag + ~((uint64_t)0);
     mask1 = ~mask0;
     r->d[0] = (r->d[0] & mask0) | (a->d[0] & mask1);
     r->d[1] = (r->d[1] & mask0) | (a->d[1] & mask1);
     r->d[2] = (r->d[2] & mask0) | (a->d[2] & mask1);
     r->d[3] = (r->d[3] & mask0) | (a->d[3] & mask1);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_scalar_from_signed62(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_modinv64_signed62 *a) {
+static void rustsecp256k1_v0_9_0_scalar_from_signed62(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_modinv64_signed62 *a) {
     const uint64_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4];
 
-    /* The output from rustsecp256k1_v0_8_1_modinv64{_var} should be normalized to range [0,modulus), and
+    /* The output from rustsecp256k1_v0_9_0_modinv64{_var} should be normalized to range [0,modulus), and
      * have limbs in [0,2^62). The modulus is < 2^256, so the top limb must be below 2^(256-62*4).
      */
     VERIFY_CHECK(a0 >> 62 == 0);
@@ -836,18 +903,13 @@ static void rustsecp256k1_v0_8_1_scalar_from_signed62(rustsecp256k1_v0_8_1_scala
     r->d[2] = a2 >> 4 | a3 << 58;
     r->d[3] = a3 >> 6 | a4 << 56;
 
-#ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_check_overflow(r) == 0);
-#endif
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_scalar_to_signed62(rustsecp256k1_v0_8_1_modinv64_signed62 *r, const rustsecp256k1_v0_8_1_scalar *a) {
+static void rustsecp256k1_v0_9_0_scalar_to_signed62(rustsecp256k1_v0_9_0_modinv64_signed62 *r, const rustsecp256k1_v0_9_0_scalar *a) {
     const uint64_t M62 = UINT64_MAX >> 2;
     const uint64_t a0 = a->d[0], a1 = a->d[1], a2 = a->d[2], a3 = a->d[3];
-
-#ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_check_overflow(a) == 0);
-#endif
+    rustsecp256k1_v0_9_0_scalar_verify(a);
 
     r->v[0] =  a0                   & M62;
     r->v[1] = (a0 >> 62 | a1 <<  2) & M62;
@@ -856,40 +918,48 @@ static void rustsecp256k1_v0_8_1_scalar_to_signed62(rustsecp256k1_v0_8_1_modinv6
     r->v[4] =  a3 >> 56;
 }
 
-static const rustsecp256k1_v0_8_1_modinv64_modinfo rustsecp256k1_v0_8_1_const_modinfo_scalar = {
+static const rustsecp256k1_v0_9_0_modinv64_modinfo rustsecp256k1_v0_9_0_const_modinfo_scalar = {
     {{0x3FD25E8CD0364141LL, 0x2ABB739ABD2280EELL, -0x15LL, 0, 256}},
     0x34F20099AA774EC1LL
 };
 
-static void rustsecp256k1_v0_8_1_scalar_inverse(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *x) {
-    rustsecp256k1_v0_8_1_modinv64_signed62 s;
+static void rustsecp256k1_v0_9_0_scalar_inverse(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *x) {
+    rustsecp256k1_v0_9_0_modinv64_signed62 s;
 #ifdef VERIFY
-    int zero_in = rustsecp256k1_v0_8_1_scalar_is_zero(x);
+    int zero_in = rustsecp256k1_v0_9_0_scalar_is_zero(x);
 #endif
-    rustsecp256k1_v0_8_1_scalar_to_signed62(&s, x);
-    rustsecp256k1_v0_8_1_modinv64(&s, &rustsecp256k1_v0_8_1_const_modinfo_scalar);
-    rustsecp256k1_v0_8_1_scalar_from_signed62(r, &s);
+    rustsecp256k1_v0_9_0_scalar_verify(x);
+
+    rustsecp256k1_v0_9_0_scalar_to_signed62(&s, x);
+    rustsecp256k1_v0_9_0_modinv64(&s, &rustsecp256k1_v0_9_0_const_modinfo_scalar);
+    rustsecp256k1_v0_9_0_scalar_from_signed62(r, &s);
 
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 #ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(r) == zero_in);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(r) == zero_in);
 #endif
 }
 
-static void rustsecp256k1_v0_8_1_scalar_inverse_var(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *x) {
-    rustsecp256k1_v0_8_1_modinv64_signed62 s;
+static void rustsecp256k1_v0_9_0_scalar_inverse_var(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *x) {
+    rustsecp256k1_v0_9_0_modinv64_signed62 s;
 #ifdef VERIFY
-    int zero_in = rustsecp256k1_v0_8_1_scalar_is_zero(x);
+    int zero_in = rustsecp256k1_v0_9_0_scalar_is_zero(x);
 #endif
-    rustsecp256k1_v0_8_1_scalar_to_signed62(&s, x);
-    rustsecp256k1_v0_8_1_modinv64_var(&s, &rustsecp256k1_v0_8_1_const_modinfo_scalar);
-    rustsecp256k1_v0_8_1_scalar_from_signed62(r, &s);
+    rustsecp256k1_v0_9_0_scalar_verify(x);
 
+    rustsecp256k1_v0_9_0_scalar_to_signed62(&s, x);
+    rustsecp256k1_v0_9_0_modinv64_var(&s, &rustsecp256k1_v0_9_0_const_modinfo_scalar);
+    rustsecp256k1_v0_9_0_scalar_from_signed62(r, &s);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 #ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(r) == zero_in);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(r) == zero_in);
 #endif
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_is_even(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_is_even(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return !(a->d[0] & 1);
 }
 
diff --git a/secp256k1-sys/depend/secp256k1/src/scalar_8x32.h b/secp256k1-sys/depend/secp256k1/src/scalar_8x32.h
index feb19c4ca..e428de33a 100644
--- a/secp256k1-sys/depend/secp256k1/src/scalar_8x32.h
+++ b/secp256k1-sys/depend/secp256k1/src/scalar_8x32.h
@@ -12,7 +12,7 @@
 /** A scalar modulo the group order of the secp256k1 curve. */
 typedef struct {
     uint32_t d[8];
-} rustsecp256k1_v0_8_1_scalar;
+} rustsecp256k1_v0_9_0_scalar;
 
 #define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{(d0), (d1), (d2), (d3), (d4), (d5), (d6), (d7)}}
 
diff --git a/secp256k1-sys/depend/secp256k1/src/scalar_8x32_impl.h b/secp256k1-sys/depend/secp256k1/src/scalar_8x32_impl.h
index 32bdb3cf4..bb7babd6d 100644
--- a/secp256k1-sys/depend/secp256k1/src/scalar_8x32_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/scalar_8x32_impl.h
@@ -7,7 +7,9 @@
 #ifndef SECP256K1_SCALAR_REPR_IMPL_H
 #define SECP256K1_SCALAR_REPR_IMPL_H
 
+#include "checkmem.h"
 #include "modinv32_impl.h"
+#include "util.h"
 
 /* Limbs of the secp256k1 order. */
 #define SECP256K1_N_0 ((uint32_t)0xD0364141UL)
@@ -36,7 +38,7 @@
 #define SECP256K1_N_H_6 ((uint32_t)0xFFFFFFFFUL)
 #define SECP256K1_N_H_7 ((uint32_t)0x7FFFFFFFUL)
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_clear(rustsecp256k1_v0_8_1_scalar *r) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_scalar_clear(rustsecp256k1_v0_9_0_scalar *r) {
     r->d[0] = 0;
     r->d[1] = 0;
     r->d[2] = 0;
@@ -47,7 +49,7 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_clear(rustsecp256k1_v0_
     r->d[7] = 0;
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_set_int(rustsecp256k1_v0_8_1_scalar *r, unsigned int v) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_scalar_set_int(rustsecp256k1_v0_9_0_scalar *r, unsigned int v) {
     r->d[0] = v;
     r->d[1] = 0;
     r->d[2] = 0;
@@ -56,25 +58,31 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_set_int(rustsecp256k1_v
     r->d[5] = 0;
     r->d[6] = 0;
     r->d[7] = 0;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-SECP256K1_INLINE static unsigned int rustsecp256k1_v0_8_1_scalar_get_bits(const rustsecp256k1_v0_8_1_scalar *a, unsigned int offset, unsigned int count) {
+SECP256K1_INLINE static unsigned int rustsecp256k1_v0_9_0_scalar_get_bits(const rustsecp256k1_v0_9_0_scalar *a, unsigned int offset, unsigned int count) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
     VERIFY_CHECK((offset + count - 1) >> 5 == offset >> 5);
+
     return (a->d[offset >> 5] >> (offset & 0x1F)) & ((1 << count) - 1);
 }
 
-SECP256K1_INLINE static unsigned int rustsecp256k1_v0_8_1_scalar_get_bits_var(const rustsecp256k1_v0_8_1_scalar *a, unsigned int offset, unsigned int count) {
+SECP256K1_INLINE static unsigned int rustsecp256k1_v0_9_0_scalar_get_bits_var(const rustsecp256k1_v0_9_0_scalar *a, unsigned int offset, unsigned int count) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
     VERIFY_CHECK(count < 32);
     VERIFY_CHECK(offset + count <= 256);
+
     if ((offset + count - 1) >> 5 == offset >> 5) {
-        return rustsecp256k1_v0_8_1_scalar_get_bits(a, offset, count);
+        return rustsecp256k1_v0_9_0_scalar_get_bits(a, offset, count);
     } else {
         VERIFY_CHECK((offset >> 5) + 1 < 8);
         return ((a->d[offset >> 5] >> (offset & 0x1F)) | (a->d[(offset >> 5) + 1] << (32 - (offset & 0x1F)))) & ((((uint32_t)1) << count) - 1);
     }
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_check_overflow(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_check_overflow(const rustsecp256k1_v0_9_0_scalar *a) {
     int yes = 0;
     int no = 0;
     no |= (a->d[7] < SECP256K1_N_7); /* No need for a > check. */
@@ -92,9 +100,10 @@ SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_check_overflow(const rus
     return yes;
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_reduce(rustsecp256k1_v0_8_1_scalar *r, uint32_t overflow) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_reduce(rustsecp256k1_v0_9_0_scalar *r, uint32_t overflow) {
     uint64_t t;
     VERIFY_CHECK(overflow <= 1);
+
     t = (uint64_t)r->d[0] + overflow * SECP256K1_N_C_0;
     r->d[0] = t & 0xFFFFFFFFUL; t >>= 32;
     t += (uint64_t)r->d[1] + overflow * SECP256K1_N_C_1;
@@ -111,12 +120,17 @@ SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_reduce(rustsecp256k1_v0_
     r->d[6] = t & 0xFFFFFFFFUL; t >>= 32;
     t += (uint64_t)r->d[7];
     r->d[7] = t & 0xFFFFFFFFUL;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return overflow;
 }
 
-static int rustsecp256k1_v0_8_1_scalar_add(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+static int rustsecp256k1_v0_9_0_scalar_add(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
     int overflow;
     uint64_t t = (uint64_t)a->d[0] + b->d[0];
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
+
     r->d[0] = t & 0xFFFFFFFFULL; t >>= 32;
     t += (uint64_t)a->d[1] + b->d[1];
     r->d[1] = t & 0xFFFFFFFFULL; t >>= 32;
@@ -132,16 +146,21 @@ static int rustsecp256k1_v0_8_1_scalar_add(rustsecp256k1_v0_8_1_scalar *r, const
     r->d[6] = t & 0xFFFFFFFFULL; t >>= 32;
     t += (uint64_t)a->d[7] + b->d[7];
     r->d[7] = t & 0xFFFFFFFFULL; t >>= 32;
-    overflow = t + rustsecp256k1_v0_8_1_scalar_check_overflow(r);
+    overflow = t + rustsecp256k1_v0_9_0_scalar_check_overflow(r);
     VERIFY_CHECK(overflow == 0 || overflow == 1);
-    rustsecp256k1_v0_8_1_scalar_reduce(r, overflow);
+    rustsecp256k1_v0_9_0_scalar_reduce(r, overflow);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return overflow;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_cadd_bit(rustsecp256k1_v0_8_1_scalar *r, unsigned int bit, int flag) {
+static void rustsecp256k1_v0_9_0_scalar_cadd_bit(rustsecp256k1_v0_9_0_scalar *r, unsigned int bit, int flag) {
     uint64_t t;
+    volatile int vflag = flag;
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     VERIFY_CHECK(bit < 256);
-    bit += ((uint32_t) flag - 1) & 0x100;  /* forcing (bit >> 5) > 7 makes this a noop */
+
+    bit += ((uint32_t) vflag - 1) & 0x100;  /* forcing (bit >> 5) > 7 makes this a noop */
     t = (uint64_t)r->d[0] + (((uint32_t)((bit >> 5) == 0)) << (bit & 0x1F));
     r->d[0] = t & 0xFFFFFFFFULL; t >>= 32;
     t += (uint64_t)r->d[1] + (((uint32_t)((bit >> 5) == 1)) << (bit & 0x1F));
@@ -158,46 +177,55 @@ static void rustsecp256k1_v0_8_1_scalar_cadd_bit(rustsecp256k1_v0_8_1_scalar *r,
     r->d[6] = t & 0xFFFFFFFFULL; t >>= 32;
     t += (uint64_t)r->d[7] + (((uint32_t)((bit >> 5) == 7)) << (bit & 0x1F));
     r->d[7] = t & 0xFFFFFFFFULL;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 #ifdef VERIFY
     VERIFY_CHECK((t >> 32) == 0);
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_check_overflow(r) == 0);
 #endif
 }
 
-static void rustsecp256k1_v0_8_1_scalar_set_b32(rustsecp256k1_v0_8_1_scalar *r, const unsigned char *b32, int *overflow) {
+static void rustsecp256k1_v0_9_0_scalar_set_b32(rustsecp256k1_v0_9_0_scalar *r, const unsigned char *b32, int *overflow) {
     int over;
-    r->d[0] = (uint32_t)b32[31] | (uint32_t)b32[30] << 8 | (uint32_t)b32[29] << 16 | (uint32_t)b32[28] << 24;
-    r->d[1] = (uint32_t)b32[27] | (uint32_t)b32[26] << 8 | (uint32_t)b32[25] << 16 | (uint32_t)b32[24] << 24;
-    r->d[2] = (uint32_t)b32[23] | (uint32_t)b32[22] << 8 | (uint32_t)b32[21] << 16 | (uint32_t)b32[20] << 24;
-    r->d[3] = (uint32_t)b32[19] | (uint32_t)b32[18] << 8 | (uint32_t)b32[17] << 16 | (uint32_t)b32[16] << 24;
-    r->d[4] = (uint32_t)b32[15] | (uint32_t)b32[14] << 8 | (uint32_t)b32[13] << 16 | (uint32_t)b32[12] << 24;
-    r->d[5] = (uint32_t)b32[11] | (uint32_t)b32[10] << 8 | (uint32_t)b32[9] << 16 | (uint32_t)b32[8] << 24;
-    r->d[6] = (uint32_t)b32[7] | (uint32_t)b32[6] << 8 | (uint32_t)b32[5] << 16 | (uint32_t)b32[4] << 24;
-    r->d[7] = (uint32_t)b32[3] | (uint32_t)b32[2] << 8 | (uint32_t)b32[1] << 16 | (uint32_t)b32[0] << 24;
-    over = rustsecp256k1_v0_8_1_scalar_reduce(r, rustsecp256k1_v0_8_1_scalar_check_overflow(r));
+    r->d[0] = rustsecp256k1_v0_9_0_read_be32(&b32[28]);
+    r->d[1] = rustsecp256k1_v0_9_0_read_be32(&b32[24]);
+    r->d[2] = rustsecp256k1_v0_9_0_read_be32(&b32[20]);
+    r->d[3] = rustsecp256k1_v0_9_0_read_be32(&b32[16]);
+    r->d[4] = rustsecp256k1_v0_9_0_read_be32(&b32[12]);
+    r->d[5] = rustsecp256k1_v0_9_0_read_be32(&b32[8]);
+    r->d[6] = rustsecp256k1_v0_9_0_read_be32(&b32[4]);
+    r->d[7] = rustsecp256k1_v0_9_0_read_be32(&b32[0]);
+    over = rustsecp256k1_v0_9_0_scalar_reduce(r, rustsecp256k1_v0_9_0_scalar_check_overflow(r));
     if (overflow) {
         *overflow = over;
     }
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_scalar_get_b32(unsigned char *bin, const rustsecp256k1_v0_8_1_scalar* a) {
-    bin[0] = a->d[7] >> 24; bin[1] = a->d[7] >> 16; bin[2] = a->d[7] >> 8; bin[3] = a->d[7];
-    bin[4] = a->d[6] >> 24; bin[5] = a->d[6] >> 16; bin[6] = a->d[6] >> 8; bin[7] = a->d[6];
-    bin[8] = a->d[5] >> 24; bin[9] = a->d[5] >> 16; bin[10] = a->d[5] >> 8; bin[11] = a->d[5];
-    bin[12] = a->d[4] >> 24; bin[13] = a->d[4] >> 16; bin[14] = a->d[4] >> 8; bin[15] = a->d[4];
-    bin[16] = a->d[3] >> 24; bin[17] = a->d[3] >> 16; bin[18] = a->d[3] >> 8; bin[19] = a->d[3];
-    bin[20] = a->d[2] >> 24; bin[21] = a->d[2] >> 16; bin[22] = a->d[2] >> 8; bin[23] = a->d[2];
-    bin[24] = a->d[1] >> 24; bin[25] = a->d[1] >> 16; bin[26] = a->d[1] >> 8; bin[27] = a->d[1];
-    bin[28] = a->d[0] >> 24; bin[29] = a->d[0] >> 16; bin[30] = a->d[0] >> 8; bin[31] = a->d[0];
+static void rustsecp256k1_v0_9_0_scalar_get_b32(unsigned char *bin, const rustsecp256k1_v0_9_0_scalar* a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
+    rustsecp256k1_v0_9_0_write_be32(&bin[0], a->d[7]);
+    rustsecp256k1_v0_9_0_write_be32(&bin[4], a->d[6]);
+    rustsecp256k1_v0_9_0_write_be32(&bin[8], a->d[5]);
+    rustsecp256k1_v0_9_0_write_be32(&bin[12], a->d[4]);
+    rustsecp256k1_v0_9_0_write_be32(&bin[16], a->d[3]);
+    rustsecp256k1_v0_9_0_write_be32(&bin[20], a->d[2]);
+    rustsecp256k1_v0_9_0_write_be32(&bin[24], a->d[1]);
+    rustsecp256k1_v0_9_0_write_be32(&bin[28], a->d[0]);
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_is_zero(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_is_zero(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return (a->d[0] | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_negate(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a) {
-    uint32_t nonzero = 0xFFFFFFFFUL * (rustsecp256k1_v0_8_1_scalar_is_zero(a) == 0);
+static void rustsecp256k1_v0_9_0_scalar_negate(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a) {
+    uint32_t nonzero = 0xFFFFFFFFUL * (rustsecp256k1_v0_9_0_scalar_is_zero(a) == 0);
     uint64_t t = (uint64_t)(~a->d[0]) + SECP256K1_N_0 + 1;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     r->d[0] = t & nonzero; t >>= 32;
     t += (uint64_t)(~a->d[1]) + SECP256K1_N_1;
     r->d[1] = t & nonzero; t >>= 32;
@@ -213,15 +241,21 @@ static void rustsecp256k1_v0_8_1_scalar_negate(rustsecp256k1_v0_8_1_scalar *r, c
     r->d[6] = t & nonzero; t >>= 32;
     t += (uint64_t)(~a->d[7]) + SECP256K1_N_7;
     r->d[7] = t & nonzero;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_is_one(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_is_one(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
 }
 
-static int rustsecp256k1_v0_8_1_scalar_is_high(const rustsecp256k1_v0_8_1_scalar *a) {
+static int rustsecp256k1_v0_9_0_scalar_is_high(const rustsecp256k1_v0_9_0_scalar *a) {
     int yes = 0;
     int no = 0;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     no |= (a->d[7] < SECP256K1_N_H_7);
     yes |= (a->d[7] > SECP256K1_N_H_7) & ~no;
     no |= (a->d[6] < SECP256K1_N_H_6) & ~yes; /* No need for a > check. */
@@ -237,12 +271,15 @@ static int rustsecp256k1_v0_8_1_scalar_is_high(const rustsecp256k1_v0_8_1_scalar
     return yes;
 }
 
-static int rustsecp256k1_v0_8_1_scalar_cond_negate(rustsecp256k1_v0_8_1_scalar *r, int flag) {
+static int rustsecp256k1_v0_9_0_scalar_cond_negate(rustsecp256k1_v0_9_0_scalar *r, int flag) {
     /* If we are flag = 0, mask = 00...00 and this is a no-op;
-     * if we are flag = 1, mask = 11...11 and this is identical to rustsecp256k1_v0_8_1_scalar_negate */
-    uint32_t mask = !flag - 1;
-    uint32_t nonzero = 0xFFFFFFFFUL * (rustsecp256k1_v0_8_1_scalar_is_zero(r) == 0);
+     * if we are flag = 1, mask = 11...11 and this is identical to rustsecp256k1_v0_9_0_scalar_negate */
+    volatile int vflag = flag;
+    uint32_t mask = -vflag;
+    uint32_t nonzero = 0xFFFFFFFFUL * (rustsecp256k1_v0_9_0_scalar_is_zero(r) == 0);
     uint64_t t = (uint64_t)(r->d[0] ^ mask) + ((SECP256K1_N_0 + 1) & mask);
+    rustsecp256k1_v0_9_0_scalar_verify(r);
+
     r->d[0] = t & nonzero; t >>= 32;
     t += (uint64_t)(r->d[1] ^ mask) + (SECP256K1_N_1 & mask);
     r->d[1] = t & nonzero; t >>= 32;
@@ -258,6 +295,8 @@ static int rustsecp256k1_v0_8_1_scalar_cond_negate(rustsecp256k1_v0_8_1_scalar *
     r->d[6] = t & nonzero; t >>= 32;
     t += (uint64_t)(r->d[7] ^ mask) + (SECP256K1_N_7 & mask);
     r->d[7] = t & nonzero;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return 2 * (mask == 0) - 1;
 }
 
@@ -326,7 +365,7 @@ static int rustsecp256k1_v0_8_1_scalar_cond_negate(rustsecp256k1_v0_8_1_scalar *
     VERIFY_CHECK(c2 == 0); \
 }
 
-static void rustsecp256k1_v0_8_1_scalar_reduce_512(rustsecp256k1_v0_8_1_scalar *r, const uint32_t *l) {
+static void rustsecp256k1_v0_9_0_scalar_reduce_512(rustsecp256k1_v0_9_0_scalar *r, const uint32_t *l) {
     uint64_t c;
     uint32_t n0 = l[8], n1 = l[9], n2 = l[10], n3 = l[11], n4 = l[12], n5 = l[13], n6 = l[14], n7 = l[15];
     uint32_t m0, m1, m2, m3, m4, m5, m6, m7, m8, m9, m10, m11, m12;
@@ -465,10 +504,10 @@ static void rustsecp256k1_v0_8_1_scalar_reduce_512(rustsecp256k1_v0_8_1_scalar *
     r->d[7] = c & 0xFFFFFFFFUL; c >>= 32;
 
     /* Final reduction of r. */
-    rustsecp256k1_v0_8_1_scalar_reduce(r, c + rustsecp256k1_v0_8_1_scalar_check_overflow(r));
+    rustsecp256k1_v0_9_0_scalar_reduce(r, c + rustsecp256k1_v0_9_0_scalar_check_overflow(r));
 }
 
-static void rustsecp256k1_v0_8_1_scalar_mul_512(uint32_t *l, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+static void rustsecp256k1_v0_9_0_scalar_mul_512(uint32_t *l, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
     /* 96 bit accumulator. */
     uint32_t c0 = 0, c1 = 0, c2 = 0;
 
@@ -563,16 +602,23 @@ static void rustsecp256k1_v0_8_1_scalar_mul_512(uint32_t *l, const rustsecp256k1
 #undef extract
 #undef extract_fast
 
-static void rustsecp256k1_v0_8_1_scalar_mul(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+static void rustsecp256k1_v0_9_0_scalar_mul(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
     uint32_t l[16];
-    rustsecp256k1_v0_8_1_scalar_mul_512(l, a, b);
-    rustsecp256k1_v0_8_1_scalar_reduce_512(r, l);
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
+
+    rustsecp256k1_v0_9_0_scalar_mul_512(l, a, b);
+    rustsecp256k1_v0_9_0_scalar_reduce_512(r, l);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static int rustsecp256k1_v0_8_1_scalar_shr_int(rustsecp256k1_v0_8_1_scalar *r, int n) {
+static int rustsecp256k1_v0_9_0_scalar_shr_int(rustsecp256k1_v0_9_0_scalar *r, int n) {
     int ret;
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     VERIFY_CHECK(n > 0);
     VERIFY_CHECK(n < 16);
+
     ret = r->d[0] & ((1 << n) - 1);
     r->d[0] = (r->d[0] >> n) + (r->d[1] << (32 - n));
     r->d[1] = (r->d[1] >> n) + (r->d[2] << (32 - n));
@@ -582,10 +628,14 @@ static int rustsecp256k1_v0_8_1_scalar_shr_int(rustsecp256k1_v0_8_1_scalar *r, i
     r->d[5] = (r->d[5] >> n) + (r->d[6] << (32 - n));
     r->d[6] = (r->d[6] >> n) + (r->d[7] << (32 - n));
     r->d[7] = (r->d[7] >> n);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return ret;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_split_128(rustsecp256k1_v0_8_1_scalar *r1, rustsecp256k1_v0_8_1_scalar *r2, const rustsecp256k1_v0_8_1_scalar *k) {
+static void rustsecp256k1_v0_9_0_scalar_split_128(rustsecp256k1_v0_9_0_scalar *r1, rustsecp256k1_v0_9_0_scalar *r2, const rustsecp256k1_v0_9_0_scalar *k) {
+    rustsecp256k1_v0_9_0_scalar_verify(k);
+
     r1->d[0] = k->d[0];
     r1->d[1] = k->d[1];
     r1->d[2] = k->d[2];
@@ -602,19 +652,28 @@ static void rustsecp256k1_v0_8_1_scalar_split_128(rustsecp256k1_v0_8_1_scalar *r
     r2->d[5] = 0;
     r2->d[6] = 0;
     r2->d[7] = 0;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r1);
+    rustsecp256k1_v0_9_0_scalar_verify(r2);
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_eq(const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_eq(const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
+
     return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3]) | (a->d[4] ^ b->d[4]) | (a->d[5] ^ b->d[5]) | (a->d[6] ^ b->d[6]) | (a->d[7] ^ b->d[7])) == 0;
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_mul_shift_var(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b, unsigned int shift) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_scalar_mul_shift_var(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b, unsigned int shift) {
     uint32_t l[16];
     unsigned int shiftlimbs;
     unsigned int shiftlow;
     unsigned int shifthigh;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
     VERIFY_CHECK(shift >= 256);
-    rustsecp256k1_v0_8_1_scalar_mul_512(l, a, b);
+
+    rustsecp256k1_v0_9_0_scalar_mul_512(l, a, b);
     shiftlimbs = shift >> 5;
     shiftlow = shift & 0x1F;
     shifthigh = 32 - shiftlow;
@@ -626,13 +685,18 @@ SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_mul_shift_var(rustsecp2
     r->d[5] = shift < 352 ? (l[5 + shiftlimbs] >> shiftlow | (shift < 320 && shiftlow ? (l[6 + shiftlimbs] << shifthigh) : 0)) : 0;
     r->d[6] = shift < 320 ? (l[6 + shiftlimbs] >> shiftlow | (shift < 288 && shiftlow ? (l[7 + shiftlimbs] << shifthigh) : 0)) : 0;
     r->d[7] = shift < 288 ? (l[7 + shiftlimbs] >> shiftlow)  : 0;
-    rustsecp256k1_v0_8_1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 5] >> ((shift - 1) & 0x1f)) & 1);
+    rustsecp256k1_v0_9_0_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 5] >> ((shift - 1) & 0x1f)) & 1);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_scalar_cmov(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, int flag) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_scalar_cmov(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, int flag) {
     uint32_t mask0, mask1;
-    VG_CHECK_VERIFY(r->d, sizeof(r->d));
-    mask0 = flag + ~((uint32_t)0);
+    volatile int vflag = flag;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    SECP256K1_CHECKMEM_CHECK_VERIFY(r->d, sizeof(r->d));
+
+    mask0 = vflag + ~((uint32_t)0);
     mask1 = ~mask0;
     r->d[0] = (r->d[0] & mask0) | (a->d[0] & mask1);
     r->d[1] = (r->d[1] & mask0) | (a->d[1] & mask1);
@@ -642,13 +706,15 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_scalar_cmov(rustsecp256k1_v0_8
     r->d[5] = (r->d[5] & mask0) | (a->d[5] & mask1);
     r->d[6] = (r->d[6] & mask0) | (a->d[6] & mask1);
     r->d[7] = (r->d[7] & mask0) | (a->d[7] & mask1);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_scalar_from_signed30(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_modinv32_signed30 *a) {
+static void rustsecp256k1_v0_9_0_scalar_from_signed30(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_modinv32_signed30 *a) {
     const uint32_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4],
                    a5 = a->v[5], a6 = a->v[6], a7 = a->v[7], a8 = a->v[8];
 
-    /* The output from rustsecp256k1_v0_8_1_modinv32{_var} should be normalized to range [0,modulus), and
+    /* The output from rustsecp256k1_v0_9_0_modinv32{_var} should be normalized to range [0,modulus), and
      * have limbs in [0,2^30). The modulus is < 2^256, so the top limb must be below 2^(256-30*8).
      */
     VERIFY_CHECK(a0 >> 30 == 0);
@@ -670,19 +736,14 @@ static void rustsecp256k1_v0_8_1_scalar_from_signed30(rustsecp256k1_v0_8_1_scala
     r->d[6] = a6 >> 12 | a7 << 18;
     r->d[7] = a7 >> 14 | a8 << 16;
 
-#ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_check_overflow(r) == 0);
-#endif
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_scalar_to_signed30(rustsecp256k1_v0_8_1_modinv32_signed30 *r, const rustsecp256k1_v0_8_1_scalar *a) {
+static void rustsecp256k1_v0_9_0_scalar_to_signed30(rustsecp256k1_v0_9_0_modinv32_signed30 *r, const rustsecp256k1_v0_9_0_scalar *a) {
     const uint32_t M30 = UINT32_MAX >> 2;
     const uint32_t a0 = a->d[0], a1 = a->d[1], a2 = a->d[2], a3 = a->d[3],
                    a4 = a->d[4], a5 = a->d[5], a6 = a->d[6], a7 = a->d[7];
-
-#ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_check_overflow(a) == 0);
-#endif
+    rustsecp256k1_v0_9_0_scalar_verify(a);
 
     r->v[0] =  a0                   & M30;
     r->v[1] = (a0 >> 30 | a1 <<  2) & M30;
@@ -695,40 +756,48 @@ static void rustsecp256k1_v0_8_1_scalar_to_signed30(rustsecp256k1_v0_8_1_modinv3
     r->v[8] =  a7 >> 16;
 }
 
-static const rustsecp256k1_v0_8_1_modinv32_modinfo rustsecp256k1_v0_8_1_const_modinfo_scalar = {
+static const rustsecp256k1_v0_9_0_modinv32_modinfo rustsecp256k1_v0_9_0_const_modinfo_scalar = {
     {{0x10364141L, 0x3F497A33L, 0x348A03BBL, 0x2BB739ABL, -0x146L, 0, 0, 0, 65536}},
     0x2A774EC1L
 };
 
-static void rustsecp256k1_v0_8_1_scalar_inverse(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *x) {
-    rustsecp256k1_v0_8_1_modinv32_signed30 s;
+static void rustsecp256k1_v0_9_0_scalar_inverse(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *x) {
+    rustsecp256k1_v0_9_0_modinv32_signed30 s;
 #ifdef VERIFY
-    int zero_in = rustsecp256k1_v0_8_1_scalar_is_zero(x);
+    int zero_in = rustsecp256k1_v0_9_0_scalar_is_zero(x);
 #endif
-    rustsecp256k1_v0_8_1_scalar_to_signed30(&s, x);
-    rustsecp256k1_v0_8_1_modinv32(&s, &rustsecp256k1_v0_8_1_const_modinfo_scalar);
-    rustsecp256k1_v0_8_1_scalar_from_signed30(r, &s);
+    rustsecp256k1_v0_9_0_scalar_verify(x);
+
+    rustsecp256k1_v0_9_0_scalar_to_signed30(&s, x);
+    rustsecp256k1_v0_9_0_modinv32(&s, &rustsecp256k1_v0_9_0_const_modinfo_scalar);
+    rustsecp256k1_v0_9_0_scalar_from_signed30(r, &s);
 
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 #ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(r) == zero_in);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(r) == zero_in);
 #endif
 }
 
-static void rustsecp256k1_v0_8_1_scalar_inverse_var(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *x) {
-    rustsecp256k1_v0_8_1_modinv32_signed30 s;
+static void rustsecp256k1_v0_9_0_scalar_inverse_var(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *x) {
+    rustsecp256k1_v0_9_0_modinv32_signed30 s;
 #ifdef VERIFY
-    int zero_in = rustsecp256k1_v0_8_1_scalar_is_zero(x);
+    int zero_in = rustsecp256k1_v0_9_0_scalar_is_zero(x);
 #endif
-    rustsecp256k1_v0_8_1_scalar_to_signed30(&s, x);
-    rustsecp256k1_v0_8_1_modinv32_var(&s, &rustsecp256k1_v0_8_1_const_modinfo_scalar);
-    rustsecp256k1_v0_8_1_scalar_from_signed30(r, &s);
+    rustsecp256k1_v0_9_0_scalar_verify(x);
 
+    rustsecp256k1_v0_9_0_scalar_to_signed30(&s, x);
+    rustsecp256k1_v0_9_0_modinv32_var(&s, &rustsecp256k1_v0_9_0_const_modinfo_scalar);
+    rustsecp256k1_v0_9_0_scalar_from_signed30(r, &s);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 #ifdef VERIFY
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(r) == zero_in);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(r) == zero_in);
 #endif
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_is_even(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_is_even(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return !(a->d[0] & 1);
 }
 
diff --git a/secp256k1-sys/depend/secp256k1/src/scalar_impl.h b/secp256k1-sys/depend/secp256k1/src/scalar_impl.h
index d1730733e..6207fa8de 100644
--- a/secp256k1-sys/depend/secp256k1/src/scalar_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/scalar_impl.h
@@ -14,10 +14,6 @@
 #include "scalar.h"
 #include "util.h"
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
-
 #if defined(EXHAUSTIVE_TEST_ORDER)
 #include "scalar_low_impl.h"
 #elif defined(SECP256K1_WIDEMUL_INT128)
@@ -28,24 +24,37 @@
 #error "Please select wide multiplication implementation"
 #endif
 
-static const rustsecp256k1_v0_8_1_scalar rustsecp256k1_v0_8_1_scalar_one = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
-static const rustsecp256k1_v0_8_1_scalar rustsecp256k1_v0_8_1_scalar_zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
+static const rustsecp256k1_v0_9_0_scalar rustsecp256k1_v0_9_0_scalar_one = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
+static const rustsecp256k1_v0_9_0_scalar rustsecp256k1_v0_9_0_scalar_zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
 
-static int rustsecp256k1_v0_8_1_scalar_set_b32_seckey(rustsecp256k1_v0_8_1_scalar *r, const unsigned char *bin) {
+static int rustsecp256k1_v0_9_0_scalar_set_b32_seckey(rustsecp256k1_v0_9_0_scalar *r, const unsigned char *bin) {
     int overflow;
-    rustsecp256k1_v0_8_1_scalar_set_b32(r, bin, &overflow);
-    return (!overflow) & (!rustsecp256k1_v0_8_1_scalar_is_zero(r));
+    rustsecp256k1_v0_9_0_scalar_set_b32(r, bin, &overflow);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
+    return (!overflow) & (!rustsecp256k1_v0_9_0_scalar_is_zero(r));
+}
+
+static void rustsecp256k1_v0_9_0_scalar_verify(const rustsecp256k1_v0_9_0_scalar *r) {
+#ifdef VERIFY
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_scalar_check_overflow(r) == 0);
+#endif
+
+    (void)r;
 }
 
-/* These parameters are generated using sage/gen_exhaustive_groups.sage. */
 #if defined(EXHAUSTIVE_TEST_ORDER)
-#  if EXHAUSTIVE_TEST_ORDER == 13
+/* Begin of section generated by sage/gen_exhaustive_groups.sage. */
+#  if EXHAUSTIVE_TEST_ORDER == 7
+#    define EXHAUSTIVE_TEST_LAMBDA 2
+#  elif EXHAUSTIVE_TEST_ORDER == 13
 #    define EXHAUSTIVE_TEST_LAMBDA 9
 #  elif EXHAUSTIVE_TEST_ORDER == 199
 #    define EXHAUSTIVE_TEST_LAMBDA 92
 #  else
 #    error No known lambda for the specified exhaustive test group order.
 #  endif
+/* End of section generated by sage/gen_exhaustive_groups.sage. */
 
 /**
  * Find r1 and r2 given k, such that r1 + r2 * lambda == k mod n; unlike in the
@@ -53,21 +62,29 @@ static int rustsecp256k1_v0_8_1_scalar_set_b32_seckey(rustsecp256k1_v0_8_1_scala
  * nontrivial to get full test coverage for the exhaustive tests. We therefore
  * (arbitrarily) set r2 = k + 5 (mod n) and r1 = k - r2 * lambda (mod n).
  */
-static void rustsecp256k1_v0_8_1_scalar_split_lambda(rustsecp256k1_v0_8_1_scalar *r1, rustsecp256k1_v0_8_1_scalar *r2, const rustsecp256k1_v0_8_1_scalar *k) {
+static void rustsecp256k1_v0_9_0_scalar_split_lambda(rustsecp256k1_v0_9_0_scalar * SECP256K1_RESTRICT r1, rustsecp256k1_v0_9_0_scalar * SECP256K1_RESTRICT r2, const rustsecp256k1_v0_9_0_scalar * SECP256K1_RESTRICT k) {
+    rustsecp256k1_v0_9_0_scalar_verify(k);
+    VERIFY_CHECK(r1 != k);
+    VERIFY_CHECK(r2 != k);
+    VERIFY_CHECK(r1 != r2);
+
     *r2 = (*k + 5) % EXHAUSTIVE_TEST_ORDER;
     *r1 = (*k + (EXHAUSTIVE_TEST_ORDER - *r2) * EXHAUSTIVE_TEST_LAMBDA) % EXHAUSTIVE_TEST_ORDER;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r1);
+    rustsecp256k1_v0_9_0_scalar_verify(r2);
 }
 #else
 /**
  * The Secp256k1 curve has an endomorphism, where lambda * (x, y) = (beta * x, y), where
  * lambda is: */
-static const rustsecp256k1_v0_8_1_scalar rustsecp256k1_v0_8_1_const_lambda = SECP256K1_SCALAR_CONST(
+static const rustsecp256k1_v0_9_0_scalar rustsecp256k1_v0_9_0_const_lambda = SECP256K1_SCALAR_CONST(
     0x5363AD4CUL, 0xC05C30E0UL, 0xA5261C02UL, 0x8812645AUL,
     0x122E22EAUL, 0x20816678UL, 0xDF02967CUL, 0x1B23BD72UL
 );
 
 #ifdef VERIFY
-static void rustsecp256k1_v0_8_1_scalar_split_lambda_verify(const rustsecp256k1_v0_8_1_scalar *r1, const rustsecp256k1_v0_8_1_scalar *r2, const rustsecp256k1_v0_8_1_scalar *k);
+static void rustsecp256k1_v0_9_0_scalar_split_lambda_verify(const rustsecp256k1_v0_9_0_scalar *r1, const rustsecp256k1_v0_9_0_scalar *r2, const rustsecp256k1_v0_9_0_scalar *k);
 #endif
 
 /*
@@ -120,44 +137,49 @@ static void rustsecp256k1_v0_8_1_scalar_split_lambda_verify(const rustsecp256k1_
  *
  * See proof below.
  */
-static void rustsecp256k1_v0_8_1_scalar_split_lambda(rustsecp256k1_v0_8_1_scalar *r1, rustsecp256k1_v0_8_1_scalar *r2, const rustsecp256k1_v0_8_1_scalar *k) {
-    rustsecp256k1_v0_8_1_scalar c1, c2;
-    static const rustsecp256k1_v0_8_1_scalar minus_b1 = SECP256K1_SCALAR_CONST(
+static void rustsecp256k1_v0_9_0_scalar_split_lambda(rustsecp256k1_v0_9_0_scalar * SECP256K1_RESTRICT r1, rustsecp256k1_v0_9_0_scalar * SECP256K1_RESTRICT r2, const rustsecp256k1_v0_9_0_scalar * SECP256K1_RESTRICT k) {
+    rustsecp256k1_v0_9_0_scalar c1, c2;
+    static const rustsecp256k1_v0_9_0_scalar minus_b1 = SECP256K1_SCALAR_CONST(
         0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL,
         0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C3UL
     );
-    static const rustsecp256k1_v0_8_1_scalar minus_b2 = SECP256K1_SCALAR_CONST(
+    static const rustsecp256k1_v0_9_0_scalar minus_b2 = SECP256K1_SCALAR_CONST(
         0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
         0x8A280AC5UL, 0x0774346DUL, 0xD765CDA8UL, 0x3DB1562CUL
     );
-    static const rustsecp256k1_v0_8_1_scalar g1 = SECP256K1_SCALAR_CONST(
+    static const rustsecp256k1_v0_9_0_scalar g1 = SECP256K1_SCALAR_CONST(
         0x3086D221UL, 0xA7D46BCDUL, 0xE86C90E4UL, 0x9284EB15UL,
         0x3DAA8A14UL, 0x71E8CA7FUL, 0xE893209AUL, 0x45DBB031UL
     );
-    static const rustsecp256k1_v0_8_1_scalar g2 = SECP256K1_SCALAR_CONST(
+    static const rustsecp256k1_v0_9_0_scalar g2 = SECP256K1_SCALAR_CONST(
         0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C4UL,
         0x221208ACUL, 0x9DF506C6UL, 0x1571B4AEUL, 0x8AC47F71UL
     );
+    rustsecp256k1_v0_9_0_scalar_verify(k);
     VERIFY_CHECK(r1 != k);
     VERIFY_CHECK(r2 != k);
+    VERIFY_CHECK(r1 != r2);
+
     /* these _var calls are constant time since the shift amount is constant */
-    rustsecp256k1_v0_8_1_scalar_mul_shift_var(&c1, k, &g1, 384);
-    rustsecp256k1_v0_8_1_scalar_mul_shift_var(&c2, k, &g2, 384);
-    rustsecp256k1_v0_8_1_scalar_mul(&c1, &c1, &minus_b1);
-    rustsecp256k1_v0_8_1_scalar_mul(&c2, &c2, &minus_b2);
-    rustsecp256k1_v0_8_1_scalar_add(r2, &c1, &c2);
-    rustsecp256k1_v0_8_1_scalar_mul(r1, r2, &rustsecp256k1_v0_8_1_const_lambda);
-    rustsecp256k1_v0_8_1_scalar_negate(r1, r1);
-    rustsecp256k1_v0_8_1_scalar_add(r1, r1, k);
+    rustsecp256k1_v0_9_0_scalar_mul_shift_var(&c1, k, &g1, 384);
+    rustsecp256k1_v0_9_0_scalar_mul_shift_var(&c2, k, &g2, 384);
+    rustsecp256k1_v0_9_0_scalar_mul(&c1, &c1, &minus_b1);
+    rustsecp256k1_v0_9_0_scalar_mul(&c2, &c2, &minus_b2);
+    rustsecp256k1_v0_9_0_scalar_add(r2, &c1, &c2);
+    rustsecp256k1_v0_9_0_scalar_mul(r1, r2, &rustsecp256k1_v0_9_0_const_lambda);
+    rustsecp256k1_v0_9_0_scalar_negate(r1, r1);
+    rustsecp256k1_v0_9_0_scalar_add(r1, r1, k);
 
+    rustsecp256k1_v0_9_0_scalar_verify(r1);
+    rustsecp256k1_v0_9_0_scalar_verify(r2);
 #ifdef VERIFY
-    rustsecp256k1_v0_8_1_scalar_split_lambda_verify(r1, r2, k);
+    rustsecp256k1_v0_9_0_scalar_split_lambda_verify(r1, r2, k);
 #endif
 }
 
 #ifdef VERIFY
 /*
- * Proof for rustsecp256k1_v0_8_1_scalar_split_lambda's bounds.
+ * Proof for rustsecp256k1_v0_9_0_scalar_split_lambda's bounds.
  *
  * Let
  *  - epsilon1 = 2^256 * |g1/2^384 - b2/d|
@@ -260,8 +282,8 @@ static void rustsecp256k1_v0_8_1_scalar_split_lambda(rustsecp256k1_v0_8_1_scalar
  *
  * Q.E.D.
  */
-static void rustsecp256k1_v0_8_1_scalar_split_lambda_verify(const rustsecp256k1_v0_8_1_scalar *r1, const rustsecp256k1_v0_8_1_scalar *r2, const rustsecp256k1_v0_8_1_scalar *k) {
-    rustsecp256k1_v0_8_1_scalar s;
+static void rustsecp256k1_v0_9_0_scalar_split_lambda_verify(const rustsecp256k1_v0_9_0_scalar *r1, const rustsecp256k1_v0_9_0_scalar *r2, const rustsecp256k1_v0_9_0_scalar *k) {
+    rustsecp256k1_v0_9_0_scalar s;
     unsigned char buf1[32];
     unsigned char buf2[32];
 
@@ -277,19 +299,19 @@ static void rustsecp256k1_v0_8_1_scalar_split_lambda_verify(const rustsecp256k1_
         0x8a, 0x65, 0x28, 0x7b, 0xd4, 0x71, 0x79, 0xfb, 0x2b, 0xe0, 0x88, 0x46, 0xce, 0xa2, 0x67, 0xed
     };
 
-    rustsecp256k1_v0_8_1_scalar_mul(&s, &rustsecp256k1_v0_8_1_const_lambda, r2);
-    rustsecp256k1_v0_8_1_scalar_add(&s, &s, r1);
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_eq(&s, k));
+    rustsecp256k1_v0_9_0_scalar_mul(&s, &rustsecp256k1_v0_9_0_const_lambda, r2);
+    rustsecp256k1_v0_9_0_scalar_add(&s, &s, r1);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_scalar_eq(&s, k));
 
-    rustsecp256k1_v0_8_1_scalar_negate(&s, r1);
-    rustsecp256k1_v0_8_1_scalar_get_b32(buf1, r1);
-    rustsecp256k1_v0_8_1_scalar_get_b32(buf2, &s);
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_memcmp_var(buf1, k1_bound, 32) < 0 || rustsecp256k1_v0_8_1_memcmp_var(buf2, k1_bound, 32) < 0);
+    rustsecp256k1_v0_9_0_scalar_negate(&s, r1);
+    rustsecp256k1_v0_9_0_scalar_get_b32(buf1, r1);
+    rustsecp256k1_v0_9_0_scalar_get_b32(buf2, &s);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_memcmp_var(buf1, k1_bound, 32) < 0 || rustsecp256k1_v0_9_0_memcmp_var(buf2, k1_bound, 32) < 0);
 
-    rustsecp256k1_v0_8_1_scalar_negate(&s, r2);
-    rustsecp256k1_v0_8_1_scalar_get_b32(buf1, r2);
-    rustsecp256k1_v0_8_1_scalar_get_b32(buf2, &s);
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_memcmp_var(buf1, k2_bound, 32) < 0 || rustsecp256k1_v0_8_1_memcmp_var(buf2, k2_bound, 32) < 0);
+    rustsecp256k1_v0_9_0_scalar_negate(&s, r2);
+    rustsecp256k1_v0_9_0_scalar_get_b32(buf1, r2);
+    rustsecp256k1_v0_9_0_scalar_get_b32(buf2, &s);
+    VERIFY_CHECK(rustsecp256k1_v0_9_0_memcmp_var(buf1, k2_bound, 32) < 0 || rustsecp256k1_v0_9_0_memcmp_var(buf2, k2_bound, 32) < 0);
 }
 #endif /* VERIFY */
 #endif /* !defined(EXHAUSTIVE_TEST_ORDER) */
diff --git a/secp256k1-sys/depend/secp256k1/src/scalar_low.h b/secp256k1-sys/depend/secp256k1/src/scalar_low.h
index a3bf6ae57..1fbec2921 100644
--- a/secp256k1-sys/depend/secp256k1/src/scalar_low.h
+++ b/secp256k1-sys/depend/secp256k1/src/scalar_low.h
@@ -10,7 +10,7 @@
 #include <stdint.h>
 
 /** A scalar modulo the group order of the secp256k1 curve. */
-typedef uint32_t rustsecp256k1_v0_8_1_scalar;
+typedef uint32_t rustsecp256k1_v0_9_0_scalar;
 
 #define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) (d0)
 
diff --git a/secp256k1-sys/depend/secp256k1/src/scalar_low_impl.h b/secp256k1-sys/depend/secp256k1/src/scalar_low_impl.h
index bd45914eb..505aad700 100644
--- a/secp256k1-sys/depend/secp256k1/src/scalar_low_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/scalar_low_impl.h
@@ -7,47 +7,68 @@
 #ifndef SECP256K1_SCALAR_REPR_IMPL_H
 #define SECP256K1_SCALAR_REPR_IMPL_H
 
+#include "checkmem.h"
 #include "scalar.h"
+#include "util.h"
 
 #include <string.h>
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_is_even(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_is_even(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return !(*a & 1);
 }
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_clear(rustsecp256k1_v0_8_1_scalar *r) { *r = 0; }
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_scalar_set_int(rustsecp256k1_v0_8_1_scalar *r, unsigned int v) { *r = v; }
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_scalar_clear(rustsecp256k1_v0_9_0_scalar *r) { *r = 0; }
+
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_scalar_set_int(rustsecp256k1_v0_9_0_scalar *r, unsigned int v) {
+    *r = v % EXHAUSTIVE_TEST_ORDER;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
+}
+
+SECP256K1_INLINE static unsigned int rustsecp256k1_v0_9_0_scalar_get_bits(const rustsecp256k1_v0_9_0_scalar *a, unsigned int offset, unsigned int count) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
 
-SECP256K1_INLINE static unsigned int rustsecp256k1_v0_8_1_scalar_get_bits(const rustsecp256k1_v0_8_1_scalar *a, unsigned int offset, unsigned int count) {
     if (offset < 32)
         return ((*a >> offset) & ((((uint32_t)1) << count) - 1));
     else
         return 0;
 }
 
-SECP256K1_INLINE static unsigned int rustsecp256k1_v0_8_1_scalar_get_bits_var(const rustsecp256k1_v0_8_1_scalar *a, unsigned int offset, unsigned int count) {
-    return rustsecp256k1_v0_8_1_scalar_get_bits(a, offset, count);
+SECP256K1_INLINE static unsigned int rustsecp256k1_v0_9_0_scalar_get_bits_var(const rustsecp256k1_v0_9_0_scalar *a, unsigned int offset, unsigned int count) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
+    return rustsecp256k1_v0_9_0_scalar_get_bits(a, offset, count);
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_check_overflow(const rustsecp256k1_v0_8_1_scalar *a) { return *a >= EXHAUSTIVE_TEST_ORDER; }
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_check_overflow(const rustsecp256k1_v0_9_0_scalar *a) { return *a >= EXHAUSTIVE_TEST_ORDER; }
+
+static int rustsecp256k1_v0_9_0_scalar_add(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
 
-static int rustsecp256k1_v0_8_1_scalar_add(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
     *r = (*a + *b) % EXHAUSTIVE_TEST_ORDER;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return *r < *b;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_cadd_bit(rustsecp256k1_v0_8_1_scalar *r, unsigned int bit, int flag) {
+static void rustsecp256k1_v0_9_0_scalar_cadd_bit(rustsecp256k1_v0_9_0_scalar *r, unsigned int bit, int flag) {
+    rustsecp256k1_v0_9_0_scalar_verify(r);
+
     if (flag && bit < 32)
         *r += ((uint32_t)1 << bit);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 #ifdef VERIFY
     VERIFY_CHECK(bit < 32);
     /* Verify that adding (1 << bit) will not overflow any in-range scalar *r by overflowing the underlying uint32_t. */
     VERIFY_CHECK(((uint32_t)1 << bit) - 1 <= UINT32_MAX - EXHAUSTIVE_TEST_ORDER);
-    VERIFY_CHECK(rustsecp256k1_v0_8_1_scalar_check_overflow(r) == 0);
 #endif
 }
 
-static void rustsecp256k1_v0_8_1_scalar_set_b32(rustsecp256k1_v0_8_1_scalar *r, const unsigned char *b32, int *overflow) {
+static void rustsecp256k1_v0_9_0_scalar_set_b32(rustsecp256k1_v0_9_0_scalar *r, const unsigned char *b32, int *overflow) {
     int i;
     int over = 0;
     *r = 0;
@@ -59,81 +80,129 @@ static void rustsecp256k1_v0_8_1_scalar_set_b32(rustsecp256k1_v0_8_1_scalar *r,
         }
     }
     if (overflow) *overflow = over;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_scalar_get_b32(unsigned char *bin, const rustsecp256k1_v0_8_1_scalar* a) {
+static void rustsecp256k1_v0_9_0_scalar_get_b32(unsigned char *bin, const rustsecp256k1_v0_9_0_scalar* a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     memset(bin, 0, 32);
     bin[28] = *a >> 24; bin[29] = *a >> 16; bin[30] = *a >> 8; bin[31] = *a;
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_is_zero(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_is_zero(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return *a == 0;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_negate(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a) {
+static void rustsecp256k1_v0_9_0_scalar_negate(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     if (*a == 0) {
         *r = 0;
     } else {
         *r = EXHAUSTIVE_TEST_ORDER - *a;
     }
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_is_one(const rustsecp256k1_v0_8_1_scalar *a) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_is_one(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return *a == 1;
 }
 
-static int rustsecp256k1_v0_8_1_scalar_is_high(const rustsecp256k1_v0_8_1_scalar *a) {
+static int rustsecp256k1_v0_9_0_scalar_is_high(const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     return *a > EXHAUSTIVE_TEST_ORDER / 2;
 }
 
-static int rustsecp256k1_v0_8_1_scalar_cond_negate(rustsecp256k1_v0_8_1_scalar *r, int flag) {
-    if (flag) rustsecp256k1_v0_8_1_scalar_negate(r, r);
+static int rustsecp256k1_v0_9_0_scalar_cond_negate(rustsecp256k1_v0_9_0_scalar *r, int flag) {
+    rustsecp256k1_v0_9_0_scalar_verify(r);
+
+    if (flag) rustsecp256k1_v0_9_0_scalar_negate(r, r);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return flag ? -1 : 1;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_mul(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+static void rustsecp256k1_v0_9_0_scalar_mul(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
+
     *r = (*a * *b) % EXHAUSTIVE_TEST_ORDER;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static int rustsecp256k1_v0_8_1_scalar_shr_int(rustsecp256k1_v0_8_1_scalar *r, int n) {
+static int rustsecp256k1_v0_9_0_scalar_shr_int(rustsecp256k1_v0_9_0_scalar *r, int n) {
     int ret;
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     VERIFY_CHECK(n > 0);
     VERIFY_CHECK(n < 16);
+
     ret = *r & ((1 << n) - 1);
     *r >>= n;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     return ret;
 }
 
-static void rustsecp256k1_v0_8_1_scalar_split_128(rustsecp256k1_v0_8_1_scalar *r1, rustsecp256k1_v0_8_1_scalar *r2, const rustsecp256k1_v0_8_1_scalar *a) {
+static void rustsecp256k1_v0_9_0_scalar_split_128(rustsecp256k1_v0_9_0_scalar *r1, rustsecp256k1_v0_9_0_scalar *r2, const rustsecp256k1_v0_9_0_scalar *a) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+
     *r1 = *a;
     *r2 = 0;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r1);
+    rustsecp256k1_v0_9_0_scalar_verify(r2);
 }
 
-SECP256K1_INLINE static int rustsecp256k1_v0_8_1_scalar_eq(const rustsecp256k1_v0_8_1_scalar *a, const rustsecp256k1_v0_8_1_scalar *b) {
+SECP256K1_INLINE static int rustsecp256k1_v0_9_0_scalar_eq(const rustsecp256k1_v0_9_0_scalar *a, const rustsecp256k1_v0_9_0_scalar *b) {
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    rustsecp256k1_v0_9_0_scalar_verify(b);
+
     return *a == *b;
 }
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_scalar_cmov(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *a, int flag) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_scalar_cmov(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *a, int flag) {
     uint32_t mask0, mask1;
-    VG_CHECK_VERIFY(r, sizeof(*r));
-    mask0 = flag + ~((uint32_t)0);
+    volatile int vflag = flag;
+    rustsecp256k1_v0_9_0_scalar_verify(a);
+    SECP256K1_CHECKMEM_CHECK_VERIFY(r, sizeof(*r));
+
+    mask0 = vflag + ~((uint32_t)0);
     mask1 = ~mask0;
     *r = (*r & mask0) | (*a & mask1);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
-static void rustsecp256k1_v0_8_1_scalar_inverse(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *x) {
+static void rustsecp256k1_v0_9_0_scalar_inverse(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *x) {
     int i;
     *r = 0;
+    rustsecp256k1_v0_9_0_scalar_verify(x);
+
     for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++)
         if ((i * *x) % EXHAUSTIVE_TEST_ORDER == 1)
             *r = i;
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
     /* If this VERIFY_CHECK triggers we were given a noninvertible scalar (and thus
      * have a composite group order; fix it in exhaustive_tests.c). */
     VERIFY_CHECK(*r != 0);
 }
 
-static void rustsecp256k1_v0_8_1_scalar_inverse_var(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_scalar *x) {
-    rustsecp256k1_v0_8_1_scalar_inverse(r, x);
+static void rustsecp256k1_v0_9_0_scalar_inverse_var(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_scalar *x) {
+    rustsecp256k1_v0_9_0_scalar_verify(x);
+
+    rustsecp256k1_v0_9_0_scalar_inverse(r, x);
+
+    rustsecp256k1_v0_9_0_scalar_verify(r);
 }
 
 #endif /* SECP256K1_SCALAR_REPR_IMPL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/scratch.h b/secp256k1-sys/depend/secp256k1/src/scratch.h
index a4a945cb7..6a6adba4d 100644
--- a/secp256k1-sys/depend/secp256k1/src/scratch.h
+++ b/secp256k1-sys/depend/secp256k1/src/scratch.h
@@ -9,7 +9,7 @@
 
 /* The typedef is used internally; the struct name is used in the public API
  * (where it is exposed as a different typedef) */
-typedef struct rustsecp256k1_v0_8_1_scratch_space_struct {
+typedef struct rustsecp256k1_v0_9_0_scratch_space_struct {
     /** guard against interpreting this object as other types */
     unsigned char magic[8];
     /** actual allocated data */
@@ -19,24 +19,24 @@ typedef struct rustsecp256k1_v0_8_1_scratch_space_struct {
     size_t alloc_size;
     /** maximum size available to allocate */
     size_t max_size;
-} rustsecp256k1_v0_8_1_scratch;
+} rustsecp256k1_v0_9_0_scratch;
 
-static rustsecp256k1_v0_8_1_scratch* rustsecp256k1_v0_8_1_scratch_create(const rustsecp256k1_v0_8_1_callback* error_callback, size_t max_size);
+static rustsecp256k1_v0_9_0_scratch* rustsecp256k1_v0_9_0_scratch_create(const rustsecp256k1_v0_9_0_callback* error_callback, size_t max_size);
 
-static void rustsecp256k1_v0_8_1_scratch_destroy(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch* scratch);
+static void rustsecp256k1_v0_9_0_scratch_destroy(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch* scratch);
 
 /** Returns an opaque object used to "checkpoint" a scratch space. Used
- *  with `rustsecp256k1_v0_8_1_scratch_apply_checkpoint` to undo allocations. */
-static size_t rustsecp256k1_v0_8_1_scratch_checkpoint(const rustsecp256k1_v0_8_1_callback* error_callback, const rustsecp256k1_v0_8_1_scratch* scratch);
+ *  with `rustsecp256k1_v0_9_0_scratch_apply_checkpoint` to undo allocations. */
+static size_t rustsecp256k1_v0_9_0_scratch_checkpoint(const rustsecp256k1_v0_9_0_callback* error_callback, const rustsecp256k1_v0_9_0_scratch* scratch);
 
-/** Applies a check point received from `rustsecp256k1_v0_8_1_scratch_checkpoint`,
+/** Applies a check point received from `rustsecp256k1_v0_9_0_scratch_checkpoint`,
  *  undoing all allocations since that point. */
-static void rustsecp256k1_v0_8_1_scratch_apply_checkpoint(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch* scratch, size_t checkpoint);
+static void rustsecp256k1_v0_9_0_scratch_apply_checkpoint(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch* scratch, size_t checkpoint);
 
 /** Returns the maximum allocation the scratch space will allow */
-static size_t rustsecp256k1_v0_8_1_scratch_max_allocation(const rustsecp256k1_v0_8_1_callback* error_callback, const rustsecp256k1_v0_8_1_scratch* scratch, size_t n_objects);
+static size_t rustsecp256k1_v0_9_0_scratch_max_allocation(const rustsecp256k1_v0_9_0_callback* error_callback, const rustsecp256k1_v0_9_0_scratch* scratch, size_t n_objects);
 
 /** Returns a pointer into the most recently allocated frame, or NULL if there is insufficient available space */
-static void *rustsecp256k1_v0_8_1_scratch_alloc(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch* scratch, size_t n);
+static void *rustsecp256k1_v0_9_0_scratch_alloc(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch* scratch, size_t n);
 
 #endif
diff --git a/secp256k1-sys/depend/secp256k1/src/scratch_impl.h b/secp256k1-sys/depend/secp256k1/src/scratch_impl.h
index 2f9ececc8..dea27b002 100644
--- a/secp256k1-sys/depend/secp256k1/src/scratch_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/scratch_impl.h
@@ -10,29 +10,29 @@
 #include "util.h"
 #include "scratch.h"
 
-static size_t rustsecp256k1_v0_8_1_scratch_checkpoint(const rustsecp256k1_v0_8_1_callback* error_callback, const rustsecp256k1_v0_8_1_scratch* scratch) {
-    if (rustsecp256k1_v0_8_1_memcmp_var(scratch->magic, "scratch", 8) != 0) {
-        rustsecp256k1_v0_8_1_callback_call(error_callback, "invalid scratch space");
+static size_t rustsecp256k1_v0_9_0_scratch_checkpoint(const rustsecp256k1_v0_9_0_callback* error_callback, const rustsecp256k1_v0_9_0_scratch* scratch) {
+    if (rustsecp256k1_v0_9_0_memcmp_var(scratch->magic, "scratch", 8) != 0) {
+        rustsecp256k1_v0_9_0_callback_call(error_callback, "invalid scratch space");
         return 0;
     }
     return scratch->alloc_size;
 }
 
-static void rustsecp256k1_v0_8_1_scratch_apply_checkpoint(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch* scratch, size_t checkpoint) {
-    if (rustsecp256k1_v0_8_1_memcmp_var(scratch->magic, "scratch", 8) != 0) {
-        rustsecp256k1_v0_8_1_callback_call(error_callback, "invalid scratch space");
+static void rustsecp256k1_v0_9_0_scratch_apply_checkpoint(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch* scratch, size_t checkpoint) {
+    if (rustsecp256k1_v0_9_0_memcmp_var(scratch->magic, "scratch", 8) != 0) {
+        rustsecp256k1_v0_9_0_callback_call(error_callback, "invalid scratch space");
         return;
     }
     if (checkpoint > scratch->alloc_size) {
-        rustsecp256k1_v0_8_1_callback_call(error_callback, "invalid checkpoint");
+        rustsecp256k1_v0_9_0_callback_call(error_callback, "invalid checkpoint");
         return;
     }
     scratch->alloc_size = checkpoint;
 }
 
-static size_t rustsecp256k1_v0_8_1_scratch_max_allocation(const rustsecp256k1_v0_8_1_callback* error_callback, const rustsecp256k1_v0_8_1_scratch* scratch, size_t objects) {
-    if (rustsecp256k1_v0_8_1_memcmp_var(scratch->magic, "scratch", 8) != 0) {
-        rustsecp256k1_v0_8_1_callback_call(error_callback, "invalid scratch space");
+static size_t rustsecp256k1_v0_9_0_scratch_max_allocation(const rustsecp256k1_v0_9_0_callback* error_callback, const rustsecp256k1_v0_9_0_scratch* scratch, size_t objects) {
+    if (rustsecp256k1_v0_9_0_memcmp_var(scratch->magic, "scratch", 8) != 0) {
+        rustsecp256k1_v0_9_0_callback_call(error_callback, "invalid scratch space");
         return 0;
     }
     /* Ensure that multiplication will not wrap around */
@@ -45,7 +45,7 @@ static size_t rustsecp256k1_v0_8_1_scratch_max_allocation(const rustsecp256k1_v0
     return scratch->max_size - scratch->alloc_size - objects * (ALIGNMENT - 1);
 }
 
-static void *rustsecp256k1_v0_8_1_scratch_alloc(const rustsecp256k1_v0_8_1_callback* error_callback, rustsecp256k1_v0_8_1_scratch* scratch, size_t size) {
+static void *rustsecp256k1_v0_9_0_scratch_alloc(const rustsecp256k1_v0_9_0_callback* error_callback, rustsecp256k1_v0_9_0_scratch* scratch, size_t size) {
     void *ret;
     size_t rounded_size;
 
@@ -56,8 +56,8 @@ static void *rustsecp256k1_v0_8_1_scratch_alloc(const rustsecp256k1_v0_8_1_callb
     }
     size = rounded_size;
 
-    if (rustsecp256k1_v0_8_1_memcmp_var(scratch->magic, "scratch", 8) != 0) {
-        rustsecp256k1_v0_8_1_callback_call(error_callback, "invalid scratch space");
+    if (rustsecp256k1_v0_9_0_memcmp_var(scratch->magic, "scratch", 8) != 0) {
+        rustsecp256k1_v0_9_0_callback_call(error_callback, "invalid scratch space");
         return NULL;
     }
 
diff --git a/secp256k1-sys/depend/secp256k1/src/secp256k1.c b/secp256k1-sys/depend/secp256k1/src/secp256k1.c
index ee0e5f471..1ffb81414 100644
--- a/secp256k1-sys/depend/secp256k1/src/secp256k1.c
+++ b/secp256k1-sys/depend/secp256k1/src/secp256k1.c
@@ -21,6 +21,7 @@
 #include "../include/secp256k1_preallocated.h"
 
 #include "assumptions.h"
+#include "checkmem.h"
 #include "util.h"
 
 #include "field_impl.h"
@@ -40,192 +41,208 @@
 # error "secp256k1.h processed without SECP256K1_BUILD defined while building secp256k1.c"
 #endif
 
-#if defined(VALGRIND)
-# include <valgrind/memcheck.h>
-#endif
-
 #define ARG_CHECK(cond) do { \
     if (EXPECT(!(cond), 0)) { \
-        rustsecp256k1_v0_8_1_callback_call(&ctx->illegal_callback, #cond); \
+        rustsecp256k1_v0_9_0_callback_call(&ctx->illegal_callback, #cond); \
         return 0; \
     } \
 } while(0)
 
-#define ARG_CHECK_NO_RETURN(cond) do { \
+#define ARG_CHECK_VOID(cond) do { \
     if (EXPECT(!(cond), 0)) { \
-        rustsecp256k1_v0_8_1_callback_call(&ctx->illegal_callback, #cond); \
+        rustsecp256k1_v0_9_0_callback_call(&ctx->illegal_callback, #cond); \
+        return; \
     } \
 } while(0)
 
 /* Note that whenever you change the context struct, you must also change the
  * context_eq function. */
-struct rustsecp256k1_v0_8_1_context_struct {
-    rustsecp256k1_v0_8_1_ecmult_gen_context ecmult_gen_ctx;
-    rustsecp256k1_v0_8_1_callback illegal_callback;
-    rustsecp256k1_v0_8_1_callback error_callback;
+struct rustsecp256k1_v0_9_0_context_struct {
+    rustsecp256k1_v0_9_0_ecmult_gen_context ecmult_gen_ctx;
+    rustsecp256k1_v0_9_0_callback illegal_callback;
+    rustsecp256k1_v0_9_0_callback error_callback;
     int declassify;
 };
 
-static const rustsecp256k1_v0_8_1_context rustsecp256k1_v0_8_1_context_static_ = {
+static const rustsecp256k1_v0_9_0_context rustsecp256k1_v0_9_0_context_static_ = {
     { 0 },
-    { rustsecp256k1_v0_8_1_default_illegal_callback_fn, 0 },
-    { rustsecp256k1_v0_8_1_default_error_callback_fn, 0 },
+    { rustsecp256k1_v0_9_0_default_illegal_callback_fn, 0 },
+    { rustsecp256k1_v0_9_0_default_error_callback_fn, 0 },
     0
 };
-const rustsecp256k1_v0_8_1_context *rustsecp256k1_v0_8_1_context_static = &rustsecp256k1_v0_8_1_context_static_;
-const rustsecp256k1_v0_8_1_context *rustsecp256k1_v0_8_1_context_no_precomp = &rustsecp256k1_v0_8_1_context_static_;
+const rustsecp256k1_v0_9_0_context *rustsecp256k1_v0_9_0_context_static = &rustsecp256k1_v0_9_0_context_static_;
+const rustsecp256k1_v0_9_0_context *rustsecp256k1_v0_9_0_context_no_precomp = &rustsecp256k1_v0_9_0_context_static_;
+
+/* Helper function that determines if a context is proper, i.e., is not the static context or a copy thereof.
+ *
+ * This is intended for "context" functions such as rustsecp256k1_v0_9_0_context_clone. Function which need specific
+ * features of a context should still check for these features directly. For example, a function that needs
+ * ecmult_gen should directly check for the existence of the ecmult_gen context. */
+static int rustsecp256k1_v0_9_0_context_is_proper(const rustsecp256k1_v0_9_0_context* ctx) {
+    return rustsecp256k1_v0_9_0_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx);
+}
 
-void rustsecp256k1_v0_8_1_selftest(void) {
-    if (!rustsecp256k1_v0_8_1_selftest_passes()) {
-        rustsecp256k1_v0_8_1_callback_call(&default_error_callback, "self test failed");
+void rustsecp256k1_v0_9_0_selftest(void) {
+    if (!rustsecp256k1_v0_9_0_selftest_passes()) {
+        rustsecp256k1_v0_9_0_callback_call(&default_error_callback, "self test failed");
     }
 }
 
-size_t rustsecp256k1_v0_8_1_context_preallocated_size(unsigned int flags) {
-    size_t ret = sizeof(rustsecp256k1_v0_8_1_context);
+size_t rustsecp256k1_v0_9_0_context_preallocated_size(unsigned int flags) {
+    size_t ret = sizeof(rustsecp256k1_v0_9_0_context);
     /* A return value of 0 is reserved as an indicator for errors when we call this function internally. */
     VERIFY_CHECK(ret != 0);
 
     if (EXPECT((flags & SECP256K1_FLAGS_TYPE_MASK) != SECP256K1_FLAGS_TYPE_CONTEXT, 0)) {
-            rustsecp256k1_v0_8_1_callback_call(&default_illegal_callback,
+            rustsecp256k1_v0_9_0_callback_call(&default_illegal_callback,
                                     "Invalid flags");
             return 0;
     }
 
+    if (EXPECT(!SECP256K1_CHECKMEM_RUNNING() && (flags & SECP256K1_FLAGS_BIT_CONTEXT_DECLASSIFY), 0)) {
+            rustsecp256k1_v0_9_0_callback_call(&default_illegal_callback,
+                                    "Declassify flag requires running with memory checking");
+            return 0;
+    }
+
     return ret;
 }
 
-size_t rustsecp256k1_v0_8_1_context_preallocated_clone_size(const rustsecp256k1_v0_8_1_context* ctx) {
-    size_t ret = sizeof(rustsecp256k1_v0_8_1_context);
+size_t rustsecp256k1_v0_9_0_context_preallocated_clone_size(const rustsecp256k1_v0_9_0_context* ctx) {
     VERIFY_CHECK(ctx != NULL);
-    return ret;
+    ARG_CHECK(rustsecp256k1_v0_9_0_context_is_proper(ctx));
+    return sizeof(rustsecp256k1_v0_9_0_context);
 }
 
-rustsecp256k1_v0_8_1_context* rustsecp256k1_v0_8_1_context_preallocated_create(void* prealloc, unsigned int flags) {
+rustsecp256k1_v0_9_0_context* rustsecp256k1_v0_9_0_context_preallocated_create(void* prealloc, unsigned int flags) {
     size_t prealloc_size;
-    rustsecp256k1_v0_8_1_context* ret;
+    rustsecp256k1_v0_9_0_context* ret;
 
-    rustsecp256k1_v0_8_1_selftest();
+    rustsecp256k1_v0_9_0_selftest();
 
-    prealloc_size = rustsecp256k1_v0_8_1_context_preallocated_size(flags);
+    prealloc_size = rustsecp256k1_v0_9_0_context_preallocated_size(flags);
     if (prealloc_size == 0) {
         return NULL;
     }
     VERIFY_CHECK(prealloc != NULL);
-    ret = (rustsecp256k1_v0_8_1_context*)prealloc;
+    ret = (rustsecp256k1_v0_9_0_context*)prealloc;
     ret->illegal_callback = default_illegal_callback;
     ret->error_callback = default_error_callback;
 
-    /* Flags have been checked by rustsecp256k1_v0_8_1_context_preallocated_size. */
+    /* Flags have been checked by rustsecp256k1_v0_9_0_context_preallocated_size. */
     VERIFY_CHECK((flags & SECP256K1_FLAGS_TYPE_MASK) == SECP256K1_FLAGS_TYPE_CONTEXT);
-    rustsecp256k1_v0_8_1_ecmult_gen_context_build(&ret->ecmult_gen_ctx);
+    rustsecp256k1_v0_9_0_ecmult_gen_context_build(&ret->ecmult_gen_ctx);
     ret->declassify = !!(flags & SECP256K1_FLAGS_BIT_CONTEXT_DECLASSIFY);
 
     return ret;
 }
 
-rustsecp256k1_v0_8_1_context* rustsecp256k1_v0_8_1_context_preallocated_clone(const rustsecp256k1_v0_8_1_context* ctx, void* prealloc) {
-    rustsecp256k1_v0_8_1_context* ret;
+rustsecp256k1_v0_9_0_context* rustsecp256k1_v0_9_0_context_preallocated_clone(const rustsecp256k1_v0_9_0_context* ctx, void* prealloc) {
+    rustsecp256k1_v0_9_0_context* ret;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(prealloc != NULL);
+    ARG_CHECK(rustsecp256k1_v0_9_0_context_is_proper(ctx));
 
-    ret = (rustsecp256k1_v0_8_1_context*)prealloc;
+    ret = (rustsecp256k1_v0_9_0_context*)prealloc;
     *ret = *ctx;
     return ret;
 }
 
-void rustsecp256k1_v0_8_1_context_preallocated_destroy(rustsecp256k1_v0_8_1_context* ctx) {
-    ARG_CHECK_NO_RETURN(ctx != rustsecp256k1_v0_8_1_context_static);
-    if (ctx != NULL) {
-        rustsecp256k1_v0_8_1_ecmult_gen_context_clear(&ctx->ecmult_gen_ctx);
+void rustsecp256k1_v0_9_0_context_preallocated_destroy(rustsecp256k1_v0_9_0_context* ctx) {
+    ARG_CHECK_VOID(ctx == NULL || rustsecp256k1_v0_9_0_context_is_proper(ctx));
+
+    /* Defined as noop */
+    if (ctx == NULL) {
+        return;
     }
+
+    rustsecp256k1_v0_9_0_ecmult_gen_context_clear(&ctx->ecmult_gen_ctx);
 }
 
-void rustsecp256k1_v0_8_1_context_set_illegal_callback(rustsecp256k1_v0_8_1_context* ctx, void (*fun)(const char* message, void* data), const void* data) {
-    ARG_CHECK_NO_RETURN(ctx != rustsecp256k1_v0_8_1_context_static);
+void rustsecp256k1_v0_9_0_context_set_illegal_callback(rustsecp256k1_v0_9_0_context* ctx, void (*fun)(const char* message, void* data), const void* data) {
+    /* We compare pointers instead of checking rustsecp256k1_v0_9_0_context_is_proper() here
+       because setting callbacks is allowed on *copies* of the static context:
+       it's harmless and makes testing easier. */
+    ARG_CHECK_VOID(ctx != rustsecp256k1_v0_9_0_context_static);
     if (fun == NULL) {
-        fun = rustsecp256k1_v0_8_1_default_illegal_callback_fn;
+        fun = rustsecp256k1_v0_9_0_default_illegal_callback_fn;
     }
     ctx->illegal_callback.fn = fun;
     ctx->illegal_callback.data = data;
 }
 
-void rustsecp256k1_v0_8_1_context_set_error_callback(rustsecp256k1_v0_8_1_context* ctx, void (*fun)(const char* message, void* data), const void* data) {
-    ARG_CHECK_NO_RETURN(ctx != rustsecp256k1_v0_8_1_context_static);
+void rustsecp256k1_v0_9_0_context_set_error_callback(rustsecp256k1_v0_9_0_context* ctx, void (*fun)(const char* message, void* data), const void* data) {
+    /* We compare pointers instead of checking rustsecp256k1_v0_9_0_context_is_proper() here
+       because setting callbacks is allowed on *copies* of the static context:
+       it's harmless and makes testing easier. */
+    ARG_CHECK_VOID(ctx != rustsecp256k1_v0_9_0_context_static);
     if (fun == NULL) {
-        fun = rustsecp256k1_v0_8_1_default_error_callback_fn;
+        fun = rustsecp256k1_v0_9_0_default_error_callback_fn;
     }
     ctx->error_callback.fn = fun;
     ctx->error_callback.data = data;
 }
 
 /* Mark memory as no-longer-secret for the purpose of analysing constant-time behaviour
- *  of the software. This is setup for use with valgrind but could be substituted with
- *  the appropriate instrumentation for other analysis tools.
+ *  of the software.
  */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_declassify(const rustsecp256k1_v0_8_1_context* ctx, const void *p, size_t len) {
-#if defined(VALGRIND)
-    if (EXPECT(ctx->declassify,0)) VALGRIND_MAKE_MEM_DEFINED(p, len);
-#else
-    (void)ctx;
-    (void)p;
-    (void)len;
-#endif
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_declassify(const rustsecp256k1_v0_9_0_context* ctx, const void *p, size_t len) {
+    if (EXPECT(ctx->declassify, 0)) SECP256K1_CHECKMEM_DEFINE(p, len);
 }
 
-static int rustsecp256k1_v0_8_1_pubkey_load(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ge* ge, const rustsecp256k1_v0_8_1_pubkey* pubkey) {
-    if (sizeof(rustsecp256k1_v0_8_1_ge_storage) == 64) {
-        /* When the rustsecp256k1_v0_8_1_ge_storage type is exactly 64 byte, use its
-         * representation inside rustsecp256k1_v0_8_1_pubkey, as conversion is very fast.
-         * Note that rustsecp256k1_v0_8_1_pubkey_save must use the same representation. */
-        rustsecp256k1_v0_8_1_ge_storage s;
+static int rustsecp256k1_v0_9_0_pubkey_load(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ge* ge, const rustsecp256k1_v0_9_0_pubkey* pubkey) {
+    if (sizeof(rustsecp256k1_v0_9_0_ge_storage) == 64) {
+        /* When the rustsecp256k1_v0_9_0_ge_storage type is exactly 64 byte, use its
+         * representation inside rustsecp256k1_v0_9_0_pubkey, as conversion is very fast.
+         * Note that rustsecp256k1_v0_9_0_pubkey_save must use the same representation. */
+        rustsecp256k1_v0_9_0_ge_storage s;
         memcpy(&s, &pubkey->data[0], sizeof(s));
-        rustsecp256k1_v0_8_1_ge_from_storage(ge, &s);
+        rustsecp256k1_v0_9_0_ge_from_storage(ge, &s);
     } else {
         /* Otherwise, fall back to 32-byte big endian for X and Y. */
-        rustsecp256k1_v0_8_1_fe x, y;
-        rustsecp256k1_v0_8_1_fe_set_b32(&x, pubkey->data);
-        rustsecp256k1_v0_8_1_fe_set_b32(&y, pubkey->data + 32);
-        rustsecp256k1_v0_8_1_ge_set_xy(ge, &x, &y);
+        rustsecp256k1_v0_9_0_fe x, y;
+        ARG_CHECK(rustsecp256k1_v0_9_0_fe_set_b32_limit(&x, pubkey->data));
+        ARG_CHECK(rustsecp256k1_v0_9_0_fe_set_b32_limit(&y, pubkey->data + 32));
+        rustsecp256k1_v0_9_0_ge_set_xy(ge, &x, &y);
     }
-    ARG_CHECK(!rustsecp256k1_v0_8_1_fe_is_zero(&ge->x));
+    ARG_CHECK(!rustsecp256k1_v0_9_0_fe_is_zero(&ge->x));
     return 1;
 }
 
-static void rustsecp256k1_v0_8_1_pubkey_save(rustsecp256k1_v0_8_1_pubkey* pubkey, rustsecp256k1_v0_8_1_ge* ge) {
-    if (sizeof(rustsecp256k1_v0_8_1_ge_storage) == 64) {
-        rustsecp256k1_v0_8_1_ge_storage s;
-        rustsecp256k1_v0_8_1_ge_to_storage(&s, ge);
+static void rustsecp256k1_v0_9_0_pubkey_save(rustsecp256k1_v0_9_0_pubkey* pubkey, rustsecp256k1_v0_9_0_ge* ge) {
+    if (sizeof(rustsecp256k1_v0_9_0_ge_storage) == 64) {
+        rustsecp256k1_v0_9_0_ge_storage s;
+        rustsecp256k1_v0_9_0_ge_to_storage(&s, ge);
         memcpy(&pubkey->data[0], &s, sizeof(s));
     } else {
-        VERIFY_CHECK(!rustsecp256k1_v0_8_1_ge_is_infinity(ge));
-        rustsecp256k1_v0_8_1_fe_normalize_var(&ge->x);
-        rustsecp256k1_v0_8_1_fe_normalize_var(&ge->y);
-        rustsecp256k1_v0_8_1_fe_get_b32(pubkey->data, &ge->x);
-        rustsecp256k1_v0_8_1_fe_get_b32(pubkey->data + 32, &ge->y);
+        VERIFY_CHECK(!rustsecp256k1_v0_9_0_ge_is_infinity(ge));
+        rustsecp256k1_v0_9_0_fe_normalize_var(&ge->x);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&ge->y);
+        rustsecp256k1_v0_9_0_fe_get_b32(pubkey->data, &ge->x);
+        rustsecp256k1_v0_9_0_fe_get_b32(pubkey->data + 32, &ge->y);
     }
 }
 
-int rustsecp256k1_v0_8_1_ec_pubkey_parse(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_pubkey* pubkey, const unsigned char *input, size_t inputlen) {
-    rustsecp256k1_v0_8_1_ge Q;
+int rustsecp256k1_v0_9_0_ec_pubkey_parse(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_pubkey* pubkey, const unsigned char *input, size_t inputlen) {
+    rustsecp256k1_v0_9_0_ge Q;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(pubkey != NULL);
     memset(pubkey, 0, sizeof(*pubkey));
     ARG_CHECK(input != NULL);
-    if (!rustsecp256k1_v0_8_1_eckey_pubkey_parse(&Q, input, inputlen)) {
+    if (!rustsecp256k1_v0_9_0_eckey_pubkey_parse(&Q, input, inputlen)) {
         return 0;
     }
-    if (!rustsecp256k1_v0_8_1_ge_is_in_correct_subgroup(&Q)) {
+    if (!rustsecp256k1_v0_9_0_ge_is_in_correct_subgroup(&Q)) {
         return 0;
     }
-    rustsecp256k1_v0_8_1_pubkey_save(pubkey, &Q);
-    rustsecp256k1_v0_8_1_ge_clear(&Q);
+    rustsecp256k1_v0_9_0_pubkey_save(pubkey, &Q);
+    rustsecp256k1_v0_9_0_ge_clear(&Q);
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_ec_pubkey_serialize(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *output, size_t *outputlen, const rustsecp256k1_v0_8_1_pubkey* pubkey, unsigned int flags) {
-    rustsecp256k1_v0_8_1_ge Q;
+int rustsecp256k1_v0_9_0_ec_pubkey_serialize(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *output, size_t *outputlen, const rustsecp256k1_v0_9_0_pubkey* pubkey, unsigned int flags) {
+    rustsecp256k1_v0_9_0_ge Q;
     size_t len;
     int ret = 0;
 
@@ -238,8 +255,8 @@ int rustsecp256k1_v0_8_1_ec_pubkey_serialize(const rustsecp256k1_v0_8_1_context*
     memset(output, 0, len);
     ARG_CHECK(pubkey != NULL);
     ARG_CHECK((flags & SECP256K1_FLAGS_TYPE_MASK) == SECP256K1_FLAGS_TYPE_COMPRESSION);
-    if (rustsecp256k1_v0_8_1_pubkey_load(ctx, &Q, pubkey)) {
-        ret = rustsecp256k1_v0_8_1_eckey_pubkey_serialize(&Q, output, &len, flags & SECP256K1_FLAGS_BIT_COMPRESSION);
+    if (rustsecp256k1_v0_9_0_pubkey_load(ctx, &Q, pubkey)) {
+        ret = rustsecp256k1_v0_9_0_eckey_pubkey_serialize(&Q, output, &len, flags & SECP256K1_FLAGS_BIT_COMPRESSION);
         if (ret) {
             *outputlen = len;
         }
@@ -247,9 +264,9 @@ int rustsecp256k1_v0_8_1_ec_pubkey_serialize(const rustsecp256k1_v0_8_1_context*
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ec_pubkey_cmp(const rustsecp256k1_v0_8_1_context* ctx, const rustsecp256k1_v0_8_1_pubkey* pubkey0, const rustsecp256k1_v0_8_1_pubkey* pubkey1) {
+int rustsecp256k1_v0_9_0_ec_pubkey_cmp(const rustsecp256k1_v0_9_0_context* ctx, const rustsecp256k1_v0_9_0_pubkey* pubkey0, const rustsecp256k1_v0_9_0_pubkey* pubkey1) {
     unsigned char out[2][33];
-    const rustsecp256k1_v0_8_1_pubkey* pk[2];
+    const rustsecp256k1_v0_9_0_pubkey* pk[2];
     int i;
 
     VERIFY_CHECK(ctx != NULL);
@@ -262,7 +279,7 @@ int rustsecp256k1_v0_8_1_ec_pubkey_cmp(const rustsecp256k1_v0_8_1_context* ctx,
          * results in consistent comparisons even if NULL or invalid pubkeys are
          * involved and prevents edge cases such as sorting algorithms that use
          * this function and do not terminate as a result. */
-        if (!rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, out[i], &out_size, pk[i], SECP256K1_EC_COMPRESSED)) {
+        if (!rustsecp256k1_v0_9_0_ec_pubkey_serialize(ctx, out[i], &out_size, pk[i], SECP256K1_EC_COMPRESSED)) {
             /* Note that ec_pubkey_serialize should already set the output to
              * zero in that case, but it's not guaranteed by the API, we can't
              * test it and writing a VERIFY_CHECK is more complex than
@@ -270,42 +287,42 @@ int rustsecp256k1_v0_8_1_ec_pubkey_cmp(const rustsecp256k1_v0_8_1_context* ctx,
             memset(out[i], 0, sizeof(out[i]));
         }
     }
-    return rustsecp256k1_v0_8_1_memcmp_var(out[0], out[1], sizeof(out[0]));
+    return rustsecp256k1_v0_9_0_memcmp_var(out[0], out[1], sizeof(out[0]));
 }
 
-static void rustsecp256k1_v0_8_1_ecdsa_signature_load(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_scalar* r, rustsecp256k1_v0_8_1_scalar* s, const rustsecp256k1_v0_8_1_ecdsa_signature* sig) {
+static void rustsecp256k1_v0_9_0_ecdsa_signature_load(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_scalar* r, rustsecp256k1_v0_9_0_scalar* s, const rustsecp256k1_v0_9_0_ecdsa_signature* sig) {
     (void)ctx;
-    if (sizeof(rustsecp256k1_v0_8_1_scalar) == 32) {
-        /* When the rustsecp256k1_v0_8_1_scalar type is exactly 32 byte, use its
-         * representation inside rustsecp256k1_v0_8_1_ecdsa_signature, as conversion is very fast.
-         * Note that rustsecp256k1_v0_8_1_ecdsa_signature_save must use the same representation. */
+    if (sizeof(rustsecp256k1_v0_9_0_scalar) == 32) {
+        /* When the rustsecp256k1_v0_9_0_scalar type is exactly 32 byte, use its
+         * representation inside rustsecp256k1_v0_9_0_ecdsa_signature, as conversion is very fast.
+         * Note that rustsecp256k1_v0_9_0_ecdsa_signature_save must use the same representation. */
         memcpy(r, &sig->data[0], 32);
         memcpy(s, &sig->data[32], 32);
     } else {
-        rustsecp256k1_v0_8_1_scalar_set_b32(r, &sig->data[0], NULL);
-        rustsecp256k1_v0_8_1_scalar_set_b32(s, &sig->data[32], NULL);
+        rustsecp256k1_v0_9_0_scalar_set_b32(r, &sig->data[0], NULL);
+        rustsecp256k1_v0_9_0_scalar_set_b32(s, &sig->data[32], NULL);
     }
 }
 
-static void rustsecp256k1_v0_8_1_ecdsa_signature_save(rustsecp256k1_v0_8_1_ecdsa_signature* sig, const rustsecp256k1_v0_8_1_scalar* r, const rustsecp256k1_v0_8_1_scalar* s) {
-    if (sizeof(rustsecp256k1_v0_8_1_scalar) == 32) {
+static void rustsecp256k1_v0_9_0_ecdsa_signature_save(rustsecp256k1_v0_9_0_ecdsa_signature* sig, const rustsecp256k1_v0_9_0_scalar* r, const rustsecp256k1_v0_9_0_scalar* s) {
+    if (sizeof(rustsecp256k1_v0_9_0_scalar) == 32) {
         memcpy(&sig->data[0], r, 32);
         memcpy(&sig->data[32], s, 32);
     } else {
-        rustsecp256k1_v0_8_1_scalar_get_b32(&sig->data[0], r);
-        rustsecp256k1_v0_8_1_scalar_get_b32(&sig->data[32], s);
+        rustsecp256k1_v0_9_0_scalar_get_b32(&sig->data[0], r);
+        rustsecp256k1_v0_9_0_scalar_get_b32(&sig->data[32], s);
     }
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
+    rustsecp256k1_v0_9_0_scalar r, s;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(sig != NULL);
     ARG_CHECK(input != NULL);
 
-    if (rustsecp256k1_v0_8_1_ecdsa_sig_parse(&r, &s, input, inputlen)) {
-        rustsecp256k1_v0_8_1_ecdsa_signature_save(sig, &r, &s);
+    if (rustsecp256k1_v0_9_0_ecdsa_sig_parse(&r, &s, input, inputlen)) {
+        rustsecp256k1_v0_9_0_ecdsa_signature_save(sig, &r, &s);
         return 1;
     } else {
         memset(sig, 0, sizeof(*sig));
@@ -313,8 +330,8 @@ int rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(const rustsecp256k1_v0_8_1_co
     }
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ecdsa_signature* sig, const unsigned char *input64) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ecdsa_signature* sig, const unsigned char *input64) {
+    rustsecp256k1_v0_9_0_scalar r, s;
     int ret = 1;
     int overflow = 0;
 
@@ -322,76 +339,76 @@ int rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(const rustsecp256k1_v0_8_
     ARG_CHECK(sig != NULL);
     ARG_CHECK(input64 != NULL);
 
-    rustsecp256k1_v0_8_1_scalar_set_b32(&r, &input64[0], &overflow);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&r, &input64[0], &overflow);
     ret &= !overflow;
-    rustsecp256k1_v0_8_1_scalar_set_b32(&s, &input64[32], &overflow);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&s, &input64[32], &overflow);
     ret &= !overflow;
     if (ret) {
-        rustsecp256k1_v0_8_1_ecdsa_signature_save(sig, &r, &s);
+        rustsecp256k1_v0_9_0_ecdsa_signature_save(sig, &r, &s);
     } else {
         memset(sig, 0, sizeof(*sig));
     }
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *output, size_t *outputlen, const rustsecp256k1_v0_8_1_ecdsa_signature* sig) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *output, size_t *outputlen, const rustsecp256k1_v0_9_0_ecdsa_signature* sig) {
+    rustsecp256k1_v0_9_0_scalar r, s;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(output != NULL);
     ARG_CHECK(outputlen != NULL);
     ARG_CHECK(sig != NULL);
 
-    rustsecp256k1_v0_8_1_ecdsa_signature_load(ctx, &r, &s, sig);
-    return rustsecp256k1_v0_8_1_ecdsa_sig_serialize(output, outputlen, &r, &s);
+    rustsecp256k1_v0_9_0_ecdsa_signature_load(ctx, &r, &s, sig);
+    return rustsecp256k1_v0_9_0_ecdsa_sig_serialize(output, outputlen, &r, &s);
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *output64, const rustsecp256k1_v0_8_1_ecdsa_signature* sig) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_signature_serialize_compact(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *output64, const rustsecp256k1_v0_9_0_ecdsa_signature* sig) {
+    rustsecp256k1_v0_9_0_scalar r, s;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(output64 != NULL);
     ARG_CHECK(sig != NULL);
 
-    rustsecp256k1_v0_8_1_ecdsa_signature_load(ctx, &r, &s, sig);
-    rustsecp256k1_v0_8_1_scalar_get_b32(&output64[0], &r);
-    rustsecp256k1_v0_8_1_scalar_get_b32(&output64[32], &s);
+    rustsecp256k1_v0_9_0_ecdsa_signature_load(ctx, &r, &s, sig);
+    rustsecp256k1_v0_9_0_scalar_get_b32(&output64[0], &r);
+    rustsecp256k1_v0_9_0_scalar_get_b32(&output64[32], &s);
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_signature_normalize(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ecdsa_signature *sigout, const rustsecp256k1_v0_8_1_ecdsa_signature *sigin) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_signature_normalize(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ecdsa_signature *sigout, const rustsecp256k1_v0_9_0_ecdsa_signature *sigin) {
+    rustsecp256k1_v0_9_0_scalar r, s;
     int ret = 0;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(sigin != NULL);
 
-    rustsecp256k1_v0_8_1_ecdsa_signature_load(ctx, &r, &s, sigin);
-    ret = rustsecp256k1_v0_8_1_scalar_is_high(&s);
+    rustsecp256k1_v0_9_0_ecdsa_signature_load(ctx, &r, &s, sigin);
+    ret = rustsecp256k1_v0_9_0_scalar_is_high(&s);
     if (sigout != NULL) {
         if (ret) {
-            rustsecp256k1_v0_8_1_scalar_negate(&s, &s);
+            rustsecp256k1_v0_9_0_scalar_negate(&s, &s);
         }
-        rustsecp256k1_v0_8_1_ecdsa_signature_save(sigout, &r, &s);
+        rustsecp256k1_v0_9_0_ecdsa_signature_save(sigout, &r, &s);
     }
 
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_verify(const rustsecp256k1_v0_8_1_context* ctx, const rustsecp256k1_v0_8_1_ecdsa_signature *sig, const unsigned char *msghash32, const rustsecp256k1_v0_8_1_pubkey *pubkey) {
-    rustsecp256k1_v0_8_1_ge q;
-    rustsecp256k1_v0_8_1_scalar r, s;
-    rustsecp256k1_v0_8_1_scalar m;
+int rustsecp256k1_v0_9_0_ecdsa_verify(const rustsecp256k1_v0_9_0_context* ctx, const rustsecp256k1_v0_9_0_ecdsa_signature *sig, const unsigned char *msghash32, const rustsecp256k1_v0_9_0_pubkey *pubkey) {
+    rustsecp256k1_v0_9_0_ge q;
+    rustsecp256k1_v0_9_0_scalar r, s;
+    rustsecp256k1_v0_9_0_scalar m;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(msghash32 != NULL);
     ARG_CHECK(sig != NULL);
     ARG_CHECK(pubkey != NULL);
 
-    rustsecp256k1_v0_8_1_scalar_set_b32(&m, msghash32, NULL);
-    rustsecp256k1_v0_8_1_ecdsa_signature_load(ctx, &r, &s, sig);
-    return (!rustsecp256k1_v0_8_1_scalar_is_high(&s) &&
-            rustsecp256k1_v0_8_1_pubkey_load(ctx, &q, pubkey) &&
-            rustsecp256k1_v0_8_1_ecdsa_sig_verify(&r, &s, &q, &m));
+    rustsecp256k1_v0_9_0_scalar_set_b32(&m, msghash32, NULL);
+    rustsecp256k1_v0_9_0_ecdsa_signature_load(ctx, &r, &s, sig);
+    return (!rustsecp256k1_v0_9_0_scalar_is_high(&s) &&
+            rustsecp256k1_v0_9_0_pubkey_load(ctx, &q, pubkey) &&
+            rustsecp256k1_v0_9_0_ecdsa_sig_verify(&r, &s, &q, &m));
 }
 
 static SECP256K1_INLINE void buffer_append(unsigned char *buf, unsigned int *offset, const void *data, unsigned int len) {
@@ -402,12 +419,12 @@ static SECP256K1_INLINE void buffer_append(unsigned char *buf, unsigned int *off
 static int nonce_function_rfc6979(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
    unsigned char keydata[112];
    unsigned int offset = 0;
-   rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 rng;
+   rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 rng;
    unsigned int i;
-   rustsecp256k1_v0_8_1_scalar msg;
+   rustsecp256k1_v0_9_0_scalar msg;
    unsigned char msgmod32[32];
-   rustsecp256k1_v0_8_1_scalar_set_b32(&msg, msg32, NULL);
-   rustsecp256k1_v0_8_1_scalar_get_b32(msgmod32, &msg);
+   rustsecp256k1_v0_9_0_scalar_set_b32(&msg, msg32, NULL);
+   rustsecp256k1_v0_9_0_scalar_get_b32(msgmod32, &msg);
    /* We feed a byte array to the PRNG as input, consisting of:
     * - the private key (32 bytes) and reduced message (32 bytes), see RFC 6979 3.2d.
     * - optionally 32 extra bytes of data, see RFC 6979 3.6 Additional Data.
@@ -424,51 +441,51 @@ static int nonce_function_rfc6979(unsigned char *nonce32, const unsigned char *m
    if (algo16 != NULL) {
        buffer_append(keydata, &offset, algo16, 16);
    }
-   rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_initialize(&rng, keydata, offset);
+   rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_initialize(&rng, keydata, offset);
    memset(keydata, 0, sizeof(keydata));
    for (i = 0; i <= counter; i++) {
-       rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
+       rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
    }
-   rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_finalize(&rng);
+   rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_finalize(&rng);
    return 1;
 }
 
-const rustsecp256k1_v0_8_1_nonce_function rustsecp256k1_v0_8_1_nonce_function_rfc6979 = nonce_function_rfc6979;
-const rustsecp256k1_v0_8_1_nonce_function rustsecp256k1_v0_8_1_nonce_function_default = nonce_function_rfc6979;
+const rustsecp256k1_v0_9_0_nonce_function rustsecp256k1_v0_9_0_nonce_function_rfc6979 = nonce_function_rfc6979;
+const rustsecp256k1_v0_9_0_nonce_function rustsecp256k1_v0_9_0_nonce_function_default = nonce_function_rfc6979;
 
-static int rustsecp256k1_v0_8_1_ecdsa_sign_inner(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_scalar* r, rustsecp256k1_v0_8_1_scalar* s, int* recid, const unsigned char *msg32, const unsigned char *seckey, rustsecp256k1_v0_8_1_nonce_function noncefp, const void* noncedata) {
-    rustsecp256k1_v0_8_1_scalar sec, non, msg;
+static int rustsecp256k1_v0_9_0_ecdsa_sign_inner(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_scalar* r, rustsecp256k1_v0_9_0_scalar* s, int* recid, const unsigned char *msg32, const unsigned char *seckey, rustsecp256k1_v0_9_0_nonce_function noncefp, const void* noncedata) {
+    rustsecp256k1_v0_9_0_scalar sec, non, msg;
     int ret = 0;
     int is_sec_valid;
     unsigned char nonce32[32];
     unsigned int count = 0;
     /* Default initialization here is important so we won't pass uninit values to the cmov in the end */
-    *r = rustsecp256k1_v0_8_1_scalar_zero;
-    *s = rustsecp256k1_v0_8_1_scalar_zero;
+    *r = rustsecp256k1_v0_9_0_scalar_zero;
+    *s = rustsecp256k1_v0_9_0_scalar_zero;
     if (recid) {
         *recid = 0;
     }
     if (noncefp == NULL) {
-        noncefp = rustsecp256k1_v0_8_1_nonce_function_default;
+        noncefp = rustsecp256k1_v0_9_0_nonce_function_default;
     }
 
     /* Fail if the secret key is invalid. */
-    is_sec_valid = rustsecp256k1_v0_8_1_scalar_set_b32_seckey(&sec, seckey);
-    rustsecp256k1_v0_8_1_scalar_cmov(&sec, &rustsecp256k1_v0_8_1_scalar_one, !is_sec_valid);
-    rustsecp256k1_v0_8_1_scalar_set_b32(&msg, msg32, NULL);
+    is_sec_valid = rustsecp256k1_v0_9_0_scalar_set_b32_seckey(&sec, seckey);
+    rustsecp256k1_v0_9_0_scalar_cmov(&sec, &rustsecp256k1_v0_9_0_scalar_one, !is_sec_valid);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&msg, msg32, NULL);
     while (1) {
         int is_nonce_valid;
         ret = !!noncefp(nonce32, msg32, seckey, NULL, (void*)noncedata, count);
         if (!ret) {
             break;
         }
-        is_nonce_valid = rustsecp256k1_v0_8_1_scalar_set_b32_seckey(&non, nonce32);
+        is_nonce_valid = rustsecp256k1_v0_9_0_scalar_set_b32_seckey(&non, nonce32);
         /* The nonce is still secret here, but it being invalid is is less likely than 1:2^255. */
-        rustsecp256k1_v0_8_1_declassify(ctx, &is_nonce_valid, sizeof(is_nonce_valid));
+        rustsecp256k1_v0_9_0_declassify(ctx, &is_nonce_valid, sizeof(is_nonce_valid));
         if (is_nonce_valid) {
-            ret = rustsecp256k1_v0_8_1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, r, s, &sec, &msg, &non, recid);
+            ret = rustsecp256k1_v0_9_0_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, r, s, &sec, &msg, &non, recid);
             /* The final signature is no longer a secret, nor is the fact that we were successful or not. */
-            rustsecp256k1_v0_8_1_declassify(ctx, &ret, sizeof(ret));
+            rustsecp256k1_v0_9_0_declassify(ctx, &ret, sizeof(ret));
             if (ret) {
                 break;
             }
@@ -480,202 +497,202 @@ static int rustsecp256k1_v0_8_1_ecdsa_sign_inner(const rustsecp256k1_v0_8_1_cont
      * used as a branching variable. */
     ret &= is_sec_valid;
     memset(nonce32, 0, 32);
-    rustsecp256k1_v0_8_1_scalar_clear(&msg);
-    rustsecp256k1_v0_8_1_scalar_clear(&non);
-    rustsecp256k1_v0_8_1_scalar_clear(&sec);
-    rustsecp256k1_v0_8_1_scalar_cmov(r, &rustsecp256k1_v0_8_1_scalar_zero, !ret);
-    rustsecp256k1_v0_8_1_scalar_cmov(s, &rustsecp256k1_v0_8_1_scalar_zero, !ret);
+    rustsecp256k1_v0_9_0_scalar_clear(&msg);
+    rustsecp256k1_v0_9_0_scalar_clear(&non);
+    rustsecp256k1_v0_9_0_scalar_clear(&sec);
+    rustsecp256k1_v0_9_0_scalar_cmov(r, &rustsecp256k1_v0_9_0_scalar_zero, !ret);
+    rustsecp256k1_v0_9_0_scalar_cmov(s, &rustsecp256k1_v0_9_0_scalar_zero, !ret);
     if (recid) {
         const int zero = 0;
-        rustsecp256k1_v0_8_1_int_cmov(recid, &zero, !ret);
+        rustsecp256k1_v0_9_0_int_cmov(recid, &zero, !ret);
     }
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ecdsa_sign(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_ecdsa_signature *signature, const unsigned char *msghash32, const unsigned char *seckey, rustsecp256k1_v0_8_1_nonce_function noncefp, const void* noncedata) {
-    rustsecp256k1_v0_8_1_scalar r, s;
+int rustsecp256k1_v0_9_0_ecdsa_sign(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_ecdsa_signature *signature, const unsigned char *msghash32, const unsigned char *seckey, rustsecp256k1_v0_9_0_nonce_function noncefp, const void* noncedata) {
+    rustsecp256k1_v0_9_0_scalar r, s;
     int ret;
     VERIFY_CHECK(ctx != NULL);
-    ARG_CHECK(rustsecp256k1_v0_8_1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(rustsecp256k1_v0_9_0_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
     ARG_CHECK(msghash32 != NULL);
     ARG_CHECK(signature != NULL);
     ARG_CHECK(seckey != NULL);
 
-    ret = rustsecp256k1_v0_8_1_ecdsa_sign_inner(ctx, &r, &s, NULL, msghash32, seckey, noncefp, noncedata);
-    rustsecp256k1_v0_8_1_ecdsa_signature_save(signature, &r, &s);
+    ret = rustsecp256k1_v0_9_0_ecdsa_sign_inner(ctx, &r, &s, NULL, msghash32, seckey, noncefp, noncedata);
+    rustsecp256k1_v0_9_0_ecdsa_signature_save(signature, &r, &s);
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ec_seckey_verify(const rustsecp256k1_v0_8_1_context* ctx, const unsigned char *seckey) {
-    rustsecp256k1_v0_8_1_scalar sec;
+int rustsecp256k1_v0_9_0_ec_seckey_verify(const rustsecp256k1_v0_9_0_context* ctx, const unsigned char *seckey) {
+    rustsecp256k1_v0_9_0_scalar sec;
     int ret;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(seckey != NULL);
 
-    ret = rustsecp256k1_v0_8_1_scalar_set_b32_seckey(&sec, seckey);
-    rustsecp256k1_v0_8_1_scalar_clear(&sec);
+    ret = rustsecp256k1_v0_9_0_scalar_set_b32_seckey(&sec, seckey);
+    rustsecp256k1_v0_9_0_scalar_clear(&sec);
     return ret;
 }
 
-static int rustsecp256k1_v0_8_1_ec_pubkey_create_helper(const rustsecp256k1_v0_8_1_ecmult_gen_context *ecmult_gen_ctx, rustsecp256k1_v0_8_1_scalar *seckey_scalar, rustsecp256k1_v0_8_1_ge *p, const unsigned char *seckey) {
-    rustsecp256k1_v0_8_1_gej pj;
+static int rustsecp256k1_v0_9_0_ec_pubkey_create_helper(const rustsecp256k1_v0_9_0_ecmult_gen_context *ecmult_gen_ctx, rustsecp256k1_v0_9_0_scalar *seckey_scalar, rustsecp256k1_v0_9_0_ge *p, const unsigned char *seckey) {
+    rustsecp256k1_v0_9_0_gej pj;
     int ret;
 
-    ret = rustsecp256k1_v0_8_1_scalar_set_b32_seckey(seckey_scalar, seckey);
-    rustsecp256k1_v0_8_1_scalar_cmov(seckey_scalar, &rustsecp256k1_v0_8_1_scalar_one, !ret);
+    ret = rustsecp256k1_v0_9_0_scalar_set_b32_seckey(seckey_scalar, seckey);
+    rustsecp256k1_v0_9_0_scalar_cmov(seckey_scalar, &rustsecp256k1_v0_9_0_scalar_one, !ret);
 
-    rustsecp256k1_v0_8_1_ecmult_gen(ecmult_gen_ctx, &pj, seckey_scalar);
-    rustsecp256k1_v0_8_1_ge_set_gej(p, &pj);
+    rustsecp256k1_v0_9_0_ecmult_gen(ecmult_gen_ctx, &pj, seckey_scalar);
+    rustsecp256k1_v0_9_0_ge_set_gej(p, &pj);
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ec_pubkey_create(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_pubkey *pubkey, const unsigned char *seckey) {
-    rustsecp256k1_v0_8_1_ge p;
-    rustsecp256k1_v0_8_1_scalar seckey_scalar;
+int rustsecp256k1_v0_9_0_ec_pubkey_create(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_pubkey *pubkey, const unsigned char *seckey) {
+    rustsecp256k1_v0_9_0_ge p;
+    rustsecp256k1_v0_9_0_scalar seckey_scalar;
     int ret = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(pubkey != NULL);
     memset(pubkey, 0, sizeof(*pubkey));
-    ARG_CHECK(rustsecp256k1_v0_8_1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(rustsecp256k1_v0_9_0_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
     ARG_CHECK(seckey != NULL);
 
-    ret = rustsecp256k1_v0_8_1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &seckey_scalar, &p, seckey);
-    rustsecp256k1_v0_8_1_pubkey_save(pubkey, &p);
-    rustsecp256k1_v0_8_1_memczero(pubkey, sizeof(*pubkey), !ret);
+    ret = rustsecp256k1_v0_9_0_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &seckey_scalar, &p, seckey);
+    rustsecp256k1_v0_9_0_pubkey_save(pubkey, &p);
+    rustsecp256k1_v0_9_0_memczero(pubkey, sizeof(*pubkey), !ret);
 
-    rustsecp256k1_v0_8_1_scalar_clear(&seckey_scalar);
+    rustsecp256k1_v0_9_0_scalar_clear(&seckey_scalar);
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ec_seckey_negate(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *seckey) {
-    rustsecp256k1_v0_8_1_scalar sec;
+int rustsecp256k1_v0_9_0_ec_seckey_negate(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *seckey) {
+    rustsecp256k1_v0_9_0_scalar sec;
     int ret = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(seckey != NULL);
 
-    ret = rustsecp256k1_v0_8_1_scalar_set_b32_seckey(&sec, seckey);
-    rustsecp256k1_v0_8_1_scalar_cmov(&sec, &rustsecp256k1_v0_8_1_scalar_zero, !ret);
-    rustsecp256k1_v0_8_1_scalar_negate(&sec, &sec);
-    rustsecp256k1_v0_8_1_scalar_get_b32(seckey, &sec);
+    ret = rustsecp256k1_v0_9_0_scalar_set_b32_seckey(&sec, seckey);
+    rustsecp256k1_v0_9_0_scalar_cmov(&sec, &rustsecp256k1_v0_9_0_scalar_zero, !ret);
+    rustsecp256k1_v0_9_0_scalar_negate(&sec, &sec);
+    rustsecp256k1_v0_9_0_scalar_get_b32(seckey, &sec);
 
-    rustsecp256k1_v0_8_1_scalar_clear(&sec);
+    rustsecp256k1_v0_9_0_scalar_clear(&sec);
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ec_privkey_negate(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *seckey) {
-    return rustsecp256k1_v0_8_1_ec_seckey_negate(ctx, seckey);
+int rustsecp256k1_v0_9_0_ec_privkey_negate(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *seckey) {
+    return rustsecp256k1_v0_9_0_ec_seckey_negate(ctx, seckey);
 }
 
-int rustsecp256k1_v0_8_1_ec_pubkey_negate(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_pubkey *pubkey) {
+int rustsecp256k1_v0_9_0_ec_pubkey_negate(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_pubkey *pubkey) {
     int ret = 0;
-    rustsecp256k1_v0_8_1_ge p;
+    rustsecp256k1_v0_9_0_ge p;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(pubkey != NULL);
 
-    ret = rustsecp256k1_v0_8_1_pubkey_load(ctx, &p, pubkey);
+    ret = rustsecp256k1_v0_9_0_pubkey_load(ctx, &p, pubkey);
     memset(pubkey, 0, sizeof(*pubkey));
     if (ret) {
-        rustsecp256k1_v0_8_1_ge_neg(&p, &p);
-        rustsecp256k1_v0_8_1_pubkey_save(pubkey, &p);
+        rustsecp256k1_v0_9_0_ge_neg(&p, &p);
+        rustsecp256k1_v0_9_0_pubkey_save(pubkey, &p);
     }
     return ret;
 }
 
 
-static int rustsecp256k1_v0_8_1_ec_seckey_tweak_add_helper(rustsecp256k1_v0_8_1_scalar *sec, const unsigned char *tweak32) {
-    rustsecp256k1_v0_8_1_scalar term;
+static int rustsecp256k1_v0_9_0_ec_seckey_tweak_add_helper(rustsecp256k1_v0_9_0_scalar *sec, const unsigned char *tweak32) {
+    rustsecp256k1_v0_9_0_scalar term;
     int overflow = 0;
     int ret = 0;
 
-    rustsecp256k1_v0_8_1_scalar_set_b32(&term, tweak32, &overflow);
-    ret = (!overflow) & rustsecp256k1_v0_8_1_eckey_privkey_tweak_add(sec, &term);
-    rustsecp256k1_v0_8_1_scalar_clear(&term);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&term, tweak32, &overflow);
+    ret = (!overflow) & rustsecp256k1_v0_9_0_eckey_privkey_tweak_add(sec, &term);
+    rustsecp256k1_v0_9_0_scalar_clear(&term);
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ec_seckey_tweak_add(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *seckey, const unsigned char *tweak32) {
-    rustsecp256k1_v0_8_1_scalar sec;
+int rustsecp256k1_v0_9_0_ec_seckey_tweak_add(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *seckey, const unsigned char *tweak32) {
+    rustsecp256k1_v0_9_0_scalar sec;
     int ret = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(seckey != NULL);
     ARG_CHECK(tweak32 != NULL);
 
-    ret = rustsecp256k1_v0_8_1_scalar_set_b32_seckey(&sec, seckey);
-    ret &= rustsecp256k1_v0_8_1_ec_seckey_tweak_add_helper(&sec, tweak32);
-    rustsecp256k1_v0_8_1_scalar_cmov(&sec, &rustsecp256k1_v0_8_1_scalar_zero, !ret);
-    rustsecp256k1_v0_8_1_scalar_get_b32(seckey, &sec);
+    ret = rustsecp256k1_v0_9_0_scalar_set_b32_seckey(&sec, seckey);
+    ret &= rustsecp256k1_v0_9_0_ec_seckey_tweak_add_helper(&sec, tweak32);
+    rustsecp256k1_v0_9_0_scalar_cmov(&sec, &rustsecp256k1_v0_9_0_scalar_zero, !ret);
+    rustsecp256k1_v0_9_0_scalar_get_b32(seckey, &sec);
 
-    rustsecp256k1_v0_8_1_scalar_clear(&sec);
+    rustsecp256k1_v0_9_0_scalar_clear(&sec);
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ec_privkey_tweak_add(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *seckey, const unsigned char *tweak32) {
-    return rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, seckey, tweak32);
+int rustsecp256k1_v0_9_0_ec_privkey_tweak_add(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *seckey, const unsigned char *tweak32) {
+    return rustsecp256k1_v0_9_0_ec_seckey_tweak_add(ctx, seckey, tweak32);
 }
 
-static int rustsecp256k1_v0_8_1_ec_pubkey_tweak_add_helper(rustsecp256k1_v0_8_1_ge *p, const unsigned char *tweak32) {
-    rustsecp256k1_v0_8_1_scalar term;
+static int rustsecp256k1_v0_9_0_ec_pubkey_tweak_add_helper(rustsecp256k1_v0_9_0_ge *p, const unsigned char *tweak32) {
+    rustsecp256k1_v0_9_0_scalar term;
     int overflow = 0;
-    rustsecp256k1_v0_8_1_scalar_set_b32(&term, tweak32, &overflow);
-    return !overflow && rustsecp256k1_v0_8_1_eckey_pubkey_tweak_add(p, &term);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&term, tweak32, &overflow);
+    return !overflow && rustsecp256k1_v0_9_0_eckey_pubkey_tweak_add(p, &term);
 }
 
-int rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_pubkey *pubkey, const unsigned char *tweak32) {
-    rustsecp256k1_v0_8_1_ge p;
+int rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_pubkey *pubkey, const unsigned char *tweak32) {
+    rustsecp256k1_v0_9_0_ge p;
     int ret = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(pubkey != NULL);
     ARG_CHECK(tweak32 != NULL);
 
-    ret = rustsecp256k1_v0_8_1_pubkey_load(ctx, &p, pubkey);
+    ret = rustsecp256k1_v0_9_0_pubkey_load(ctx, &p, pubkey);
     memset(pubkey, 0, sizeof(*pubkey));
-    ret = ret && rustsecp256k1_v0_8_1_ec_pubkey_tweak_add_helper(&p, tweak32);
+    ret = ret && rustsecp256k1_v0_9_0_ec_pubkey_tweak_add_helper(&p, tweak32);
     if (ret) {
-        rustsecp256k1_v0_8_1_pubkey_save(pubkey, &p);
+        rustsecp256k1_v0_9_0_pubkey_save(pubkey, &p);
     }
 
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *seckey, const unsigned char *tweak32) {
-    rustsecp256k1_v0_8_1_scalar factor;
-    rustsecp256k1_v0_8_1_scalar sec;
+int rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *seckey, const unsigned char *tweak32) {
+    rustsecp256k1_v0_9_0_scalar factor;
+    rustsecp256k1_v0_9_0_scalar sec;
     int ret = 0;
     int overflow = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(seckey != NULL);
     ARG_CHECK(tweak32 != NULL);
 
-    rustsecp256k1_v0_8_1_scalar_set_b32(&factor, tweak32, &overflow);
-    ret = rustsecp256k1_v0_8_1_scalar_set_b32_seckey(&sec, seckey);
-    ret &= (!overflow) & rustsecp256k1_v0_8_1_eckey_privkey_tweak_mul(&sec, &factor);
-    rustsecp256k1_v0_8_1_scalar_cmov(&sec, &rustsecp256k1_v0_8_1_scalar_zero, !ret);
-    rustsecp256k1_v0_8_1_scalar_get_b32(seckey, &sec);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&factor, tweak32, &overflow);
+    ret = rustsecp256k1_v0_9_0_scalar_set_b32_seckey(&sec, seckey);
+    ret &= (!overflow) & rustsecp256k1_v0_9_0_eckey_privkey_tweak_mul(&sec, &factor);
+    rustsecp256k1_v0_9_0_scalar_cmov(&sec, &rustsecp256k1_v0_9_0_scalar_zero, !ret);
+    rustsecp256k1_v0_9_0_scalar_get_b32(seckey, &sec);
 
-    rustsecp256k1_v0_8_1_scalar_clear(&sec);
-    rustsecp256k1_v0_8_1_scalar_clear(&factor);
+    rustsecp256k1_v0_9_0_scalar_clear(&sec);
+    rustsecp256k1_v0_9_0_scalar_clear(&factor);
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_ec_privkey_tweak_mul(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *seckey, const unsigned char *tweak32) {
-    return rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(ctx, seckey, tweak32);
+int rustsecp256k1_v0_9_0_ec_privkey_tweak_mul(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *seckey, const unsigned char *tweak32) {
+    return rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(ctx, seckey, tweak32);
 }
 
-int rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_pubkey *pubkey, const unsigned char *tweak32) {
-    rustsecp256k1_v0_8_1_ge p;
-    rustsecp256k1_v0_8_1_scalar factor;
+int rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_pubkey *pubkey, const unsigned char *tweak32) {
+    rustsecp256k1_v0_9_0_ge p;
+    rustsecp256k1_v0_9_0_scalar factor;
     int ret = 0;
     int overflow = 0;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(pubkey != NULL);
     ARG_CHECK(tweak32 != NULL);
 
-    rustsecp256k1_v0_8_1_scalar_set_b32(&factor, tweak32, &overflow);
-    ret = !overflow && rustsecp256k1_v0_8_1_pubkey_load(ctx, &p, pubkey);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&factor, tweak32, &overflow);
+    ret = !overflow && rustsecp256k1_v0_9_0_pubkey_load(ctx, &p, pubkey);
     memset(pubkey, 0, sizeof(*pubkey));
     if (ret) {
-        if (rustsecp256k1_v0_8_1_eckey_pubkey_tweak_mul(&p, &factor)) {
-            rustsecp256k1_v0_8_1_pubkey_save(pubkey, &p);
+        if (rustsecp256k1_v0_9_0_eckey_pubkey_tweak_mul(&p, &factor)) {
+            rustsecp256k1_v0_9_0_pubkey_save(pubkey, &p);
         } else {
             ret = 0;
         }
@@ -684,18 +701,20 @@ int rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(const rustsecp256k1_v0_8_1_context*
     return ret;
 }
 
-int rustsecp256k1_v0_8_1_context_randomize(rustsecp256k1_v0_8_1_context* ctx, const unsigned char *seed32) {
+int rustsecp256k1_v0_9_0_context_randomize(rustsecp256k1_v0_9_0_context* ctx, const unsigned char *seed32) {
     VERIFY_CHECK(ctx != NULL);
-    if (rustsecp256k1_v0_8_1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)) {
-        rustsecp256k1_v0_8_1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, seed32);
+    ARG_CHECK(rustsecp256k1_v0_9_0_context_is_proper(ctx));
+
+    if (rustsecp256k1_v0_9_0_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)) {
+        rustsecp256k1_v0_9_0_ecmult_gen_blind(&ctx->ecmult_gen_ctx, seed32);
     }
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_ec_pubkey_combine(const rustsecp256k1_v0_8_1_context* ctx, rustsecp256k1_v0_8_1_pubkey *pubnonce, const rustsecp256k1_v0_8_1_pubkey * const *pubnonces, size_t n) {
+int rustsecp256k1_v0_9_0_ec_pubkey_combine(const rustsecp256k1_v0_9_0_context* ctx, rustsecp256k1_v0_9_0_pubkey *pubnonce, const rustsecp256k1_v0_9_0_pubkey * const *pubnonces, size_t n) {
     size_t i;
-    rustsecp256k1_v0_8_1_gej Qj;
-    rustsecp256k1_v0_8_1_ge Q;
+    rustsecp256k1_v0_9_0_gej Qj;
+    rustsecp256k1_v0_9_0_ge Q;
 
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(pubnonce != NULL);
@@ -703,31 +722,31 @@ int rustsecp256k1_v0_8_1_ec_pubkey_combine(const rustsecp256k1_v0_8_1_context* c
     ARG_CHECK(n >= 1);
     ARG_CHECK(pubnonces != NULL);
 
-    rustsecp256k1_v0_8_1_gej_set_infinity(&Qj);
+    rustsecp256k1_v0_9_0_gej_set_infinity(&Qj);
 
     for (i = 0; i < n; i++) {
         ARG_CHECK(pubnonces[i] != NULL);
-        rustsecp256k1_v0_8_1_pubkey_load(ctx, &Q, pubnonces[i]);
-        rustsecp256k1_v0_8_1_gej_add_ge(&Qj, &Qj, &Q);
+        rustsecp256k1_v0_9_0_pubkey_load(ctx, &Q, pubnonces[i]);
+        rustsecp256k1_v0_9_0_gej_add_ge(&Qj, &Qj, &Q);
     }
-    if (rustsecp256k1_v0_8_1_gej_is_infinity(&Qj)) {
+    if (rustsecp256k1_v0_9_0_gej_is_infinity(&Qj)) {
         return 0;
     }
-    rustsecp256k1_v0_8_1_ge_set_gej(&Q, &Qj);
-    rustsecp256k1_v0_8_1_pubkey_save(pubnonce, &Q);
+    rustsecp256k1_v0_9_0_ge_set_gej(&Q, &Qj);
+    rustsecp256k1_v0_9_0_pubkey_save(pubnonce, &Q);
     return 1;
 }
 
-int rustsecp256k1_v0_8_1_tagged_sha256(const rustsecp256k1_v0_8_1_context* ctx, unsigned char *hash32, const unsigned char *tag, size_t taglen, const unsigned char *msg, size_t msglen) {
-    rustsecp256k1_v0_8_1_sha256 sha;
+int rustsecp256k1_v0_9_0_tagged_sha256(const rustsecp256k1_v0_9_0_context* ctx, unsigned char *hash32, const unsigned char *tag, size_t taglen, const unsigned char *msg, size_t msglen) {
+    rustsecp256k1_v0_9_0_sha256 sha;
     VERIFY_CHECK(ctx != NULL);
     ARG_CHECK(hash32 != NULL);
     ARG_CHECK(tag != NULL);
     ARG_CHECK(msg != NULL);
 
-    rustsecp256k1_v0_8_1_sha256_initialize_tagged(&sha, tag, taglen);
-    rustsecp256k1_v0_8_1_sha256_write(&sha, msg, msglen);
-    rustsecp256k1_v0_8_1_sha256_finalize(&sha, hash32);
+    rustsecp256k1_v0_9_0_sha256_initialize_tagged(&sha, tag, taglen);
+    rustsecp256k1_v0_9_0_sha256_write(&sha, msg, msglen);
+    rustsecp256k1_v0_9_0_sha256_finalize(&sha, hash32);
     return 1;
 }
 
@@ -746,3 +765,7 @@ int rustsecp256k1_v0_8_1_tagged_sha256(const rustsecp256k1_v0_8_1_context* ctx,
 #ifdef ENABLE_MODULE_SCHNORRSIG
 # include "modules/schnorrsig/main_impl.h"
 #endif
+
+#ifdef ENABLE_MODULE_ELLSWIFT
+# include "modules/ellswift/main_impl.h"
+#endif
diff --git a/secp256k1-sys/depend/secp256k1/src/selftest.h b/secp256k1-sys/depend/secp256k1/src/selftest.h
index 202b98f43..7efe89bc6 100644
--- a/secp256k1-sys/depend/secp256k1/src/selftest.h
+++ b/secp256k1-sys/depend/secp256k1/src/selftest.h
@@ -11,22 +11,22 @@
 
 #include <string.h>
 
-static int rustsecp256k1_v0_8_1_selftest_sha256(void) {
+static int rustsecp256k1_v0_9_0_selftest_sha256(void) {
     static const char *input63 = "For this sample, this 63-byte string will be used as input data";
     static const unsigned char output32[32] = {
         0xf0, 0x8a, 0x78, 0xcb, 0xba, 0xee, 0x08, 0x2b, 0x05, 0x2a, 0xe0, 0x70, 0x8f, 0x32, 0xfa, 0x1e,
         0x50, 0xc5, 0xc4, 0x21, 0xaa, 0x77, 0x2b, 0xa5, 0xdb, 0xb4, 0x06, 0xa2, 0xea, 0x6b, 0xe3, 0x42,
     };
     unsigned char out[32];
-    rustsecp256k1_v0_8_1_sha256 hasher;
-    rustsecp256k1_v0_8_1_sha256_initialize(&hasher);
-    rustsecp256k1_v0_8_1_sha256_write(&hasher, (const unsigned char*)input63, 63);
-    rustsecp256k1_v0_8_1_sha256_finalize(&hasher, out);
-    return rustsecp256k1_v0_8_1_memcmp_var(out, output32, 32) == 0;
+    rustsecp256k1_v0_9_0_sha256 hasher;
+    rustsecp256k1_v0_9_0_sha256_initialize(&hasher);
+    rustsecp256k1_v0_9_0_sha256_write(&hasher, (const unsigned char*)input63, 63);
+    rustsecp256k1_v0_9_0_sha256_finalize(&hasher, out);
+    return rustsecp256k1_v0_9_0_memcmp_var(out, output32, 32) == 0;
 }
 
-static int rustsecp256k1_v0_8_1_selftest_passes(void) {
-    return rustsecp256k1_v0_8_1_selftest_sha256();
+static int rustsecp256k1_v0_9_0_selftest_passes(void) {
+    return rustsecp256k1_v0_9_0_selftest_sha256();
 }
 
 #endif /* SECP256K1_SELFTEST_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/testrand.h b/secp256k1-sys/depend/secp256k1/src/testrand.h
index 6ac916909..ce8b95c2b 100644
--- a/secp256k1-sys/depend/secp256k1/src/testrand.h
+++ b/secp256k1-sys/depend/secp256k1/src/testrand.h
@@ -7,44 +7,42 @@
 #ifndef SECP256K1_TESTRAND_H
 #define SECP256K1_TESTRAND_H
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
+#include "util.h"
 
 /* A non-cryptographic RNG used only for test infrastructure. */
 
 /** Seed the pseudorandom number generator for testing. */
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_testrand_seed(const unsigned char *seed16);
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_testrand_seed(const unsigned char *seed16);
 
 /** Generate a pseudorandom number in the range [0..2**32-1]. */
-SECP256K1_INLINE static uint32_t rustsecp256k1_v0_8_1_testrand32(void);
+SECP256K1_INLINE static uint32_t rustsecp256k1_v0_9_0_testrand32(void);
 
 /** Generate a pseudorandom number in the range [0..2**64-1]. */
-SECP256K1_INLINE static uint64_t rustsecp256k1_v0_8_1_testrand64(void);
+SECP256K1_INLINE static uint64_t rustsecp256k1_v0_9_0_testrand64(void);
 
 /** Generate a pseudorandom number in the range [0..2**bits-1]. Bits must be 1 or
  *  more. */
-SECP256K1_INLINE static uint64_t rustsecp256k1_v0_8_1_testrand_bits(int bits);
+SECP256K1_INLINE static uint64_t rustsecp256k1_v0_9_0_testrand_bits(int bits);
 
 /** Generate a pseudorandom number in the range [0..range-1]. */
-static uint32_t rustsecp256k1_v0_8_1_testrand_int(uint32_t range);
+static uint32_t rustsecp256k1_v0_9_0_testrand_int(uint32_t range);
 
 /** Generate a pseudorandom 32-byte array. */
-static void rustsecp256k1_v0_8_1_testrand256(unsigned char *b32);
+static void rustsecp256k1_v0_9_0_testrand256(unsigned char *b32);
 
 /** Generate a pseudorandom 32-byte array with long sequences of zero and one bits. */
-static void rustsecp256k1_v0_8_1_testrand256_test(unsigned char *b32);
+static void rustsecp256k1_v0_9_0_testrand256_test(unsigned char *b32);
 
 /** Generate pseudorandom bytes with long sequences of zero and one bits. */
-static void rustsecp256k1_v0_8_1_testrand_bytes_test(unsigned char *bytes, size_t len);
+static void rustsecp256k1_v0_9_0_testrand_bytes_test(unsigned char *bytes, size_t len);
 
 /** Flip a single random bit in a byte array */
-static void rustsecp256k1_v0_8_1_testrand_flip(unsigned char *b, size_t len);
+static void rustsecp256k1_v0_9_0_testrand_flip(unsigned char *b, size_t len);
 
 /** Initialize the test RNG using (hex encoded) array up to 16 bytes, or randomly if hexseed is NULL. */
-static void rustsecp256k1_v0_8_1_testrand_init(const char* hexseed);
+static void rustsecp256k1_v0_9_0_testrand_init(const char* hexseed);
 
 /** Print final test information. */
-static void rustsecp256k1_v0_8_1_testrand_finish(void);
+static void rustsecp256k1_v0_9_0_testrand_finish(void);
 
 #endif /* SECP256K1_TESTRAND_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/testrand_impl.h b/secp256k1-sys/depend/secp256k1/src/testrand_impl.h
index 040ed2541..3c05a5725 100644
--- a/secp256k1-sys/depend/secp256k1/src/testrand_impl.h
+++ b/secp256k1-sys/depend/secp256k1/src/testrand_impl.h
@@ -13,108 +13,78 @@
 
 #include "testrand.h"
 #include "hash.h"
+#include "util.h"
 
-static uint64_t rustsecp256k1_v0_8_1_test_state[4];
-static uint64_t rustsecp256k1_v0_8_1_test_rng_integer;
-static int rustsecp256k1_v0_8_1_test_rng_integer_bits_left = 0;
+static uint64_t rustsecp256k1_v0_9_0_test_state[4];
 
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_testrand_seed(const unsigned char *seed16) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_testrand_seed(const unsigned char *seed16) {
     static const unsigned char PREFIX[19] = "secp256k1 test init";
     unsigned char out32[32];
-    rustsecp256k1_v0_8_1_sha256 hash;
+    rustsecp256k1_v0_9_0_sha256 hash;
     int i;
 
     /* Use SHA256(PREFIX || seed16) as initial state. */
-    rustsecp256k1_v0_8_1_sha256_initialize(&hash);
-    rustsecp256k1_v0_8_1_sha256_write(&hash, PREFIX, sizeof(PREFIX));
-    rustsecp256k1_v0_8_1_sha256_write(&hash, seed16, 16);
-    rustsecp256k1_v0_8_1_sha256_finalize(&hash, out32);
+    rustsecp256k1_v0_9_0_sha256_initialize(&hash);
+    rustsecp256k1_v0_9_0_sha256_write(&hash, PREFIX, sizeof(PREFIX));
+    rustsecp256k1_v0_9_0_sha256_write(&hash, seed16, 16);
+    rustsecp256k1_v0_9_0_sha256_finalize(&hash, out32);
     for (i = 0; i < 4; ++i) {
         uint64_t s = 0;
         int j;
         for (j = 0; j < 8; ++j) s = (s << 8) | out32[8*i + j];
-        rustsecp256k1_v0_8_1_test_state[i] = s;
+        rustsecp256k1_v0_9_0_test_state[i] = s;
     }
-    rustsecp256k1_v0_8_1_test_rng_integer_bits_left = 0;
 }
 
 SECP256K1_INLINE static uint64_t rotl(const uint64_t x, int k) {
     return (x << k) | (x >> (64 - k));
 }
 
-SECP256K1_INLINE static uint64_t rustsecp256k1_v0_8_1_testrand64(void) {
+SECP256K1_INLINE static uint64_t rustsecp256k1_v0_9_0_testrand64(void) {
     /* Test-only Xoshiro256++ RNG. See https://prng.di.unimi.it/ */
-    const uint64_t result = rotl(rustsecp256k1_v0_8_1_test_state[0] + rustsecp256k1_v0_8_1_test_state[3], 23) + rustsecp256k1_v0_8_1_test_state[0];
-    const uint64_t t = rustsecp256k1_v0_8_1_test_state[1] << 17;
-    rustsecp256k1_v0_8_1_test_state[2] ^= rustsecp256k1_v0_8_1_test_state[0];
-    rustsecp256k1_v0_8_1_test_state[3] ^= rustsecp256k1_v0_8_1_test_state[1];
-    rustsecp256k1_v0_8_1_test_state[1] ^= rustsecp256k1_v0_8_1_test_state[2];
-    rustsecp256k1_v0_8_1_test_state[0] ^= rustsecp256k1_v0_8_1_test_state[3];
-    rustsecp256k1_v0_8_1_test_state[2] ^= t;
-    rustsecp256k1_v0_8_1_test_state[3] = rotl(rustsecp256k1_v0_8_1_test_state[3], 45);
+    const uint64_t result = rotl(rustsecp256k1_v0_9_0_test_state[0] + rustsecp256k1_v0_9_0_test_state[3], 23) + rustsecp256k1_v0_9_0_test_state[0];
+    const uint64_t t = rustsecp256k1_v0_9_0_test_state[1] << 17;
+    rustsecp256k1_v0_9_0_test_state[2] ^= rustsecp256k1_v0_9_0_test_state[0];
+    rustsecp256k1_v0_9_0_test_state[3] ^= rustsecp256k1_v0_9_0_test_state[1];
+    rustsecp256k1_v0_9_0_test_state[1] ^= rustsecp256k1_v0_9_0_test_state[2];
+    rustsecp256k1_v0_9_0_test_state[0] ^= rustsecp256k1_v0_9_0_test_state[3];
+    rustsecp256k1_v0_9_0_test_state[2] ^= t;
+    rustsecp256k1_v0_9_0_test_state[3] = rotl(rustsecp256k1_v0_9_0_test_state[3], 45);
     return result;
 }
 
-SECP256K1_INLINE static uint64_t rustsecp256k1_v0_8_1_testrand_bits(int bits) {
-    uint64_t ret;
-    if (rustsecp256k1_v0_8_1_test_rng_integer_bits_left < bits) {
-        rustsecp256k1_v0_8_1_test_rng_integer = rustsecp256k1_v0_8_1_testrand64();
-        rustsecp256k1_v0_8_1_test_rng_integer_bits_left = 64;
-    }
-    ret = rustsecp256k1_v0_8_1_test_rng_integer;
-    rustsecp256k1_v0_8_1_test_rng_integer >>= bits;
-    rustsecp256k1_v0_8_1_test_rng_integer_bits_left -= bits;
-    ret &= ((~((uint64_t)0)) >> (64 - bits));
-    return ret;
+SECP256K1_INLINE static uint64_t rustsecp256k1_v0_9_0_testrand_bits(int bits) {
+    if (bits == 0) return 0;
+    return rustsecp256k1_v0_9_0_testrand64() >> (64 - bits);
 }
 
-SECP256K1_INLINE static uint32_t rustsecp256k1_v0_8_1_testrand32(void) {
-    return rustsecp256k1_v0_8_1_testrand_bits(32);
+SECP256K1_INLINE static uint32_t rustsecp256k1_v0_9_0_testrand32(void) {
+    return rustsecp256k1_v0_9_0_testrand64() >> 32;
 }
 
-static uint32_t rustsecp256k1_v0_8_1_testrand_int(uint32_t range) {
-    /* We want a uniform integer between 0 and range-1, inclusive.
-     * B is the smallest number such that range <= 2**B.
-     * two mechanisms implemented here:
-     * - generate B bits numbers until one below range is found, and return it
-     * - find the largest multiple M of range that is <= 2**(B+A), generate B+A
-     *   bits numbers until one below M is found, and return it modulo range
-     * The second mechanism consumes A more bits of entropy in every iteration,
-     * but may need fewer iterations due to M being closer to 2**(B+A) then
-     * range is to 2**B. The array below (indexed by B) contains a 0 when the
-     * first mechanism is to be used, and the number A otherwise.
-     */
-    static const int addbits[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 2, 2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 2, 1, 0};
-    uint32_t trange, mult;
-    int bits = 0;
-    if (range <= 1) {
-        return 0;
-    }
-    trange = range - 1;
-    while (trange > 0) {
-        trange >>= 1;
-        bits++;
+static uint32_t rustsecp256k1_v0_9_0_testrand_int(uint32_t range) {
+    uint32_t mask = 0;
+    uint32_t range_copy;
+    /* Reduce range by 1, changing its meaning to "maximum value". */
+    VERIFY_CHECK(range != 0);
+    range -= 1;
+    /* Count the number of bits in range. */
+    range_copy = range;
+    while (range_copy) {
+        mask = (mask << 1) | 1U;
+        range_copy >>= 1;
     }
-    if (addbits[bits]) {
-        bits = bits + addbits[bits];
-        mult = ((~((uint32_t)0)) >> (32 - bits)) / range;
-        trange = range * mult;
-    } else {
-        trange = range;
-        mult = 1;
-    }
-    while(1) {
-        uint32_t x = rustsecp256k1_v0_8_1_testrand_bits(bits);
-        if (x < trange) {
-            return (mult == 1) ? x : (x % range);
-        }
+    /* Generation loop. */
+    while (1) {
+        uint32_t val = rustsecp256k1_v0_9_0_testrand64() & mask;
+        if (val <= range) return val;
     }
 }
 
-static void rustsecp256k1_v0_8_1_testrand256(unsigned char *b32) {
+static void rustsecp256k1_v0_9_0_testrand256(unsigned char *b32) {
     int i;
     for (i = 0; i < 4; ++i) {
-        uint64_t val = rustsecp256k1_v0_8_1_testrand64();
+        uint64_t val = rustsecp256k1_v0_9_0_testrand64();
         b32[0] = val;
         b32[1] = val >> 8;
         b32[2] = val >> 16;
@@ -127,14 +97,14 @@ static void rustsecp256k1_v0_8_1_testrand256(unsigned char *b32) {
     }
 }
 
-static void rustsecp256k1_v0_8_1_testrand_bytes_test(unsigned char *bytes, size_t len) {
+static void rustsecp256k1_v0_9_0_testrand_bytes_test(unsigned char *bytes, size_t len) {
     size_t bits = 0;
     memset(bytes, 0, len);
     while (bits < len * 8) {
         int now;
         uint32_t val;
-        now = 1 + (rustsecp256k1_v0_8_1_testrand_bits(6) * rustsecp256k1_v0_8_1_testrand_bits(5) + 16) / 31;
-        val = rustsecp256k1_v0_8_1_testrand_bits(1);
+        now = 1 + (rustsecp256k1_v0_9_0_testrand_bits(6) * rustsecp256k1_v0_9_0_testrand_bits(5) + 16) / 31;
+        val = rustsecp256k1_v0_9_0_testrand_bits(1);
         while (now > 0 && bits < len * 8) {
             bytes[bits / 8] |= val << (bits % 8);
             now--;
@@ -143,15 +113,15 @@ static void rustsecp256k1_v0_8_1_testrand_bytes_test(unsigned char *bytes, size_
     }
 }
 
-static void rustsecp256k1_v0_8_1_testrand256_test(unsigned char *b32) {
-    rustsecp256k1_v0_8_1_testrand_bytes_test(b32, 32);
+static void rustsecp256k1_v0_9_0_testrand256_test(unsigned char *b32) {
+    rustsecp256k1_v0_9_0_testrand_bytes_test(b32, 32);
 }
 
-static void rustsecp256k1_v0_8_1_testrand_flip(unsigned char *b, size_t len) {
-    b[rustsecp256k1_v0_8_1_testrand_int(len)] ^= (1 << rustsecp256k1_v0_8_1_testrand_bits(3));
+static void rustsecp256k1_v0_9_0_testrand_flip(unsigned char *b, size_t len) {
+    b[rustsecp256k1_v0_9_0_testrand_int(len)] ^= (1 << rustsecp256k1_v0_9_0_testrand_bits(3));
 }
 
-static void rustsecp256k1_v0_8_1_testrand_init(const char* hexseed) {
+static void rustsecp256k1_v0_9_0_testrand_init(const char* hexseed) {
     unsigned char seed16[16] = {0};
     if (hexseed && strlen(hexseed) != 0) {
         int pos = 0;
@@ -185,12 +155,12 @@ static void rustsecp256k1_v0_8_1_testrand_init(const char* hexseed) {
     }
 
     printf("random seed = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", seed16[0], seed16[1], seed16[2], seed16[3], seed16[4], seed16[5], seed16[6], seed16[7], seed16[8], seed16[9], seed16[10], seed16[11], seed16[12], seed16[13], seed16[14], seed16[15]);
-    rustsecp256k1_v0_8_1_testrand_seed(seed16);
+    rustsecp256k1_v0_9_0_testrand_seed(seed16);
 }
 
-static void rustsecp256k1_v0_8_1_testrand_finish(void) {
+static void rustsecp256k1_v0_9_0_testrand_finish(void) {
     unsigned char run32[32];
-    rustsecp256k1_v0_8_1_testrand256(run32);
+    rustsecp256k1_v0_9_0_testrand256(run32);
     printf("random run = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", run32[0], run32[1], run32[2], run32[3], run32[4], run32[5], run32[6], run32[7], run32[8], run32[9], run32[10], run32[11], run32[12], run32[13], run32[14], run32[15]);
 }
 
diff --git a/secp256k1-sys/depend/secp256k1/src/tests.c b/secp256k1-sys/depend/secp256k1/src/tests.c
index 9dc5802d4..030bbf5b9 100644
--- a/secp256k1-sys/depend/secp256k1/src/tests.c
+++ b/secp256k1-sys/depend/secp256k1/src/tests.c
@@ -4,20 +4,25 @@
  * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
  ***********************************************************************/
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include <time.h>
 
+#ifdef USE_EXTERNAL_DEFAULT_CALLBACKS
+    #pragma message("Ignoring USE_EXTERNAL_CALLBACKS in tests.")
+    #undef USE_EXTERNAL_DEFAULT_CALLBACKS
+#endif
+#if defined(VERIFY) && defined(COVERAGE)
+    #pragma message("Defining VERIFY for tests being built for coverage analysis support is meaningless.")
+#endif
 #include "secp256k1.c"
+
 #include "../include/secp256k1.h"
 #include "../include/secp256k1_preallocated.h"
 #include "testrand_impl.h"
+#include "checkmem.h"
 #include "util.h"
 
 #include "../contrib/lax_der_parsing.c"
@@ -29,16 +34,49 @@
 #include "int128_impl.h"
 #endif
 
-#define CONDITIONAL_TEST(cnt, nam) if (count < (cnt)) { printf("Skipping %s (iteration count too low)\n", nam); } else
+#define CONDITIONAL_TEST(cnt, nam) if (COUNT < (cnt)) { printf("Skipping %s (iteration count too low)\n", nam); } else
 
-static int count = 64;
-static rustsecp256k1_v0_8_1_context *ctx = NULL;
+static int COUNT = 64;
+static rustsecp256k1_v0_9_0_context *CTX = NULL;
+static rustsecp256k1_v0_9_0_context *STATIC_CTX = NULL;
+
+static int all_bytes_equal(const void* s, unsigned char value, size_t n) {
+    const unsigned char *p = s;
+    size_t i;
+
+    for (i = 0; i < n; i++) {
+        if (p[i] != value) {
+            return 0;
+        }
+    }
+    return 1;
+}
+
+/* TODO Use CHECK_ILLEGAL(_VOID) everywhere and get rid of the uncounting callback */
+/* CHECK that expr_or_stmt calls the illegal callback of ctx exactly once
+ *
+ * For checking functions that use ARG_CHECK_VOID */
+#define CHECK_ILLEGAL_VOID(ctx, expr_or_stmt) do { \
+    int32_t _calls_to_illegal_callback = 0; \
+    rustsecp256k1_v0_9_0_callback _saved_illegal_cb = ctx->illegal_callback; \
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(ctx, \
+        counting_illegal_callback_fn, &_calls_to_illegal_callback); \
+    { expr_or_stmt; } \
+    ctx->illegal_callback = _saved_illegal_cb; \
+    CHECK(_calls_to_illegal_callback == 1); \
+} while(0);
+
+/* CHECK that expr calls the illegal callback of ctx exactly once and that expr == 0
+ *
+ * For checking functions that use ARG_CHECK */
+#define CHECK_ILLEGAL(ctx, expr) CHECK_ILLEGAL_VOID(ctx, CHECK((expr) == 0))
 
 static void counting_illegal_callback_fn(const char* str, void* data) {
     /* Dummy callback function that just counts. */
     int32_t *p;
     (void)str;
     p = data;
+    CHECK(*p != INT32_MAX);
     (*p)++;
 }
 
@@ -47,395 +85,514 @@ static void uncounting_illegal_callback_fn(const char* str, void* data) {
     int32_t *p;
     (void)str;
     p = data;
+    CHECK(*p != INT32_MIN);
     (*p)--;
 }
 
-void random_field_element_test(rustsecp256k1_v0_8_1_fe *fe) {
-    do {
-        unsigned char b32[32];
-        rustsecp256k1_v0_8_1_testrand256_test(b32);
-        if (rustsecp256k1_v0_8_1_fe_set_b32(fe, b32)) {
-            break;
-        }
-    } while(1);
-}
-
-void random_field_element_magnitude(rustsecp256k1_v0_8_1_fe *fe) {
-    rustsecp256k1_v0_8_1_fe zero;
-    int n = rustsecp256k1_v0_8_1_testrand_int(9);
-    rustsecp256k1_v0_8_1_fe_normalize(fe);
+static void random_field_element_magnitude(rustsecp256k1_v0_9_0_fe *fe, int m) {
+    rustsecp256k1_v0_9_0_fe zero;
+    int n = rustsecp256k1_v0_9_0_testrand_int(m + 1);
+    rustsecp256k1_v0_9_0_fe_normalize(fe);
     if (n == 0) {
         return;
     }
-    rustsecp256k1_v0_8_1_fe_clear(&zero);
-    rustsecp256k1_v0_8_1_fe_negate(&zero, &zero, 0);
-    rustsecp256k1_v0_8_1_fe_mul_int(&zero, n - 1);
-    rustsecp256k1_v0_8_1_fe_add(fe, &zero);
+    rustsecp256k1_v0_9_0_fe_clear(&zero);
+    rustsecp256k1_v0_9_0_fe_negate(&zero, &zero, 0);
+    rustsecp256k1_v0_9_0_fe_mul_int_unchecked(&zero, n - 1);
+    rustsecp256k1_v0_9_0_fe_add(fe, &zero);
 #ifdef VERIFY
     CHECK(fe->magnitude == n);
 #endif
 }
 
-void random_group_element_test(rustsecp256k1_v0_8_1_ge *ge) {
-    rustsecp256k1_v0_8_1_fe fe;
+static void random_fe_test(rustsecp256k1_v0_9_0_fe *x) {
+    unsigned char bin[32];
     do {
-        random_field_element_test(&fe);
-        if (rustsecp256k1_v0_8_1_ge_set_xo_var(ge, &fe, rustsecp256k1_v0_8_1_testrand_bits(1))) {
-            rustsecp256k1_v0_8_1_fe_normalize(&ge->y);
-            break;
+        rustsecp256k1_v0_9_0_testrand256_test(bin);
+        if (rustsecp256k1_v0_9_0_fe_set_b32_limit(x, bin)) {
+            return;
         }
     } while(1);
-    ge->infinity = 0;
 }
 
-void random_group_element_jacobian_test(rustsecp256k1_v0_8_1_gej *gej, const rustsecp256k1_v0_8_1_ge *ge) {
-    rustsecp256k1_v0_8_1_fe z2, z3;
+static void random_fe_non_zero_test(rustsecp256k1_v0_9_0_fe *fe) {
     do {
-        random_field_element_test(&gej->z);
-        if (!rustsecp256k1_v0_8_1_fe_is_zero(&gej->z)) {
+        random_fe_test(fe);
+    } while(rustsecp256k1_v0_9_0_fe_is_zero(fe));
+}
+
+static void random_fe_magnitude(rustsecp256k1_v0_9_0_fe *fe) {
+    random_field_element_magnitude(fe, 8);
+}
+
+static void random_ge_x_magnitude(rustsecp256k1_v0_9_0_ge *ge) {
+    random_field_element_magnitude(&ge->x, SECP256K1_GE_X_MAGNITUDE_MAX);
+}
+
+static void random_ge_y_magnitude(rustsecp256k1_v0_9_0_ge *ge) {
+    random_field_element_magnitude(&ge->y, SECP256K1_GE_Y_MAGNITUDE_MAX);
+}
+
+static void random_gej_x_magnitude(rustsecp256k1_v0_9_0_gej *gej) {
+    random_field_element_magnitude(&gej->x, SECP256K1_GEJ_X_MAGNITUDE_MAX);
+}
+
+static void random_gej_y_magnitude(rustsecp256k1_v0_9_0_gej *gej) {
+    random_field_element_magnitude(&gej->y, SECP256K1_GEJ_Y_MAGNITUDE_MAX);
+}
+
+static void random_gej_z_magnitude(rustsecp256k1_v0_9_0_gej *gej) {
+    random_field_element_magnitude(&gej->z, SECP256K1_GEJ_Z_MAGNITUDE_MAX);
+}
+
+static void random_group_element_test(rustsecp256k1_v0_9_0_ge *ge) {
+    rustsecp256k1_v0_9_0_fe fe;
+    do {
+        random_fe_test(&fe);
+        if (rustsecp256k1_v0_9_0_ge_set_xo_var(ge, &fe, rustsecp256k1_v0_9_0_testrand_bits(1))) {
+            rustsecp256k1_v0_9_0_fe_normalize(&ge->y);
             break;
         }
     } while(1);
-    rustsecp256k1_v0_8_1_fe_sqr(&z2, &gej->z);
-    rustsecp256k1_v0_8_1_fe_mul(&z3, &z2, &gej->z);
-    rustsecp256k1_v0_8_1_fe_mul(&gej->x, &ge->x, &z2);
-    rustsecp256k1_v0_8_1_fe_mul(&gej->y, &ge->y, &z3);
+    ge->infinity = 0;
+}
+
+static void random_group_element_jacobian_test(rustsecp256k1_v0_9_0_gej *gej, const rustsecp256k1_v0_9_0_ge *ge) {
+    rustsecp256k1_v0_9_0_fe z2, z3;
+    random_fe_non_zero_test(&gej->z);
+    rustsecp256k1_v0_9_0_fe_sqr(&z2, &gej->z);
+    rustsecp256k1_v0_9_0_fe_mul(&z3, &z2, &gej->z);
+    rustsecp256k1_v0_9_0_fe_mul(&gej->x, &ge->x, &z2);
+    rustsecp256k1_v0_9_0_fe_mul(&gej->y, &ge->y, &z3);
     gej->infinity = ge->infinity;
 }
 
-void random_gej_test(rustsecp256k1_v0_8_1_gej *gej) {
-    rustsecp256k1_v0_8_1_ge ge;
+static void random_gej_test(rustsecp256k1_v0_9_0_gej *gej) {
+    rustsecp256k1_v0_9_0_ge ge;
     random_group_element_test(&ge);
     random_group_element_jacobian_test(gej, &ge);
 }
 
-void random_scalar_order_test(rustsecp256k1_v0_8_1_scalar *num) {
+static void random_scalar_order_test(rustsecp256k1_v0_9_0_scalar *num) {
     do {
         unsigned char b32[32];
         int overflow = 0;
-        rustsecp256k1_v0_8_1_testrand256_test(b32);
-        rustsecp256k1_v0_8_1_scalar_set_b32(num, b32, &overflow);
-        if (overflow || rustsecp256k1_v0_8_1_scalar_is_zero(num)) {
+        rustsecp256k1_v0_9_0_testrand256_test(b32);
+        rustsecp256k1_v0_9_0_scalar_set_b32(num, b32, &overflow);
+        if (overflow || rustsecp256k1_v0_9_0_scalar_is_zero(num)) {
             continue;
         }
         break;
     } while(1);
 }
 
-void random_scalar_order(rustsecp256k1_v0_8_1_scalar *num) {
+static void random_scalar_order(rustsecp256k1_v0_9_0_scalar *num) {
     do {
         unsigned char b32[32];
         int overflow = 0;
-        rustsecp256k1_v0_8_1_testrand256(b32);
-        rustsecp256k1_v0_8_1_scalar_set_b32(num, b32, &overflow);
-        if (overflow || rustsecp256k1_v0_8_1_scalar_is_zero(num)) {
+        rustsecp256k1_v0_9_0_testrand256(b32);
+        rustsecp256k1_v0_9_0_scalar_set_b32(num, b32, &overflow);
+        if (overflow || rustsecp256k1_v0_9_0_scalar_is_zero(num)) {
             continue;
         }
         break;
     } while(1);
 }
 
-void random_scalar_order_b32(unsigned char *b32) {
-    rustsecp256k1_v0_8_1_scalar num;
+static void random_scalar_order_b32(unsigned char *b32) {
+    rustsecp256k1_v0_9_0_scalar num;
     random_scalar_order(&num);
-    rustsecp256k1_v0_8_1_scalar_get_b32(b32, &num);
+    rustsecp256k1_v0_9_0_scalar_get_b32(b32, &num);
 }
 
-void run_selftest_tests(void) {
+static void run_xoshiro256pp_tests(void) {
+    {
+        size_t i;
+        /* Sanity check that we run before the actual seeding. */
+        for (i = 0; i < sizeof(rustsecp256k1_v0_9_0_test_state)/sizeof(rustsecp256k1_v0_9_0_test_state[0]); i++) {
+            CHECK(rustsecp256k1_v0_9_0_test_state[i] == 0);
+        }
+    }
+    {
+        int i;
+        unsigned char buf32[32];
+        unsigned char seed16[16] = {
+            'C', 'H', 'I', 'C', 'K', 'E', 'N', '!',
+            'C', 'H', 'I', 'C', 'K', 'E', 'N', '!',
+        };
+        unsigned char buf32_expected[32] = {
+            0xAF, 0xCC, 0xA9, 0x16, 0xB5, 0x6C, 0xE3, 0xF0,
+            0x44, 0x3F, 0x45, 0xE0, 0x47, 0xA5, 0x08, 0x36,
+            0x4C, 0xCC, 0xC1, 0x18, 0xB2, 0xD8, 0x8F, 0xEF,
+            0x43, 0x26, 0x15, 0x57, 0x37, 0x00, 0xEF, 0x30,
+        };
+        rustsecp256k1_v0_9_0_testrand_seed(seed16);
+        for (i = 0; i < 17; i++) {
+            rustsecp256k1_v0_9_0_testrand256(buf32);
+        }
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(buf32, buf32_expected, sizeof(buf32)) == 0);
+    }
+}
+
+static void run_selftest_tests(void) {
     /* Test public API */
-    rustsecp256k1_v0_8_1_selftest();
+    rustsecp256k1_v0_9_0_selftest();
 }
 
-int ecmult_gen_context_eq(const rustsecp256k1_v0_8_1_ecmult_gen_context *a, const rustsecp256k1_v0_8_1_ecmult_gen_context *b) {
+static int ecmult_gen_context_eq(const rustsecp256k1_v0_9_0_ecmult_gen_context *a, const rustsecp256k1_v0_9_0_ecmult_gen_context *b) {
     return a->built == b->built
-            && rustsecp256k1_v0_8_1_scalar_eq(&a->blind, &b->blind)
-            && rustsecp256k1_v0_8_1_gej_eq_var(&a->initial, &b->initial);
+            && rustsecp256k1_v0_9_0_scalar_eq(&a->blind, &b->blind)
+            && rustsecp256k1_v0_9_0_gej_eq_var(&a->initial, &b->initial);
 }
 
-int context_eq(const rustsecp256k1_v0_8_1_context *a, const rustsecp256k1_v0_8_1_context *b) {
+static int context_eq(const rustsecp256k1_v0_9_0_context *a, const rustsecp256k1_v0_9_0_context *b) {
     return a->declassify == b->declassify
             && ecmult_gen_context_eq(&a->ecmult_gen_ctx, &b->ecmult_gen_ctx)
             && a->illegal_callback.fn == b->illegal_callback.fn
-            && a->illegal_callback.data == b->illegal_callback.
-data
+            && a->illegal_callback.data == b->illegal_callback.data
             && a->error_callback.fn == b->error_callback.fn
             && a->error_callback.data == b->error_callback.data;
 }
 
-void test_deprecated_flags(void) {
+static void run_deprecated_context_flags_test(void) {
+    /* Check that a context created with any of the flags in the flags array is
+     * identical to the NONE context. */
     unsigned int flags[] = { SECP256K1_CONTEXT_SIGN,
                              SECP256K1_CONTEXT_VERIFY,
                              SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY };
+    rustsecp256k1_v0_9_0_context *none_ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
     int i;
-    /* Check that a context created with any of the flags in the flags array is
-     * identical to the NONE context. */
     for (i = 0; i < (int)(sizeof(flags)/sizeof(flags[0])); i++) {
-        rustsecp256k1_v0_8_1_context *tmp_ctx;
-        CHECK(rustsecp256k1_v0_8_1_context_preallocated_size(SECP256K1_CONTEXT_NONE) == rustsecp256k1_v0_8_1_context_preallocated_size(flags[i]));
-        tmp_ctx = rustsecp256k1_v0_8_1_context_create(flags[i]);
-        CHECK(context_eq(ctx, tmp_ctx));
-        rustsecp256k1_v0_8_1_context_destroy(tmp_ctx);
+        rustsecp256k1_v0_9_0_context *tmp_ctx;
+        CHECK(rustsecp256k1_v0_9_0_context_preallocated_size(SECP256K1_CONTEXT_NONE) == rustsecp256k1_v0_9_0_context_preallocated_size(flags[i]));
+        tmp_ctx = rustsecp256k1_v0_9_0_context_create(flags[i]);
+        CHECK(context_eq(none_ctx, tmp_ctx));
+        rustsecp256k1_v0_9_0_context_destroy(tmp_ctx);
     }
+    rustsecp256k1_v0_9_0_context_destroy(none_ctx);
 }
 
-void run_context_tests(int use_prealloc) {
-    rustsecp256k1_v0_8_1_pubkey pubkey;
-    rustsecp256k1_v0_8_1_pubkey zero_pubkey;
-    rustsecp256k1_v0_8_1_ecdsa_signature sig;
+static void run_ec_illegal_argument_tests(void) {
+    int ecount = 0;
+    int ecount2 = 10;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
+    rustsecp256k1_v0_9_0_pubkey zero_pubkey;
+    rustsecp256k1_v0_9_0_ecdsa_signature sig;
     unsigned char ctmp[32];
-    int32_t ecount;
-    int32_t ecount2;
-    rustsecp256k1_v0_8_1_context *sttc;
-    void *ctx_prealloc = NULL;
-    void *sttc_prealloc = NULL;
 
-    rustsecp256k1_v0_8_1_gej pubj;
-    rustsecp256k1_v0_8_1_ge pub;
-    rustsecp256k1_v0_8_1_scalar msg, key, nonce;
-    rustsecp256k1_v0_8_1_scalar sigr, sigs;
+    /* Setup */
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount2);
+    memset(ctmp, 1, 32);
+    memset(&zero_pubkey, 0, sizeof(zero_pubkey));
 
-    /* Check that deprecated rustsecp256k1_v0_8_1_context_no_precomp is an alias to rustsecp256k1_v0_8_1_context_static. */
-    CHECK(rustsecp256k1_v0_8_1_context_no_precomp == rustsecp256k1_v0_8_1_context_static);
+    /* Verify context-type checking illegal-argument errors. */
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(STATIC_CTX, &pubkey, ctmp) == 0);
+    CHECK(ecount == 1);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, ctmp) == 1);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(STATIC_CTX, &sig, ctmp, ctmp, NULL, NULL) == 0);
+    CHECK(ecount == 2);
+    SECP256K1_CHECKMEM_UNDEFINE(&sig, sizeof(sig));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, ctmp, ctmp, NULL, NULL) == 1);
+    SECP256K1_CHECKMEM_CHECK(&sig, sizeof(sig));
+    CHECK(ecount2 == 10);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, ctmp, &pubkey) == 1);
+    CHECK(ecount2 == 10);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(STATIC_CTX, &sig, ctmp, &pubkey) == 1);
+    CHECK(ecount == 2);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, &pubkey, ctmp) == 1);
+    CHECK(ecount2 == 10);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(STATIC_CTX, &pubkey, ctmp) == 1);
+    CHECK(ecount == 2);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(CTX, &pubkey, ctmp) == 1);
+    CHECK(ecount2 == 10);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_negate(STATIC_CTX, &pubkey) == 1);
+    CHECK(ecount == 2);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_negate(CTX, &pubkey) == 1);
+    CHECK(ecount == 2);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_negate(STATIC_CTX, &zero_pubkey) == 0);
+    CHECK(ecount == 3);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_negate(CTX, NULL) == 0);
+    CHECK(ecount2 == 11);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(STATIC_CTX, &pubkey, ctmp) == 1);
+    CHECK(ecount == 3);
+
+    /* Clean up */
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, NULL, NULL);
+}
+
+static void run_static_context_tests(int use_prealloc) {
+    /* Check that deprecated rustsecp256k1_v0_9_0_context_no_precomp is an alias to rustsecp256k1_v0_9_0_context_static. */
+    CHECK(rustsecp256k1_v0_9_0_context_no_precomp == rustsecp256k1_v0_9_0_context_static);
+
+    {
+        unsigned char seed[32] = {0x17};
+
+        /* Randomizing rustsecp256k1_v0_9_0_context_static is not supported. */
+        CHECK_ILLEGAL(STATIC_CTX, rustsecp256k1_v0_9_0_context_randomize(STATIC_CTX, seed));
+        CHECK_ILLEGAL(STATIC_CTX, rustsecp256k1_v0_9_0_context_randomize(STATIC_CTX, NULL));
+
+        /* Destroying or cloning rustsecp256k1_v0_9_0_context_static is not supported. */
+        if (use_prealloc) {
+            CHECK_ILLEGAL(STATIC_CTX, rustsecp256k1_v0_9_0_context_preallocated_clone_size(STATIC_CTX));
+            {
+                rustsecp256k1_v0_9_0_context *my_static_ctx = malloc(sizeof(*STATIC_CTX));
+                CHECK(my_static_ctx != NULL);
+                memset(my_static_ctx, 0x2a, sizeof(*my_static_ctx));
+                CHECK_ILLEGAL(STATIC_CTX, rustsecp256k1_v0_9_0_context_preallocated_clone(STATIC_CTX, my_static_ctx));
+                CHECK(all_bytes_equal(my_static_ctx, 0x2a, sizeof(*my_static_ctx)));
+                free(my_static_ctx);
+            }
+            CHECK_ILLEGAL_VOID(STATIC_CTX, rustsecp256k1_v0_9_0_context_preallocated_destroy(STATIC_CTX));
+        } else {
+            CHECK_ILLEGAL(STATIC_CTX, rustsecp256k1_v0_9_0_context_clone(STATIC_CTX));
+            CHECK_ILLEGAL_VOID(STATIC_CTX, rustsecp256k1_v0_9_0_context_destroy(STATIC_CTX));
+        }
+    }
+
+    {
+        /* Verify that setting and resetting illegal callback works */
+        int32_t dummy = 0;
+        rustsecp256k1_v0_9_0_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &dummy);
+        CHECK(STATIC_CTX->illegal_callback.fn == counting_illegal_callback_fn);
+        CHECK(STATIC_CTX->illegal_callback.data == &dummy);
+        rustsecp256k1_v0_9_0_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
+        CHECK(STATIC_CTX->illegal_callback.fn == rustsecp256k1_v0_9_0_default_illegal_callback_fn);
+        CHECK(STATIC_CTX->illegal_callback.data == NULL);
+    }
+}
+
+static void run_proper_context_tests(int use_prealloc) {
+    int32_t dummy = 0;
+    rustsecp256k1_v0_9_0_context *my_ctx, *my_ctx_fresh;
+    void *my_ctx_prealloc = NULL;
+    unsigned char seed[32] = {0x17};
+
+    rustsecp256k1_v0_9_0_gej pubj;
+    rustsecp256k1_v0_9_0_ge pub;
+    rustsecp256k1_v0_9_0_scalar msg, key, nonce;
+    rustsecp256k1_v0_9_0_scalar sigr, sigs;
+
+    /* Fresh reference context for comparison */
+    my_ctx_fresh = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
 
     if (use_prealloc) {
-        ctx_prealloc = malloc(rustsecp256k1_v0_8_1_context_preallocated_size(SECP256K1_CONTEXT_NONE));
-        CHECK(ctx_prealloc != NULL);
-        ctx = rustsecp256k1_v0_8_1_context_preallocated_create(ctx_prealloc, SECP256K1_CONTEXT_NONE);
-        sttc_prealloc = malloc(rustsecp256k1_v0_8_1_context_preallocated_clone_size(rustsecp256k1_v0_8_1_context_static));
-        CHECK(sttc_prealloc != NULL);
-        sttc = rustsecp256k1_v0_8_1_context_preallocated_clone(rustsecp256k1_v0_8_1_context_static, sttc_prealloc);
+        my_ctx_prealloc = malloc(rustsecp256k1_v0_9_0_context_preallocated_size(SECP256K1_CONTEXT_NONE));
+        CHECK(my_ctx_prealloc != NULL);
+        my_ctx = rustsecp256k1_v0_9_0_context_preallocated_create(my_ctx_prealloc, SECP256K1_CONTEXT_NONE);
     } else {
-        sttc = rustsecp256k1_v0_8_1_context_clone(rustsecp256k1_v0_8_1_context_static);
-        ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
+        my_ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
     }
 
-    test_deprecated_flags();
+    /* Randomize and reset randomization */
+    CHECK(context_eq(my_ctx, my_ctx_fresh));
+    CHECK(rustsecp256k1_v0_9_0_context_randomize(my_ctx, seed) == 1);
+    CHECK(!context_eq(my_ctx, my_ctx_fresh));
+    CHECK(rustsecp256k1_v0_9_0_context_randomize(my_ctx, NULL) == 1);
+    CHECK(context_eq(my_ctx, my_ctx_fresh));
 
-    memset(&zero_pubkey, 0, sizeof(zero_pubkey));
-
-    ecount = 0;
-    ecount2 = 10;
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(sttc, counting_illegal_callback_fn, &ecount);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount2);
-    /* set error callback (to a function that still aborts in case malloc() fails in rustsecp256k1_v0_8_1_context_clone() below) */
-    rustsecp256k1_v0_8_1_context_set_error_callback(ctx, rustsecp256k1_v0_8_1_default_illegal_callback_fn, NULL);
-    CHECK(ctx->error_callback.fn != sttc->error_callback.fn);
-    CHECK(ctx->error_callback.fn == rustsecp256k1_v0_8_1_default_illegal_callback_fn);
+    /* set error callback (to a function that still aborts in case malloc() fails in rustsecp256k1_v0_9_0_context_clone() below) */
+    rustsecp256k1_v0_9_0_context_set_error_callback(my_ctx, rustsecp256k1_v0_9_0_default_illegal_callback_fn, NULL);
+    CHECK(my_ctx->error_callback.fn != rustsecp256k1_v0_9_0_default_error_callback_fn);
+    CHECK(my_ctx->error_callback.fn == rustsecp256k1_v0_9_0_default_illegal_callback_fn);
 
     /* check if sizes for cloning are consistent */
-    CHECK(rustsecp256k1_v0_8_1_context_preallocated_clone_size(ctx) == rustsecp256k1_v0_8_1_context_preallocated_size(SECP256K1_CONTEXT_NONE));
-    CHECK(rustsecp256k1_v0_8_1_context_preallocated_clone_size(sttc) >= sizeof(rustsecp256k1_v0_8_1_context));
+    CHECK(rustsecp256k1_v0_9_0_context_preallocated_clone_size(my_ctx) == rustsecp256k1_v0_9_0_context_preallocated_size(SECP256K1_CONTEXT_NONE));
 
     /*** clone and destroy all of them to make sure cloning was complete ***/
     {
-        rustsecp256k1_v0_8_1_context *ctx_tmp;
+        rustsecp256k1_v0_9_0_context *ctx_tmp;
 
         if (use_prealloc) {
             /* clone into a non-preallocated context and then again into a new preallocated one. */
-            ctx_tmp = ctx; ctx = rustsecp256k1_v0_8_1_context_clone(ctx); rustsecp256k1_v0_8_1_context_preallocated_destroy(ctx_tmp);
-            free(ctx_prealloc); ctx_prealloc = malloc(rustsecp256k1_v0_8_1_context_preallocated_size(SECP256K1_CONTEXT_NONE)); CHECK(ctx_prealloc != NULL);
-            ctx_tmp = ctx; ctx = rustsecp256k1_v0_8_1_context_preallocated_clone(ctx, ctx_prealloc); rustsecp256k1_v0_8_1_context_destroy(ctx_tmp);
+            ctx_tmp = my_ctx;
+            my_ctx = rustsecp256k1_v0_9_0_context_clone(my_ctx);
+            CHECK(context_eq(ctx_tmp, my_ctx));
+            rustsecp256k1_v0_9_0_context_preallocated_destroy(ctx_tmp);
+
+            free(my_ctx_prealloc);
+            my_ctx_prealloc = malloc(rustsecp256k1_v0_9_0_context_preallocated_size(SECP256K1_CONTEXT_NONE));
+            CHECK(my_ctx_prealloc != NULL);
+            ctx_tmp = my_ctx;
+            my_ctx = rustsecp256k1_v0_9_0_context_preallocated_clone(my_ctx, my_ctx_prealloc);
+            CHECK(context_eq(ctx_tmp, my_ctx));
+            rustsecp256k1_v0_9_0_context_destroy(ctx_tmp);
         } else {
             /* clone into a preallocated context and then again into a new non-preallocated one. */
             void *prealloc_tmp;
 
-            prealloc_tmp = malloc(rustsecp256k1_v0_8_1_context_preallocated_size(SECP256K1_CONTEXT_NONE)); CHECK(prealloc_tmp != NULL);
-            ctx_tmp = ctx; ctx = rustsecp256k1_v0_8_1_context_preallocated_clone(ctx, prealloc_tmp); rustsecp256k1_v0_8_1_context_destroy(ctx_tmp);
-            ctx_tmp = ctx; ctx = rustsecp256k1_v0_8_1_context_clone(ctx); rustsecp256k1_v0_8_1_context_preallocated_destroy(ctx_tmp);
+            prealloc_tmp = malloc(rustsecp256k1_v0_9_0_context_preallocated_size(SECP256K1_CONTEXT_NONE));
+            CHECK(prealloc_tmp != NULL);
+            ctx_tmp = my_ctx;
+            my_ctx = rustsecp256k1_v0_9_0_context_preallocated_clone(my_ctx, prealloc_tmp);
+            CHECK(context_eq(ctx_tmp, my_ctx));
+            rustsecp256k1_v0_9_0_context_destroy(ctx_tmp);
+
+            ctx_tmp = my_ctx;
+            my_ctx = rustsecp256k1_v0_9_0_context_clone(my_ctx);
+            CHECK(context_eq(ctx_tmp, my_ctx));
+            rustsecp256k1_v0_9_0_context_preallocated_destroy(ctx_tmp);
             free(prealloc_tmp);
         }
     }
 
     /* Verify that the error callback makes it across the clone. */
-    CHECK(ctx->error_callback.fn != sttc->error_callback.fn);
-    CHECK(ctx->error_callback.fn == rustsecp256k1_v0_8_1_default_illegal_callback_fn);
+    CHECK(my_ctx->error_callback.fn != rustsecp256k1_v0_9_0_default_error_callback_fn);
+    CHECK(my_ctx->error_callback.fn == rustsecp256k1_v0_9_0_default_illegal_callback_fn);
     /* And that it resets back to default. */
-    rustsecp256k1_v0_8_1_context_set_error_callback(ctx, NULL, NULL);
-    CHECK(ctx->error_callback.fn == sttc->error_callback.fn);
+    rustsecp256k1_v0_9_0_context_set_error_callback(my_ctx, NULL, NULL);
+    CHECK(my_ctx->error_callback.fn == rustsecp256k1_v0_9_0_default_error_callback_fn);
+    CHECK(context_eq(my_ctx, my_ctx_fresh));
+
+    /* Verify that setting and resetting illegal callback works */
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(my_ctx, counting_illegal_callback_fn, &dummy);
+    CHECK(my_ctx->illegal_callback.fn == counting_illegal_callback_fn);
+    CHECK(my_ctx->illegal_callback.data == &dummy);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(my_ctx, NULL, NULL);
+    CHECK(my_ctx->illegal_callback.fn == rustsecp256k1_v0_9_0_default_illegal_callback_fn);
+    CHECK(my_ctx->illegal_callback.data == NULL);
+    CHECK(context_eq(my_ctx, my_ctx_fresh));
 
     /*** attempt to use them ***/
     random_scalar_order_test(&msg);
     random_scalar_order_test(&key);
-    rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &pubj, &key);
-    rustsecp256k1_v0_8_1_ge_set_gej(&pub, &pubj);
-
-    /* Verify context-type checking illegal-argument errors. */
-    memset(ctmp, 1, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(sttc, &pubkey, ctmp) == 0);
-    CHECK(ecount == 1);
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, ctmp) == 1);
-    VG_CHECK(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(sttc, &sig, ctmp, ctmp, NULL, NULL) == 0);
-    CHECK(ecount == 2);
-    VG_UNDEF(&sig, sizeof(sig));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, ctmp, ctmp, NULL, NULL) == 1);
-    VG_CHECK(&sig, sizeof(sig));
-    CHECK(ecount2 == 10);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, ctmp, &pubkey) == 1);
-    CHECK(ecount2 == 10);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(sttc, &sig, ctmp, &pubkey) == 1);
-    CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, &pubkey, ctmp) == 1);
-    CHECK(ecount2 == 10);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(sttc, &pubkey, ctmp) == 1);
-    CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(ctx, &pubkey, ctmp) == 1);
-    CHECK(ecount2 == 10);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_negate(sttc, &pubkey) == 1);
-    CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_negate(ctx, &pubkey) == 1);
-    CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_negate(ctx, NULL) == 0);
-    CHECK(ecount2 == 11);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_negate(sttc, &zero_pubkey) == 0);
-    CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(sttc, &pubkey, ctmp) == 1);
-    CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_context_randomize(sttc, ctmp) == 1);
-    CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_context_randomize(sttc, NULL) == 1);
-    CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_context_randomize(ctx, ctmp) == 1);
-    CHECK(ecount2 == 11);
-    CHECK(rustsecp256k1_v0_8_1_context_randomize(ctx, NULL) == 1);
-    CHECK(ecount2 == 11);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(sttc, NULL, NULL);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, NULL, NULL);
+    rustsecp256k1_v0_9_0_ecmult_gen(&my_ctx->ecmult_gen_ctx, &pubj, &key);
+    rustsecp256k1_v0_9_0_ge_set_gej(&pub, &pubj);
 
     /* obtain a working nonce */
     do {
         random_scalar_order_test(&nonce);
-    } while(!rustsecp256k1_v0_8_1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, &sigr, &sigs, &key, &msg, &nonce, NULL));
+    } while(!rustsecp256k1_v0_9_0_ecdsa_sig_sign(&my_ctx->ecmult_gen_ctx, &sigr, &sigs, &key, &msg, &nonce, NULL));
 
     /* try signing */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, &sigr, &sigs, &key, &msg, &nonce, NULL));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_sign(&my_ctx->ecmult_gen_ctx, &sigr, &sigs, &key, &msg, &nonce, NULL));
 
     /* try verifying */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sigr, &sigs, &pub, &msg));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sigr, &sigs, &pub, &msg));
 
     /* cleanup */
     if (use_prealloc) {
-        rustsecp256k1_v0_8_1_context_preallocated_destroy(ctx);
-        rustsecp256k1_v0_8_1_context_preallocated_destroy(sttc);
-        free(ctx_prealloc);
-        free(sttc_prealloc);
+        rustsecp256k1_v0_9_0_context_preallocated_destroy(my_ctx);
+        free(my_ctx_prealloc);
     } else {
-        rustsecp256k1_v0_8_1_context_destroy(ctx);
-        rustsecp256k1_v0_8_1_context_destroy(sttc);
+        rustsecp256k1_v0_9_0_context_destroy(my_ctx);
     }
+    rustsecp256k1_v0_9_0_context_destroy(my_ctx_fresh);
+
     /* Defined as no-op. */
-    rustsecp256k1_v0_8_1_context_destroy(NULL);
-    rustsecp256k1_v0_8_1_context_preallocated_destroy(NULL);
+    rustsecp256k1_v0_9_0_context_destroy(NULL);
+    rustsecp256k1_v0_9_0_context_preallocated_destroy(NULL);
 }
 
-void run_scratch_tests(void) {
+static void run_scratch_tests(void) {
     const size_t adj_alloc = ((500 + ALIGNMENT - 1) / ALIGNMENT) * ALIGNMENT;
 
     int32_t ecount = 0;
     size_t checkpoint;
     size_t checkpoint_2;
-    rustsecp256k1_v0_8_1_scratch_space *scratch;
-    rustsecp256k1_v0_8_1_scratch_space local_scratch;
+    rustsecp256k1_v0_9_0_scratch_space *scratch;
+    rustsecp256k1_v0_9_0_scratch_space local_scratch;
 
-    ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
 
     /* Test public API */
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
-    rustsecp256k1_v0_8_1_context_set_error_callback(ctx, counting_illegal_callback_fn, &ecount);
-
-    scratch = rustsecp256k1_v0_8_1_scratch_space_create(ctx, 1000);
+    scratch = rustsecp256k1_v0_9_0_scratch_space_create(CTX, 1000);
     CHECK(scratch != NULL);
     CHECK(ecount == 0);
 
     /* Test internal API */
-    CHECK(rustsecp256k1_v0_8_1_scratch_max_allocation(&ctx->error_callback, scratch, 0) == 1000);
-    CHECK(rustsecp256k1_v0_8_1_scratch_max_allocation(&ctx->error_callback, scratch, 1) == 1000 - (ALIGNMENT - 1));
+    CHECK(rustsecp256k1_v0_9_0_scratch_max_allocation(&CTX->error_callback, scratch, 0) == 1000);
+    CHECK(rustsecp256k1_v0_9_0_scratch_max_allocation(&CTX->error_callback, scratch, 1) == 1000 - (ALIGNMENT - 1));
     CHECK(scratch->alloc_size == 0);
     CHECK(scratch->alloc_size % ALIGNMENT == 0);
 
     /* Allocating 500 bytes succeeds */
-    checkpoint = rustsecp256k1_v0_8_1_scratch_checkpoint(&ctx->error_callback, scratch);
-    CHECK(rustsecp256k1_v0_8_1_scratch_alloc(&ctx->error_callback, scratch, 500) != NULL);
-    CHECK(rustsecp256k1_v0_8_1_scratch_max_allocation(&ctx->error_callback, scratch, 0) == 1000 - adj_alloc);
-    CHECK(rustsecp256k1_v0_8_1_scratch_max_allocation(&ctx->error_callback, scratch, 1) == 1000 - adj_alloc - (ALIGNMENT - 1));
+    checkpoint = rustsecp256k1_v0_9_0_scratch_checkpoint(&CTX->error_callback, scratch);
+    CHECK(rustsecp256k1_v0_9_0_scratch_alloc(&CTX->error_callback, scratch, 500) != NULL);
+    CHECK(rustsecp256k1_v0_9_0_scratch_max_allocation(&CTX->error_callback, scratch, 0) == 1000 - adj_alloc);
+    CHECK(rustsecp256k1_v0_9_0_scratch_max_allocation(&CTX->error_callback, scratch, 1) == 1000 - adj_alloc - (ALIGNMENT - 1));
     CHECK(scratch->alloc_size != 0);
     CHECK(scratch->alloc_size % ALIGNMENT == 0);
 
     /* Allocating another 501 bytes fails */
-    CHECK(rustsecp256k1_v0_8_1_scratch_alloc(&ctx->error_callback, scratch, 501) == NULL);
-    CHECK(rustsecp256k1_v0_8_1_scratch_max_allocation(&ctx->error_callback, scratch, 0) == 1000 - adj_alloc);
-    CHECK(rustsecp256k1_v0_8_1_scratch_max_allocation(&ctx->error_callback, scratch, 1) == 1000 - adj_alloc - (ALIGNMENT - 1));
+    CHECK(rustsecp256k1_v0_9_0_scratch_alloc(&CTX->error_callback, scratch, 501) == NULL);
+    CHECK(rustsecp256k1_v0_9_0_scratch_max_allocation(&CTX->error_callback, scratch, 0) == 1000 - adj_alloc);
+    CHECK(rustsecp256k1_v0_9_0_scratch_max_allocation(&CTX->error_callback, scratch, 1) == 1000 - adj_alloc - (ALIGNMENT - 1));
     CHECK(scratch->alloc_size != 0);
     CHECK(scratch->alloc_size % ALIGNMENT == 0);
 
     /* ...but it succeeds once we apply the checkpoint to undo it */
-    rustsecp256k1_v0_8_1_scratch_apply_checkpoint(&ctx->error_callback, scratch, checkpoint);
+    rustsecp256k1_v0_9_0_scratch_apply_checkpoint(&CTX->error_callback, scratch, checkpoint);
     CHECK(scratch->alloc_size == 0);
-    CHECK(rustsecp256k1_v0_8_1_scratch_max_allocation(&ctx->error_callback, scratch, 0) == 1000);
-    CHECK(rustsecp256k1_v0_8_1_scratch_alloc(&ctx->error_callback, scratch, 500) != NULL);
+    CHECK(rustsecp256k1_v0_9_0_scratch_max_allocation(&CTX->error_callback, scratch, 0) == 1000);
+    CHECK(rustsecp256k1_v0_9_0_scratch_alloc(&CTX->error_callback, scratch, 500) != NULL);
     CHECK(scratch->alloc_size != 0);
 
     /* try to apply a bad checkpoint */
-    checkpoint_2 = rustsecp256k1_v0_8_1_scratch_checkpoint(&ctx->error_callback, scratch);
-    rustsecp256k1_v0_8_1_scratch_apply_checkpoint(&ctx->error_callback, scratch, checkpoint);
+    checkpoint_2 = rustsecp256k1_v0_9_0_scratch_checkpoint(&CTX->error_callback, scratch);
+    rustsecp256k1_v0_9_0_scratch_apply_checkpoint(&CTX->error_callback, scratch, checkpoint);
     CHECK(ecount == 0);
-    rustsecp256k1_v0_8_1_scratch_apply_checkpoint(&ctx->error_callback, scratch, checkpoint_2); /* checkpoint_2 is after checkpoint */
+    rustsecp256k1_v0_9_0_scratch_apply_checkpoint(&CTX->error_callback, scratch, checkpoint_2); /* checkpoint_2 is after checkpoint */
     CHECK(ecount == 1);
-    rustsecp256k1_v0_8_1_scratch_apply_checkpoint(&ctx->error_callback, scratch, (size_t) -1); /* this is just wildly invalid */
+    rustsecp256k1_v0_9_0_scratch_apply_checkpoint(&CTX->error_callback, scratch, (size_t) -1); /* this is just wildly invalid */
     CHECK(ecount == 2);
 
     /* try to use badly initialized scratch space */
-    rustsecp256k1_v0_8_1_scratch_space_destroy(ctx, scratch);
+    rustsecp256k1_v0_9_0_scratch_space_destroy(CTX, scratch);
     memset(&local_scratch, 0, sizeof(local_scratch));
     scratch = &local_scratch;
-    CHECK(!rustsecp256k1_v0_8_1_scratch_max_allocation(&ctx->error_callback, scratch, 0));
+    CHECK(!rustsecp256k1_v0_9_0_scratch_max_allocation(&CTX->error_callback, scratch, 0));
     CHECK(ecount == 3);
-    CHECK(rustsecp256k1_v0_8_1_scratch_alloc(&ctx->error_callback, scratch, 500) == NULL);
+    CHECK(rustsecp256k1_v0_9_0_scratch_alloc(&CTX->error_callback, scratch, 500) == NULL);
     CHECK(ecount == 4);
-    rustsecp256k1_v0_8_1_scratch_space_destroy(ctx, scratch);
+    rustsecp256k1_v0_9_0_scratch_space_destroy(CTX, scratch);
     CHECK(ecount == 5);
 
     /* Test that large integers do not wrap around in a bad way */
-    scratch = rustsecp256k1_v0_8_1_scratch_space_create(ctx, 1000);
+    scratch = rustsecp256k1_v0_9_0_scratch_space_create(CTX, 1000);
     /* Try max allocation with a large number of objects. Only makes sense if
      * ALIGNMENT is greater than 1 because otherwise the objects take no extra
      * space. */
-    CHECK(ALIGNMENT <= 1 || !rustsecp256k1_v0_8_1_scratch_max_allocation(&ctx->error_callback, scratch, (SIZE_MAX / (ALIGNMENT - 1)) + 1));
+    CHECK(ALIGNMENT <= 1 || !rustsecp256k1_v0_9_0_scratch_max_allocation(&CTX->error_callback, scratch, (SIZE_MAX / (ALIGNMENT - 1)) + 1));
     /* Try allocating SIZE_MAX to test wrap around which only happens if
      * ALIGNMENT > 1, otherwise it returns NULL anyway because the scratch
      * space is too small. */
-    CHECK(rustsecp256k1_v0_8_1_scratch_alloc(&ctx->error_callback, scratch, SIZE_MAX) == NULL);
-    rustsecp256k1_v0_8_1_scratch_space_destroy(ctx, scratch);
+    CHECK(rustsecp256k1_v0_9_0_scratch_alloc(&CTX->error_callback, scratch, SIZE_MAX) == NULL);
+    rustsecp256k1_v0_9_0_scratch_space_destroy(CTX, scratch);
 
     /* cleanup */
-    rustsecp256k1_v0_8_1_scratch_space_destroy(ctx, NULL); /* no-op */
-    rustsecp256k1_v0_8_1_context_destroy(ctx);
-}
+    rustsecp256k1_v0_9_0_scratch_space_destroy(CTX, NULL); /* no-op */
 
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, NULL, NULL);
+    rustsecp256k1_v0_9_0_context_set_error_callback(CTX, NULL, NULL);
+}
 
-void run_ctz_tests(void) {
+static void run_ctz_tests(void) {
     static const uint32_t b32[] = {1, 0xffffffff, 0x5e56968f, 0xe0d63129};
     static const uint64_t b64[] = {1, 0xffffffffffffffff, 0xbcd02462139b3fc3, 0x98b5f80c769693ef};
     int shift;
     unsigned i;
     for (i = 0; i < sizeof(b32) / sizeof(b32[0]); ++i) {
         for (shift = 0; shift < 32; ++shift) {
-            CHECK(rustsecp256k1_v0_8_1_ctz32_var_debruijn(b32[i] << shift) == shift);
-            CHECK(rustsecp256k1_v0_8_1_ctz32_var(b32[i] << shift) == shift);
+            CHECK(rustsecp256k1_v0_9_0_ctz32_var_debruijn(b32[i] << shift) == shift);
+            CHECK(rustsecp256k1_v0_9_0_ctz32_var(b32[i] << shift) == shift);
         }
     }
     for (i = 0; i < sizeof(b64) / sizeof(b64[0]); ++i) {
         for (shift = 0; shift < 64; ++shift) {
-            CHECK(rustsecp256k1_v0_8_1_ctz64_var_debruijn(b64[i] << shift) == shift);
-            CHECK(rustsecp256k1_v0_8_1_ctz64_var(b64[i] << shift) == shift);
+            CHECK(rustsecp256k1_v0_9_0_ctz64_var_debruijn(b64[i] << shift) == shift);
+            CHECK(rustsecp256k1_v0_9_0_ctz64_var(b64[i] << shift) == shift);
         }
     }
 }
 
 /***** HASH TESTS *****/
 
-void run_sha256_known_output_tests(void) {
+static void run_sha256_known_output_tests(void) {
     static const char *inputs[] = {
         "", "abc", "message digest", "secure hash algorithm", "SHA256 is considered to be safe",
         "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
@@ -465,29 +622,29 @@ void run_sha256_known_output_tests(void) {
 
     for (i = 0; i < ninputs; i++) {
         unsigned char out[32];
-        rustsecp256k1_v0_8_1_sha256 hasher;
+        rustsecp256k1_v0_9_0_sha256 hasher;
         unsigned int j;
         /* 1. Run: simply write the input bytestrings */
         j = repeat[i];
-        rustsecp256k1_v0_8_1_sha256_initialize(&hasher);
+        rustsecp256k1_v0_9_0_sha256_initialize(&hasher);
         while (j > 0) {
-            rustsecp256k1_v0_8_1_sha256_write(&hasher, (const unsigned char*)(inputs[i]), strlen(inputs[i]));
+            rustsecp256k1_v0_9_0_sha256_write(&hasher, (const unsigned char*)(inputs[i]), strlen(inputs[i]));
             j--;
         }
-        rustsecp256k1_v0_8_1_sha256_finalize(&hasher, out);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(out, outputs[i], 32) == 0);
+        rustsecp256k1_v0_9_0_sha256_finalize(&hasher, out);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, outputs[i], 32) == 0);
         /* 2. Run: split the input bytestrings randomly before writing */
         if (strlen(inputs[i]) > 0) {
-            int split = rustsecp256k1_v0_8_1_testrand_int(strlen(inputs[i]));
-            rustsecp256k1_v0_8_1_sha256_initialize(&hasher);
+            int split = rustsecp256k1_v0_9_0_testrand_int(strlen(inputs[i]));
+            rustsecp256k1_v0_9_0_sha256_initialize(&hasher);
             j = repeat[i];
             while (j > 0) {
-                rustsecp256k1_v0_8_1_sha256_write(&hasher, (const unsigned char*)(inputs[i]), split);
-                rustsecp256k1_v0_8_1_sha256_write(&hasher, (const unsigned char*)(inputs[i] + split), strlen(inputs[i]) - split);
+                rustsecp256k1_v0_9_0_sha256_write(&hasher, (const unsigned char*)(inputs[i]), split);
+                rustsecp256k1_v0_9_0_sha256_write(&hasher, (const unsigned char*)(inputs[i] + split), strlen(inputs[i]) - split);
                 j--;
             }
-            rustsecp256k1_v0_8_1_sha256_finalize(&hasher, out);
-            CHECK(rustsecp256k1_v0_8_1_memcmp_var(out, outputs[i], 32) == 0);
+            rustsecp256k1_v0_9_0_sha256_finalize(&hasher, out);
+            CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, outputs[i], 32) == 0);
         }
     }
 }
@@ -536,9 +693,9 @@ for x in digests:
     print(x + ',')
 ```
 */
-void run_sha256_counter_tests(void) {
+static void run_sha256_counter_tests(void) {
     static const char *input = "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmno";
-    static const rustsecp256k1_v0_8_1_sha256 midstates[] = {
+    static const rustsecp256k1_v0_9_0_sha256 midstates[] = {
         {{0xa2b5c8bb, 0x26c88bb3, 0x2abdc3d2, 0x9def99a3, 0xdfd21a6e, 0x41fe585b, 0x7ef2c440, 0x2b79adda},
          {0x00}, 0xfffc0},
         {{0xa0d29445, 0x9287de66, 0x76aabd71, 0x41acd765, 0x0c7528b4, 0x84e14906, 0x942faec6, 0xcc5a7b26},
@@ -587,14 +744,25 @@ void run_sha256_counter_tests(void) {
     unsigned int i;
     for (i = 0; i < sizeof(midstates)/sizeof(midstates[0]); i++) {
         unsigned char out[32];
-        rustsecp256k1_v0_8_1_sha256 hasher = midstates[i];
-        rustsecp256k1_v0_8_1_sha256_write(&hasher, (const unsigned char*)input, strlen(input));
-        rustsecp256k1_v0_8_1_sha256_finalize(&hasher, out);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(out, outputs[i], 32) == 0);
+        rustsecp256k1_v0_9_0_sha256 hasher = midstates[i];
+        rustsecp256k1_v0_9_0_sha256_write(&hasher, (const unsigned char*)input, strlen(input));
+        rustsecp256k1_v0_9_0_sha256_finalize(&hasher, out);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, outputs[i], 32) == 0);
     }
 }
 
-void run_hmac_sha256_tests(void) {
+/* Tests for the equality of two sha256 structs. This function only produces a
+ * correct result if an integer multiple of 64 many bytes have been written
+ * into the hash functions. This function is used by some module tests. */
+static void test_sha256_eq(const rustsecp256k1_v0_9_0_sha256 *sha1, const rustsecp256k1_v0_9_0_sha256 *sha2) {
+    /* Is buffer fully consumed? */
+    CHECK((sha1->bytes & 0x3F) == 0);
+
+    CHECK(sha1->bytes == sha2->bytes);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(sha1->s, sha2->s, sizeof(sha1->s)) == 0);
+}
+
+static void run_hmac_sha256_tests(void) {
     static const char *keys[6] = {
         "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
         "\x4a\x65\x66\x65",
@@ -621,24 +789,24 @@ void run_hmac_sha256_tests(void) {
     };
     int i;
     for (i = 0; i < 6; i++) {
-        rustsecp256k1_v0_8_1_hmac_sha256 hasher;
+        rustsecp256k1_v0_9_0_hmac_sha256 hasher;
         unsigned char out[32];
-        rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hasher, (const unsigned char*)(keys[i]), strlen(keys[i]));
-        rustsecp256k1_v0_8_1_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i]), strlen(inputs[i]));
-        rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hasher, out);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(out, outputs[i], 32) == 0);
+        rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hasher, (const unsigned char*)(keys[i]), strlen(keys[i]));
+        rustsecp256k1_v0_9_0_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i]), strlen(inputs[i]));
+        rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hasher, out);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, outputs[i], 32) == 0);
         if (strlen(inputs[i]) > 0) {
-            int split = rustsecp256k1_v0_8_1_testrand_int(strlen(inputs[i]));
-            rustsecp256k1_v0_8_1_hmac_sha256_initialize(&hasher, (const unsigned char*)(keys[i]), strlen(keys[i]));
-            rustsecp256k1_v0_8_1_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i]), split);
-            rustsecp256k1_v0_8_1_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i] + split), strlen(inputs[i]) - split);
-            rustsecp256k1_v0_8_1_hmac_sha256_finalize(&hasher, out);
-            CHECK(rustsecp256k1_v0_8_1_memcmp_var(out, outputs[i], 32) == 0);
+            int split = rustsecp256k1_v0_9_0_testrand_int(strlen(inputs[i]));
+            rustsecp256k1_v0_9_0_hmac_sha256_initialize(&hasher, (const unsigned char*)(keys[i]), strlen(keys[i]));
+            rustsecp256k1_v0_9_0_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i]), split);
+            rustsecp256k1_v0_9_0_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i] + split), strlen(inputs[i]) - split);
+            rustsecp256k1_v0_9_0_hmac_sha256_finalize(&hasher, out);
+            CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, outputs[i], 32) == 0);
         }
     }
 }
 
-void run_rfc6979_hmac_sha256_tests(void) {
+static void run_rfc6979_hmac_sha256_tests(void) {
     static const unsigned char key1[65] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x00, 0x4b, 0xf5, 0x12, 0x2f, 0x34, 0x45, 0x54, 0xc5, 0x3b, 0xde, 0x2e, 0xbb, 0x8c, 0xd2, 0xb7, 0xe3, 0xd1, 0x60, 0x0a, 0xd6, 0x31, 0xc3, 0x85, 0xa5, 0xd7, 0xcc, 0xe2, 0x3c, 0x77, 0x85, 0x45, 0x9a, 0};
     static const unsigned char out1[3][32] = {
         {0x4f, 0xe2, 0x95, 0x25, 0xb2, 0x08, 0x68, 0x09, 0x15, 0x9a, 0xcd, 0xf0, 0x50, 0x6e, 0xfb, 0x86, 0xb0, 0xec, 0x93, 0x2c, 0x7b, 0xa4, 0x42, 0x56, 0xab, 0x32, 0x1e, 0x42, 0x1e, 0x67, 0xe9, 0xfb},
@@ -653,33 +821,33 @@ void run_rfc6979_hmac_sha256_tests(void) {
         {0x75, 0x97, 0x88, 0x7c, 0xbd, 0x76, 0x32, 0x1f, 0x32, 0xe3, 0x04, 0x40, 0x67, 0x9a, 0x22, 0xcf, 0x7f, 0x8d, 0x9d, 0x2e, 0xac, 0x39, 0x0e, 0x58, 0x1f, 0xea, 0x09, 0x1c, 0xe2, 0x02, 0xba, 0x94}
     };
 
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256 rng;
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256 rng;
     unsigned char out[32];
     int i;
 
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_initialize(&rng, key1, 64);
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_initialize(&rng, key1, 64);
     for (i = 0; i < 3; i++) {
-        rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(&rng, out, 32);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(out, out1[i], 32) == 0);
+        rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_generate(&rng, out, 32);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, out1[i], 32) == 0);
     }
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_finalize(&rng);
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_finalize(&rng);
 
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_initialize(&rng, key1, 65);
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_initialize(&rng, key1, 65);
     for (i = 0; i < 3; i++) {
-        rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(&rng, out, 32);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(out, out1[i], 32) != 0);
+        rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_generate(&rng, out, 32);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, out1[i], 32) != 0);
     }
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_finalize(&rng);
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_finalize(&rng);
 
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_initialize(&rng, key2, 64);
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_initialize(&rng, key2, 64);
     for (i = 0; i < 3; i++) {
-        rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_generate(&rng, out, 32);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(out, out2[i], 32) == 0);
+        rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_generate(&rng, out, 32);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, out2[i], 32) == 0);
     }
-    rustsecp256k1_v0_8_1_rfc6979_hmac_sha256_finalize(&rng);
+    rustsecp256k1_v0_9_0_rfc6979_hmac_sha256_finalize(&rng);
 }
 
-void run_tagged_sha256_tests(void) {
+static void run_tagged_sha256_tests(void) {
     int ecount = 0;
     unsigned char tag[32] = { 0 };
     unsigned char msg[32] = { 0 };
@@ -691,100 +859,28 @@ void run_tagged_sha256_tests(void) {
         0xE2, 0x76, 0x55, 0x9A, 0x3B, 0xDE, 0x55, 0xB3
     };
 
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
 
     /* API test */
-    CHECK(rustsecp256k1_v0_8_1_tagged_sha256(ctx, hash32, tag, sizeof(tag), msg, sizeof(msg)) == 1);
-    CHECK(rustsecp256k1_v0_8_1_tagged_sha256(ctx, NULL, tag, sizeof(tag), msg, sizeof(msg)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_tagged_sha256(CTX, hash32, tag, sizeof(tag), msg, sizeof(msg)) == 1);
+    CHECK(rustsecp256k1_v0_9_0_tagged_sha256(CTX, NULL, tag, sizeof(tag), msg, sizeof(msg)) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_tagged_sha256(ctx, hash32, NULL, 0, msg, sizeof(msg)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_tagged_sha256(CTX, hash32, NULL, 0, msg, sizeof(msg)) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_tagged_sha256(ctx, hash32, tag, sizeof(tag), NULL, 0) == 0);
+    CHECK(rustsecp256k1_v0_9_0_tagged_sha256(CTX, hash32, tag, sizeof(tag), NULL, 0) == 0);
     CHECK(ecount == 3);
 
     /* Static test vector */
     memcpy(tag, "tag", 3);
     memcpy(msg, "msg", 3);
-    CHECK(rustsecp256k1_v0_8_1_tagged_sha256(ctx, hash32, tag, 3, msg, 3) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(hash32, hash_expected, sizeof(hash32)) == 0);
-}
-
-/***** RANDOM TESTS *****/
-
-void test_rand_bits(int rand32, int bits) {
-    /* (1-1/2^B)^rounds[B] < 1/10^9, so rounds is the number of iterations to
-     * get a false negative chance below once in a billion */
-    static const unsigned int rounds[7] = {1, 30, 73, 156, 322, 653, 1316};
-    /* We try multiplying the results with various odd numbers, which shouldn't
-     * influence the uniform distribution modulo a power of 2. */
-    static const uint32_t mults[6] = {1, 3, 21, 289, 0x9999, 0x80402011};
-    /* We only select up to 6 bits from the output to analyse */
-    unsigned int usebits = bits > 6 ? 6 : bits;
-    unsigned int maxshift = bits - usebits;
-    /* For each of the maxshift+1 usebits-bit sequences inside a bits-bit
-       number, track all observed outcomes, one per bit in a uint64_t. */
-    uint64_t x[6][27] = {{0}};
-    unsigned int i, shift, m;
-    /* Multiply the output of all rand calls with the odd number m, which
-       should not change the uniformity of its distribution. */
-    for (i = 0; i < rounds[usebits]; i++) {
-        uint32_t r = (rand32 ? rustsecp256k1_v0_8_1_testrand32() : rustsecp256k1_v0_8_1_testrand_bits(bits));
-        CHECK((((uint64_t)r) >> bits) == 0);
-        for (m = 0; m < sizeof(mults) / sizeof(mults[0]); m++) {
-            uint32_t rm = r * mults[m];
-            for (shift = 0; shift <= maxshift; shift++) {
-                x[m][shift] |= (((uint64_t)1) << ((rm >> shift) & ((1 << usebits) - 1)));
-            }
-        }
-    }
-    for (m = 0; m < sizeof(mults) / sizeof(mults[0]); m++) {
-        for (shift = 0; shift <= maxshift; shift++) {
-            /* Test that the lower usebits bits of x[shift] are 1 */
-            CHECK(((~x[m][shift]) << (64 - (1 << usebits))) == 0);
-        }
-    }
-}
-
-/* Subrange must be a whole divisor of range, and at most 64 */
-void test_rand_int(uint32_t range, uint32_t subrange) {
-    /* (1-1/subrange)^rounds < 1/10^9 */
-    int rounds = (subrange * 2073) / 100;
-    int i;
-    uint64_t x = 0;
-    CHECK((range % subrange) == 0);
-    for (i = 0; i < rounds; i++) {
-        uint32_t r = rustsecp256k1_v0_8_1_testrand_int(range);
-        CHECK(r < range);
-        r = r % subrange;
-        x |= (((uint64_t)1) << r);
-    }
-    /* Test that the lower subrange bits of x are 1. */
-    CHECK(((~x) << (64 - subrange)) == 0);
-}
-
-void run_rand_bits(void) {
-    size_t b;
-    test_rand_bits(1, 32);
-    for (b = 1; b <= 32; b++) {
-        test_rand_bits(0, b);
-    }
-}
-
-void run_rand_int(void) {
-    static const uint32_t ms[] = {1, 3, 17, 1000, 13771, 999999, 33554432};
-    static const uint32_t ss[] = {1, 3, 6, 9, 13, 31, 64};
-    unsigned int m, s;
-    for (m = 0; m < sizeof(ms) / sizeof(ms[0]); m++) {
-        for (s = 0; s < sizeof(ss) / sizeof(ss[0]); s++) {
-            test_rand_int(ms[m] * ss[s], ss[s]);
-        }
-    }
+    CHECK(rustsecp256k1_v0_9_0_tagged_sha256(CTX, hash32, tag, 3, msg, 3) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(hash32, hash_expected, sizeof(hash32)) == 0);
 }
 
 /***** MODINV TESTS *****/
 
 /* Compute the modular inverse of (odd) x mod 2^64. */
-uint64_t modinv2p64(uint64_t x) {
+static uint64_t modinv2p64(uint64_t x) {
     /* If w = 1/x mod 2^(2^L), then w*(2 - w*x) = 1/x mod 2^(2^(L+1)). See
      * Hacker's Delight second edition, Henry S. Warren, Jr., pages 245-247 for
      * why. Start with L=0, for which it is true for every odd x that
@@ -801,7 +897,7 @@ uint64_t modinv2p64(uint64_t x) {
  *
  * Out is a 512-bit number (represented as 32 uint16_t's in LE order). The other
  * arguments are 256-bit numbers (represented as 16 uint16_t's in LE order). */
-void mulmod256(uint16_t* out, const uint16_t* a, const uint16_t* b, const uint16_t* m) {
+static void mulmod256(uint16_t* out, const uint16_t* a, const uint16_t* b, const uint16_t* m) {
     uint16_t mul[32];
     uint64_t c = 0;
     int i, j;
@@ -885,7 +981,7 @@ void mulmod256(uint16_t* out, const uint16_t* a, const uint16_t* b, const uint16
 }
 
 /* Convert a 256-bit number represented as 16 uint16_t's to signed30 notation. */
-void uint16_to_signed30(rustsecp256k1_v0_8_1_modinv32_signed30* out, const uint16_t* in) {
+static void uint16_to_signed30(rustsecp256k1_v0_9_0_modinv32_signed30* out, const uint16_t* in) {
     int i;
     memset(out->v, 0, sizeof(out->v));
     for (i = 0; i < 256; ++i) {
@@ -894,7 +990,7 @@ void uint16_to_signed30(rustsecp256k1_v0_8_1_modinv32_signed30* out, const uint1
 }
 
 /* Convert a 256-bit number in signed30 notation to a representation as 16 uint16_t's. */
-void signed30_to_uint16(uint16_t* out, const rustsecp256k1_v0_8_1_modinv32_signed30* in) {
+static void signed30_to_uint16(uint16_t* out, const rustsecp256k1_v0_9_0_modinv32_signed30* in) {
     int i;
     memset(out, 0, 32);
     for (i = 0; i < 256; ++i) {
@@ -903,10 +999,10 @@ void signed30_to_uint16(uint16_t* out, const rustsecp256k1_v0_8_1_modinv32_signe
 }
 
 /* Randomly mutate the sign of limbs in signed30 representation, without changing the value. */
-void mutate_sign_signed30(rustsecp256k1_v0_8_1_modinv32_signed30* x) {
+static void mutate_sign_signed30(rustsecp256k1_v0_9_0_modinv32_signed30* x) {
     int i;
     for (i = 0; i < 16; ++i) {
-        int pos = rustsecp256k1_v0_8_1_testrand_bits(3);
+        int pos = rustsecp256k1_v0_9_0_testrand_bits(3);
         if (x->v[pos] > 0 && x->v[pos + 1] <= 0x3fffffff) {
             x->v[pos] -= 0x40000000;
             x->v[pos + 1] += 1;
@@ -917,25 +1013,45 @@ void mutate_sign_signed30(rustsecp256k1_v0_8_1_modinv32_signed30* x) {
     }
 }
 
-/* Test rustsecp256k1_v0_8_1_modinv32{_var}, using inputs in 16-bit limb format, and returning inverse. */
-void test_modinv32_uint16(uint16_t* out, const uint16_t* in, const uint16_t* mod) {
+/* Test rustsecp256k1_v0_9_0_modinv32{_var}, using inputs in 16-bit limb format, and returning inverse. */
+static void test_modinv32_uint16(uint16_t* out, const uint16_t* in, const uint16_t* mod) {
     uint16_t tmp[16];
-    rustsecp256k1_v0_8_1_modinv32_signed30 x;
-    rustsecp256k1_v0_8_1_modinv32_modinfo m;
+    rustsecp256k1_v0_9_0_modinv32_signed30 x;
+    rustsecp256k1_v0_9_0_modinv32_modinfo m;
     int i, vartime, nonzero;
 
     uint16_to_signed30(&x, in);
     nonzero = (x.v[0] | x.v[1] | x.v[2] | x.v[3] | x.v[4] | x.v[5] | x.v[6] | x.v[7] | x.v[8]) != 0;
     uint16_to_signed30(&m.modulus, mod);
-    mutate_sign_signed30(&m.modulus);
 
     /* compute 1/modulus mod 2^30 */
     m.modulus_inv30 = modinv2p64(m.modulus.v[0]) & 0x3fffffff;
     CHECK(((m.modulus_inv30 * m.modulus.v[0]) & 0x3fffffff) == 1);
 
+    /* Test rustsecp256k1_v0_9_0_jacobi32_maybe_var. */
+    if (nonzero) {
+        int jac;
+        uint16_t sqr[16], negone[16];
+        mulmod256(sqr, in, in, mod);
+        uint16_to_signed30(&x, sqr);
+        /* Compute jacobi symbol of in^2, which must be 1 (or uncomputable). */
+        jac = rustsecp256k1_v0_9_0_jacobi32_maybe_var(&x, &m);
+        CHECK(jac == 0 || jac == 1);
+        /* Then compute the jacobi symbol of -(in^2). x and -x have opposite
+         * jacobi symbols if and only if (mod % 4) == 3. */
+        negone[0] = mod[0] - 1;
+        for (i = 1; i < 16; ++i) negone[i] = mod[i];
+        mulmod256(sqr, sqr, negone, mod);
+        uint16_to_signed30(&x, sqr);
+        jac = rustsecp256k1_v0_9_0_jacobi32_maybe_var(&x, &m);
+        CHECK(jac == 0 || jac == 1 - (mod[0] & 2));
+    }
+
+    uint16_to_signed30(&x, in);
+    mutate_sign_signed30(&m.modulus);
     for (vartime = 0; vartime < 2; ++vartime) {
         /* compute inverse */
-        (vartime ? rustsecp256k1_v0_8_1_modinv32_var : rustsecp256k1_v0_8_1_modinv32)(&x, &m);
+        (vartime ? rustsecp256k1_v0_9_0_modinv32_var : rustsecp256k1_v0_9_0_modinv32)(&x, &m);
 
         /* produce output */
         signed30_to_uint16(out, &x);
@@ -946,7 +1062,7 @@ void test_modinv32_uint16(uint16_t* out, const uint16_t* in, const uint16_t* mod
         for (i = 1; i < 16; ++i) CHECK(tmp[i] == 0);
 
         /* invert again */
-        (vartime ? rustsecp256k1_v0_8_1_modinv32_var : rustsecp256k1_v0_8_1_modinv32)(&x, &m);
+        (vartime ? rustsecp256k1_v0_9_0_modinv32_var : rustsecp256k1_v0_9_0_modinv32)(&x, &m);
 
         /* check if the result is equal to the input */
         signed30_to_uint16(tmp, &x);
@@ -956,7 +1072,7 @@ void test_modinv32_uint16(uint16_t* out, const uint16_t* in, const uint16_t* mod
 
 #ifdef SECP256K1_WIDEMUL_INT128
 /* Convert a 256-bit number represented as 16 uint16_t's to signed62 notation. */
-void uint16_to_signed62(rustsecp256k1_v0_8_1_modinv64_signed62* out, const uint16_t* in) {
+static void uint16_to_signed62(rustsecp256k1_v0_9_0_modinv64_signed62* out, const uint16_t* in) {
     int i;
     memset(out->v, 0, sizeof(out->v));
     for (i = 0; i < 256; ++i) {
@@ -965,7 +1081,7 @@ void uint16_to_signed62(rustsecp256k1_v0_8_1_modinv64_signed62* out, const uint1
 }
 
 /* Convert a 256-bit number in signed62 notation to a representation as 16 uint16_t's. */
-void signed62_to_uint16(uint16_t* out, const rustsecp256k1_v0_8_1_modinv64_signed62* in) {
+static void signed62_to_uint16(uint16_t* out, const rustsecp256k1_v0_9_0_modinv64_signed62* in) {
     int i;
     memset(out, 0, 32);
     for (i = 0; i < 256; ++i) {
@@ -974,11 +1090,11 @@ void signed62_to_uint16(uint16_t* out, const rustsecp256k1_v0_8_1_modinv64_signe
 }
 
 /* Randomly mutate the sign of limbs in signed62 representation, without changing the value. */
-void mutate_sign_signed62(rustsecp256k1_v0_8_1_modinv64_signed62* x) {
+static void mutate_sign_signed62(rustsecp256k1_v0_9_0_modinv64_signed62* x) {
     static const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
     int i;
     for (i = 0; i < 8; ++i) {
-        int pos = rustsecp256k1_v0_8_1_testrand_bits(2);
+        int pos = rustsecp256k1_v0_9_0_testrand_bits(2);
         if (x->v[pos] > 0 && x->v[pos + 1] <= M62) {
             x->v[pos] -= (M62 + 1);
             x->v[pos + 1] += 1;
@@ -989,26 +1105,46 @@ void mutate_sign_signed62(rustsecp256k1_v0_8_1_modinv64_signed62* x) {
     }
 }
 
-/* Test rustsecp256k1_v0_8_1_modinv64{_var}, using inputs in 16-bit limb format, and returning inverse. */
-void test_modinv64_uint16(uint16_t* out, const uint16_t* in, const uint16_t* mod) {
+/* Test rustsecp256k1_v0_9_0_modinv64{_var}, using inputs in 16-bit limb format, and returning inverse. */
+static void test_modinv64_uint16(uint16_t* out, const uint16_t* in, const uint16_t* mod) {
     static const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
     uint16_t tmp[16];
-    rustsecp256k1_v0_8_1_modinv64_signed62 x;
-    rustsecp256k1_v0_8_1_modinv64_modinfo m;
+    rustsecp256k1_v0_9_0_modinv64_signed62 x;
+    rustsecp256k1_v0_9_0_modinv64_modinfo m;
     int i, vartime, nonzero;
 
     uint16_to_signed62(&x, in);
     nonzero = (x.v[0] | x.v[1] | x.v[2] | x.v[3] | x.v[4]) != 0;
     uint16_to_signed62(&m.modulus, mod);
-    mutate_sign_signed62(&m.modulus);
 
     /* compute 1/modulus mod 2^62 */
     m.modulus_inv62 = modinv2p64(m.modulus.v[0]) & M62;
     CHECK(((m.modulus_inv62 * m.modulus.v[0]) & M62) == 1);
 
+    /* Test rustsecp256k1_v0_9_0_jacobi64_maybe_var. */
+    if (nonzero) {
+        int jac;
+        uint16_t sqr[16], negone[16];
+        mulmod256(sqr, in, in, mod);
+        uint16_to_signed62(&x, sqr);
+        /* Compute jacobi symbol of in^2, which must be 1 (or uncomputable). */
+        jac = rustsecp256k1_v0_9_0_jacobi64_maybe_var(&x, &m);
+        CHECK(jac == 0 || jac == 1);
+        /* Then compute the jacobi symbol of -(in^2). x and -x have opposite
+         * jacobi symbols if and only if (mod % 4) == 3. */
+        negone[0] = mod[0] - 1;
+        for (i = 1; i < 16; ++i) negone[i] = mod[i];
+        mulmod256(sqr, sqr, negone, mod);
+        uint16_to_signed62(&x, sqr);
+        jac = rustsecp256k1_v0_9_0_jacobi64_maybe_var(&x, &m);
+        CHECK(jac == 0 || jac == 1 - (mod[0] & 2));
+    }
+
+    uint16_to_signed62(&x, in);
+    mutate_sign_signed62(&m.modulus);
     for (vartime = 0; vartime < 2; ++vartime) {
         /* compute inverse */
-        (vartime ? rustsecp256k1_v0_8_1_modinv64_var : rustsecp256k1_v0_8_1_modinv64)(&x, &m);
+        (vartime ? rustsecp256k1_v0_9_0_modinv64_var : rustsecp256k1_v0_9_0_modinv64)(&x, &m);
 
         /* produce output */
         signed62_to_uint16(out, &x);
@@ -1019,7 +1155,7 @@ void test_modinv64_uint16(uint16_t* out, const uint16_t* in, const uint16_t* mod
         for (i = 1; i < 16; ++i) CHECK(tmp[i] == 0);
 
         /* invert again */
-        (vartime ? rustsecp256k1_v0_8_1_modinv64_var : rustsecp256k1_v0_8_1_modinv64)(&x, &m);
+        (vartime ? rustsecp256k1_v0_9_0_modinv64_var : rustsecp256k1_v0_9_0_modinv64)(&x, &m);
 
         /* check if the result is equal to the input */
         signed62_to_uint16(tmp, &x);
@@ -1029,7 +1165,7 @@ void test_modinv64_uint16(uint16_t* out, const uint16_t* in, const uint16_t* mod
 #endif
 
 /* test if a and b are coprime */
-int coprime(const uint16_t* a, const uint16_t* b) {
+static int coprime(const uint16_t* a, const uint16_t* b) {
     uint16_t x[16], y[16], t[16];
     int i;
     int iszero;
@@ -1059,7 +1195,7 @@ int coprime(const uint16_t* a, const uint16_t* b) {
     return 1;
 }
 
-void run_modinv_tests(void) {
+static void run_modinv_tests(void) {
     /* Fixed test cases. Each tuple is (input, modulus, output), each as 16x16 bits in LE order. */
     static const uint16_t CASES[][3][16] = {
         /* Test cases triggering edge cases in divsteps */
@@ -1661,7 +1797,7 @@ void run_modinv_tests(void) {
 #endif
     }
 
-    for (i = 0; i < 100 * count; ++i) {
+    for (i = 0; i < 100 * COUNT; ++i) {
         /* 256-bit numbers in 16-uint16_t's notation */
         static const uint16_t ZERO[16] = {0};
         uint16_t xd[16];  /* the number (in range [0,2^256)) to be inverted */
@@ -1671,8 +1807,8 @@ void run_modinv_tests(void) {
         /* generate random xd and md, so that md is odd, md>1, xd<md, and gcd(xd,md)=1 */
         do {
             /* generate random xd and md (with many subsequent 0s and 1s) */
-            rustsecp256k1_v0_8_1_testrand256_test((unsigned char*)xd);
-            rustsecp256k1_v0_8_1_testrand256_test((unsigned char*)md);
+            rustsecp256k1_v0_9_0_testrand256_test((unsigned char*)xd);
+            rustsecp256k1_v0_9_0_testrand256_test((unsigned char*)md);
             md[0] |= 1; /* modulus must be odd */
             /* If modulus is 1, find another one. */
             ok = md[0] != 1;
@@ -1686,7 +1822,7 @@ void run_modinv_tests(void) {
 #endif
 
         /* In a few cases, also test with input=0 */
-        if (i < count) {
+        if (i < COUNT) {
             test_modinv32_uint16(id, ZERO, md);
 #ifdef SECP256K1_WIDEMUL_INT128
             test_modinv64_uint16(id, ZERO, md);
@@ -1699,7 +1835,7 @@ void run_modinv_tests(void) {
 
 #ifdef SECP256K1_WIDEMUL_INT128
 /* Add two 256-bit numbers (represented as 16 uint16_t's in LE order) together mod 2^256. */
-void add256(uint16_t* out, const uint16_t* a, const uint16_t* b) {
+static void add256(uint16_t* out, const uint16_t* a, const uint16_t* b) {
     int i;
     uint32_t carry = 0;
     for (i = 0; i < 16; ++i) {
@@ -1711,7 +1847,7 @@ void add256(uint16_t* out, const uint16_t* a, const uint16_t* b) {
 }
 
 /* Negate a 256-bit number (represented as 16 uint16_t's in LE order) mod 2^256. */
-void neg256(uint16_t* out, const uint16_t* a) {
+static void neg256(uint16_t* out, const uint16_t* a) {
     int i;
     uint32_t carry = 1;
     for (i = 0; i < 16; ++i) {
@@ -1722,7 +1858,7 @@ void neg256(uint16_t* out, const uint16_t* a) {
 }
 
 /* Right-shift a 256-bit number (represented as 16 uint16_t's in LE order). */
-void rshift256(uint16_t* out, const uint16_t* a, int n, int sign_extend) {
+static void rshift256(uint16_t* out, const uint16_t* a, int n, int sign_extend) {
     uint16_t sign = sign_extend && (a[15] >> 15);
     int i, j;
     for (i = 15; i >= 0; --i) {
@@ -1740,7 +1876,7 @@ void rshift256(uint16_t* out, const uint16_t* a, int n, int sign_extend) {
 }
 
 /* Load a 64-bit unsigned integer into an array of 16 uint16_t's in LE order representing a 256-bit value. */
-void load256u64(uint16_t* out, uint64_t v, int is_signed) {
+static void load256u64(uint16_t* out, uint64_t v, int is_signed) {
     int i;
     uint64_t sign = is_signed && (v >> 63) ? UINT64_MAX : 0;
     for (i = 0; i < 4; ++i) {
@@ -1752,7 +1888,7 @@ void load256u64(uint16_t* out, uint64_t v, int is_signed) {
 }
 
 /* Load a 128-bit unsigned integer into an array of 16 uint16_t's in LE order representing a 256-bit value. */
-void load256two64(uint16_t* out, uint64_t hi, uint64_t lo, int is_signed) {
+static void load256two64(uint16_t* out, uint64_t hi, uint64_t lo, int is_signed) {
     int i;
     uint64_t sign = is_signed && (hi >> 63) ? UINT64_MAX : 0;
     for (i = 0; i < 4; ++i) {
@@ -1767,7 +1903,7 @@ void load256two64(uint16_t* out, uint64_t hi, uint64_t lo, int is_signed) {
 }
 
 /* Check whether the 256-bit value represented by array of 16-bit values is in range -2^127 < v < 2^127. */
-int int256is127(const uint16_t* v) {
+static int int256is127(const uint16_t* v) {
     int all_0 = ((v[7] & 0x8000) == 0), all_1 = ((v[7] & 0x8000) == 0x8000);
     int i;
     for (i = 8; i < 16; ++i) {
@@ -1777,26 +1913,26 @@ int int256is127(const uint16_t* v) {
     return all_0 || all_1;
 }
 
-void load256u128(uint16_t* out, const rustsecp256k1_v0_8_1_uint128* v) {
-    uint64_t lo = rustsecp256k1_v0_8_1_u128_to_u64(v), hi = rustsecp256k1_v0_8_1_u128_hi_u64(v);
+static void load256u128(uint16_t* out, const rustsecp256k1_v0_9_0_uint128* v) {
+    uint64_t lo = rustsecp256k1_v0_9_0_u128_to_u64(v), hi = rustsecp256k1_v0_9_0_u128_hi_u64(v);
     load256two64(out, hi, lo, 0);
 }
 
-void load256i128(uint16_t* out, const rustsecp256k1_v0_8_1_int128* v) {
+static void load256i128(uint16_t* out, const rustsecp256k1_v0_9_0_int128* v) {
     uint64_t lo;
     int64_t hi;
-    rustsecp256k1_v0_8_1_int128 c = *v;
-    lo = rustsecp256k1_v0_8_1_i128_to_i64(&c);
-    rustsecp256k1_v0_8_1_i128_rshift(&c, 64);
-    hi = rustsecp256k1_v0_8_1_i128_to_i64(&c);
+    rustsecp256k1_v0_9_0_int128 c = *v;
+    lo = rustsecp256k1_v0_9_0_i128_to_u64(&c);
+    rustsecp256k1_v0_9_0_i128_rshift(&c, 64);
+    hi = rustsecp256k1_v0_9_0_i128_to_i64(&c);
     load256two64(out, hi, lo, 1);
 }
 
-void run_int128_test_case(void) {
+static void run_int128_test_case(void) {
     unsigned char buf[32];
     uint64_t v[4];
-    rustsecp256k1_v0_8_1_int128 swa, swz;
-    rustsecp256k1_v0_8_1_uint128 uwa, uwz;
+    rustsecp256k1_v0_9_0_int128 swa, swz;
+    rustsecp256k1_v0_9_0_uint128 uwa, uwz;
     uint64_t ub, uc;
     int64_t sb, sc;
     uint16_t rswa[16], rswz[32], rswr[32], ruwa[16], ruwz[32], ruwr[32];
@@ -1804,7 +1940,7 @@ void run_int128_test_case(void) {
     int i;
 
     /* Generate 32-byte random value. */
-    rustsecp256k1_v0_8_1_testrand256_test(buf);
+    rustsecp256k1_v0_9_0_testrand256_test(buf);
     /* Convert into 4 64-bit integers. */
     for (i = 0; i < 4; ++i) {
         uint64_t vi = 0;
@@ -1813,8 +1949,8 @@ void run_int128_test_case(void) {
         v[i] = vi;
     }
     /* Convert those into a 128-bit value and two 64-bit values (signed and unsigned). */
-    rustsecp256k1_v0_8_1_u128_load(&uwa, v[1], v[0]);
-    rustsecp256k1_v0_8_1_i128_load(&swa, v[1], v[0]);
+    rustsecp256k1_v0_9_0_u128_load(&uwa, v[1], v[0]);
+    rustsecp256k1_v0_9_0_i128_load(&swa, v[1], v[0]);
     ub = v[2];
     sb = v[2];
     uc = v[3];
@@ -1826,39 +1962,39 @@ void run_int128_test_case(void) {
     load256u64(rsb, sb, 1);
     load256u64(ruc, uc, 0);
     load256u64(rsc, sc, 1);
-    /* test rustsecp256k1_v0_8_1_u128_mul */
+    /* test rustsecp256k1_v0_9_0_u128_mul */
     mulmod256(ruwr, rub, ruc, NULL);
-    rustsecp256k1_v0_8_1_u128_mul(&uwz, ub, uc);
+    rustsecp256k1_v0_9_0_u128_mul(&uwz, ub, uc);
     load256u128(ruwz, &uwz);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(ruwr, ruwz, 16) == 0);
-    /* test rustsecp256k1_v0_8_1_u128_accum_mul */
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(ruwr, ruwz, 16) == 0);
+    /* test rustsecp256k1_v0_9_0_u128_accum_mul */
     mulmod256(ruwr, rub, ruc, NULL);
     add256(ruwr, ruwr, ruwa);
     uwz = uwa;
-    rustsecp256k1_v0_8_1_u128_accum_mul(&uwz, ub, uc);
+    rustsecp256k1_v0_9_0_u128_accum_mul(&uwz, ub, uc);
     load256u128(ruwz, &uwz);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(ruwr, ruwz, 16) == 0);
-    /* test rustsecp256k1_v0_8_1_u128_accum_u64 */
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(ruwr, ruwz, 16) == 0);
+    /* test rustsecp256k1_v0_9_0_u128_accum_u64 */
     add256(ruwr, rub, ruwa);
     uwz = uwa;
-    rustsecp256k1_v0_8_1_u128_accum_u64(&uwz, ub);
+    rustsecp256k1_v0_9_0_u128_accum_u64(&uwz, ub);
     load256u128(ruwz, &uwz);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(ruwr, ruwz, 16) == 0);
-    /* test rustsecp256k1_v0_8_1_u128_rshift */
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(ruwr, ruwz, 16) == 0);
+    /* test rustsecp256k1_v0_9_0_u128_rshift */
     rshift256(ruwr, ruwa, uc % 128, 0);
     uwz = uwa;
-    rustsecp256k1_v0_8_1_u128_rshift(&uwz, uc % 128);
+    rustsecp256k1_v0_9_0_u128_rshift(&uwz, uc % 128);
     load256u128(ruwz, &uwz);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(ruwr, ruwz, 16) == 0);
-    /* test rustsecp256k1_v0_8_1_u128_to_u64 */
-    CHECK(rustsecp256k1_v0_8_1_u128_to_u64(&uwa) == v[0]);
-    /* test rustsecp256k1_v0_8_1_u128_hi_u64 */
-    CHECK(rustsecp256k1_v0_8_1_u128_hi_u64(&uwa) == v[1]);
-    /* test rustsecp256k1_v0_8_1_u128_from_u64 */
-    rustsecp256k1_v0_8_1_u128_from_u64(&uwz, ub);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(ruwr, ruwz, 16) == 0);
+    /* test rustsecp256k1_v0_9_0_u128_to_u64 */
+    CHECK(rustsecp256k1_v0_9_0_u128_to_u64(&uwa) == v[0]);
+    /* test rustsecp256k1_v0_9_0_u128_hi_u64 */
+    CHECK(rustsecp256k1_v0_9_0_u128_hi_u64(&uwa) == v[1]);
+    /* test rustsecp256k1_v0_9_0_u128_from_u64 */
+    rustsecp256k1_v0_9_0_u128_from_u64(&uwz, ub);
     load256u128(ruwz, &uwz);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(rub, ruwz, 16) == 0);
-    /* test rustsecp256k1_v0_8_1_u128_check_bits */
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(rub, ruwz, 16) == 0);
+    /* test rustsecp256k1_v0_9_0_u128_check_bits */
     {
         int uwa_bits = 0;
         int j;
@@ -1866,24 +2002,24 @@ void run_int128_test_case(void) {
             if (ruwa[j / 16] >> (j % 16)) uwa_bits = 1 + j;
         }
         for (j = 0; j < 128; ++j) {
-            CHECK(rustsecp256k1_v0_8_1_u128_check_bits(&uwa, j) == (uwa_bits <= j));
+            CHECK(rustsecp256k1_v0_9_0_u128_check_bits(&uwa, j) == (uwa_bits <= j));
         }
     }
-    /* test rustsecp256k1_v0_8_1_i128_mul */
+    /* test rustsecp256k1_v0_9_0_i128_mul */
     mulmod256(rswr, rsb, rsc, NULL);
-    rustsecp256k1_v0_8_1_i128_mul(&swz, sb, sc);
+    rustsecp256k1_v0_9_0_i128_mul(&swz, sb, sc);
     load256i128(rswz, &swz);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(rswr, rswz, 16) == 0);
-    /* test rustsecp256k1_v0_8_1_i128_accum_mul */
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(rswr, rswz, 16) == 0);
+    /* test rustsecp256k1_v0_9_0_i128_accum_mul */
     mulmod256(rswr, rsb, rsc, NULL);
     add256(rswr, rswr, rswa);
     if (int256is127(rswr)) {
         swz = swa;
-        rustsecp256k1_v0_8_1_i128_accum_mul(&swz, sb, sc);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&swz, sb, sc);
         load256i128(rswz, &swz);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(rswr, rswz, 16) == 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(rswr, rswz, 16) == 0);
     }
-    /* test rustsecp256k1_v0_8_1_i128_det */
+    /* test rustsecp256k1_v0_9_0_i128_det */
     {
         uint16_t rsd[16], rse[16], rst[32];
         int64_t sd = v[0], se = v[1];
@@ -1893,23 +2029,25 @@ void run_int128_test_case(void) {
         neg256(rst, rst);
         mulmod256(rswr, rsb, rse, NULL);
         add256(rswr, rswr, rst);
-        rustsecp256k1_v0_8_1_i128_det(&swz, sb, sc, sd, se);
+        rustsecp256k1_v0_9_0_i128_det(&swz, sb, sc, sd, se);
         load256i128(rswz, &swz);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(rswr, rswz, 16) == 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(rswr, rswz, 16) == 0);
     }
-    /* test rustsecp256k1_v0_8_1_i128_rshift */
+    /* test rustsecp256k1_v0_9_0_i128_rshift */
     rshift256(rswr, rswa, uc % 127, 1);
     swz = swa;
-    rustsecp256k1_v0_8_1_i128_rshift(&swz, uc % 127);
+    rustsecp256k1_v0_9_0_i128_rshift(&swz, uc % 127);
     load256i128(rswz, &swz);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(rswr, rswz, 16) == 0);
-    /* test rustsecp256k1_v0_8_1_i128_to_i64 */
-    CHECK((uint64_t)rustsecp256k1_v0_8_1_i128_to_i64(&swa) == v[0]);
-    /* test rustsecp256k1_v0_8_1_i128_from_i64 */
-    rustsecp256k1_v0_8_1_i128_from_i64(&swz, sb);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(rswr, rswz, 16) == 0);
+    /* test rustsecp256k1_v0_9_0_i128_to_u64 */
+    CHECK(rustsecp256k1_v0_9_0_i128_to_u64(&swa) == v[0]);
+    /* test rustsecp256k1_v0_9_0_i128_from_i64 */
+    rustsecp256k1_v0_9_0_i128_from_i64(&swz, sb);
     load256i128(rswz, &swz);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(rsb, rswz, 16) == 0);
-    /* test rustsecp256k1_v0_8_1_i128_eq_var */
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(rsb, rswz, 16) == 0);
+    /* test rustsecp256k1_v0_9_0_i128_to_i64 */
+    CHECK(rustsecp256k1_v0_9_0_i128_to_i64(&swz) == sb);
+    /* test rustsecp256k1_v0_9_0_i128_eq_var */
     {
         int expect = (uc & 1);
         swz = swa;
@@ -1921,84 +2059,110 @@ void run_int128_test_case(void) {
             } else {
                 v0c ^= (((uint64_t)1) << (ub & 63));
             }
-            rustsecp256k1_v0_8_1_i128_load(&swz, v1c, v0c);
+            rustsecp256k1_v0_9_0_i128_load(&swz, v1c, v0c);
         }
-        CHECK(rustsecp256k1_v0_8_1_i128_eq_var(&swa, &swz) == expect);
+        CHECK(rustsecp256k1_v0_9_0_i128_eq_var(&swa, &swz) == expect);
     }
-    /* test rustsecp256k1_v0_8_1_i128_check_pow2 */
+    /* test rustsecp256k1_v0_9_0_i128_check_pow2 (sign == 1) */
     {
         int expect = (uc & 1);
         int pos = ub % 127;
         if (expect) {
-            /* If expect==1, set swz to exactly (2 << pos). */
+            /* If expect==1, set swz to exactly 2^pos. */
             uint64_t hi = 0;
             uint64_t lo = 0;
-            if (pos & 64) {
+            if (pos >= 64) {
                 hi = (((uint64_t)1) << (pos & 63));
             } else {
                 lo = (((uint64_t)1) << (pos & 63));
             }
-            rustsecp256k1_v0_8_1_i128_load(&swz, hi, lo);
+            rustsecp256k1_v0_9_0_i128_load(&swz, hi, lo);
         } else {
-            /* If expect==0, set swz = swa, but update expect=1 if swa happens to equal (2 << pos). */
-            if (pos & 64) {
+            /* If expect==0, set swz = swa, but update expect=1 if swa happens to equal 2^pos. */
+            if (pos >= 64) {
                 if ((v[1] == (((uint64_t)1) << (pos & 63))) && v[0] == 0) expect = 1;
             } else {
                 if ((v[0] == (((uint64_t)1) << (pos & 63))) && v[1] == 0) expect = 1;
             }
             swz = swa;
         }
-        CHECK(rustsecp256k1_v0_8_1_i128_check_pow2(&swz, pos) == expect);
-    }
-}
-
-void run_int128_tests(void) {
-    {   /* rustsecp256k1_v0_8_1_u128_accum_mul */
-        rustsecp256k1_v0_8_1_uint128 res;
-
-        /* Check rustsecp256k1_v0_8_1_u128_accum_mul overflow */
-        rustsecp256k1_v0_8_1_u128_mul(&res, UINT64_MAX, UINT64_MAX);
-        rustsecp256k1_v0_8_1_u128_accum_mul(&res, UINT64_MAX, UINT64_MAX);
-        CHECK(rustsecp256k1_v0_8_1_u128_to_u64(&res) == 2);
-        CHECK(rustsecp256k1_v0_8_1_u128_hi_u64(&res) == 18446744073709551612U);
-    }
-    {   /* rustsecp256k1_v0_8_1_u128_accum_mul */
-        rustsecp256k1_v0_8_1_int128 res;
-
-        /* Compute INT128_MAX = 2^127 - 1 with rustsecp256k1_v0_8_1_i128_accum_mul */
-        rustsecp256k1_v0_8_1_i128_mul(&res, INT64_MAX, INT64_MAX);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&res, INT64_MAX, INT64_MAX);
-        CHECK(rustsecp256k1_v0_8_1_i128_to_i64(&res) == 2);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&res, 4, 9223372036854775807);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&res, 1, 1);
-        CHECK((uint64_t)rustsecp256k1_v0_8_1_i128_to_i64(&res) == UINT64_MAX);
-        rustsecp256k1_v0_8_1_i128_rshift(&res, 64);
-        CHECK(rustsecp256k1_v0_8_1_i128_to_i64(&res) == INT64_MAX);
-
-        /* Compute INT128_MIN = - 2^127 with rustsecp256k1_v0_8_1_i128_accum_mul */
-        rustsecp256k1_v0_8_1_i128_mul(&res, INT64_MAX, INT64_MIN);
-        CHECK(rustsecp256k1_v0_8_1_i128_to_i64(&res) == INT64_MIN);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&res, INT64_MAX, INT64_MIN);
-        CHECK(rustsecp256k1_v0_8_1_i128_to_i64(&res) == 0);
-        rustsecp256k1_v0_8_1_i128_accum_mul(&res, 2, INT64_MIN);
-        CHECK(rustsecp256k1_v0_8_1_i128_to_i64(&res) == 0);
-        rustsecp256k1_v0_8_1_i128_rshift(&res, 64);
-        CHECK(rustsecp256k1_v0_8_1_i128_to_i64(&res) == INT64_MIN);
+        CHECK(rustsecp256k1_v0_9_0_i128_check_pow2(&swz, pos, 1) == expect);
+    }
+    /* test rustsecp256k1_v0_9_0_i128_check_pow2 (sign == -1) */
+    {
+        int expect = (uc & 1);
+        int pos = ub % 127;
+        if (expect) {
+            /* If expect==1, set swz to exactly -2^pos. */
+            uint64_t hi = ~(uint64_t)0;
+            uint64_t lo = ~(uint64_t)0;
+            if (pos >= 64) {
+                hi <<= (pos & 63);
+                lo = 0;
+            } else {
+                lo <<= (pos & 63);
+            }
+            rustsecp256k1_v0_9_0_i128_load(&swz, hi, lo);
+        } else {
+            /* If expect==0, set swz = swa, but update expect=1 if swa happens to equal -2^pos. */
+            if (pos >= 64) {
+                if ((v[1] == ((~(uint64_t)0) << (pos & 63))) && v[0] == 0) expect = 1;
+            } else {
+                if ((v[0] == ((~(uint64_t)0) << (pos & 63))) && v[1] == ~(uint64_t)0) expect = 1;
+            }
+            swz = swa;
+        }
+        CHECK(rustsecp256k1_v0_9_0_i128_check_pow2(&swz, pos, -1) == expect);
+    }
+}
+
+static void run_int128_tests(void) {
+    {   /* rustsecp256k1_v0_9_0_u128_accum_mul */
+        rustsecp256k1_v0_9_0_uint128 res;
+
+        /* Check rustsecp256k1_v0_9_0_u128_accum_mul overflow */
+        rustsecp256k1_v0_9_0_u128_mul(&res, UINT64_MAX, UINT64_MAX);
+        rustsecp256k1_v0_9_0_u128_accum_mul(&res, UINT64_MAX, UINT64_MAX);
+        CHECK(rustsecp256k1_v0_9_0_u128_to_u64(&res) == 2);
+        CHECK(rustsecp256k1_v0_9_0_u128_hi_u64(&res) == 18446744073709551612U);
+    }
+    {   /* rustsecp256k1_v0_9_0_u128_accum_mul */
+        rustsecp256k1_v0_9_0_int128 res;
+
+        /* Compute INT128_MAX = 2^127 - 1 with rustsecp256k1_v0_9_0_i128_accum_mul */
+        rustsecp256k1_v0_9_0_i128_mul(&res, INT64_MAX, INT64_MAX);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&res, INT64_MAX, INT64_MAX);
+        CHECK(rustsecp256k1_v0_9_0_i128_to_u64(&res) == 2);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&res, 4, 9223372036854775807);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&res, 1, 1);
+        CHECK(rustsecp256k1_v0_9_0_i128_to_u64(&res) == UINT64_MAX);
+        rustsecp256k1_v0_9_0_i128_rshift(&res, 64);
+        CHECK(rustsecp256k1_v0_9_0_i128_to_i64(&res) == INT64_MAX);
+
+        /* Compute INT128_MIN = - 2^127 with rustsecp256k1_v0_9_0_i128_accum_mul */
+        rustsecp256k1_v0_9_0_i128_mul(&res, INT64_MAX, INT64_MIN);
+        CHECK(rustsecp256k1_v0_9_0_i128_to_u64(&res) == (uint64_t)INT64_MIN);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&res, INT64_MAX, INT64_MIN);
+        CHECK(rustsecp256k1_v0_9_0_i128_to_u64(&res) == 0);
+        rustsecp256k1_v0_9_0_i128_accum_mul(&res, 2, INT64_MIN);
+        CHECK(rustsecp256k1_v0_9_0_i128_to_u64(&res) == 0);
+        rustsecp256k1_v0_9_0_i128_rshift(&res, 64);
+        CHECK(rustsecp256k1_v0_9_0_i128_to_i64(&res) == INT64_MIN);
     }
     {
         /* Randomized tests. */
         int i;
-        for (i = 0; i < 256 * count; ++i) run_int128_test_case();
+        for (i = 0; i < 256 * COUNT; ++i) run_int128_test_case();
     }
 }
 #endif
 
 /***** SCALAR TESTS *****/
 
-void scalar_test(void) {
-    rustsecp256k1_v0_8_1_scalar s;
-    rustsecp256k1_v0_8_1_scalar s1;
-    rustsecp256k1_v0_8_1_scalar s2;
+static void scalar_test(void) {
+    rustsecp256k1_v0_9_0_scalar s;
+    rustsecp256k1_v0_9_0_scalar s1;
+    rustsecp256k1_v0_9_0_scalar s2;
     unsigned char c[32];
 
     /* Set 's' to a random scalar, with value 'snum'. */
@@ -2009,202 +2173,211 @@ void scalar_test(void) {
 
     /* Set 's2' to a random scalar, with value 'snum2', and byte array representation 'c'. */
     random_scalar_order_test(&s2);
-    rustsecp256k1_v0_8_1_scalar_get_b32(c, &s2);
+    rustsecp256k1_v0_9_0_scalar_get_b32(c, &s2);
 
     {
         int i;
         /* Test that fetching groups of 4 bits from a scalar and recursing n(i)=16*n(i-1)+p(i) reconstructs it. */
-        rustsecp256k1_v0_8_1_scalar n;
-        rustsecp256k1_v0_8_1_scalar_set_int(&n, 0);
+        rustsecp256k1_v0_9_0_scalar n;
+        rustsecp256k1_v0_9_0_scalar_set_int(&n, 0);
         for (i = 0; i < 256; i += 4) {
-            rustsecp256k1_v0_8_1_scalar t;
+            rustsecp256k1_v0_9_0_scalar t;
             int j;
-            rustsecp256k1_v0_8_1_scalar_set_int(&t, rustsecp256k1_v0_8_1_scalar_get_bits(&s, 256 - 4 - i, 4));
+            rustsecp256k1_v0_9_0_scalar_set_int(&t, rustsecp256k1_v0_9_0_scalar_get_bits(&s, 256 - 4 - i, 4));
             for (j = 0; j < 4; j++) {
-                rustsecp256k1_v0_8_1_scalar_add(&n, &n, &n);
+                rustsecp256k1_v0_9_0_scalar_add(&n, &n, &n);
             }
-            rustsecp256k1_v0_8_1_scalar_add(&n, &n, &t);
+            rustsecp256k1_v0_9_0_scalar_add(&n, &n, &t);
         }
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&n, &s));
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&n, &s));
     }
 
     {
         /* Test that fetching groups of randomly-sized bits from a scalar and recursing n(i)=b*n(i-1)+p(i) reconstructs it. */
-        rustsecp256k1_v0_8_1_scalar n;
+        rustsecp256k1_v0_9_0_scalar n;
         int i = 0;
-        rustsecp256k1_v0_8_1_scalar_set_int(&n, 0);
+        rustsecp256k1_v0_9_0_scalar_set_int(&n, 0);
         while (i < 256) {
-            rustsecp256k1_v0_8_1_scalar t;
+            rustsecp256k1_v0_9_0_scalar t;
             int j;
-            int now = rustsecp256k1_v0_8_1_testrand_int(15) + 1;
+            int now = rustsecp256k1_v0_9_0_testrand_int(15) + 1;
             if (now + i > 256) {
                 now = 256 - i;
             }
-            rustsecp256k1_v0_8_1_scalar_set_int(&t, rustsecp256k1_v0_8_1_scalar_get_bits_var(&s, 256 - now - i, now));
+            rustsecp256k1_v0_9_0_scalar_set_int(&t, rustsecp256k1_v0_9_0_scalar_get_bits_var(&s, 256 - now - i, now));
             for (j = 0; j < now; j++) {
-                rustsecp256k1_v0_8_1_scalar_add(&n, &n, &n);
+                rustsecp256k1_v0_9_0_scalar_add(&n, &n, &n);
             }
-            rustsecp256k1_v0_8_1_scalar_add(&n, &n, &t);
+            rustsecp256k1_v0_9_0_scalar_add(&n, &n, &t);
             i += now;
         }
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&n, &s));
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&n, &s));
     }
 
     {
-        /* test rustsecp256k1_v0_8_1_scalar_shr_int */
-        rustsecp256k1_v0_8_1_scalar r;
+        /* test rustsecp256k1_v0_9_0_scalar_shr_int */
+        rustsecp256k1_v0_9_0_scalar r;
         int i;
         random_scalar_order_test(&r);
         for (i = 0; i < 100; ++i) {
             int low;
-            int shift = 1 + rustsecp256k1_v0_8_1_testrand_int(15);
-            int expected = r.d[0] % (1 << shift);
-            low = rustsecp256k1_v0_8_1_scalar_shr_int(&r, shift);
+            int shift = 1 + rustsecp256k1_v0_9_0_testrand_int(15);
+            int expected = r.d[0] % (1ULL << shift);
+            low = rustsecp256k1_v0_9_0_scalar_shr_int(&r, shift);
             CHECK(expected == low);
         }
     }
 
     {
         /* Test commutativity of add. */
-        rustsecp256k1_v0_8_1_scalar r1, r2;
-        rustsecp256k1_v0_8_1_scalar_add(&r1, &s1, &s2);
-        rustsecp256k1_v0_8_1_scalar_add(&r2, &s2, &s1);
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &r2));
+        rustsecp256k1_v0_9_0_scalar r1, r2;
+        rustsecp256k1_v0_9_0_scalar_add(&r1, &s1, &s2);
+        rustsecp256k1_v0_9_0_scalar_add(&r2, &s2, &s1);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &r2));
     }
 
     {
-        rustsecp256k1_v0_8_1_scalar r1, r2;
-        rustsecp256k1_v0_8_1_scalar b;
+        rustsecp256k1_v0_9_0_scalar r1, r2;
+        rustsecp256k1_v0_9_0_scalar b;
         int i;
         /* Test add_bit. */
-        int bit = rustsecp256k1_v0_8_1_testrand_bits(8);
-        rustsecp256k1_v0_8_1_scalar_set_int(&b, 1);
-        CHECK(rustsecp256k1_v0_8_1_scalar_is_one(&b));
+        int bit = rustsecp256k1_v0_9_0_testrand_bits(8);
+        rustsecp256k1_v0_9_0_scalar_set_int(&b, 1);
+        CHECK(rustsecp256k1_v0_9_0_scalar_is_one(&b));
         for (i = 0; i < bit; i++) {
-            rustsecp256k1_v0_8_1_scalar_add(&b, &b, &b);
+            rustsecp256k1_v0_9_0_scalar_add(&b, &b, &b);
         }
         r1 = s1;
         r2 = s1;
-        if (!rustsecp256k1_v0_8_1_scalar_add(&r1, &r1, &b)) {
+        if (!rustsecp256k1_v0_9_0_scalar_add(&r1, &r1, &b)) {
             /* No overflow happened. */
-            rustsecp256k1_v0_8_1_scalar_cadd_bit(&r2, bit, 1);
-            CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &r2));
+            rustsecp256k1_v0_9_0_scalar_cadd_bit(&r2, bit, 1);
+            CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &r2));
             /* cadd is a noop when flag is zero */
-            rustsecp256k1_v0_8_1_scalar_cadd_bit(&r2, bit, 0);
-            CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &r2));
+            rustsecp256k1_v0_9_0_scalar_cadd_bit(&r2, bit, 0);
+            CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &r2));
         }
     }
 
     {
         /* Test commutativity of mul. */
-        rustsecp256k1_v0_8_1_scalar r1, r2;
-        rustsecp256k1_v0_8_1_scalar_mul(&r1, &s1, &s2);
-        rustsecp256k1_v0_8_1_scalar_mul(&r2, &s2, &s1);
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &r2));
+        rustsecp256k1_v0_9_0_scalar r1, r2;
+        rustsecp256k1_v0_9_0_scalar_mul(&r1, &s1, &s2);
+        rustsecp256k1_v0_9_0_scalar_mul(&r2, &s2, &s1);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &r2));
     }
 
     {
         /* Test associativity of add. */
-        rustsecp256k1_v0_8_1_scalar r1, r2;
-        rustsecp256k1_v0_8_1_scalar_add(&r1, &s1, &s2);
-        rustsecp256k1_v0_8_1_scalar_add(&r1, &r1, &s);
-        rustsecp256k1_v0_8_1_scalar_add(&r2, &s2, &s);
-        rustsecp256k1_v0_8_1_scalar_add(&r2, &s1, &r2);
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &r2));
+        rustsecp256k1_v0_9_0_scalar r1, r2;
+        rustsecp256k1_v0_9_0_scalar_add(&r1, &s1, &s2);
+        rustsecp256k1_v0_9_0_scalar_add(&r1, &r1, &s);
+        rustsecp256k1_v0_9_0_scalar_add(&r2, &s2, &s);
+        rustsecp256k1_v0_9_0_scalar_add(&r2, &s1, &r2);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &r2));
     }
 
     {
         /* Test associativity of mul. */
-        rustsecp256k1_v0_8_1_scalar r1, r2;
-        rustsecp256k1_v0_8_1_scalar_mul(&r1, &s1, &s2);
-        rustsecp256k1_v0_8_1_scalar_mul(&r1, &r1, &s);
-        rustsecp256k1_v0_8_1_scalar_mul(&r2, &s2, &s);
-        rustsecp256k1_v0_8_1_scalar_mul(&r2, &s1, &r2);
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &r2));
+        rustsecp256k1_v0_9_0_scalar r1, r2;
+        rustsecp256k1_v0_9_0_scalar_mul(&r1, &s1, &s2);
+        rustsecp256k1_v0_9_0_scalar_mul(&r1, &r1, &s);
+        rustsecp256k1_v0_9_0_scalar_mul(&r2, &s2, &s);
+        rustsecp256k1_v0_9_0_scalar_mul(&r2, &s1, &r2);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &r2));
     }
 
     {
         /* Test distributitivity of mul over add. */
-        rustsecp256k1_v0_8_1_scalar r1, r2, t;
-        rustsecp256k1_v0_8_1_scalar_add(&r1, &s1, &s2);
-        rustsecp256k1_v0_8_1_scalar_mul(&r1, &r1, &s);
-        rustsecp256k1_v0_8_1_scalar_mul(&r2, &s1, &s);
-        rustsecp256k1_v0_8_1_scalar_mul(&t, &s2, &s);
-        rustsecp256k1_v0_8_1_scalar_add(&r2, &r2, &t);
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &r2));
+        rustsecp256k1_v0_9_0_scalar r1, r2, t;
+        rustsecp256k1_v0_9_0_scalar_add(&r1, &s1, &s2);
+        rustsecp256k1_v0_9_0_scalar_mul(&r1, &r1, &s);
+        rustsecp256k1_v0_9_0_scalar_mul(&r2, &s1, &s);
+        rustsecp256k1_v0_9_0_scalar_mul(&t, &s2, &s);
+        rustsecp256k1_v0_9_0_scalar_add(&r2, &r2, &t);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &r2));
     }
 
     {
         /* Test multiplicative identity. */
-        rustsecp256k1_v0_8_1_scalar r1, v1;
-        rustsecp256k1_v0_8_1_scalar_set_int(&v1,1);
-        rustsecp256k1_v0_8_1_scalar_mul(&r1, &s1, &v1);
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &s1));
+        rustsecp256k1_v0_9_0_scalar r1;
+        rustsecp256k1_v0_9_0_scalar_mul(&r1, &s1, &rustsecp256k1_v0_9_0_scalar_one);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &s1));
     }
 
     {
         /* Test additive identity. */
-        rustsecp256k1_v0_8_1_scalar r1, v0;
-        rustsecp256k1_v0_8_1_scalar_set_int(&v0,0);
-        rustsecp256k1_v0_8_1_scalar_add(&r1, &s1, &v0);
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &s1));
+        rustsecp256k1_v0_9_0_scalar r1;
+        rustsecp256k1_v0_9_0_scalar_add(&r1, &s1, &rustsecp256k1_v0_9_0_scalar_zero);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &s1));
     }
 
     {
         /* Test zero product property. */
-        rustsecp256k1_v0_8_1_scalar r1, v0;
-        rustsecp256k1_v0_8_1_scalar_set_int(&v0,0);
-        rustsecp256k1_v0_8_1_scalar_mul(&r1, &s1, &v0);
-        CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &v0));
+        rustsecp256k1_v0_9_0_scalar r1;
+        rustsecp256k1_v0_9_0_scalar_mul(&r1, &s1, &rustsecp256k1_v0_9_0_scalar_zero);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &rustsecp256k1_v0_9_0_scalar_zero));
     }
 
 }
 
-void run_scalar_set_b32_seckey_tests(void) {
+static void run_scalar_set_b32_seckey_tests(void) {
     unsigned char b32[32];
-    rustsecp256k1_v0_8_1_scalar s1;
-    rustsecp256k1_v0_8_1_scalar s2;
+    rustsecp256k1_v0_9_0_scalar s1;
+    rustsecp256k1_v0_9_0_scalar s2;
 
     /* Usually set_b32 and set_b32_seckey give the same result */
     random_scalar_order_b32(b32);
-    rustsecp256k1_v0_8_1_scalar_set_b32(&s1, b32, NULL);
-    CHECK(rustsecp256k1_v0_8_1_scalar_set_b32_seckey(&s2, b32) == 1);
-    CHECK(rustsecp256k1_v0_8_1_scalar_eq(&s1, &s2) == 1);
+    rustsecp256k1_v0_9_0_scalar_set_b32(&s1, b32, NULL);
+    CHECK(rustsecp256k1_v0_9_0_scalar_set_b32_seckey(&s2, b32) == 1);
+    CHECK(rustsecp256k1_v0_9_0_scalar_eq(&s1, &s2) == 1);
 
     memset(b32, 0, sizeof(b32));
-    CHECK(rustsecp256k1_v0_8_1_scalar_set_b32_seckey(&s2, b32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_scalar_set_b32_seckey(&s2, b32) == 0);
     memset(b32, 0xFF, sizeof(b32));
-    CHECK(rustsecp256k1_v0_8_1_scalar_set_b32_seckey(&s2, b32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_scalar_set_b32_seckey(&s2, b32) == 0);
 }
 
-void run_scalar_tests(void) {
+static void run_scalar_tests(void) {
     int i;
-    for (i = 0; i < 128 * count; i++) {
+    for (i = 0; i < 128 * COUNT; i++) {
         scalar_test();
     }
-    for (i = 0; i < count; i++) {
+    for (i = 0; i < COUNT; i++) {
         run_scalar_set_b32_seckey_tests();
     }
 
+    {
+        /* Check that the scalar constants rustsecp256k1_v0_9_0_scalar_zero and
+           rustsecp256k1_v0_9_0_scalar_one contain the expected values. */
+        rustsecp256k1_v0_9_0_scalar zero, one;
+
+        CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(&rustsecp256k1_v0_9_0_scalar_zero));
+        rustsecp256k1_v0_9_0_scalar_set_int(&zero, 0);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&zero, &rustsecp256k1_v0_9_0_scalar_zero));
+
+        CHECK(rustsecp256k1_v0_9_0_scalar_is_one(&rustsecp256k1_v0_9_0_scalar_one));
+        rustsecp256k1_v0_9_0_scalar_set_int(&one, 1);
+        CHECK(rustsecp256k1_v0_9_0_scalar_eq(&one, &rustsecp256k1_v0_9_0_scalar_one));
+    }
+
     {
         /* (-1)+1 should be zero. */
-        rustsecp256k1_v0_8_1_scalar s, o;
-        rustsecp256k1_v0_8_1_scalar_set_int(&s, 1);
-        CHECK(rustsecp256k1_v0_8_1_scalar_is_one(&s));
-        rustsecp256k1_v0_8_1_scalar_negate(&o, &s);
-        rustsecp256k1_v0_8_1_scalar_add(&o, &o, &s);
-        CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(&o));
-        rustsecp256k1_v0_8_1_scalar_negate(&o, &o);
-        CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(&o));
+        rustsecp256k1_v0_9_0_scalar o;
+        rustsecp256k1_v0_9_0_scalar_negate(&o, &rustsecp256k1_v0_9_0_scalar_one);
+        rustsecp256k1_v0_9_0_scalar_add(&o, &o, &rustsecp256k1_v0_9_0_scalar_one);
+        CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(&o));
+        rustsecp256k1_v0_9_0_scalar_negate(&o, &o);
+        CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(&o));
     }
 
     {
         /* Does check_overflow check catch all ones? */
-        static const rustsecp256k1_v0_8_1_scalar overflowed = SECP256K1_SCALAR_CONST(
+        static const rustsecp256k1_v0_9_0_scalar overflowed = SECP256K1_SCALAR_CONST(
             0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL,
             0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL
         );
-        CHECK(rustsecp256k1_v0_8_1_scalar_check_overflow(&overflowed));
+        CHECK(rustsecp256k1_v0_9_0_scalar_check_overflow(&overflowed));
     }
 
     {
@@ -2213,14 +2386,13 @@ void run_scalar_tests(void) {
          *  and edge-case coverage on 32-bit and 64-bit implementations.
          * The responses were generated with Sage 5.9.
          */
-        rustsecp256k1_v0_8_1_scalar x;
-        rustsecp256k1_v0_8_1_scalar y;
-        rustsecp256k1_v0_8_1_scalar z;
-        rustsecp256k1_v0_8_1_scalar zz;
-        rustsecp256k1_v0_8_1_scalar one;
-        rustsecp256k1_v0_8_1_scalar r1;
-        rustsecp256k1_v0_8_1_scalar r2;
-        rustsecp256k1_v0_8_1_scalar zzv;
+        rustsecp256k1_v0_9_0_scalar x;
+        rustsecp256k1_v0_9_0_scalar y;
+        rustsecp256k1_v0_9_0_scalar z;
+        rustsecp256k1_v0_9_0_scalar zz;
+        rustsecp256k1_v0_9_0_scalar r1;
+        rustsecp256k1_v0_9_0_scalar r2;
+        rustsecp256k1_v0_9_0_scalar zzv;
         int overflow;
         unsigned char chal[33][2][32] = {
             {{0xff, 0xff, 0x03, 0x07, 0x00, 0x00, 0x00, 0x00,
@@ -2754,30 +2926,29 @@ void run_scalar_tests(void) {
               0x1e, 0x86, 0x5d, 0x89, 0x63, 0xe6, 0x0a, 0x46,
               0x5c, 0x02, 0x97, 0x1b, 0x62, 0x43, 0x86, 0xf5}}
         };
-        rustsecp256k1_v0_8_1_scalar_set_int(&one, 1);
         for (i = 0; i < 33; i++) {
-            rustsecp256k1_v0_8_1_scalar_set_b32(&x, chal[i][0], &overflow);
+            rustsecp256k1_v0_9_0_scalar_set_b32(&x, chal[i][0], &overflow);
             CHECK(!overflow);
-            rustsecp256k1_v0_8_1_scalar_set_b32(&y, chal[i][1], &overflow);
+            rustsecp256k1_v0_9_0_scalar_set_b32(&y, chal[i][1], &overflow);
             CHECK(!overflow);
-            rustsecp256k1_v0_8_1_scalar_set_b32(&r1, res[i][0], &overflow);
+            rustsecp256k1_v0_9_0_scalar_set_b32(&r1, res[i][0], &overflow);
             CHECK(!overflow);
-            rustsecp256k1_v0_8_1_scalar_set_b32(&r2, res[i][1], &overflow);
+            rustsecp256k1_v0_9_0_scalar_set_b32(&r2, res[i][1], &overflow);
             CHECK(!overflow);
-            rustsecp256k1_v0_8_1_scalar_mul(&z, &x, &y);
-            CHECK(!rustsecp256k1_v0_8_1_scalar_check_overflow(&z));
-            CHECK(rustsecp256k1_v0_8_1_scalar_eq(&r1, &z));
-            if (!rustsecp256k1_v0_8_1_scalar_is_zero(&y)) {
-                rustsecp256k1_v0_8_1_scalar_inverse(&zz, &y);
-                CHECK(!rustsecp256k1_v0_8_1_scalar_check_overflow(&zz));
-                rustsecp256k1_v0_8_1_scalar_inverse_var(&zzv, &y);
-                CHECK(rustsecp256k1_v0_8_1_scalar_eq(&zzv, &zz));
-                rustsecp256k1_v0_8_1_scalar_mul(&z, &z, &zz);
-                CHECK(!rustsecp256k1_v0_8_1_scalar_check_overflow(&z));
-                CHECK(rustsecp256k1_v0_8_1_scalar_eq(&x, &z));
-                rustsecp256k1_v0_8_1_scalar_mul(&zz, &zz, &y);
-                CHECK(!rustsecp256k1_v0_8_1_scalar_check_overflow(&zz));
-                CHECK(rustsecp256k1_v0_8_1_scalar_eq(&one, &zz));
+            rustsecp256k1_v0_9_0_scalar_mul(&z, &x, &y);
+            CHECK(!rustsecp256k1_v0_9_0_scalar_check_overflow(&z));
+            CHECK(rustsecp256k1_v0_9_0_scalar_eq(&r1, &z));
+            if (!rustsecp256k1_v0_9_0_scalar_is_zero(&y)) {
+                rustsecp256k1_v0_9_0_scalar_inverse(&zz, &y);
+                CHECK(!rustsecp256k1_v0_9_0_scalar_check_overflow(&zz));
+                rustsecp256k1_v0_9_0_scalar_inverse_var(&zzv, &y);
+                CHECK(rustsecp256k1_v0_9_0_scalar_eq(&zzv, &zz));
+                rustsecp256k1_v0_9_0_scalar_mul(&z, &z, &zz);
+                CHECK(!rustsecp256k1_v0_9_0_scalar_check_overflow(&z));
+                CHECK(rustsecp256k1_v0_9_0_scalar_eq(&x, &z));
+                rustsecp256k1_v0_9_0_scalar_mul(&zz, &zz, &y);
+                CHECK(!rustsecp256k1_v0_9_0_scalar_check_overflow(&zz));
+                CHECK(rustsecp256k1_v0_9_0_scalar_eq(&rustsecp256k1_v0_9_0_scalar_one, &zz));
             }
         }
     }
@@ -2785,32 +2956,22 @@ void run_scalar_tests(void) {
 
 /***** FIELD TESTS *****/
 
-void random_fe(rustsecp256k1_v0_8_1_fe *x) {
+static void random_fe(rustsecp256k1_v0_9_0_fe *x) {
     unsigned char bin[32];
     do {
-        rustsecp256k1_v0_8_1_testrand256(bin);
-        if (rustsecp256k1_v0_8_1_fe_set_b32(x, bin)) {
+        rustsecp256k1_v0_9_0_testrand256(bin);
+        if (rustsecp256k1_v0_9_0_fe_set_b32_limit(x, bin)) {
             return;
         }
     } while(1);
 }
 
-void random_fe_test(rustsecp256k1_v0_8_1_fe *x) {
-    unsigned char bin[32];
-    do {
-        rustsecp256k1_v0_8_1_testrand256_test(bin);
-        if (rustsecp256k1_v0_8_1_fe_set_b32(x, bin)) {
-            return;
-        }
-    } while(1);
-}
-
-void random_fe_non_zero(rustsecp256k1_v0_8_1_fe *nz) {
+static void random_fe_non_zero(rustsecp256k1_v0_9_0_fe *nz) {
     int tries = 10;
     while (--tries >= 0) {
         random_fe(nz);
-        rustsecp256k1_v0_8_1_fe_normalize(nz);
-        if (!rustsecp256k1_v0_8_1_fe_is_zero(nz)) {
+        rustsecp256k1_v0_9_0_fe_normalize(nz);
+        if (!rustsecp256k1_v0_9_0_fe_is_zero(nz)) {
             break;
         }
     }
@@ -2818,208 +2979,284 @@ void random_fe_non_zero(rustsecp256k1_v0_8_1_fe *nz) {
     CHECK(tries >= 0);
 }
 
-void random_fe_non_square(rustsecp256k1_v0_8_1_fe *ns) {
-    rustsecp256k1_v0_8_1_fe r;
+static void random_fe_non_square(rustsecp256k1_v0_9_0_fe *ns) {
+    rustsecp256k1_v0_9_0_fe r;
     random_fe_non_zero(ns);
-    if (rustsecp256k1_v0_8_1_fe_sqrt(&r, ns)) {
-        rustsecp256k1_v0_8_1_fe_negate(ns, ns, 1);
+    if (rustsecp256k1_v0_9_0_fe_sqrt(&r, ns)) {
+        rustsecp256k1_v0_9_0_fe_negate(ns, ns, 1);
     }
 }
 
-int check_fe_equal(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *b) {
-    rustsecp256k1_v0_8_1_fe an = *a;
-    rustsecp256k1_v0_8_1_fe bn = *b;
-    rustsecp256k1_v0_8_1_fe_normalize_weak(&an);
-    rustsecp256k1_v0_8_1_fe_normalize_var(&bn);
-    return rustsecp256k1_v0_8_1_fe_equal_var(&an, &bn);
+static int check_fe_equal(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *b) {
+    rustsecp256k1_v0_9_0_fe an = *a;
+    rustsecp256k1_v0_9_0_fe bn = *b;
+    rustsecp256k1_v0_9_0_fe_normalize_weak(&an);
+    return rustsecp256k1_v0_9_0_fe_equal(&an, &bn);
 }
 
-void run_field_convert(void) {
+static void run_field_convert(void) {
     static const unsigned char b32[32] = {
         0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
         0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
         0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29,
         0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x40
     };
-    static const rustsecp256k1_v0_8_1_fe_storage fes = SECP256K1_FE_STORAGE_CONST(
+    static const rustsecp256k1_v0_9_0_fe_storage fes = SECP256K1_FE_STORAGE_CONST(
         0x00010203UL, 0x04050607UL, 0x11121314UL, 0x15161718UL,
         0x22232425UL, 0x26272829UL, 0x33343536UL, 0x37383940UL
     );
-    static const rustsecp256k1_v0_8_1_fe fe = SECP256K1_FE_CONST(
+    static const rustsecp256k1_v0_9_0_fe fe = SECP256K1_FE_CONST(
         0x00010203UL, 0x04050607UL, 0x11121314UL, 0x15161718UL,
         0x22232425UL, 0x26272829UL, 0x33343536UL, 0x37383940UL
     );
-    rustsecp256k1_v0_8_1_fe fe2;
+    rustsecp256k1_v0_9_0_fe fe2;
     unsigned char b322[32];
-    rustsecp256k1_v0_8_1_fe_storage fes2;
+    rustsecp256k1_v0_9_0_fe_storage fes2;
     /* Check conversions to fe. */
-    CHECK(rustsecp256k1_v0_8_1_fe_set_b32(&fe2, b32));
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&fe, &fe2));
-    rustsecp256k1_v0_8_1_fe_from_storage(&fe2, &fes);
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&fe, &fe2));
+    CHECK(rustsecp256k1_v0_9_0_fe_set_b32_limit(&fe2, b32));
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&fe, &fe2));
+    rustsecp256k1_v0_9_0_fe_from_storage(&fe2, &fes);
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&fe, &fe2));
     /* Check conversion from fe. */
-    rustsecp256k1_v0_8_1_fe_get_b32(b322, &fe);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(b322, b32, 32) == 0);
-    rustsecp256k1_v0_8_1_fe_to_storage(&fes2, &fe);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&fes2, &fes, sizeof(fes)) == 0);
+    rustsecp256k1_v0_9_0_fe_get_b32(b322, &fe);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(b322, b32, 32) == 0);
+    rustsecp256k1_v0_9_0_fe_to_storage(&fes2, &fe);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&fes2, &fes, sizeof(fes)) == 0);
+}
+
+static void run_field_be32_overflow(void) {
+    {
+        static const unsigned char zero_overflow[32] = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x2F,
+        };
+        static const unsigned char zero[32] = { 0x00 };
+        unsigned char out[32];
+        rustsecp256k1_v0_9_0_fe fe;
+        CHECK(rustsecp256k1_v0_9_0_fe_set_b32_limit(&fe, zero_overflow) == 0);
+        rustsecp256k1_v0_9_0_fe_set_b32_mod(&fe, zero_overflow);
+        CHECK(rustsecp256k1_v0_9_0_fe_normalizes_to_zero(&fe) == 1);
+        rustsecp256k1_v0_9_0_fe_normalize(&fe);
+        CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&fe) == 1);
+        rustsecp256k1_v0_9_0_fe_get_b32(out, &fe);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, zero, 32) == 0);
+    }
+    {
+        static const unsigned char one_overflow[32] = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x30,
+        };
+        static const unsigned char one[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+        };
+        unsigned char out[32];
+        rustsecp256k1_v0_9_0_fe fe;
+        CHECK(rustsecp256k1_v0_9_0_fe_set_b32_limit(&fe, one_overflow) == 0);
+        rustsecp256k1_v0_9_0_fe_set_b32_mod(&fe, one_overflow);
+        rustsecp256k1_v0_9_0_fe_normalize(&fe);
+        CHECK(rustsecp256k1_v0_9_0_fe_cmp_var(&fe, &rustsecp256k1_v0_9_0_fe_one) == 0);
+        rustsecp256k1_v0_9_0_fe_get_b32(out, &fe);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, one, 32) == 0);
+    }
+    {
+        static const unsigned char ff_overflow[32] = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+        };
+        static const unsigned char ff[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x03, 0xD0,
+        };
+        unsigned char out[32];
+        rustsecp256k1_v0_9_0_fe fe;
+        const rustsecp256k1_v0_9_0_fe fe_ff = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0x01, 0x000003d0);
+        CHECK(rustsecp256k1_v0_9_0_fe_set_b32_limit(&fe, ff_overflow) == 0);
+        rustsecp256k1_v0_9_0_fe_set_b32_mod(&fe, ff_overflow);
+        rustsecp256k1_v0_9_0_fe_normalize(&fe);
+        CHECK(rustsecp256k1_v0_9_0_fe_cmp_var(&fe, &fe_ff) == 0);
+        rustsecp256k1_v0_9_0_fe_get_b32(out, &fe);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(out, ff, 32) == 0);
+    }
 }
 
 /* Returns true if two field elements have the same representation. */
-int fe_identical(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *b) {
+static int fe_identical(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *b) {
     int ret = 1;
-#ifdef VERIFY
-    ret &= (a->magnitude == b->magnitude);
-    ret &= (a->normalized == b->normalized);
-#endif
     /* Compare the struct member that holds the limbs. */
-    ret &= (rustsecp256k1_v0_8_1_memcmp_var(a->n, b->n, sizeof(a->n)) == 0);
+    ret &= (rustsecp256k1_v0_9_0_memcmp_var(a->n, b->n, sizeof(a->n)) == 0);
     return ret;
 }
 
-void run_field_half(void) {
-    rustsecp256k1_v0_8_1_fe t, u;
+static void run_field_half(void) {
+    rustsecp256k1_v0_9_0_fe t, u;
     int m;
 
     /* Check magnitude 0 input */
-    rustsecp256k1_v0_8_1_fe_get_bounds(&t, 0);
-    rustsecp256k1_v0_8_1_fe_half(&t);
+    rustsecp256k1_v0_9_0_fe_get_bounds(&t, 0);
+    rustsecp256k1_v0_9_0_fe_half(&t);
 #ifdef VERIFY
     CHECK(t.magnitude == 1);
     CHECK(t.normalized == 0);
 #endif
-    CHECK(rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&t));
+    CHECK(rustsecp256k1_v0_9_0_fe_normalizes_to_zero(&t));
 
     /* Check non-zero magnitudes in the supported range */
     for (m = 1; m < 32; m++) {
         /* Check max-value input */
-        rustsecp256k1_v0_8_1_fe_get_bounds(&t, m);
+        rustsecp256k1_v0_9_0_fe_get_bounds(&t, m);
 
         u = t;
-        rustsecp256k1_v0_8_1_fe_half(&u);
+        rustsecp256k1_v0_9_0_fe_half(&u);
 #ifdef VERIFY
         CHECK(u.magnitude == (m >> 1) + 1);
         CHECK(u.normalized == 0);
 #endif
-        rustsecp256k1_v0_8_1_fe_normalize_weak(&u);
-        rustsecp256k1_v0_8_1_fe_add(&u, &u);
+        rustsecp256k1_v0_9_0_fe_normalize_weak(&u);
+        rustsecp256k1_v0_9_0_fe_add(&u, &u);
         CHECK(check_fe_equal(&t, &u));
 
         /* Check worst-case input: ensure the LSB is 1 so that P will be added,
          * which will also cause all carries to be 1, since all limbs that can
          * generate a carry are initially even and all limbs of P are odd in
          * every existing field implementation. */
-        rustsecp256k1_v0_8_1_fe_get_bounds(&t, m);
+        rustsecp256k1_v0_9_0_fe_get_bounds(&t, m);
         CHECK(t.n[0] > 0);
         CHECK((t.n[0] & 1) == 0);
         --t.n[0];
 
         u = t;
-        rustsecp256k1_v0_8_1_fe_half(&u);
+        rustsecp256k1_v0_9_0_fe_half(&u);
 #ifdef VERIFY
         CHECK(u.magnitude == (m >> 1) + 1);
         CHECK(u.normalized == 0);
 #endif
-        rustsecp256k1_v0_8_1_fe_normalize_weak(&u);
-        rustsecp256k1_v0_8_1_fe_add(&u, &u);
+        rustsecp256k1_v0_9_0_fe_normalize_weak(&u);
+        rustsecp256k1_v0_9_0_fe_add(&u, &u);
         CHECK(check_fe_equal(&t, &u));
     }
 }
 
-void run_field_misc(void) {
-    rustsecp256k1_v0_8_1_fe x;
-    rustsecp256k1_v0_8_1_fe y;
-    rustsecp256k1_v0_8_1_fe z;
-    rustsecp256k1_v0_8_1_fe q;
-    rustsecp256k1_v0_8_1_fe fe5 = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 5);
+static void run_field_misc(void) {
+    rustsecp256k1_v0_9_0_fe x;
+    rustsecp256k1_v0_9_0_fe y;
+    rustsecp256k1_v0_9_0_fe z;
+    rustsecp256k1_v0_9_0_fe q;
+    int v;
+    rustsecp256k1_v0_9_0_fe fe5 = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 5);
     int i, j;
-    for (i = 0; i < 1000 * count; i++) {
-        rustsecp256k1_v0_8_1_fe_storage xs, ys, zs;
+    for (i = 0; i < 1000 * COUNT; i++) {
+        rustsecp256k1_v0_9_0_fe_storage xs, ys, zs;
         if (i & 1) {
             random_fe(&x);
         } else {
             random_fe_test(&x);
         }
         random_fe_non_zero(&y);
+        v = rustsecp256k1_v0_9_0_testrand_bits(15);
+        /* Test that fe_add_int is equivalent to fe_set_int + fe_add. */
+        rustsecp256k1_v0_9_0_fe_set_int(&q, v); /* q = v */
+        z = x; /* z = x */
+        rustsecp256k1_v0_9_0_fe_add(&z, &q); /* z = x+v */
+        q = x; /* q = x */
+        rustsecp256k1_v0_9_0_fe_add_int(&q, v); /* q = x+v */
+        CHECK(check_fe_equal(&q, &z));
         /* Test the fe equality and comparison operations. */
-        CHECK(rustsecp256k1_v0_8_1_fe_cmp_var(&x, &x) == 0);
-        CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&x, &x));
+        CHECK(rustsecp256k1_v0_9_0_fe_cmp_var(&x, &x) == 0);
+        CHECK(rustsecp256k1_v0_9_0_fe_equal(&x, &x));
         z = x;
-        rustsecp256k1_v0_8_1_fe_add(&z,&y);
+        rustsecp256k1_v0_9_0_fe_add(&z,&y);
         /* Test fe conditional move; z is not normalized here. */
         q = x;
-        rustsecp256k1_v0_8_1_fe_cmov(&x, &z, 0);
+        rustsecp256k1_v0_9_0_fe_cmov(&x, &z, 0);
 #ifdef VERIFY
-        CHECK(x.normalized && x.magnitude == 1);
+        CHECK(!x.normalized);
+        CHECK((x.magnitude == q.magnitude) || (x.magnitude == z.magnitude));
+        CHECK((x.magnitude >= q.magnitude) && (x.magnitude >= z.magnitude));
 #endif
-        rustsecp256k1_v0_8_1_fe_cmov(&x, &x, 1);
+        x = q;
+        rustsecp256k1_v0_9_0_fe_cmov(&x, &x, 1);
         CHECK(!fe_identical(&x, &z));
         CHECK(fe_identical(&x, &q));
-        rustsecp256k1_v0_8_1_fe_cmov(&q, &z, 1);
+        rustsecp256k1_v0_9_0_fe_cmov(&q, &z, 1);
 #ifdef VERIFY
-        CHECK(!q.normalized && q.magnitude == z.magnitude);
+        CHECK(!q.normalized);
+        CHECK((q.magnitude == x.magnitude) || (q.magnitude == z.magnitude));
+        CHECK((q.magnitude >= x.magnitude) && (q.magnitude >= z.magnitude));
 #endif
         CHECK(fe_identical(&q, &z));
-        rustsecp256k1_v0_8_1_fe_normalize_var(&x);
-        rustsecp256k1_v0_8_1_fe_normalize_var(&z);
-        CHECK(!rustsecp256k1_v0_8_1_fe_equal_var(&x, &z));
-        rustsecp256k1_v0_8_1_fe_normalize_var(&q);
-        rustsecp256k1_v0_8_1_fe_cmov(&q, &z, (i&1));
+        q = z;
+        rustsecp256k1_v0_9_0_fe_normalize_var(&x);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&z);
+        CHECK(!rustsecp256k1_v0_9_0_fe_equal(&x, &z));
+        rustsecp256k1_v0_9_0_fe_normalize_var(&q);
+        rustsecp256k1_v0_9_0_fe_cmov(&q, &z, (i&1));
 #ifdef VERIFY
         CHECK(q.normalized && q.magnitude == 1);
 #endif
         for (j = 0; j < 6; j++) {
-            rustsecp256k1_v0_8_1_fe_negate(&z, &z, j+1);
-            rustsecp256k1_v0_8_1_fe_normalize_var(&q);
-            rustsecp256k1_v0_8_1_fe_cmov(&q, &z, (j&1));
+            rustsecp256k1_v0_9_0_fe_negate_unchecked(&z, &z, j+1);
+            rustsecp256k1_v0_9_0_fe_normalize_var(&q);
+            rustsecp256k1_v0_9_0_fe_cmov(&q, &z, (j&1));
 #ifdef VERIFY
-            CHECK((q.normalized != (j&1)) && q.magnitude == ((j&1) ? z.magnitude : 1));
+            CHECK(!q.normalized && q.magnitude == z.magnitude);
 #endif
         }
-        rustsecp256k1_v0_8_1_fe_normalize_var(&z);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&z);
         /* Test storage conversion and conditional moves. */
-        rustsecp256k1_v0_8_1_fe_to_storage(&xs, &x);
-        rustsecp256k1_v0_8_1_fe_to_storage(&ys, &y);
-        rustsecp256k1_v0_8_1_fe_to_storage(&zs, &z);
-        rustsecp256k1_v0_8_1_fe_storage_cmov(&zs, &xs, 0);
-        rustsecp256k1_v0_8_1_fe_storage_cmov(&zs, &zs, 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&xs, &zs, sizeof(xs)) != 0);
-        rustsecp256k1_v0_8_1_fe_storage_cmov(&ys, &xs, 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&xs, &ys, sizeof(xs)) == 0);
-        rustsecp256k1_v0_8_1_fe_from_storage(&x, &xs);
-        rustsecp256k1_v0_8_1_fe_from_storage(&y, &ys);
-        rustsecp256k1_v0_8_1_fe_from_storage(&z, &zs);
+        rustsecp256k1_v0_9_0_fe_to_storage(&xs, &x);
+        rustsecp256k1_v0_9_0_fe_to_storage(&ys, &y);
+        rustsecp256k1_v0_9_0_fe_to_storage(&zs, &z);
+        rustsecp256k1_v0_9_0_fe_storage_cmov(&zs, &xs, 0);
+        rustsecp256k1_v0_9_0_fe_storage_cmov(&zs, &zs, 1);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&xs, &zs, sizeof(xs)) != 0);
+        rustsecp256k1_v0_9_0_fe_storage_cmov(&ys, &xs, 1);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&xs, &ys, sizeof(xs)) == 0);
+        rustsecp256k1_v0_9_0_fe_from_storage(&x, &xs);
+        rustsecp256k1_v0_9_0_fe_from_storage(&y, &ys);
+        rustsecp256k1_v0_9_0_fe_from_storage(&z, &zs);
         /* Test that mul_int, mul, and add agree. */
-        rustsecp256k1_v0_8_1_fe_add(&y, &x);
-        rustsecp256k1_v0_8_1_fe_add(&y, &x);
+        rustsecp256k1_v0_9_0_fe_add(&y, &x);
+        rustsecp256k1_v0_9_0_fe_add(&y, &x);
         z = x;
-        rustsecp256k1_v0_8_1_fe_mul_int(&z, 3);
+        rustsecp256k1_v0_9_0_fe_mul_int(&z, 3);
         CHECK(check_fe_equal(&y, &z));
-        rustsecp256k1_v0_8_1_fe_add(&y, &x);
-        rustsecp256k1_v0_8_1_fe_add(&z, &x);
+        rustsecp256k1_v0_9_0_fe_add(&y, &x);
+        rustsecp256k1_v0_9_0_fe_add(&z, &x);
         CHECK(check_fe_equal(&z, &y));
         z = x;
-        rustsecp256k1_v0_8_1_fe_mul_int(&z, 5);
-        rustsecp256k1_v0_8_1_fe_mul(&q, &x, &fe5);
+        rustsecp256k1_v0_9_0_fe_mul_int(&z, 5);
+        rustsecp256k1_v0_9_0_fe_mul(&q, &x, &fe5);
         CHECK(check_fe_equal(&z, &q));
-        rustsecp256k1_v0_8_1_fe_negate(&x, &x, 1);
-        rustsecp256k1_v0_8_1_fe_add(&z, &x);
-        rustsecp256k1_v0_8_1_fe_add(&q, &x);
+        rustsecp256k1_v0_9_0_fe_negate(&x, &x, 1);
+        rustsecp256k1_v0_9_0_fe_add(&z, &x);
+        rustsecp256k1_v0_9_0_fe_add(&q, &x);
         CHECK(check_fe_equal(&y, &z));
         CHECK(check_fe_equal(&q, &y));
-        /* Check rustsecp256k1_v0_8_1_fe_half. */
+        /* Check rustsecp256k1_v0_9_0_fe_half. */
         z = x;
-        rustsecp256k1_v0_8_1_fe_half(&z);
-        rustsecp256k1_v0_8_1_fe_add(&z, &z);
+        rustsecp256k1_v0_9_0_fe_half(&z);
+        rustsecp256k1_v0_9_0_fe_add(&z, &z);
         CHECK(check_fe_equal(&x, &z));
-        rustsecp256k1_v0_8_1_fe_add(&z, &z);
-        rustsecp256k1_v0_8_1_fe_half(&z);
+        rustsecp256k1_v0_9_0_fe_add(&z, &z);
+        rustsecp256k1_v0_9_0_fe_half(&z);
         CHECK(check_fe_equal(&x, &z));
     }
 }
 
-void test_fe_mul(const rustsecp256k1_v0_8_1_fe* a, const rustsecp256k1_v0_8_1_fe* b, int use_sqr)
+static void test_fe_mul(const rustsecp256k1_v0_9_0_fe* a, const rustsecp256k1_v0_9_0_fe* b, int use_sqr)
 {
-    rustsecp256k1_v0_8_1_fe c, an, bn;
+    rustsecp256k1_v0_9_0_fe c, an, bn;
     /* Variables in BE 32-byte format. */
     unsigned char a32[32], b32[32], c32[32];
     /* Variables in LE 16x uint16_t format. */
@@ -3035,20 +3272,20 @@ void test_fe_mul(const rustsecp256k1_v0_8_1_fe* a, const rustsecp256k1_v0_8_1_fe
     /* Compute C = A * B in fe format. */
     c = *a;
     if (use_sqr) {
-        rustsecp256k1_v0_8_1_fe_sqr(&c, &c);
+        rustsecp256k1_v0_9_0_fe_sqr(&c, &c);
     } else {
-        rustsecp256k1_v0_8_1_fe_mul(&c, &c, b);
+        rustsecp256k1_v0_9_0_fe_mul(&c, &c, b);
     }
 
     /* Convert A, B, C into LE 16x uint16_t format. */
     an = *a;
     bn = *b;
-    rustsecp256k1_v0_8_1_fe_normalize_var(&c);
-    rustsecp256k1_v0_8_1_fe_normalize_var(&an);
-    rustsecp256k1_v0_8_1_fe_normalize_var(&bn);
-    rustsecp256k1_v0_8_1_fe_get_b32(a32, &an);
-    rustsecp256k1_v0_8_1_fe_get_b32(b32, &bn);
-    rustsecp256k1_v0_8_1_fe_get_b32(c32, &c);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&c);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&an);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&bn);
+    rustsecp256k1_v0_9_0_fe_get_b32(a32, &an);
+    rustsecp256k1_v0_9_0_fe_get_b32(b32, &bn);
+    rustsecp256k1_v0_9_0_fe_get_b32(c32, &c);
     for (i = 0; i < 16; ++i) {
         a16[i] = a32[31 - 2*i] + ((uint16_t)a32[30 - 2*i] << 8);
         b16[i] = b32[31 - 2*i] + ((uint16_t)b32[30 - 2*i] << 8);
@@ -3057,21 +3294,21 @@ void test_fe_mul(const rustsecp256k1_v0_8_1_fe* a, const rustsecp256k1_v0_8_1_fe
     /* Compute T = A * B in LE 16x uint16_t format. */
     mulmod256(t16, a16, b16, m16);
     /* Compare */
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(t16, c16, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(t16, c16, 32) == 0);
 }
 
-void run_fe_mul(void) {
+static void run_fe_mul(void) {
     int i;
-    for (i = 0; i < 100 * count; ++i) {
-        rustsecp256k1_v0_8_1_fe a, b, c, d;
+    for (i = 0; i < 100 * COUNT; ++i) {
+        rustsecp256k1_v0_9_0_fe a, b, c, d;
         random_fe(&a);
-        random_field_element_magnitude(&a);
+        random_fe_magnitude(&a);
         random_fe(&b);
-        random_field_element_magnitude(&b);
+        random_fe_magnitude(&b);
         random_fe_test(&c);
-        random_field_element_magnitude(&c);
+        random_fe_magnitude(&c);
         random_fe_test(&d);
-        random_field_element_magnitude(&d);
+        random_fe_magnitude(&d);
         test_fe_mul(&a, &a, 1);
         test_fe_mul(&c, &c, 1);
         test_fe_mul(&a, &b, 0);
@@ -3081,51 +3318,51 @@ void run_fe_mul(void) {
     }
 }
 
-void run_sqr(void) {
-    rustsecp256k1_v0_8_1_fe x, s;
+static void run_sqr(void) {
+    rustsecp256k1_v0_9_0_fe x, s;
 
     {
         int i;
-        rustsecp256k1_v0_8_1_fe_set_int(&x, 1);
-        rustsecp256k1_v0_8_1_fe_negate(&x, &x, 1);
+        rustsecp256k1_v0_9_0_fe_set_int(&x, 1);
+        rustsecp256k1_v0_9_0_fe_negate(&x, &x, 1);
 
         for (i = 1; i <= 512; ++i) {
-            rustsecp256k1_v0_8_1_fe_mul_int(&x, 2);
-            rustsecp256k1_v0_8_1_fe_normalize(&x);
-            rustsecp256k1_v0_8_1_fe_sqr(&s, &x);
+            rustsecp256k1_v0_9_0_fe_mul_int(&x, 2);
+            rustsecp256k1_v0_9_0_fe_normalize(&x);
+            rustsecp256k1_v0_9_0_fe_sqr(&s, &x);
         }
     }
 }
 
-void test_sqrt(const rustsecp256k1_v0_8_1_fe *a, const rustsecp256k1_v0_8_1_fe *k) {
-    rustsecp256k1_v0_8_1_fe r1, r2;
-    int v = rustsecp256k1_v0_8_1_fe_sqrt(&r1, a);
+static void test_sqrt(const rustsecp256k1_v0_9_0_fe *a, const rustsecp256k1_v0_9_0_fe *k) {
+    rustsecp256k1_v0_9_0_fe r1, r2;
+    int v = rustsecp256k1_v0_9_0_fe_sqrt(&r1, a);
     CHECK((v == 0) == (k == NULL));
 
     if (k != NULL) {
         /* Check that the returned root is +/- the given known answer */
-        rustsecp256k1_v0_8_1_fe_negate(&r2, &r1, 1);
-        rustsecp256k1_v0_8_1_fe_add(&r1, k); rustsecp256k1_v0_8_1_fe_add(&r2, k);
-        rustsecp256k1_v0_8_1_fe_normalize(&r1); rustsecp256k1_v0_8_1_fe_normalize(&r2);
-        CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&r1) || rustsecp256k1_v0_8_1_fe_is_zero(&r2));
+        rustsecp256k1_v0_9_0_fe_negate(&r2, &r1, 1);
+        rustsecp256k1_v0_9_0_fe_add(&r1, k); rustsecp256k1_v0_9_0_fe_add(&r2, k);
+        rustsecp256k1_v0_9_0_fe_normalize(&r1); rustsecp256k1_v0_9_0_fe_normalize(&r2);
+        CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&r1) || rustsecp256k1_v0_9_0_fe_is_zero(&r2));
     }
 }
 
-void run_sqrt(void) {
-    rustsecp256k1_v0_8_1_fe ns, x, s, t;
+static void run_sqrt(void) {
+    rustsecp256k1_v0_9_0_fe ns, x, s, t;
     int i;
 
     /* Check sqrt(0) is 0 */
-    rustsecp256k1_v0_8_1_fe_set_int(&x, 0);
-    rustsecp256k1_v0_8_1_fe_sqr(&s, &x);
+    rustsecp256k1_v0_9_0_fe_set_int(&x, 0);
+    rustsecp256k1_v0_9_0_fe_sqr(&s, &x);
     test_sqrt(&s, &x);
 
     /* Check sqrt of small squares (and their negatives) */
     for (i = 1; i <= 100; i++) {
-        rustsecp256k1_v0_8_1_fe_set_int(&x, i);
-        rustsecp256k1_v0_8_1_fe_sqr(&s, &x);
+        rustsecp256k1_v0_9_0_fe_set_int(&x, i);
+        rustsecp256k1_v0_9_0_fe_sqr(&s, &x);
         test_sqrt(&s, &x);
-        rustsecp256k1_v0_8_1_fe_negate(&t, &s, 1);
+        rustsecp256k1_v0_9_0_fe_negate(&t, &s, 1);
         test_sqrt(&t, NULL);
     }
 
@@ -3133,13 +3370,15 @@ void run_sqrt(void) {
     for (i = 0; i < 10; i++) {
         int j;
         random_fe_non_square(&ns);
-        for (j = 0; j < count; j++) {
+        for (j = 0; j < COUNT; j++) {
             random_fe(&x);
-            rustsecp256k1_v0_8_1_fe_sqr(&s, &x);
+            rustsecp256k1_v0_9_0_fe_sqr(&s, &x);
+            CHECK(rustsecp256k1_v0_9_0_fe_is_square_var(&s));
             test_sqrt(&s, &x);
-            rustsecp256k1_v0_8_1_fe_negate(&t, &s, 1);
+            rustsecp256k1_v0_9_0_fe_negate(&t, &s, 1);
+            CHECK(!rustsecp256k1_v0_9_0_fe_is_square_var(&t));
             test_sqrt(&t, NULL);
-            rustsecp256k1_v0_8_1_fe_mul(&t, &s, &ns);
+            rustsecp256k1_v0_9_0_fe_mul(&t, &s, &ns);
             test_sqrt(&t, NULL);
         }
     }
@@ -3147,12 +3386,12 @@ void run_sqrt(void) {
 
 /***** FIELD/SCALAR INVERSE TESTS *****/
 
-static const rustsecp256k1_v0_8_1_scalar scalar_minus_one = SECP256K1_SCALAR_CONST(
+static const rustsecp256k1_v0_9_0_scalar scalar_minus_one = SECP256K1_SCALAR_CONST(
     0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE,
     0xBAAEDCE6, 0xAF48A03B, 0xBFD25E8C, 0xD0364140
 );
 
-static const rustsecp256k1_v0_8_1_fe fe_minus_one = SECP256K1_FE_CONST(
+static const rustsecp256k1_v0_9_0_fe fe_minus_one = SECP256K1_FE_CONST(
     0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
     0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0xFFFFFC2E
 );
@@ -3164,57 +3403,57 @@ static const rustsecp256k1_v0_8_1_fe fe_minus_one = SECP256K1_FE_CONST(
  * for x!=0 and x!=1: 1/(1/x - 1) + 1 == -1/(x-1)
  */
 
-void test_inverse_scalar(rustsecp256k1_v0_8_1_scalar* out, const rustsecp256k1_v0_8_1_scalar* x, int var)
+static void test_inverse_scalar(rustsecp256k1_v0_9_0_scalar* out, const rustsecp256k1_v0_9_0_scalar* x, int var)
 {
-    rustsecp256k1_v0_8_1_scalar l, r, t;
+    rustsecp256k1_v0_9_0_scalar l, r, t;
 
-    (var ? rustsecp256k1_v0_8_1_scalar_inverse_var : rustsecp256k1_v0_8_1_scalar_inverse)(&l, x);  /* l = 1/x */
+    (var ? rustsecp256k1_v0_9_0_scalar_inverse_var : rustsecp256k1_v0_9_0_scalar_inverse)(&l, x);  /* l = 1/x */
     if (out) *out = l;
-    if (rustsecp256k1_v0_8_1_scalar_is_zero(x)) {
-        CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(&l));
+    if (rustsecp256k1_v0_9_0_scalar_is_zero(x)) {
+        CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(&l));
         return;
     }
-    rustsecp256k1_v0_8_1_scalar_mul(&t, x, &l);                                             /* t = x*(1/x) */
-    CHECK(rustsecp256k1_v0_8_1_scalar_is_one(&t));                                          /* x*(1/x) == 1 */
-    rustsecp256k1_v0_8_1_scalar_add(&r, x, &scalar_minus_one);                              /* r = x-1 */
-    if (rustsecp256k1_v0_8_1_scalar_is_zero(&r)) return;
-    (var ? rustsecp256k1_v0_8_1_scalar_inverse_var : rustsecp256k1_v0_8_1_scalar_inverse)(&r, &r); /* r = 1/(x-1) */
-    rustsecp256k1_v0_8_1_scalar_add(&l, &scalar_minus_one, &l);                             /* l = 1/x-1 */
-    (var ? rustsecp256k1_v0_8_1_scalar_inverse_var : rustsecp256k1_v0_8_1_scalar_inverse)(&l, &l); /* l = 1/(1/x-1) */
-    rustsecp256k1_v0_8_1_scalar_add(&l, &l, &rustsecp256k1_v0_8_1_scalar_one);                         /* l = 1/(1/x-1)+1 */
-    rustsecp256k1_v0_8_1_scalar_add(&l, &r, &l);                                            /* l = 1/(1/x-1)+1 + 1/(x-1) */
-    CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(&l));                                         /* l == 0 */
+    rustsecp256k1_v0_9_0_scalar_mul(&t, x, &l);                                             /* t = x*(1/x) */
+    CHECK(rustsecp256k1_v0_9_0_scalar_is_one(&t));                                          /* x*(1/x) == 1 */
+    rustsecp256k1_v0_9_0_scalar_add(&r, x, &scalar_minus_one);                              /* r = x-1 */
+    if (rustsecp256k1_v0_9_0_scalar_is_zero(&r)) return;
+    (var ? rustsecp256k1_v0_9_0_scalar_inverse_var : rustsecp256k1_v0_9_0_scalar_inverse)(&r, &r); /* r = 1/(x-1) */
+    rustsecp256k1_v0_9_0_scalar_add(&l, &scalar_minus_one, &l);                             /* l = 1/x-1 */
+    (var ? rustsecp256k1_v0_9_0_scalar_inverse_var : rustsecp256k1_v0_9_0_scalar_inverse)(&l, &l); /* l = 1/(1/x-1) */
+    rustsecp256k1_v0_9_0_scalar_add(&l, &l, &rustsecp256k1_v0_9_0_scalar_one);                         /* l = 1/(1/x-1)+1 */
+    rustsecp256k1_v0_9_0_scalar_add(&l, &r, &l);                                            /* l = 1/(1/x-1)+1 + 1/(x-1) */
+    CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(&l));                                         /* l == 0 */
 }
 
-void test_inverse_field(rustsecp256k1_v0_8_1_fe* out, const rustsecp256k1_v0_8_1_fe* x, int var)
+static void test_inverse_field(rustsecp256k1_v0_9_0_fe* out, const rustsecp256k1_v0_9_0_fe* x, int var)
 {
-    rustsecp256k1_v0_8_1_fe l, r, t;
+    rustsecp256k1_v0_9_0_fe l, r, t;
 
-    (var ? rustsecp256k1_v0_8_1_fe_inv_var : rustsecp256k1_v0_8_1_fe_inv)(&l, x) ;   /* l = 1/x */
+    (var ? rustsecp256k1_v0_9_0_fe_inv_var : rustsecp256k1_v0_9_0_fe_inv)(&l, x) ;   /* l = 1/x */
     if (out) *out = l;
     t = *x;                                                    /* t = x */
-    if (rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&t)) {
-        CHECK(rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&l));
+    if (rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&t)) {
+        CHECK(rustsecp256k1_v0_9_0_fe_normalizes_to_zero(&l));
         return;
     }
-    rustsecp256k1_v0_8_1_fe_mul(&t, x, &l);                               /* t = x*(1/x) */
-    rustsecp256k1_v0_8_1_fe_add(&t, &fe_minus_one);                       /* t = x*(1/x)-1 */
-    CHECK(rustsecp256k1_v0_8_1_fe_normalizes_to_zero(&t));                /* x*(1/x)-1 == 0 */
+    rustsecp256k1_v0_9_0_fe_mul(&t, x, &l);                               /* t = x*(1/x) */
+    rustsecp256k1_v0_9_0_fe_add(&t, &fe_minus_one);                       /* t = x*(1/x)-1 */
+    CHECK(rustsecp256k1_v0_9_0_fe_normalizes_to_zero(&t));                /* x*(1/x)-1 == 0 */
     r = *x;                                                    /* r = x */
-    rustsecp256k1_v0_8_1_fe_add(&r, &fe_minus_one);                       /* r = x-1 */
-    if (rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&r)) return;
-    (var ? rustsecp256k1_v0_8_1_fe_inv_var : rustsecp256k1_v0_8_1_fe_inv)(&r, &r);   /* r = 1/(x-1) */
-    rustsecp256k1_v0_8_1_fe_add(&l, &fe_minus_one);                       /* l = 1/x-1 */
-    (var ? rustsecp256k1_v0_8_1_fe_inv_var : rustsecp256k1_v0_8_1_fe_inv)(&l, &l);   /* l = 1/(1/x-1) */
-    rustsecp256k1_v0_8_1_fe_add(&l, &rustsecp256k1_v0_8_1_fe_one);                   /* l = 1/(1/x-1)+1 */
-    rustsecp256k1_v0_8_1_fe_add(&l, &r);                                  /* l = 1/(1/x-1)+1 + 1/(x-1) */
-    CHECK(rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&l));            /* l == 0 */
+    rustsecp256k1_v0_9_0_fe_add(&r, &fe_minus_one);                       /* r = x-1 */
+    if (rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&r)) return;
+    (var ? rustsecp256k1_v0_9_0_fe_inv_var : rustsecp256k1_v0_9_0_fe_inv)(&r, &r);   /* r = 1/(x-1) */
+    rustsecp256k1_v0_9_0_fe_add(&l, &fe_minus_one);                       /* l = 1/x-1 */
+    (var ? rustsecp256k1_v0_9_0_fe_inv_var : rustsecp256k1_v0_9_0_fe_inv)(&l, &l);   /* l = 1/(1/x-1) */
+    rustsecp256k1_v0_9_0_fe_add_int(&l, 1);                               /* l = 1/(1/x-1)+1 */
+    rustsecp256k1_v0_9_0_fe_add(&l, &r);                                  /* l = 1/(1/x-1)+1 + 1/(x-1) */
+    CHECK(rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&l));            /* l == 0 */
 }
 
-void run_inverse_tests(void)
+static void run_inverse_tests(void)
 {
     /* Fixed test cases for field inverses: pairs of (x, 1/x) mod p. */
-    static const rustsecp256k1_v0_8_1_fe fe_cases[][2] = {
+    static const rustsecp256k1_v0_9_0_fe fe_cases[][2] = {
         /* 0 */
         {SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0),
          SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0)},
@@ -3319,7 +3558,7 @@ void run_inverse_tests(void)
          SECP256K1_FE_CONST(0x9a94b9b5, 0x57eb71ee, 0x4c975b8b, 0xac5262a8, 0x077b0595, 0xe12a6b1f, 0xd728edef, 0x1a6bf956)}
     };
     /* Fixed test cases for scalar inverses: pairs of (x, 1/x) mod n. */
-    static const rustsecp256k1_v0_8_1_scalar scalar_cases[][2] = {
+    static const rustsecp256k1_v0_9_0_scalar scalar_cases[][2] = {
         /* 0 */
         {SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0),
          SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0)},
@@ -3406,8 +3645,8 @@ void run_inverse_tests(void)
     };
     int i, var, testrand;
     unsigned char b32[32];
-    rustsecp256k1_v0_8_1_fe x_fe;
-    rustsecp256k1_v0_8_1_scalar x_scalar;
+    rustsecp256k1_v0_9_0_fe x_fe;
+    rustsecp256k1_v0_9_0_scalar x_scalar;
     memset(b32, 0, sizeof(b32));
     /* Test fixed test cases through test_inverse_{scalar,field}, both ways. */
     for (i = 0; (size_t)i < sizeof(fe_cases)/sizeof(fe_cases[0]); ++i) {
@@ -3421,23 +3660,23 @@ void run_inverse_tests(void)
     for (i = 0; (size_t)i < sizeof(scalar_cases)/sizeof(scalar_cases[0]); ++i) {
         for (var = 0; var <= 1; ++var) {
             test_inverse_scalar(&x_scalar, &scalar_cases[i][0], var);
-            CHECK(rustsecp256k1_v0_8_1_scalar_eq(&x_scalar, &scalar_cases[i][1]));
+            CHECK(rustsecp256k1_v0_9_0_scalar_eq(&x_scalar, &scalar_cases[i][1]));
             test_inverse_scalar(&x_scalar, &scalar_cases[i][1], var);
-            CHECK(rustsecp256k1_v0_8_1_scalar_eq(&x_scalar, &scalar_cases[i][0]));
+            CHECK(rustsecp256k1_v0_9_0_scalar_eq(&x_scalar, &scalar_cases[i][0]));
         }
     }
     /* Test inputs 0..999 and their respective negations. */
     for (i = 0; i < 1000; ++i) {
         b32[31] = i & 0xff;
         b32[30] = (i >> 8) & 0xff;
-        rustsecp256k1_v0_8_1_scalar_set_b32(&x_scalar, b32, NULL);
-        rustsecp256k1_v0_8_1_fe_set_b32(&x_fe, b32);
+        rustsecp256k1_v0_9_0_scalar_set_b32(&x_scalar, b32, NULL);
+        rustsecp256k1_v0_9_0_fe_set_b32_mod(&x_fe, b32);
         for (var = 0; var <= 1; ++var) {
             test_inverse_scalar(NULL, &x_scalar, var);
             test_inverse_field(NULL, &x_fe, var);
         }
-        rustsecp256k1_v0_8_1_scalar_negate(&x_scalar, &x_scalar);
-        rustsecp256k1_v0_8_1_fe_negate(&x_fe, &x_fe, 1);
+        rustsecp256k1_v0_9_0_scalar_negate(&x_scalar, &x_scalar);
+        rustsecp256k1_v0_9_0_fe_negate(&x_fe, &x_fe, 1);
         for (var = 0; var <= 1; ++var) {
             test_inverse_scalar(NULL, &x_scalar, var);
             test_inverse_field(NULL, &x_fe, var);
@@ -3445,10 +3684,10 @@ void run_inverse_tests(void)
     }
     /* test 128*count random inputs; half with testrand256_test, half with testrand256 */
     for (testrand = 0; testrand <= 1; ++testrand) {
-        for (i = 0; i < 64 * count; ++i) {
-            (testrand ? rustsecp256k1_v0_8_1_testrand256_test : rustsecp256k1_v0_8_1_testrand256)(b32);
-            rustsecp256k1_v0_8_1_scalar_set_b32(&x_scalar, b32, NULL);
-            rustsecp256k1_v0_8_1_fe_set_b32(&x_fe, b32);
+        for (i = 0; i < 64 * COUNT; ++i) {
+            (testrand ? rustsecp256k1_v0_9_0_testrand256_test : rustsecp256k1_v0_9_0_testrand256)(b32);
+            rustsecp256k1_v0_9_0_scalar_set_b32(&x_scalar, b32, NULL);
+            rustsecp256k1_v0_9_0_fe_set_b32_mod(&x_fe, b32);
             for (var = 0; var <= 1; ++var) {
                 test_inverse_scalar(NULL, &x_scalar, var);
                 test_inverse_field(NULL, &x_fe, var);
@@ -3459,55 +3698,55 @@ void run_inverse_tests(void)
 
 /***** GROUP TESTS *****/
 
-void ge_equals_ge(const rustsecp256k1_v0_8_1_ge *a, const rustsecp256k1_v0_8_1_ge *b) {
+static void ge_equals_ge(const rustsecp256k1_v0_9_0_ge *a, const rustsecp256k1_v0_9_0_ge *b) {
     CHECK(a->infinity == b->infinity);
     if (a->infinity) {
         return;
     }
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&a->x, &b->x));
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&a->y, &b->y));
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&a->x, &b->x));
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&a->y, &b->y));
 }
 
 /* This compares jacobian points including their Z, not just their geometric meaning. */
-int gej_xyz_equals_gej(const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_gej *b) {
-    rustsecp256k1_v0_8_1_gej a2;
-    rustsecp256k1_v0_8_1_gej b2;
+static int gej_xyz_equals_gej(const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_gej *b) {
+    rustsecp256k1_v0_9_0_gej a2;
+    rustsecp256k1_v0_9_0_gej b2;
     int ret = 1;
     ret &= a->infinity == b->infinity;
     if (ret && !a->infinity) {
         a2 = *a;
         b2 = *b;
-        rustsecp256k1_v0_8_1_fe_normalize(&a2.x);
-        rustsecp256k1_v0_8_1_fe_normalize(&a2.y);
-        rustsecp256k1_v0_8_1_fe_normalize(&a2.z);
-        rustsecp256k1_v0_8_1_fe_normalize(&b2.x);
-        rustsecp256k1_v0_8_1_fe_normalize(&b2.y);
-        rustsecp256k1_v0_8_1_fe_normalize(&b2.z);
-        ret &= rustsecp256k1_v0_8_1_fe_cmp_var(&a2.x, &b2.x) == 0;
-        ret &= rustsecp256k1_v0_8_1_fe_cmp_var(&a2.y, &b2.y) == 0;
-        ret &= rustsecp256k1_v0_8_1_fe_cmp_var(&a2.z, &b2.z) == 0;
+        rustsecp256k1_v0_9_0_fe_normalize(&a2.x);
+        rustsecp256k1_v0_9_0_fe_normalize(&a2.y);
+        rustsecp256k1_v0_9_0_fe_normalize(&a2.z);
+        rustsecp256k1_v0_9_0_fe_normalize(&b2.x);
+        rustsecp256k1_v0_9_0_fe_normalize(&b2.y);
+        rustsecp256k1_v0_9_0_fe_normalize(&b2.z);
+        ret &= rustsecp256k1_v0_9_0_fe_cmp_var(&a2.x, &b2.x) == 0;
+        ret &= rustsecp256k1_v0_9_0_fe_cmp_var(&a2.y, &b2.y) == 0;
+        ret &= rustsecp256k1_v0_9_0_fe_cmp_var(&a2.z, &b2.z) == 0;
     }
     return ret;
 }
 
-void ge_equals_gej(const rustsecp256k1_v0_8_1_ge *a, const rustsecp256k1_v0_8_1_gej *b) {
-    rustsecp256k1_v0_8_1_fe z2s;
-    rustsecp256k1_v0_8_1_fe u1, u2, s1, s2;
+static void ge_equals_gej(const rustsecp256k1_v0_9_0_ge *a, const rustsecp256k1_v0_9_0_gej *b) {
+    rustsecp256k1_v0_9_0_fe z2s;
+    rustsecp256k1_v0_9_0_fe u1, u2, s1, s2;
     CHECK(a->infinity == b->infinity);
     if (a->infinity) {
         return;
     }
     /* Check a.x * b.z^2 == b.x && a.y * b.z^3 == b.y, to avoid inverses. */
-    rustsecp256k1_v0_8_1_fe_sqr(&z2s, &b->z);
-    rustsecp256k1_v0_8_1_fe_mul(&u1, &a->x, &z2s);
-    u2 = b->x; rustsecp256k1_v0_8_1_fe_normalize_weak(&u2);
-    rustsecp256k1_v0_8_1_fe_mul(&s1, &a->y, &z2s); rustsecp256k1_v0_8_1_fe_mul(&s1, &s1, &b->z);
-    s2 = b->y; rustsecp256k1_v0_8_1_fe_normalize_weak(&s2);
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&u1, &u2));
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&s1, &s2));
+    rustsecp256k1_v0_9_0_fe_sqr(&z2s, &b->z);
+    rustsecp256k1_v0_9_0_fe_mul(&u1, &a->x, &z2s);
+    u2 = b->x;
+    rustsecp256k1_v0_9_0_fe_mul(&s1, &a->y, &z2s); rustsecp256k1_v0_9_0_fe_mul(&s1, &s1, &b->z);
+    s2 = b->y;
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&u1, &u2));
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&s1, &s2));
 }
 
-void test_ge(void) {
+static void test_ge(void) {
     int i, i1;
     int runs = 6;
     /* 25 points are used:
@@ -3516,122 +3755,123 @@ void test_ge(void) {
      *   negation, and then those two again but with randomized Z coordinate.
      * - The same is then done for lambda*p1 and lambda^2*p1.
      */
-    rustsecp256k1_v0_8_1_ge *ge = (rustsecp256k1_v0_8_1_ge *)checked_malloc(&ctx->error_callback, sizeof(rustsecp256k1_v0_8_1_ge) * (1 + 4 * runs));
-    rustsecp256k1_v0_8_1_gej *gej = (rustsecp256k1_v0_8_1_gej *)checked_malloc(&ctx->error_callback, sizeof(rustsecp256k1_v0_8_1_gej) * (1 + 4 * runs));
-    rustsecp256k1_v0_8_1_fe zf;
-    rustsecp256k1_v0_8_1_fe zfi2, zfi3;
-
-    rustsecp256k1_v0_8_1_gej_set_infinity(&gej[0]);
-    rustsecp256k1_v0_8_1_ge_clear(&ge[0]);
-    rustsecp256k1_v0_8_1_ge_set_gej_var(&ge[0], &gej[0]);
+    rustsecp256k1_v0_9_0_ge *ge = (rustsecp256k1_v0_9_0_ge *)checked_malloc(&CTX->error_callback, sizeof(rustsecp256k1_v0_9_0_ge) * (1 + 4 * runs));
+    rustsecp256k1_v0_9_0_gej *gej = (rustsecp256k1_v0_9_0_gej *)checked_malloc(&CTX->error_callback, sizeof(rustsecp256k1_v0_9_0_gej) * (1 + 4 * runs));
+    rustsecp256k1_v0_9_0_fe zf, r;
+    rustsecp256k1_v0_9_0_fe zfi2, zfi3;
+
+    rustsecp256k1_v0_9_0_gej_set_infinity(&gej[0]);
+    rustsecp256k1_v0_9_0_ge_clear(&ge[0]);
+    rustsecp256k1_v0_9_0_ge_set_gej_var(&ge[0], &gej[0]);
     for (i = 0; i < runs; i++) {
         int j;
-        rustsecp256k1_v0_8_1_ge g;
+        rustsecp256k1_v0_9_0_ge g;
         random_group_element_test(&g);
         if (i >= runs - 2) {
-            rustsecp256k1_v0_8_1_ge_mul_lambda(&g, &ge[1]);
+            rustsecp256k1_v0_9_0_ge_mul_lambda(&g, &ge[1]);
         }
         if (i >= runs - 1) {
-            rustsecp256k1_v0_8_1_ge_mul_lambda(&g, &g);
+            rustsecp256k1_v0_9_0_ge_mul_lambda(&g, &g);
         }
         ge[1 + 4 * i] = g;
         ge[2 + 4 * i] = g;
-        rustsecp256k1_v0_8_1_ge_neg(&ge[3 + 4 * i], &g);
-        rustsecp256k1_v0_8_1_ge_neg(&ge[4 + 4 * i], &g);
-        rustsecp256k1_v0_8_1_gej_set_ge(&gej[1 + 4 * i], &ge[1 + 4 * i]);
+        rustsecp256k1_v0_9_0_ge_neg(&ge[3 + 4 * i], &g);
+        rustsecp256k1_v0_9_0_ge_neg(&ge[4 + 4 * i], &g);
+        rustsecp256k1_v0_9_0_gej_set_ge(&gej[1 + 4 * i], &ge[1 + 4 * i]);
         random_group_element_jacobian_test(&gej[2 + 4 * i], &ge[2 + 4 * i]);
-        rustsecp256k1_v0_8_1_gej_set_ge(&gej[3 + 4 * i], &ge[3 + 4 * i]);
+        rustsecp256k1_v0_9_0_gej_set_ge(&gej[3 + 4 * i], &ge[3 + 4 * i]);
         random_group_element_jacobian_test(&gej[4 + 4 * i], &ge[4 + 4 * i]);
         for (j = 0; j < 4; j++) {
-            random_field_element_magnitude(&ge[1 + j + 4 * i].x);
-            random_field_element_magnitude(&ge[1 + j + 4 * i].y);
-            random_field_element_magnitude(&gej[1 + j + 4 * i].x);
-            random_field_element_magnitude(&gej[1 + j + 4 * i].y);
-            random_field_element_magnitude(&gej[1 + j + 4 * i].z);
+            random_ge_x_magnitude(&ge[1 + j + 4 * i]);
+            random_ge_y_magnitude(&ge[1 + j + 4 * i]);
+            random_gej_x_magnitude(&gej[1 + j + 4 * i]);
+            random_gej_y_magnitude(&gej[1 + j + 4 * i]);
+            random_gej_z_magnitude(&gej[1 + j + 4 * i]);
         }
     }
 
     /* Generate random zf, and zfi2 = 1/zf^2, zfi3 = 1/zf^3 */
-    do {
-        random_field_element_test(&zf);
-    } while(rustsecp256k1_v0_8_1_fe_is_zero(&zf));
-    random_field_element_magnitude(&zf);
-    rustsecp256k1_v0_8_1_fe_inv_var(&zfi3, &zf);
-    rustsecp256k1_v0_8_1_fe_sqr(&zfi2, &zfi3);
-    rustsecp256k1_v0_8_1_fe_mul(&zfi3, &zfi3, &zfi2);
+    random_fe_non_zero_test(&zf);
+    random_fe_magnitude(&zf);
+    rustsecp256k1_v0_9_0_fe_inv_var(&zfi3, &zf);
+    rustsecp256k1_v0_9_0_fe_sqr(&zfi2, &zfi3);
+    rustsecp256k1_v0_9_0_fe_mul(&zfi3, &zfi3, &zfi2);
+
+    /* Generate random r */
+    random_fe_non_zero_test(&r);
 
     for (i1 = 0; i1 < 1 + 4 * runs; i1++) {
         int i2;
         for (i2 = 0; i2 < 1 + 4 * runs; i2++) {
             /* Compute reference result using gej + gej (var). */
-            rustsecp256k1_v0_8_1_gej refj, resj;
-            rustsecp256k1_v0_8_1_ge ref;
-            rustsecp256k1_v0_8_1_fe zr;
-            rustsecp256k1_v0_8_1_gej_add_var(&refj, &gej[i1], &gej[i2], rustsecp256k1_v0_8_1_gej_is_infinity(&gej[i1]) ? NULL : &zr);
+            rustsecp256k1_v0_9_0_gej refj, resj;
+            rustsecp256k1_v0_9_0_ge ref;
+            rustsecp256k1_v0_9_0_fe zr;
+            rustsecp256k1_v0_9_0_gej_add_var(&refj, &gej[i1], &gej[i2], rustsecp256k1_v0_9_0_gej_is_infinity(&gej[i1]) ? NULL : &zr);
             /* Check Z ratio. */
-            if (!rustsecp256k1_v0_8_1_gej_is_infinity(&gej[i1]) && !rustsecp256k1_v0_8_1_gej_is_infinity(&refj)) {
-                rustsecp256k1_v0_8_1_fe zrz; rustsecp256k1_v0_8_1_fe_mul(&zrz, &zr, &gej[i1].z);
-                CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&zrz, &refj.z));
+            if (!rustsecp256k1_v0_9_0_gej_is_infinity(&gej[i1]) && !rustsecp256k1_v0_9_0_gej_is_infinity(&refj)) {
+                rustsecp256k1_v0_9_0_fe zrz; rustsecp256k1_v0_9_0_fe_mul(&zrz, &zr, &gej[i1].z);
+                CHECK(rustsecp256k1_v0_9_0_fe_equal(&zrz, &refj.z));
             }
-            rustsecp256k1_v0_8_1_ge_set_gej_var(&ref, &refj);
+            rustsecp256k1_v0_9_0_ge_set_gej_var(&ref, &refj);
 
             /* Test gej + ge with Z ratio result (var). */
-            rustsecp256k1_v0_8_1_gej_add_ge_var(&resj, &gej[i1], &ge[i2], rustsecp256k1_v0_8_1_gej_is_infinity(&gej[i1]) ? NULL : &zr);
+            rustsecp256k1_v0_9_0_gej_add_ge_var(&resj, &gej[i1], &ge[i2], rustsecp256k1_v0_9_0_gej_is_infinity(&gej[i1]) ? NULL : &zr);
             ge_equals_gej(&ref, &resj);
-            if (!rustsecp256k1_v0_8_1_gej_is_infinity(&gej[i1]) && !rustsecp256k1_v0_8_1_gej_is_infinity(&resj)) {
-                rustsecp256k1_v0_8_1_fe zrz; rustsecp256k1_v0_8_1_fe_mul(&zrz, &zr, &gej[i1].z);
-                CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&zrz, &resj.z));
+            if (!rustsecp256k1_v0_9_0_gej_is_infinity(&gej[i1]) && !rustsecp256k1_v0_9_0_gej_is_infinity(&resj)) {
+                rustsecp256k1_v0_9_0_fe zrz; rustsecp256k1_v0_9_0_fe_mul(&zrz, &zr, &gej[i1].z);
+                CHECK(rustsecp256k1_v0_9_0_fe_equal(&zrz, &resj.z));
             }
 
             /* Test gej + ge (var, with additional Z factor). */
             {
-                rustsecp256k1_v0_8_1_ge ge2_zfi = ge[i2]; /* the second term with x and y rescaled for z = 1/zf */
-                rustsecp256k1_v0_8_1_fe_mul(&ge2_zfi.x, &ge2_zfi.x, &zfi2);
-                rustsecp256k1_v0_8_1_fe_mul(&ge2_zfi.y, &ge2_zfi.y, &zfi3);
-                random_field_element_magnitude(&ge2_zfi.x);
-                random_field_element_magnitude(&ge2_zfi.y);
-                rustsecp256k1_v0_8_1_gej_add_zinv_var(&resj, &gej[i1], &ge2_zfi, &zf);
+                rustsecp256k1_v0_9_0_ge ge2_zfi = ge[i2]; /* the second term with x and y rescaled for z = 1/zf */
+                rustsecp256k1_v0_9_0_fe_mul(&ge2_zfi.x, &ge2_zfi.x, &zfi2);
+                rustsecp256k1_v0_9_0_fe_mul(&ge2_zfi.y, &ge2_zfi.y, &zfi3);
+                random_ge_x_magnitude(&ge2_zfi);
+                random_ge_y_magnitude(&ge2_zfi);
+                rustsecp256k1_v0_9_0_gej_add_zinv_var(&resj, &gej[i1], &ge2_zfi, &zf);
                 ge_equals_gej(&ref, &resj);
             }
 
             /* Test gej + ge (const). */
             if (i2 != 0) {
-                /* rustsecp256k1_v0_8_1_gej_add_ge does not support its second argument being infinity. */
-                rustsecp256k1_v0_8_1_gej_add_ge(&resj, &gej[i1], &ge[i2]);
+                /* rustsecp256k1_v0_9_0_gej_add_ge does not support its second argument being infinity. */
+                rustsecp256k1_v0_9_0_gej_add_ge(&resj, &gej[i1], &ge[i2]);
                 ge_equals_gej(&ref, &resj);
             }
 
             /* Test doubling (var). */
             if ((i1 == 0 && i2 == 0) || ((i1 + 3)/4 == (i2 + 3)/4 && ((i1 + 3)%4)/2 == ((i2 + 3)%4)/2)) {
-                rustsecp256k1_v0_8_1_fe zr2;
+                rustsecp256k1_v0_9_0_fe zr2;
                 /* Normal doubling with Z ratio result. */
-                rustsecp256k1_v0_8_1_gej_double_var(&resj, &gej[i1], &zr2);
+                rustsecp256k1_v0_9_0_gej_double_var(&resj, &gej[i1], &zr2);
                 ge_equals_gej(&ref, &resj);
                 /* Check Z ratio. */
-                rustsecp256k1_v0_8_1_fe_mul(&zr2, &zr2, &gej[i1].z);
-                CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&zr2, &resj.z));
+                rustsecp256k1_v0_9_0_fe_mul(&zr2, &zr2, &gej[i1].z);
+                CHECK(rustsecp256k1_v0_9_0_fe_equal(&zr2, &resj.z));
                 /* Normal doubling. */
-                rustsecp256k1_v0_8_1_gej_double_var(&resj, &gej[i2], NULL);
+                rustsecp256k1_v0_9_0_gej_double_var(&resj, &gej[i2], NULL);
                 ge_equals_gej(&ref, &resj);
                 /* Constant-time doubling. */
-                rustsecp256k1_v0_8_1_gej_double(&resj, &gej[i2]);
+                rustsecp256k1_v0_9_0_gej_double(&resj, &gej[i2]);
                 ge_equals_gej(&ref, &resj);
             }
 
             /* Test adding opposites. */
             if ((i1 == 0 && i2 == 0) || ((i1 + 3)/4 == (i2 + 3)/4 && ((i1 + 3)%4)/2 != ((i2 + 3)%4)/2)) {
-                CHECK(rustsecp256k1_v0_8_1_ge_is_infinity(&ref));
+                CHECK(rustsecp256k1_v0_9_0_ge_is_infinity(&ref));
             }
 
             /* Test adding infinity. */
             if (i1 == 0) {
-                CHECK(rustsecp256k1_v0_8_1_ge_is_infinity(&ge[i1]));
-                CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&gej[i1]));
+                CHECK(rustsecp256k1_v0_9_0_ge_is_infinity(&ge[i1]));
+                CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&gej[i1]));
                 ge_equals_gej(&ref, &gej[i2]);
             }
             if (i2 == 0) {
-                CHECK(rustsecp256k1_v0_8_1_ge_is_infinity(&ge[i2]));
-                CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&gej[i2]));
+                CHECK(rustsecp256k1_v0_9_0_ge_is_infinity(&ge[i2]));
+                CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&gej[i2]));
                 ge_equals_gej(&ref, &gej[i1]);
             }
         }
@@ -3639,53 +3879,76 @@ void test_ge(void) {
 
     /* Test adding all points together in random order equals infinity. */
     {
-        rustsecp256k1_v0_8_1_gej sum = SECP256K1_GEJ_CONST_INFINITY;
-        rustsecp256k1_v0_8_1_gej *gej_shuffled = (rustsecp256k1_v0_8_1_gej *)checked_malloc(&ctx->error_callback, (4 * runs + 1) * sizeof(rustsecp256k1_v0_8_1_gej));
+        rustsecp256k1_v0_9_0_gej sum = SECP256K1_GEJ_CONST_INFINITY;
+        rustsecp256k1_v0_9_0_gej *gej_shuffled = (rustsecp256k1_v0_9_0_gej *)checked_malloc(&CTX->error_callback, (4 * runs + 1) * sizeof(rustsecp256k1_v0_9_0_gej));
         for (i = 0; i < 4 * runs + 1; i++) {
             gej_shuffled[i] = gej[i];
         }
         for (i = 0; i < 4 * runs + 1; i++) {
-            int swap = i + rustsecp256k1_v0_8_1_testrand_int(4 * runs + 1 - i);
+            int swap = i + rustsecp256k1_v0_9_0_testrand_int(4 * runs + 1 - i);
             if (swap != i) {
-                rustsecp256k1_v0_8_1_gej t = gej_shuffled[i];
+                rustsecp256k1_v0_9_0_gej t = gej_shuffled[i];
                 gej_shuffled[i] = gej_shuffled[swap];
                 gej_shuffled[swap] = t;
             }
         }
         for (i = 0; i < 4 * runs + 1; i++) {
-            rustsecp256k1_v0_8_1_gej_add_var(&sum, &sum, &gej_shuffled[i], NULL);
+            rustsecp256k1_v0_9_0_gej_add_var(&sum, &sum, &gej_shuffled[i], NULL);
         }
-        CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&sum));
+        CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&sum));
         free(gej_shuffled);
     }
 
     /* Test batch gej -> ge conversion without known z ratios. */
     {
-        rustsecp256k1_v0_8_1_ge *ge_set_all = (rustsecp256k1_v0_8_1_ge *)checked_malloc(&ctx->error_callback, (4 * runs + 1) * sizeof(rustsecp256k1_v0_8_1_ge));
-        rustsecp256k1_v0_8_1_ge_set_all_gej_var(ge_set_all, gej, 4 * runs + 1);
+        rustsecp256k1_v0_9_0_ge *ge_set_all = (rustsecp256k1_v0_9_0_ge *)checked_malloc(&CTX->error_callback, (4 * runs + 1) * sizeof(rustsecp256k1_v0_9_0_ge));
+        rustsecp256k1_v0_9_0_ge_set_all_gej_var(ge_set_all, gej, 4 * runs + 1);
         for (i = 0; i < 4 * runs + 1; i++) {
-            rustsecp256k1_v0_8_1_fe s;
+            rustsecp256k1_v0_9_0_fe s;
             random_fe_non_zero(&s);
-            rustsecp256k1_v0_8_1_gej_rescale(&gej[i], &s);
+            rustsecp256k1_v0_9_0_gej_rescale(&gej[i], &s);
             ge_equals_gej(&ge_set_all[i], &gej[i]);
         }
         free(ge_set_all);
     }
 
+    /* Test that all elements have X coordinates on the curve. */
+    for (i = 1; i < 4 * runs + 1; i++) {
+        rustsecp256k1_v0_9_0_fe n;
+        CHECK(rustsecp256k1_v0_9_0_ge_x_on_curve_var(&ge[i].x));
+        /* And the same holds after random rescaling. */
+        rustsecp256k1_v0_9_0_fe_mul(&n, &zf, &ge[i].x);
+        CHECK(rustsecp256k1_v0_9_0_ge_x_frac_on_curve_var(&n, &zf));
+    }
+
+    /* Test correspondence of rustsecp256k1_v0_9_0_ge_x{,_frac}_on_curve_var with ge_set_xo. */
+    {
+        rustsecp256k1_v0_9_0_fe n;
+        rustsecp256k1_v0_9_0_ge q;
+        int ret_on_curve, ret_frac_on_curve, ret_set_xo;
+        rustsecp256k1_v0_9_0_fe_mul(&n, &zf, &r);
+        ret_on_curve = rustsecp256k1_v0_9_0_ge_x_on_curve_var(&r);
+        ret_frac_on_curve = rustsecp256k1_v0_9_0_ge_x_frac_on_curve_var(&n, &zf);
+        ret_set_xo = rustsecp256k1_v0_9_0_ge_set_xo_var(&q, &r, 0);
+        CHECK(ret_on_curve == ret_frac_on_curve);
+        CHECK(ret_on_curve == ret_set_xo);
+        if (ret_set_xo) CHECK(rustsecp256k1_v0_9_0_fe_equal(&r, &q.x));
+    }
+
     /* Test batch gej -> ge conversion with many infinities. */
     for (i = 0; i < 4 * runs + 1; i++) {
         int odd;
         random_group_element_test(&ge[i]);
-        odd = rustsecp256k1_v0_8_1_fe_is_odd(&ge[i].x);
+        odd = rustsecp256k1_v0_9_0_fe_is_odd(&ge[i].x);
         CHECK(odd == 0 || odd == 1);
         /* randomly set half the points to infinity */
         if (odd == i % 2) {
-            rustsecp256k1_v0_8_1_ge_set_infinity(&ge[i]);
+            rustsecp256k1_v0_9_0_ge_set_infinity(&ge[i]);
         }
-        rustsecp256k1_v0_8_1_gej_set_ge(&gej[i], &ge[i]);
+        rustsecp256k1_v0_9_0_gej_set_ge(&gej[i], &ge[i]);
     }
     /* batch convert */
-    rustsecp256k1_v0_8_1_ge_set_all_gej_var(ge, gej, 4 * runs + 1);
+    rustsecp256k1_v0_9_0_ge_set_all_gej_var(ge, gej, 4 * runs + 1);
     /* check result */
     for (i = 0; i < 4 * runs + 1; i++) {
         ge_equals_gej(&ge[i], &gej[i]);
@@ -3693,53 +3956,52 @@ void test_ge(void) {
 
     /* Test batch gej -> ge conversion with all infinities. */
     for (i = 0; i < 4 * runs + 1; i++) {
-        rustsecp256k1_v0_8_1_gej_set_infinity(&gej[i]);
+        rustsecp256k1_v0_9_0_gej_set_infinity(&gej[i]);
     }
     /* batch convert */
-    rustsecp256k1_v0_8_1_ge_set_all_gej_var(ge, gej, 4 * runs + 1);
+    rustsecp256k1_v0_9_0_ge_set_all_gej_var(ge, gej, 4 * runs + 1);
     /* check result */
     for (i = 0; i < 4 * runs + 1; i++) {
-        CHECK(rustsecp256k1_v0_8_1_ge_is_infinity(&ge[i]));
+        CHECK(rustsecp256k1_v0_9_0_ge_is_infinity(&ge[i]));
     }
 
     free(ge);
     free(gej);
 }
 
-
-void test_intialized_inf(void) {
-    rustsecp256k1_v0_8_1_ge p;
-    rustsecp256k1_v0_8_1_gej pj, npj, infj1, infj2, infj3;
-    rustsecp256k1_v0_8_1_fe zinv;
+static void test_intialized_inf(void) {
+    rustsecp256k1_v0_9_0_ge p;
+    rustsecp256k1_v0_9_0_gej pj, npj, infj1, infj2, infj3;
+    rustsecp256k1_v0_9_0_fe zinv;
 
     /* Test that adding P+(-P) results in a fully initialized infinity*/
     random_group_element_test(&p);
-    rustsecp256k1_v0_8_1_gej_set_ge(&pj, &p);
-    rustsecp256k1_v0_8_1_gej_neg(&npj, &pj);
+    rustsecp256k1_v0_9_0_gej_set_ge(&pj, &p);
+    rustsecp256k1_v0_9_0_gej_neg(&npj, &pj);
 
-    rustsecp256k1_v0_8_1_gej_add_var(&infj1, &pj, &npj, NULL);
-    CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&infj1));
-    CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&infj1.x));
-    CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&infj1.y));
-    CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&infj1.z));
+    rustsecp256k1_v0_9_0_gej_add_var(&infj1, &pj, &npj, NULL);
+    CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&infj1));
+    CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&infj1.x));
+    CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&infj1.y));
+    CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&infj1.z));
 
-    rustsecp256k1_v0_8_1_gej_add_ge_var(&infj2, &npj, &p, NULL);
-    CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&infj2));
-    CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&infj2.x));
-    CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&infj2.y));
-    CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&infj2.z));
+    rustsecp256k1_v0_9_0_gej_add_ge_var(&infj2, &npj, &p, NULL);
+    CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&infj2));
+    CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&infj2.x));
+    CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&infj2.y));
+    CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&infj2.z));
 
-    rustsecp256k1_v0_8_1_fe_set_int(&zinv, 1);
-    rustsecp256k1_v0_8_1_gej_add_zinv_var(&infj3, &npj, &p, &zinv);
-    CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&infj3));
-    CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&infj3.x));
-    CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&infj3.y));
-    CHECK(rustsecp256k1_v0_8_1_fe_is_zero(&infj3.z));
+    rustsecp256k1_v0_9_0_fe_set_int(&zinv, 1);
+    rustsecp256k1_v0_9_0_gej_add_zinv_var(&infj3, &npj, &p, &zinv);
+    CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&infj3));
+    CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&infj3.x));
+    CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&infj3.y));
+    CHECK(rustsecp256k1_v0_9_0_fe_is_zero(&infj3.z));
 
 
 }
 
-void test_add_neg_y_diff_x(void) {
+static void test_add_neg_y_diff_x(void) {
     /* The point of this test is to check that we can add two points
      * whose y-coordinates are negatives of each other but whose x
      * coordinates differ. If the x-coordinates were the same, these
@@ -3753,84 +4015,77 @@ void test_add_neg_y_diff_x(void) {
      * which this test is a regression test for.
      *
      * These points were generated in sage as
-     * # secp256k1 params
-     * F = FiniteField (0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F)
-     * C = EllipticCurve ([F (0), F (7)])
-     * G = C.lift_x(0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798)
-     * N = FiniteField(G.order())
      *
-     * # endomorphism values (lambda is 1^{1/3} in N, beta is 1^{1/3} in F)
-     * x = polygen(N)
-     * lam  = (1 - x^3).roots()[1][0]
+     * load("rustsecp256k1_v0_9_0_params.sage")
      *
      * # random "bad pair"
      * P = C.random_element()
-     * Q = -int(lam) * P
-     * print "    P: %x %x" % P.xy()
-     * print "    Q: %x %x" % Q.xy()
-     * print "P + Q: %x %x" % (P + Q).xy()
+     * Q = -int(LAMBDA) * P
+     * print("    P: %x %x" % P.xy())
+     * print("    Q: %x %x" % Q.xy())
+     * print("P + Q: %x %x" % (P + Q).xy())
      */
-    rustsecp256k1_v0_8_1_gej aj = SECP256K1_GEJ_CONST(
+    rustsecp256k1_v0_9_0_gej aj = SECP256K1_GEJ_CONST(
         0x8d24cd95, 0x0a355af1, 0x3c543505, 0x44238d30,
         0x0643d79f, 0x05a59614, 0x2f8ec030, 0xd58977cb,
         0x001e337a, 0x38093dcd, 0x6c0f386d, 0x0b1293a8,
         0x4d72c879, 0xd7681924, 0x44e6d2f3, 0x9190117d
     );
-    rustsecp256k1_v0_8_1_gej bj = SECP256K1_GEJ_CONST(
+    rustsecp256k1_v0_9_0_gej bj = SECP256K1_GEJ_CONST(
         0xc7b74206, 0x1f788cd9, 0xabd0937d, 0x164a0d86,
         0x95f6ff75, 0xf19a4ce9, 0xd013bd7b, 0xbf92d2a7,
         0xffe1cc85, 0xc7f6c232, 0x93f0c792, 0xf4ed6c57,
         0xb28d3786, 0x2897e6db, 0xbb192d0b, 0x6e6feab2
     );
-    rustsecp256k1_v0_8_1_gej sumj = SECP256K1_GEJ_CONST(
+    rustsecp256k1_v0_9_0_gej sumj = SECP256K1_GEJ_CONST(
         0x671a63c0, 0x3efdad4c, 0x389a7798, 0x24356027,
         0xb3d69010, 0x278625c3, 0x5c86d390, 0x184a8f7a,
         0x5f6409c2, 0x2ce01f2b, 0x511fd375, 0x25071d08,
         0xda651801, 0x70e95caf, 0x8f0d893c, 0xbed8fbbe
     );
-    rustsecp256k1_v0_8_1_ge b;
-    rustsecp256k1_v0_8_1_gej resj;
-    rustsecp256k1_v0_8_1_ge res;
-    rustsecp256k1_v0_8_1_ge_set_gej(&b, &bj);
+    rustsecp256k1_v0_9_0_ge b;
+    rustsecp256k1_v0_9_0_gej resj;
+    rustsecp256k1_v0_9_0_ge res;
+    rustsecp256k1_v0_9_0_ge_set_gej(&b, &bj);
 
-    rustsecp256k1_v0_8_1_gej_add_var(&resj, &aj, &bj, NULL);
-    rustsecp256k1_v0_8_1_ge_set_gej(&res, &resj);
+    rustsecp256k1_v0_9_0_gej_add_var(&resj, &aj, &bj, NULL);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res, &resj);
     ge_equals_gej(&res, &sumj);
 
-    rustsecp256k1_v0_8_1_gej_add_ge(&resj, &aj, &b);
-    rustsecp256k1_v0_8_1_ge_set_gej(&res, &resj);
+    rustsecp256k1_v0_9_0_gej_add_ge(&resj, &aj, &b);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res, &resj);
     ge_equals_gej(&res, &sumj);
 
-    rustsecp256k1_v0_8_1_gej_add_ge_var(&resj, &aj, &b, NULL);
-    rustsecp256k1_v0_8_1_ge_set_gej(&res, &resj);
+    rustsecp256k1_v0_9_0_gej_add_ge_var(&resj, &aj, &b, NULL);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res, &resj);
     ge_equals_gej(&res, &sumj);
 }
 
-void run_ge(void) {
+static void run_ge(void) {
     int i;
-    for (i = 0; i < count * 32; i++) {
+    for (i = 0; i < COUNT * 32; i++) {
         test_ge();
     }
     test_add_neg_y_diff_x();
     test_intialized_inf();
 }
 
-void test_gej_cmov(const rustsecp256k1_v0_8_1_gej *a, const rustsecp256k1_v0_8_1_gej *b) {
-    rustsecp256k1_v0_8_1_gej t = *a;
-    rustsecp256k1_v0_8_1_gej_cmov(&t, b, 0);
+static void test_gej_cmov(const rustsecp256k1_v0_9_0_gej *a, const rustsecp256k1_v0_9_0_gej *b) {
+    rustsecp256k1_v0_9_0_gej t = *a;
+    rustsecp256k1_v0_9_0_gej_cmov(&t, b, 0);
     CHECK(gej_xyz_equals_gej(&t, a));
-    rustsecp256k1_v0_8_1_gej_cmov(&t, b, 1);
+    rustsecp256k1_v0_9_0_gej_cmov(&t, b, 1);
     CHECK(gej_xyz_equals_gej(&t, b));
 }
 
-void run_gej(void) {
+static void run_gej(void) {
     int i;
-    rustsecp256k1_v0_8_1_gej a, b;
+    rustsecp256k1_v0_9_0_gej a, b;
 
-    /* Tests for rustsecp256k1_v0_8_1_gej_cmov */
-    for (i = 0; i < count; i++) {
-        rustsecp256k1_v0_8_1_gej_set_infinity(&a);
-        rustsecp256k1_v0_8_1_gej_set_infinity(&b);
+    /* Tests for rustsecp256k1_v0_9_0_gej_cmov */
+    for (i = 0; i < COUNT; i++) {
+        rustsecp256k1_v0_9_0_gej_set_infinity(&a);
+        rustsecp256k1_v0_9_0_gej_set_infinity(&b);
         test_gej_cmov(&a, &b);
 
         random_gej_test(&a);
@@ -3845,94 +4100,91 @@ void run_gej(void) {
         test_gej_cmov(&b, &a);
     }
 
-    /* Tests for rustsecp256k1_v0_8_1_gej_eq_var */
-    for (i = 0; i < count; i++) {
-        rustsecp256k1_v0_8_1_fe fe;
+    /* Tests for rustsecp256k1_v0_9_0_gej_eq_var */
+    for (i = 0; i < COUNT; i++) {
+        rustsecp256k1_v0_9_0_fe fe;
         random_gej_test(&a);
         random_gej_test(&b);
-        CHECK(!rustsecp256k1_v0_8_1_gej_eq_var(&a, &b));
+        CHECK(!rustsecp256k1_v0_9_0_gej_eq_var(&a, &b));
 
         b = a;
-        random_field_element_test(&fe);
-        if (rustsecp256k1_v0_8_1_fe_is_zero(&fe)) {
-            continue;
-        }
-        rustsecp256k1_v0_8_1_gej_rescale(&a, &fe);
-        CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&a, &b));
+        random_fe_non_zero_test(&fe);
+        rustsecp256k1_v0_9_0_gej_rescale(&a, &fe);
+        CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&a, &b));
     }
 }
 
-void test_ec_combine(void) {
-    rustsecp256k1_v0_8_1_scalar sum = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
-    rustsecp256k1_v0_8_1_pubkey data[6];
-    const rustsecp256k1_v0_8_1_pubkey* d[6];
-    rustsecp256k1_v0_8_1_pubkey sd;
-    rustsecp256k1_v0_8_1_pubkey sd2;
-    rustsecp256k1_v0_8_1_gej Qj;
-    rustsecp256k1_v0_8_1_ge Q;
+static void test_ec_combine(void) {
+    rustsecp256k1_v0_9_0_scalar sum = rustsecp256k1_v0_9_0_scalar_zero;
+    rustsecp256k1_v0_9_0_pubkey data[6];
+    const rustsecp256k1_v0_9_0_pubkey* d[6];
+    rustsecp256k1_v0_9_0_pubkey sd;
+    rustsecp256k1_v0_9_0_pubkey sd2;
+    rustsecp256k1_v0_9_0_gej Qj;
+    rustsecp256k1_v0_9_0_ge Q;
     int i;
     for (i = 1; i <= 6; i++) {
-        rustsecp256k1_v0_8_1_scalar s;
+        rustsecp256k1_v0_9_0_scalar s;
         random_scalar_order_test(&s);
-        rustsecp256k1_v0_8_1_scalar_add(&sum, &sum, &s);
-        rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &Qj, &s);
-        rustsecp256k1_v0_8_1_ge_set_gej(&Q, &Qj);
-        rustsecp256k1_v0_8_1_pubkey_save(&data[i - 1], &Q);
+        rustsecp256k1_v0_9_0_scalar_add(&sum, &sum, &s);
+        rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &Qj, &s);
+        rustsecp256k1_v0_9_0_ge_set_gej(&Q, &Qj);
+        rustsecp256k1_v0_9_0_pubkey_save(&data[i - 1], &Q);
         d[i - 1] = &data[i - 1];
-        rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &Qj, &sum);
-        rustsecp256k1_v0_8_1_ge_set_gej(&Q, &Qj);
-        rustsecp256k1_v0_8_1_pubkey_save(&sd, &Q);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_combine(ctx, &sd2, d, i) == 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&sd, &sd2, sizeof(sd)) == 0);
+        rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &Qj, &sum);
+        rustsecp256k1_v0_9_0_ge_set_gej(&Q, &Qj);
+        rustsecp256k1_v0_9_0_pubkey_save(&sd, &Q);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_combine(CTX, &sd2, d, i) == 1);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&sd, &sd2, sizeof(sd)) == 0);
     }
 }
 
-void run_ec_combine(void) {
+static void run_ec_combine(void) {
     int i;
-    for (i = 0; i < count * 8; i++) {
+    for (i = 0; i < COUNT * 8; i++) {
          test_ec_combine();
     }
 }
 
-void test_group_decompress(const rustsecp256k1_v0_8_1_fe* x) {
+static void test_group_decompress(const rustsecp256k1_v0_9_0_fe* x) {
     /* The input itself, normalized. */
-    rustsecp256k1_v0_8_1_fe fex = *x;
+    rustsecp256k1_v0_9_0_fe fex = *x;
     /* Results of set_xo_var(..., 0), set_xo_var(..., 1). */
-    rustsecp256k1_v0_8_1_ge ge_even, ge_odd;
+    rustsecp256k1_v0_9_0_ge ge_even, ge_odd;
     /* Return values of the above calls. */
     int res_even, res_odd;
 
-    rustsecp256k1_v0_8_1_fe_normalize_var(&fex);
+    rustsecp256k1_v0_9_0_fe_normalize_var(&fex);
 
-    res_even = rustsecp256k1_v0_8_1_ge_set_xo_var(&ge_even, &fex, 0);
-    res_odd = rustsecp256k1_v0_8_1_ge_set_xo_var(&ge_odd, &fex, 1);
+    res_even = rustsecp256k1_v0_9_0_ge_set_xo_var(&ge_even, &fex, 0);
+    res_odd = rustsecp256k1_v0_9_0_ge_set_xo_var(&ge_odd, &fex, 1);
 
     CHECK(res_even == res_odd);
 
     if (res_even) {
-        rustsecp256k1_v0_8_1_fe_normalize_var(&ge_odd.x);
-        rustsecp256k1_v0_8_1_fe_normalize_var(&ge_even.x);
-        rustsecp256k1_v0_8_1_fe_normalize_var(&ge_odd.y);
-        rustsecp256k1_v0_8_1_fe_normalize_var(&ge_even.y);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&ge_odd.x);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&ge_even.x);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&ge_odd.y);
+        rustsecp256k1_v0_9_0_fe_normalize_var(&ge_even.y);
 
         /* No infinity allowed. */
         CHECK(!ge_even.infinity);
         CHECK(!ge_odd.infinity);
 
         /* Check that the x coordinates check out. */
-        CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&ge_even.x, x));
-        CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&ge_odd.x, x));
+        CHECK(rustsecp256k1_v0_9_0_fe_equal(&ge_even.x, x));
+        CHECK(rustsecp256k1_v0_9_0_fe_equal(&ge_odd.x, x));
 
         /* Check odd/even Y in ge_odd, ge_even. */
-        CHECK(rustsecp256k1_v0_8_1_fe_is_odd(&ge_odd.y));
-        CHECK(!rustsecp256k1_v0_8_1_fe_is_odd(&ge_even.y));
+        CHECK(rustsecp256k1_v0_9_0_fe_is_odd(&ge_odd.y));
+        CHECK(!rustsecp256k1_v0_9_0_fe_is_odd(&ge_even.y));
     }
 }
 
-void run_group_decompress(void) {
+static void run_group_decompress(void) {
     int i;
-    for (i = 0; i < count * 4; i++) {
-        rustsecp256k1_v0_8_1_fe fe;
+    for (i = 0; i < COUNT * 4; i++) {
+        rustsecp256k1_v0_9_0_fe fe;
         random_fe_test(&fe);
         test_group_decompress(&fe);
     }
@@ -3940,7 +4192,7 @@ void run_group_decompress(void) {
 
 /***** ECMULT TESTS *****/
 
-void test_pre_g_table(const rustsecp256k1_v0_8_1_ge_storage * pre_g, size_t n) {
+static void test_pre_g_table(const rustsecp256k1_v0_9_0_ge_storage * pre_g, size_t n) {
     /* Tests the pre_g / pre_g_128 tables for consistency.
      * For independent verification we take a "geometric" approach to verification.
      * We check that every entry is on-curve.
@@ -3951,170 +4203,168 @@ void test_pre_g_table(const rustsecp256k1_v0_8_1_ge_storage * pre_g, size_t n) {
      *
      * Checking the table's generators are correct is done in run_ecmult_pre_g.
      */
-    rustsecp256k1_v0_8_1_gej g2;
-    rustsecp256k1_v0_8_1_ge p, q, gg;
-    rustsecp256k1_v0_8_1_fe dpx, dpy, dqx, dqy;
+    rustsecp256k1_v0_9_0_gej g2;
+    rustsecp256k1_v0_9_0_ge p, q, gg;
+    rustsecp256k1_v0_9_0_fe dpx, dpy, dqx, dqy;
     size_t i;
 
     CHECK(0 < n);
 
-    rustsecp256k1_v0_8_1_ge_from_storage(&p, &pre_g[0]);
-    CHECK(rustsecp256k1_v0_8_1_ge_is_valid_var(&p));
+    rustsecp256k1_v0_9_0_ge_from_storage(&p, &pre_g[0]);
+    CHECK(rustsecp256k1_v0_9_0_ge_is_valid_var(&p));
 
-    rustsecp256k1_v0_8_1_gej_set_ge(&g2, &p);
-    rustsecp256k1_v0_8_1_gej_double_var(&g2, &g2, NULL);
-    rustsecp256k1_v0_8_1_ge_set_gej_var(&gg, &g2);
+    rustsecp256k1_v0_9_0_gej_set_ge(&g2, &p);
+    rustsecp256k1_v0_9_0_gej_double_var(&g2, &g2, NULL);
+    rustsecp256k1_v0_9_0_ge_set_gej_var(&gg, &g2);
     for (i = 1; i < n; ++i) {
-        rustsecp256k1_v0_8_1_fe_negate(&dpx, &p.x, 1); rustsecp256k1_v0_8_1_fe_add(&dpx, &gg.x); rustsecp256k1_v0_8_1_fe_normalize_weak(&dpx);
-        rustsecp256k1_v0_8_1_fe_negate(&dpy, &p.y, 1); rustsecp256k1_v0_8_1_fe_add(&dpy, &gg.y); rustsecp256k1_v0_8_1_fe_normalize_weak(&dpy);
+        rustsecp256k1_v0_9_0_fe_negate(&dpx, &p.x, 1); rustsecp256k1_v0_9_0_fe_add(&dpx, &gg.x); rustsecp256k1_v0_9_0_fe_normalize_weak(&dpx);
+        rustsecp256k1_v0_9_0_fe_negate(&dpy, &p.y, 1); rustsecp256k1_v0_9_0_fe_add(&dpy, &gg.y); rustsecp256k1_v0_9_0_fe_normalize_weak(&dpy);
         /* Check that p is not equal to gg */
-        CHECK(!rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&dpx) || !rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&dpy));
+        CHECK(!rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&dpx) || !rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&dpy));
 
-        rustsecp256k1_v0_8_1_ge_from_storage(&q, &pre_g[i]);
-        CHECK(rustsecp256k1_v0_8_1_ge_is_valid_var(&q));
+        rustsecp256k1_v0_9_0_ge_from_storage(&q, &pre_g[i]);
+        CHECK(rustsecp256k1_v0_9_0_ge_is_valid_var(&q));
 
-        rustsecp256k1_v0_8_1_fe_negate(&dqx, &q.x, 1); rustsecp256k1_v0_8_1_fe_add(&dqx, &gg.x); rustsecp256k1_v0_8_1_fe_normalize_weak(&dqx);
-        dqy = q.y; rustsecp256k1_v0_8_1_fe_add(&dqy, &gg.y); rustsecp256k1_v0_8_1_fe_normalize_weak(&dqy);
+        rustsecp256k1_v0_9_0_fe_negate(&dqx, &q.x, 1); rustsecp256k1_v0_9_0_fe_add(&dqx, &gg.x);
+        dqy = q.y; rustsecp256k1_v0_9_0_fe_add(&dqy, &gg.y);
         /* Check that -q is not equal to gg */
-        CHECK(!rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&dqx) || !rustsecp256k1_v0_8_1_fe_normalizes_to_zero_var(&dqy));
+        CHECK(!rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&dqx) || !rustsecp256k1_v0_9_0_fe_normalizes_to_zero_var(&dqy));
 
         /* Check that -q is not equal to p */
-        CHECK(!rustsecp256k1_v0_8_1_fe_equal_var(&dpx, &dqx) || !rustsecp256k1_v0_8_1_fe_equal_var(&dpy, &dqy));
+        CHECK(!rustsecp256k1_v0_9_0_fe_equal(&dpx, &dqx) || !rustsecp256k1_v0_9_0_fe_equal(&dpy, &dqy));
 
         /* Check that p, -q and gg are colinear */
-        rustsecp256k1_v0_8_1_fe_mul(&dpx, &dpx, &dqy);
-        rustsecp256k1_v0_8_1_fe_mul(&dpy, &dpy, &dqx);
-        CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&dpx, &dpy));
+        rustsecp256k1_v0_9_0_fe_mul(&dpx, &dpx, &dqy);
+        rustsecp256k1_v0_9_0_fe_mul(&dpy, &dpy, &dqx);
+        CHECK(rustsecp256k1_v0_9_0_fe_equal(&dpx, &dpy));
 
         p = q;
     }
 }
 
-void run_ecmult_pre_g(void) {
-    rustsecp256k1_v0_8_1_ge_storage gs;
-    rustsecp256k1_v0_8_1_gej gj;
-    rustsecp256k1_v0_8_1_ge g;
+static void run_ecmult_pre_g(void) {
+    rustsecp256k1_v0_9_0_ge_storage gs;
+    rustsecp256k1_v0_9_0_gej gj;
+    rustsecp256k1_v0_9_0_ge g;
     size_t i;
 
     /* Check that the pre_g and pre_g_128 tables are consistent. */
-    test_pre_g_table(rustsecp256k1_v0_8_1_pre_g, ECMULT_TABLE_SIZE(WINDOW_G));
-    test_pre_g_table(rustsecp256k1_v0_8_1_pre_g_128, ECMULT_TABLE_SIZE(WINDOW_G));
+    test_pre_g_table(rustsecp256k1_v0_9_0_pre_g, ECMULT_TABLE_SIZE(WINDOW_G));
+    test_pre_g_table(rustsecp256k1_v0_9_0_pre_g_128, ECMULT_TABLE_SIZE(WINDOW_G));
 
     /* Check the first entry from the pre_g table. */
-    rustsecp256k1_v0_8_1_ge_to_storage(&gs, &rustsecp256k1_v0_8_1_ge_const_g);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&gs, &rustsecp256k1_v0_8_1_pre_g[0], sizeof(gs)) == 0);
+    rustsecp256k1_v0_9_0_ge_to_storage(&gs, &rustsecp256k1_v0_9_0_ge_const_g);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&gs, &rustsecp256k1_v0_9_0_pre_g[0], sizeof(gs)) == 0);
 
     /* Check the first entry from the pre_g_128 table. */
-    rustsecp256k1_v0_8_1_gej_set_ge(&gj, &rustsecp256k1_v0_8_1_ge_const_g);
+    rustsecp256k1_v0_9_0_gej_set_ge(&gj, &rustsecp256k1_v0_9_0_ge_const_g);
     for (i = 0; i < 128; ++i) {
-      rustsecp256k1_v0_8_1_gej_double_var(&gj, &gj, NULL);
+      rustsecp256k1_v0_9_0_gej_double_var(&gj, &gj, NULL);
     }
-    rustsecp256k1_v0_8_1_ge_set_gej(&g, &gj);
-    rustsecp256k1_v0_8_1_ge_to_storage(&gs, &g);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&gs, &rustsecp256k1_v0_8_1_pre_g_128[0], sizeof(gs)) == 0);
+    rustsecp256k1_v0_9_0_ge_set_gej(&g, &gj);
+    rustsecp256k1_v0_9_0_ge_to_storage(&gs, &g);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&gs, &rustsecp256k1_v0_9_0_pre_g_128[0], sizeof(gs)) == 0);
 }
 
-void run_ecmult_chain(void) {
+static void run_ecmult_chain(void) {
     /* random starting point A (on the curve) */
-    rustsecp256k1_v0_8_1_gej a = SECP256K1_GEJ_CONST(
+    rustsecp256k1_v0_9_0_gej a = SECP256K1_GEJ_CONST(
         0x8b30bbe9, 0xae2a9906, 0x96b22f67, 0x0709dff3,
         0x727fd8bc, 0x04d3362c, 0x6c7bf458, 0xe2846004,
         0xa357ae91, 0x5c4a6528, 0x1309edf2, 0x0504740f,
         0x0eb33439, 0x90216b4f, 0x81063cb6, 0x5f2f7e0f
     );
     /* two random initial factors xn and gn */
-    rustsecp256k1_v0_8_1_scalar xn = SECP256K1_SCALAR_CONST(
+    rustsecp256k1_v0_9_0_scalar xn = SECP256K1_SCALAR_CONST(
         0x84cc5452, 0xf7fde1ed, 0xb4d38a8c, 0xe9b1b84c,
         0xcef31f14, 0x6e569be9, 0x705d357a, 0x42985407
     );
-    rustsecp256k1_v0_8_1_scalar gn = SECP256K1_SCALAR_CONST(
+    rustsecp256k1_v0_9_0_scalar gn = SECP256K1_SCALAR_CONST(
         0xa1e58d22, 0x553dcd42, 0xb2398062, 0x5d4c57a9,
         0x6e9323d4, 0x2b3152e5, 0xca2c3990, 0xedc7c9de
     );
     /* two small multipliers to be applied to xn and gn in every iteration: */
-    static const rustsecp256k1_v0_8_1_scalar xf = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0x1337);
-    static const rustsecp256k1_v0_8_1_scalar gf = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0x7113);
+    static const rustsecp256k1_v0_9_0_scalar xf = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0x1337);
+    static const rustsecp256k1_v0_9_0_scalar gf = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0x7113);
     /* accumulators with the resulting coefficients to A and G */
-    rustsecp256k1_v0_8_1_scalar ae = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
-    rustsecp256k1_v0_8_1_scalar ge = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
+    rustsecp256k1_v0_9_0_scalar ae = rustsecp256k1_v0_9_0_scalar_one;
+    rustsecp256k1_v0_9_0_scalar ge = rustsecp256k1_v0_9_0_scalar_zero;
     /* actual points */
-    rustsecp256k1_v0_8_1_gej x;
-    rustsecp256k1_v0_8_1_gej x2;
+    rustsecp256k1_v0_9_0_gej x;
+    rustsecp256k1_v0_9_0_gej x2;
     int i;
 
     /* the point being computed */
     x = a;
-    for (i = 0; i < 200*count; i++) {
+    for (i = 0; i < 200*COUNT; i++) {
         /* in each iteration, compute X = xn*X + gn*G; */
-        rustsecp256k1_v0_8_1_ecmult(&x, &x, &xn, &gn);
+        rustsecp256k1_v0_9_0_ecmult(&x, &x, &xn, &gn);
         /* also compute ae and ge: the actual accumulated factors for A and G */
         /* if X was (ae*A+ge*G), xn*X + gn*G results in (xn*ae*A + (xn*ge+gn)*G) */
-        rustsecp256k1_v0_8_1_scalar_mul(&ae, &ae, &xn);
-        rustsecp256k1_v0_8_1_scalar_mul(&ge, &ge, &xn);
-        rustsecp256k1_v0_8_1_scalar_add(&ge, &ge, &gn);
+        rustsecp256k1_v0_9_0_scalar_mul(&ae, &ae, &xn);
+        rustsecp256k1_v0_9_0_scalar_mul(&ge, &ge, &xn);
+        rustsecp256k1_v0_9_0_scalar_add(&ge, &ge, &gn);
         /* modify xn and gn */
-        rustsecp256k1_v0_8_1_scalar_mul(&xn, &xn, &xf);
-        rustsecp256k1_v0_8_1_scalar_mul(&gn, &gn, &gf);
+        rustsecp256k1_v0_9_0_scalar_mul(&xn, &xn, &xf);
+        rustsecp256k1_v0_9_0_scalar_mul(&gn, &gn, &gf);
 
         /* verify */
         if (i == 19999) {
             /* expected result after 19999 iterations */
-            rustsecp256k1_v0_8_1_gej rp = SECP256K1_GEJ_CONST(
+            rustsecp256k1_v0_9_0_gej rp = SECP256K1_GEJ_CONST(
                 0xD6E96687, 0xF9B10D09, 0x2A6F3543, 0x9D86CEBE,
                 0xA4535D0D, 0x409F5358, 0x6440BD74, 0xB933E830,
                 0xB95CBCA2, 0xC77DA786, 0x539BE8FD, 0x53354D2D,
                 0x3B4F566A, 0xE6580454, 0x07ED6015, 0xEE1B2A88
             );
-            CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&rp, &x));
+            CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&rp, &x));
         }
     }
     /* redo the computation, but directly with the resulting ae and ge coefficients: */
-    rustsecp256k1_v0_8_1_ecmult(&x2, &a, &ae, &ge);
-    CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&x, &x2));
+    rustsecp256k1_v0_9_0_ecmult(&x2, &a, &ae, &ge);
+    CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&x, &x2));
 }
 
-void test_point_times_order(const rustsecp256k1_v0_8_1_gej *point) {
+static void test_point_times_order(const rustsecp256k1_v0_9_0_gej *point) {
     /* X * (point + G) + (order-X) * (pointer + G) = 0 */
-    rustsecp256k1_v0_8_1_scalar x;
-    rustsecp256k1_v0_8_1_scalar nx;
-    rustsecp256k1_v0_8_1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
-    rustsecp256k1_v0_8_1_scalar one = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
-    rustsecp256k1_v0_8_1_gej res1, res2;
-    rustsecp256k1_v0_8_1_ge res3;
+    rustsecp256k1_v0_9_0_scalar x;
+    rustsecp256k1_v0_9_0_scalar nx;
+    rustsecp256k1_v0_9_0_gej res1, res2;
+    rustsecp256k1_v0_9_0_ge res3;
     unsigned char pub[65];
     size_t psize = 65;
     random_scalar_order_test(&x);
-    rustsecp256k1_v0_8_1_scalar_negate(&nx, &x);
-    rustsecp256k1_v0_8_1_ecmult(&res1, point, &x, &x); /* calc res1 = x * point + x * G; */
-    rustsecp256k1_v0_8_1_ecmult(&res2, point, &nx, &nx); /* calc res2 = (order - x) * point + (order - x) * G; */
-    rustsecp256k1_v0_8_1_gej_add_var(&res1, &res1, &res2, NULL);
-    CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&res1));
-    rustsecp256k1_v0_8_1_ge_set_gej(&res3, &res1);
-    CHECK(rustsecp256k1_v0_8_1_ge_is_infinity(&res3));
-    CHECK(rustsecp256k1_v0_8_1_ge_is_valid_var(&res3) == 0);
-    CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_serialize(&res3, pub, &psize, 0) == 0);
+    rustsecp256k1_v0_9_0_scalar_negate(&nx, &x);
+    rustsecp256k1_v0_9_0_ecmult(&res1, point, &x, &x); /* calc res1 = x * point + x * G; */
+    rustsecp256k1_v0_9_0_ecmult(&res2, point, &nx, &nx); /* calc res2 = (order - x) * point + (order - x) * G; */
+    rustsecp256k1_v0_9_0_gej_add_var(&res1, &res1, &res2, NULL);
+    CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&res1));
+    rustsecp256k1_v0_9_0_ge_set_gej(&res3, &res1);
+    CHECK(rustsecp256k1_v0_9_0_ge_is_infinity(&res3));
+    CHECK(rustsecp256k1_v0_9_0_ge_is_valid_var(&res3) == 0);
+    CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_serialize(&res3, pub, &psize, 0) == 0);
     psize = 65;
-    CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_serialize(&res3, pub, &psize, 1) == 0);
+    CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_serialize(&res3, pub, &psize, 1) == 0);
     /* check zero/one edge cases */
-    rustsecp256k1_v0_8_1_ecmult(&res1, point, &zero, &zero);
-    rustsecp256k1_v0_8_1_ge_set_gej(&res3, &res1);
-    CHECK(rustsecp256k1_v0_8_1_ge_is_infinity(&res3));
-    rustsecp256k1_v0_8_1_ecmult(&res1, point, &one, &zero);
-    rustsecp256k1_v0_8_1_ge_set_gej(&res3, &res1);
+    rustsecp256k1_v0_9_0_ecmult(&res1, point, &rustsecp256k1_v0_9_0_scalar_zero, &rustsecp256k1_v0_9_0_scalar_zero);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res3, &res1);
+    CHECK(rustsecp256k1_v0_9_0_ge_is_infinity(&res3));
+    rustsecp256k1_v0_9_0_ecmult(&res1, point, &rustsecp256k1_v0_9_0_scalar_one, &rustsecp256k1_v0_9_0_scalar_zero);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res3, &res1);
     ge_equals_gej(&res3, point);
-    rustsecp256k1_v0_8_1_ecmult(&res1, point, &zero, &one);
-    rustsecp256k1_v0_8_1_ge_set_gej(&res3, &res1);
-    ge_equals_ge(&res3, &rustsecp256k1_v0_8_1_ge_const_g);
+    rustsecp256k1_v0_9_0_ecmult(&res1, point, &rustsecp256k1_v0_9_0_scalar_zero, &rustsecp256k1_v0_9_0_scalar_one);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res3, &res1);
+    ge_equals_ge(&res3, &rustsecp256k1_v0_9_0_ge_const_g);
 }
 
-/* These scalars reach large (in absolute value) outputs when fed to rustsecp256k1_v0_8_1_scalar_split_lambda.
+/* These scalars reach large (in absolute value) outputs when fed to rustsecp256k1_v0_9_0_scalar_split_lambda.
  *
  * They are computed as:
  * - For a in [-2, -1, 0, 1, 2]:
  *   - For b in [-3, -1, 1, 3]:
  *     - Output (a*LAMBDA + (ORDER+b)/2) % ORDER
  */
-static const rustsecp256k1_v0_8_1_scalar scalars_near_split_bounds[20] = {
+static const rustsecp256k1_v0_9_0_scalar scalars_near_split_bounds[20] = {
     SECP256K1_SCALAR_CONST(0xd938a566, 0x7f479e3e, 0xb5b3c7fa, 0xefdb3749, 0x3aa0585c, 0xc5ea2367, 0xe1b660db, 0x0209e6fc),
     SECP256K1_SCALAR_CONST(0xd938a566, 0x7f479e3e, 0xb5b3c7fa, 0xefdb3749, 0x3aa0585c, 0xc5ea2367, 0xe1b660db, 0x0209e6fd),
     SECP256K1_SCALAR_CONST(0xd938a566, 0x7f479e3e, 0xb5b3c7fa, 0xefdb3749, 0x3aa0585c, 0xc5ea2367, 0xe1b660db, 0x0209e6fe),
@@ -4137,49 +4387,48 @@ static const rustsecp256k1_v0_8_1_scalar scalars_near_split_bounds[20] = {
     SECP256K1_SCALAR_CONST(0x26c75a99, 0x80b861c1, 0x4a4c3805, 0x1024c8b4, 0x704d760e, 0xe95e7cd3, 0xde1bfdb1, 0xce2c5a45)
 };
 
-void test_ecmult_target(const rustsecp256k1_v0_8_1_scalar* target, int mode) {
+static void test_ecmult_target(const rustsecp256k1_v0_9_0_scalar* target, int mode) {
     /* Mode: 0=ecmult_gen, 1=ecmult, 2=ecmult_const */
-    rustsecp256k1_v0_8_1_scalar n1, n2;
-    rustsecp256k1_v0_8_1_ge p;
-    rustsecp256k1_v0_8_1_gej pj, p1j, p2j, ptj;
-    static const rustsecp256k1_v0_8_1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
+    rustsecp256k1_v0_9_0_scalar n1, n2;
+    rustsecp256k1_v0_9_0_ge p;
+    rustsecp256k1_v0_9_0_gej pj, p1j, p2j, ptj;
 
     /* Generate random n1,n2 such that n1+n2 = -target. */
     random_scalar_order_test(&n1);
-    rustsecp256k1_v0_8_1_scalar_add(&n2, &n1, target);
-    rustsecp256k1_v0_8_1_scalar_negate(&n2, &n2);
+    rustsecp256k1_v0_9_0_scalar_add(&n2, &n1, target);
+    rustsecp256k1_v0_9_0_scalar_negate(&n2, &n2);
 
     /* Generate a random input point. */
     if (mode != 0) {
         random_group_element_test(&p);
-        rustsecp256k1_v0_8_1_gej_set_ge(&pj, &p);
+        rustsecp256k1_v0_9_0_gej_set_ge(&pj, &p);
     }
 
     /* EC multiplications */
     if (mode == 0) {
-        rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &p1j, &n1);
-        rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &p2j, &n2);
-        rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &ptj, target);
+        rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &p1j, &n1);
+        rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &p2j, &n2);
+        rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &ptj, target);
     } else if (mode == 1) {
-        rustsecp256k1_v0_8_1_ecmult(&p1j, &pj, &n1, &zero);
-        rustsecp256k1_v0_8_1_ecmult(&p2j, &pj, &n2, &zero);
-        rustsecp256k1_v0_8_1_ecmult(&ptj, &pj, target, &zero);
+        rustsecp256k1_v0_9_0_ecmult(&p1j, &pj, &n1, &rustsecp256k1_v0_9_0_scalar_zero);
+        rustsecp256k1_v0_9_0_ecmult(&p2j, &pj, &n2, &rustsecp256k1_v0_9_0_scalar_zero);
+        rustsecp256k1_v0_9_0_ecmult(&ptj, &pj, target, &rustsecp256k1_v0_9_0_scalar_zero);
     } else {
-        rustsecp256k1_v0_8_1_ecmult_const(&p1j, &p, &n1, 256);
-        rustsecp256k1_v0_8_1_ecmult_const(&p2j, &p, &n2, 256);
-        rustsecp256k1_v0_8_1_ecmult_const(&ptj, &p, target, 256);
+        rustsecp256k1_v0_9_0_ecmult_const(&p1j, &p, &n1);
+        rustsecp256k1_v0_9_0_ecmult_const(&p2j, &p, &n2);
+        rustsecp256k1_v0_9_0_ecmult_const(&ptj, &p, target);
     }
 
     /* Add them all up: n1*P + n2*P + target*P = (n1+n2+target)*P = (n1+n1-n1-n2)*P = 0. */
-    rustsecp256k1_v0_8_1_gej_add_var(&ptj, &ptj, &p1j, NULL);
-    rustsecp256k1_v0_8_1_gej_add_var(&ptj, &ptj, &p2j, NULL);
-    CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&ptj));
+    rustsecp256k1_v0_9_0_gej_add_var(&ptj, &ptj, &p1j, NULL);
+    rustsecp256k1_v0_9_0_gej_add_var(&ptj, &ptj, &p2j, NULL);
+    CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&ptj));
 }
 
-void run_ecmult_near_split_bound(void) {
+static void run_ecmult_near_split_bound(void) {
     int i;
     unsigned j;
-    for (i = 0; i < 4*count; ++i) {
+    for (i = 0; i < 4*COUNT; ++i) {
         for (j = 0; j < sizeof(scalars_near_split_bounds) / sizeof(scalars_near_split_bounds[0]); ++j) {
             test_ecmult_target(&scalars_near_split_bounds[j], 0);
             test_ecmult_target(&scalars_near_split_bounds[j], 1);
@@ -4188,143 +4437,197 @@ void run_ecmult_near_split_bound(void) {
     }
 }
 
-void run_point_times_order(void) {
+static void run_point_times_order(void) {
     int i;
-    rustsecp256k1_v0_8_1_fe x = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 2);
-    static const rustsecp256k1_v0_8_1_fe xr = SECP256K1_FE_CONST(
+    rustsecp256k1_v0_9_0_fe x = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 2);
+    static const rustsecp256k1_v0_9_0_fe xr = SECP256K1_FE_CONST(
         0x7603CB59, 0xB0EF6C63, 0xFE608479, 0x2A0C378C,
         0xDB3233A8, 0x0F8A9A09, 0xA877DEAD, 0x31B38C45
     );
     for (i = 0; i < 500; i++) {
-        rustsecp256k1_v0_8_1_ge p;
-        if (rustsecp256k1_v0_8_1_ge_set_xo_var(&p, &x, 1)) {
-            rustsecp256k1_v0_8_1_gej j;
-            CHECK(rustsecp256k1_v0_8_1_ge_is_valid_var(&p));
-            rustsecp256k1_v0_8_1_gej_set_ge(&j, &p);
+        rustsecp256k1_v0_9_0_ge p;
+        if (rustsecp256k1_v0_9_0_ge_set_xo_var(&p, &x, 1)) {
+            rustsecp256k1_v0_9_0_gej j;
+            CHECK(rustsecp256k1_v0_9_0_ge_is_valid_var(&p));
+            rustsecp256k1_v0_9_0_gej_set_ge(&j, &p);
             test_point_times_order(&j);
         }
-        rustsecp256k1_v0_8_1_fe_sqr(&x, &x);
+        rustsecp256k1_v0_9_0_fe_sqr(&x, &x);
     }
-    rustsecp256k1_v0_8_1_fe_normalize_var(&x);
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&x, &xr));
+    rustsecp256k1_v0_9_0_fe_normalize_var(&x);
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&x, &xr));
 }
 
-void ecmult_const_random_mult(void) {
+static void ecmult_const_random_mult(void) {
     /* random starting point A (on the curve) */
-    rustsecp256k1_v0_8_1_ge a = SECP256K1_GE_CONST(
+    rustsecp256k1_v0_9_0_ge a = SECP256K1_GE_CONST(
         0x6d986544, 0x57ff52b8, 0xcf1b8126, 0x5b802a5b,
         0xa97f9263, 0xb1e88044, 0x93351325, 0x91bc450a,
         0x535c59f7, 0x325e5d2b, 0xc391fbe8, 0x3c12787c,
         0x337e4a98, 0xe82a9011, 0x0123ba37, 0xdd769c7d
     );
     /* random initial factor xn */
-    rustsecp256k1_v0_8_1_scalar xn = SECP256K1_SCALAR_CONST(
+    rustsecp256k1_v0_9_0_scalar xn = SECP256K1_SCALAR_CONST(
         0x649d4f77, 0xc4242df7, 0x7f2079c9, 0x14530327,
         0xa31b876a, 0xd2d8ce2a, 0x2236d5c6, 0xd7b2029b
     );
     /* expected xn * A (from sage) */
-    rustsecp256k1_v0_8_1_ge expected_b = SECP256K1_GE_CONST(
+    rustsecp256k1_v0_9_0_ge expected_b = SECP256K1_GE_CONST(
         0x23773684, 0x4d209dc7, 0x098a786f, 0x20d06fcd,
         0x070a38bf, 0xc11ac651, 0x03004319, 0x1e2a8786,
         0xed8c3b8e, 0xc06dd57b, 0xd06ea66e, 0x45492b0f,
         0xb84e4e1b, 0xfb77e21f, 0x96baae2a, 0x63dec956
     );
-    rustsecp256k1_v0_8_1_gej b;
-    rustsecp256k1_v0_8_1_ecmult_const(&b, &a, &xn, 256);
+    rustsecp256k1_v0_9_0_gej b;
+    rustsecp256k1_v0_9_0_ecmult_const(&b, &a, &xn);
 
-    CHECK(rustsecp256k1_v0_8_1_ge_is_valid_var(&a));
+    CHECK(rustsecp256k1_v0_9_0_ge_is_valid_var(&a));
     ge_equals_gej(&expected_b, &b);
 }
 
-void ecmult_const_commutativity(void) {
-    rustsecp256k1_v0_8_1_scalar a;
-    rustsecp256k1_v0_8_1_scalar b;
-    rustsecp256k1_v0_8_1_gej res1;
-    rustsecp256k1_v0_8_1_gej res2;
-    rustsecp256k1_v0_8_1_ge mid1;
-    rustsecp256k1_v0_8_1_ge mid2;
+static void ecmult_const_commutativity(void) {
+    rustsecp256k1_v0_9_0_scalar a;
+    rustsecp256k1_v0_9_0_scalar b;
+    rustsecp256k1_v0_9_0_gej res1;
+    rustsecp256k1_v0_9_0_gej res2;
+    rustsecp256k1_v0_9_0_ge mid1;
+    rustsecp256k1_v0_9_0_ge mid2;
     random_scalar_order_test(&a);
     random_scalar_order_test(&b);
 
-    rustsecp256k1_v0_8_1_ecmult_const(&res1, &rustsecp256k1_v0_8_1_ge_const_g, &a, 256);
-    rustsecp256k1_v0_8_1_ecmult_const(&res2, &rustsecp256k1_v0_8_1_ge_const_g, &b, 256);
-    rustsecp256k1_v0_8_1_ge_set_gej(&mid1, &res1);
-    rustsecp256k1_v0_8_1_ge_set_gej(&mid2, &res2);
-    rustsecp256k1_v0_8_1_ecmult_const(&res1, &mid1, &b, 256);
-    rustsecp256k1_v0_8_1_ecmult_const(&res2, &mid2, &a, 256);
-    rustsecp256k1_v0_8_1_ge_set_gej(&mid1, &res1);
-    rustsecp256k1_v0_8_1_ge_set_gej(&mid2, &res2);
+    rustsecp256k1_v0_9_0_ecmult_const(&res1, &rustsecp256k1_v0_9_0_ge_const_g, &a);
+    rustsecp256k1_v0_9_0_ecmult_const(&res2, &rustsecp256k1_v0_9_0_ge_const_g, &b);
+    rustsecp256k1_v0_9_0_ge_set_gej(&mid1, &res1);
+    rustsecp256k1_v0_9_0_ge_set_gej(&mid2, &res2);
+    rustsecp256k1_v0_9_0_ecmult_const(&res1, &mid1, &b);
+    rustsecp256k1_v0_9_0_ecmult_const(&res2, &mid2, &a);
+    rustsecp256k1_v0_9_0_ge_set_gej(&mid1, &res1);
+    rustsecp256k1_v0_9_0_ge_set_gej(&mid2, &res2);
     ge_equals_ge(&mid1, &mid2);
 }
 
-void ecmult_const_mult_zero_one(void) {
-    rustsecp256k1_v0_8_1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
-    rustsecp256k1_v0_8_1_scalar one = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
-    rustsecp256k1_v0_8_1_scalar negone;
-    rustsecp256k1_v0_8_1_gej res1;
-    rustsecp256k1_v0_8_1_ge res2;
-    rustsecp256k1_v0_8_1_ge point;
-    rustsecp256k1_v0_8_1_scalar_negate(&negone, &one);
+static void ecmult_const_mult_zero_one(void) {
+    rustsecp256k1_v0_9_0_scalar negone;
+    rustsecp256k1_v0_9_0_gej res1;
+    rustsecp256k1_v0_9_0_ge res2;
+    rustsecp256k1_v0_9_0_ge point;
+    rustsecp256k1_v0_9_0_scalar_negate(&negone, &rustsecp256k1_v0_9_0_scalar_one);
 
     random_group_element_test(&point);
-    rustsecp256k1_v0_8_1_ecmult_const(&res1, &point, &zero, 3);
-    rustsecp256k1_v0_8_1_ge_set_gej(&res2, &res1);
-    CHECK(rustsecp256k1_v0_8_1_ge_is_infinity(&res2));
-    rustsecp256k1_v0_8_1_ecmult_const(&res1, &point, &one, 2);
-    rustsecp256k1_v0_8_1_ge_set_gej(&res2, &res1);
+    rustsecp256k1_v0_9_0_ecmult_const(&res1, &point, &rustsecp256k1_v0_9_0_scalar_zero);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res2, &res1);
+    CHECK(rustsecp256k1_v0_9_0_ge_is_infinity(&res2));
+    rustsecp256k1_v0_9_0_ecmult_const(&res1, &point, &rustsecp256k1_v0_9_0_scalar_one);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res2, &res1);
     ge_equals_ge(&res2, &point);
-    rustsecp256k1_v0_8_1_ecmult_const(&res1, &point, &negone, 256);
-    rustsecp256k1_v0_8_1_gej_neg(&res1, &res1);
-    rustsecp256k1_v0_8_1_ge_set_gej(&res2, &res1);
+    rustsecp256k1_v0_9_0_ecmult_const(&res1, &point, &negone);
+    rustsecp256k1_v0_9_0_gej_neg(&res1, &res1);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res2, &res1);
     ge_equals_ge(&res2, &point);
 }
 
-void ecmult_const_chain_multiply(void) {
+static void ecmult_const_mult_xonly(void) {
+    int i;
+
+    /* Test correspondence between rustsecp256k1_v0_9_0_ecmult_const and rustsecp256k1_v0_9_0_ecmult_const_xonly. */
+    for (i = 0; i < 2*COUNT; ++i) {
+        rustsecp256k1_v0_9_0_ge base;
+        rustsecp256k1_v0_9_0_gej basej, resj;
+        rustsecp256k1_v0_9_0_fe n, d, resx, v;
+        rustsecp256k1_v0_9_0_scalar q;
+        int res;
+        /* Random base point. */
+        random_group_element_test(&base);
+        /* Random scalar to multiply it with. */
+        random_scalar_order_test(&q);
+        /* If i is odd, n=d*base.x for random non-zero d */
+        if (i & 1) {
+            random_fe_non_zero_test(&d);
+            rustsecp256k1_v0_9_0_fe_mul(&n, &base.x, &d);
+        } else {
+            n = base.x;
+        }
+        /* Perform x-only multiplication. */
+        res = rustsecp256k1_v0_9_0_ecmult_const_xonly(&resx, &n, (i & 1) ? &d : NULL, &q, i & 2);
+        CHECK(res);
+        /* Perform normal multiplication. */
+        rustsecp256k1_v0_9_0_gej_set_ge(&basej, &base);
+        rustsecp256k1_v0_9_0_ecmult(&resj, &basej, &q, NULL);
+        /* Check that resj's X coordinate corresponds with resx. */
+        rustsecp256k1_v0_9_0_fe_sqr(&v, &resj.z);
+        rustsecp256k1_v0_9_0_fe_mul(&v, &v, &resx);
+        CHECK(check_fe_equal(&v, &resj.x));
+    }
+
+    /* Test that rustsecp256k1_v0_9_0_ecmult_const_xonly correctly rejects X coordinates not on curve. */
+    for (i = 0; i < 2*COUNT; ++i) {
+        rustsecp256k1_v0_9_0_fe x, n, d, r;
+        int res;
+        rustsecp256k1_v0_9_0_scalar q;
+        random_scalar_order_test(&q);
+        /* Generate random X coordinate not on the curve. */
+        do {
+            random_fe_test(&x);
+        } while (rustsecp256k1_v0_9_0_ge_x_on_curve_var(&x));
+        /* If i is odd, n=d*x for random non-zero d. */
+        if (i & 1) {
+            random_fe_non_zero_test(&d);
+            rustsecp256k1_v0_9_0_fe_mul(&n, &x, &d);
+        } else {
+            n = x;
+        }
+        res = rustsecp256k1_v0_9_0_ecmult_const_xonly(&r, &n, (i & 1) ? &d : NULL, &q, 0);
+        CHECK(res == 0);
+    }
+}
+
+static void ecmult_const_chain_multiply(void) {
     /* Check known result (randomly generated test problem from sage) */
-    const rustsecp256k1_v0_8_1_scalar scalar = SECP256K1_SCALAR_CONST(
+    const rustsecp256k1_v0_9_0_scalar scalar = SECP256K1_SCALAR_CONST(
         0x4968d524, 0x2abf9b7a, 0x466abbcf, 0x34b11b6d,
         0xcd83d307, 0x827bed62, 0x05fad0ce, 0x18fae63b
     );
-    const rustsecp256k1_v0_8_1_gej expected_point = SECP256K1_GEJ_CONST(
+    const rustsecp256k1_v0_9_0_gej expected_point = SECP256K1_GEJ_CONST(
         0x5494c15d, 0x32099706, 0xc2395f94, 0x348745fd,
         0x757ce30e, 0x4e8c90fb, 0xa2bad184, 0xf883c69f,
         0x5d195d20, 0xe191bf7f, 0x1be3e55f, 0x56a80196,
         0x6071ad01, 0xf1462f66, 0xc997fa94, 0xdb858435
     );
-    rustsecp256k1_v0_8_1_gej point;
-    rustsecp256k1_v0_8_1_ge res;
+    rustsecp256k1_v0_9_0_gej point;
+    rustsecp256k1_v0_9_0_ge res;
     int i;
 
-    rustsecp256k1_v0_8_1_gej_set_ge(&point, &rustsecp256k1_v0_8_1_ge_const_g);
+    rustsecp256k1_v0_9_0_gej_set_ge(&point, &rustsecp256k1_v0_9_0_ge_const_g);
     for (i = 0; i < 100; ++i) {
-        rustsecp256k1_v0_8_1_ge tmp;
-        rustsecp256k1_v0_8_1_ge_set_gej(&tmp, &point);
-        rustsecp256k1_v0_8_1_ecmult_const(&point, &tmp, &scalar, 256);
+        rustsecp256k1_v0_9_0_ge tmp;
+        rustsecp256k1_v0_9_0_ge_set_gej(&tmp, &point);
+        rustsecp256k1_v0_9_0_ecmult_const(&point, &tmp, &scalar);
     }
-    rustsecp256k1_v0_8_1_ge_set_gej(&res, &point);
+    rustsecp256k1_v0_9_0_ge_set_gej(&res, &point);
     ge_equals_gej(&res, &expected_point);
 }
 
-void run_ecmult_const_tests(void) {
+static void run_ecmult_const_tests(void) {
     ecmult_const_mult_zero_one();
     ecmult_const_random_mult();
     ecmult_const_commutativity();
     ecmult_const_chain_multiply();
+    ecmult_const_mult_xonly();
 }
 
 typedef struct {
-    rustsecp256k1_v0_8_1_scalar *sc;
-    rustsecp256k1_v0_8_1_ge *pt;
+    rustsecp256k1_v0_9_0_scalar *sc;
+    rustsecp256k1_v0_9_0_ge *pt;
 } ecmult_multi_data;
 
-static int ecmult_multi_callback(rustsecp256k1_v0_8_1_scalar *sc, rustsecp256k1_v0_8_1_ge *pt, size_t idx, void *cbdata) {
+static int ecmult_multi_callback(rustsecp256k1_v0_9_0_scalar *sc, rustsecp256k1_v0_9_0_ge *pt, size_t idx, void *cbdata) {
     ecmult_multi_data *data = (ecmult_multi_data*) cbdata;
     *sc = data->sc[idx];
     *pt = data->pt[idx];
     return 1;
 }
 
-static int ecmult_multi_false_callback(rustsecp256k1_v0_8_1_scalar *sc, rustsecp256k1_v0_8_1_ge *pt, size_t idx, void *cbdata) {
+static int ecmult_multi_false_callback(rustsecp256k1_v0_9_0_scalar *sc, rustsecp256k1_v0_9_0_ge *pt, size_t idx, void *cbdata) {
     (void)sc;
     (void)pt;
     (void)idx;
@@ -4332,94 +4635,92 @@ static int ecmult_multi_false_callback(rustsecp256k1_v0_8_1_scalar *sc, rustsecp
     return 0;
 }
 
-void test_ecmult_multi(rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8_1_ecmult_multi_func ecmult_multi) {
+static void test_ecmult_multi(rustsecp256k1_v0_9_0_scratch *scratch, rustsecp256k1_v0_9_0_ecmult_multi_func ecmult_multi) {
     int ncount;
-    rustsecp256k1_v0_8_1_scalar szero;
-    rustsecp256k1_v0_8_1_scalar sc[32];
-    rustsecp256k1_v0_8_1_ge pt[32];
-    rustsecp256k1_v0_8_1_gej r;
-    rustsecp256k1_v0_8_1_gej r2;
+    rustsecp256k1_v0_9_0_scalar sc[32];
+    rustsecp256k1_v0_9_0_ge pt[32];
+    rustsecp256k1_v0_9_0_gej r;
+    rustsecp256k1_v0_9_0_gej r2;
     ecmult_multi_data data;
 
     data.sc = sc;
     data.pt = pt;
-    rustsecp256k1_v0_8_1_scalar_set_int(&szero, 0);
 
     /* No points to multiply */
-    CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, NULL, ecmult_multi_callback, &data, 0));
+    CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, NULL, ecmult_multi_callback, &data, 0));
 
     /* Check 1- and 2-point multiplies against ecmult */
-    for (ncount = 0; ncount < count; ncount++) {
-        rustsecp256k1_v0_8_1_ge ptg;
-        rustsecp256k1_v0_8_1_gej ptgj;
+    for (ncount = 0; ncount < COUNT; ncount++) {
+        rustsecp256k1_v0_9_0_ge ptg;
+        rustsecp256k1_v0_9_0_gej ptgj;
         random_scalar_order(&sc[0]);
         random_scalar_order(&sc[1]);
 
         random_group_element_test(&ptg);
-        rustsecp256k1_v0_8_1_gej_set_ge(&ptgj, &ptg);
+        rustsecp256k1_v0_9_0_gej_set_ge(&ptgj, &ptg);
         pt[0] = ptg;
-        pt[1] = rustsecp256k1_v0_8_1_ge_const_g;
+        pt[1] = rustsecp256k1_v0_9_0_ge_const_g;
 
         /* only G scalar */
-        rustsecp256k1_v0_8_1_ecmult(&r2, &ptgj, &szero, &sc[0]);
-        CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &sc[0], ecmult_multi_callback, &data, 0));
-        CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&r, &r2));
+        rustsecp256k1_v0_9_0_ecmult(&r2, &ptgj, &rustsecp256k1_v0_9_0_scalar_zero, &sc[0]);
+        CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &sc[0], ecmult_multi_callback, &data, 0));
+        CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&r, &r2));
 
         /* 1-point */
-        rustsecp256k1_v0_8_1_ecmult(&r2, &ptgj, &sc[0], &szero);
-        CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, 1));
-        CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&r, &r2));
+        rustsecp256k1_v0_9_0_ecmult(&r2, &ptgj, &sc[0], &rustsecp256k1_v0_9_0_scalar_zero);
+        CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 1));
+        CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&r, &r2));
 
         /* Try to multiply 1 point, but callback returns false */
-        CHECK(!ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_false_callback, &data, 1));
+        CHECK(!ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_false_callback, &data, 1));
 
         /* 2-point */
-        rustsecp256k1_v0_8_1_ecmult(&r2, &ptgj, &sc[0], &sc[1]);
-        CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, 2));
-        CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&r, &r2));
+        rustsecp256k1_v0_9_0_ecmult(&r2, &ptgj, &sc[0], &sc[1]);
+        CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 2));
+        CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&r, &r2));
 
         /* 2-point with G scalar */
-        rustsecp256k1_v0_8_1_ecmult(&r2, &ptgj, &sc[0], &sc[1]);
-        CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &sc[1], ecmult_multi_callback, &data, 1));
-        CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&r, &r2));
+        rustsecp256k1_v0_9_0_ecmult(&r2, &ptgj, &sc[0], &sc[1]);
+        CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &sc[1], ecmult_multi_callback, &data, 1));
+        CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&r, &r2));
     }
 
     /* Check infinite outputs of various forms */
-    for (ncount = 0; ncount < count; ncount++) {
-        rustsecp256k1_v0_8_1_ge ptg;
+    for (ncount = 0; ncount < COUNT; ncount++) {
+        rustsecp256k1_v0_9_0_ge ptg;
         size_t i, j;
         size_t sizes[] = { 2, 10, 32 };
 
         for (j = 0; j < 3; j++) {
             for (i = 0; i < 32; i++) {
                 random_scalar_order(&sc[i]);
-                rustsecp256k1_v0_8_1_ge_set_infinity(&pt[i]);
+                rustsecp256k1_v0_9_0_ge_set_infinity(&pt[i]);
             }
-            CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, sizes[j]));
-            CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&r));
+            CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, sizes[j]));
+            CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&r));
         }
 
         for (j = 0; j < 3; j++) {
             for (i = 0; i < 32; i++) {
                 random_group_element_test(&ptg);
                 pt[i] = ptg;
-                rustsecp256k1_v0_8_1_scalar_set_int(&sc[i], 0);
+                rustsecp256k1_v0_9_0_scalar_set_int(&sc[i], 0);
             }
-            CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, sizes[j]));
-            CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&r));
+            CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, sizes[j]));
+            CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&r));
         }
 
         for (j = 0; j < 3; j++) {
             random_group_element_test(&ptg);
             for (i = 0; i < 16; i++) {
                 random_scalar_order(&sc[2*i]);
-                rustsecp256k1_v0_8_1_scalar_negate(&sc[2*i + 1], &sc[2*i]);
+                rustsecp256k1_v0_9_0_scalar_negate(&sc[2*i + 1], &sc[2*i]);
                 pt[2 * i] = ptg;
                 pt[2 * i + 1] = ptg;
             }
 
-            CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, sizes[j]));
-            CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&r));
+            CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, sizes[j]));
+            CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&r));
 
             random_scalar_order(&sc[0]);
             for (i = 0; i < 16; i++) {
@@ -4428,66 +4729,66 @@ void test_ecmult_multi(rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8
                 sc[2*i] = sc[0];
                 sc[2*i+1] = sc[0];
                 pt[2 * i] = ptg;
-                rustsecp256k1_v0_8_1_ge_neg(&pt[2*i+1], &pt[2*i]);
+                rustsecp256k1_v0_9_0_ge_neg(&pt[2*i+1], &pt[2*i]);
             }
 
-            CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, sizes[j]));
-            CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&r));
+            CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, sizes[j]));
+            CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&r));
         }
 
         random_group_element_test(&ptg);
-        rustsecp256k1_v0_8_1_scalar_set_int(&sc[0], 0);
+        rustsecp256k1_v0_9_0_scalar_set_int(&sc[0], 0);
         pt[0] = ptg;
         for (i = 1; i < 32; i++) {
             pt[i] = ptg;
 
             random_scalar_order(&sc[i]);
-            rustsecp256k1_v0_8_1_scalar_add(&sc[0], &sc[0], &sc[i]);
-            rustsecp256k1_v0_8_1_scalar_negate(&sc[i], &sc[i]);
+            rustsecp256k1_v0_9_0_scalar_add(&sc[0], &sc[0], &sc[i]);
+            rustsecp256k1_v0_9_0_scalar_negate(&sc[i], &sc[i]);
         }
 
-        CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, 32));
-        CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&r));
+        CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 32));
+        CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&r));
     }
 
     /* Check random points, constant scalar */
-    for (ncount = 0; ncount < count; ncount++) {
+    for (ncount = 0; ncount < COUNT; ncount++) {
         size_t i;
-        rustsecp256k1_v0_8_1_gej_set_infinity(&r);
+        rustsecp256k1_v0_9_0_gej_set_infinity(&r);
 
         random_scalar_order(&sc[0]);
         for (i = 0; i < 20; i++) {
-            rustsecp256k1_v0_8_1_ge ptg;
+            rustsecp256k1_v0_9_0_ge ptg;
             sc[i] = sc[0];
             random_group_element_test(&ptg);
             pt[i] = ptg;
-            rustsecp256k1_v0_8_1_gej_add_ge_var(&r, &r, &pt[i], NULL);
+            rustsecp256k1_v0_9_0_gej_add_ge_var(&r, &r, &pt[i], NULL);
         }
 
-        rustsecp256k1_v0_8_1_ecmult(&r2, &r, &sc[0], &szero);
-        CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, 20));
-        CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&r, &r2));
+        rustsecp256k1_v0_9_0_ecmult(&r2, &r, &sc[0], &rustsecp256k1_v0_9_0_scalar_zero);
+        CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 20));
+        CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&r, &r2));
     }
 
     /* Check random scalars, constant point */
-    for (ncount = 0; ncount < count; ncount++) {
+    for (ncount = 0; ncount < COUNT; ncount++) {
         size_t i;
-        rustsecp256k1_v0_8_1_ge ptg;
-        rustsecp256k1_v0_8_1_gej p0j;
-        rustsecp256k1_v0_8_1_scalar rs;
-        rustsecp256k1_v0_8_1_scalar_set_int(&rs, 0);
+        rustsecp256k1_v0_9_0_ge ptg;
+        rustsecp256k1_v0_9_0_gej p0j;
+        rustsecp256k1_v0_9_0_scalar rs;
+        rustsecp256k1_v0_9_0_scalar_set_int(&rs, 0);
 
         random_group_element_test(&ptg);
         for (i = 0; i < 20; i++) {
             random_scalar_order(&sc[i]);
             pt[i] = ptg;
-            rustsecp256k1_v0_8_1_scalar_add(&rs, &rs, &sc[i]);
+            rustsecp256k1_v0_9_0_scalar_add(&rs, &rs, &sc[i]);
         }
 
-        rustsecp256k1_v0_8_1_gej_set_ge(&p0j, &pt[0]);
-        rustsecp256k1_v0_8_1_ecmult(&r2, &p0j, &rs, &szero);
-        CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, 20));
-        CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&r, &r2));
+        rustsecp256k1_v0_9_0_gej_set_ge(&p0j, &pt[0]);
+        rustsecp256k1_v0_9_0_ecmult(&r2, &p0j, &rs, &rustsecp256k1_v0_9_0_scalar_zero);
+        CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 20));
+        CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&r, &r2));
     }
 
     /* Sanity check that zero scalars don't cause problems */
@@ -4496,60 +4797,60 @@ void test_ecmult_multi(rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8
         random_group_element_test(&pt[ncount]);
     }
 
-    rustsecp256k1_v0_8_1_scalar_clear(&sc[0]);
-    CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, 20));
-    rustsecp256k1_v0_8_1_scalar_clear(&sc[1]);
-    rustsecp256k1_v0_8_1_scalar_clear(&sc[2]);
-    rustsecp256k1_v0_8_1_scalar_clear(&sc[3]);
-    rustsecp256k1_v0_8_1_scalar_clear(&sc[4]);
-    CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, 6));
-    CHECK(ecmult_multi(&ctx->error_callback, scratch, &r, &szero, ecmult_multi_callback, &data, 5));
-    CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&r));
+    rustsecp256k1_v0_9_0_scalar_clear(&sc[0]);
+    CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 20));
+    rustsecp256k1_v0_9_0_scalar_clear(&sc[1]);
+    rustsecp256k1_v0_9_0_scalar_clear(&sc[2]);
+    rustsecp256k1_v0_9_0_scalar_clear(&sc[3]);
+    rustsecp256k1_v0_9_0_scalar_clear(&sc[4]);
+    CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 6));
+    CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 5));
+    CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&r));
 
     /* Run through s0*(t0*P) + s1*(t1*P) exhaustively for many small values of s0, s1, t0, t1 */
     {
         const size_t TOP = 8;
         size_t s0i, s1i;
         size_t t0i, t1i;
-        rustsecp256k1_v0_8_1_ge ptg;
-        rustsecp256k1_v0_8_1_gej ptgj;
+        rustsecp256k1_v0_9_0_ge ptg;
+        rustsecp256k1_v0_9_0_gej ptgj;
 
         random_group_element_test(&ptg);
-        rustsecp256k1_v0_8_1_gej_set_ge(&ptgj, &ptg);
+        rustsecp256k1_v0_9_0_gej_set_ge(&ptgj, &ptg);
 
         for(t0i = 0; t0i < TOP; t0i++) {
             for(t1i = 0; t1i < TOP; t1i++) {
-                rustsecp256k1_v0_8_1_gej t0p, t1p;
-                rustsecp256k1_v0_8_1_scalar t0, t1;
+                rustsecp256k1_v0_9_0_gej t0p, t1p;
+                rustsecp256k1_v0_9_0_scalar t0, t1;
 
-                rustsecp256k1_v0_8_1_scalar_set_int(&t0, (t0i + 1) / 2);
-                rustsecp256k1_v0_8_1_scalar_cond_negate(&t0, t0i & 1);
-                rustsecp256k1_v0_8_1_scalar_set_int(&t1, (t1i + 1) / 2);
-                rustsecp256k1_v0_8_1_scalar_cond_negate(&t1, t1i & 1);
+                rustsecp256k1_v0_9_0_scalar_set_int(&t0, (t0i + 1) / 2);
+                rustsecp256k1_v0_9_0_scalar_cond_negate(&t0, t0i & 1);
+                rustsecp256k1_v0_9_0_scalar_set_int(&t1, (t1i + 1) / 2);
+                rustsecp256k1_v0_9_0_scalar_cond_negate(&t1, t1i & 1);
 
-                rustsecp256k1_v0_8_1_ecmult(&t0p, &ptgj, &t0, &szero);
-                rustsecp256k1_v0_8_1_ecmult(&t1p, &ptgj, &t1, &szero);
+                rustsecp256k1_v0_9_0_ecmult(&t0p, &ptgj, &t0, &rustsecp256k1_v0_9_0_scalar_zero);
+                rustsecp256k1_v0_9_0_ecmult(&t1p, &ptgj, &t1, &rustsecp256k1_v0_9_0_scalar_zero);
 
                 for(s0i = 0; s0i < TOP; s0i++) {
                     for(s1i = 0; s1i < TOP; s1i++) {
-                        rustsecp256k1_v0_8_1_scalar tmp1, tmp2;
-                        rustsecp256k1_v0_8_1_gej expected, actual;
+                        rustsecp256k1_v0_9_0_scalar tmp1, tmp2;
+                        rustsecp256k1_v0_9_0_gej expected, actual;
 
-                        rustsecp256k1_v0_8_1_ge_set_gej(&pt[0], &t0p);
-                        rustsecp256k1_v0_8_1_ge_set_gej(&pt[1], &t1p);
+                        rustsecp256k1_v0_9_0_ge_set_gej(&pt[0], &t0p);
+                        rustsecp256k1_v0_9_0_ge_set_gej(&pt[1], &t1p);
 
-                        rustsecp256k1_v0_8_1_scalar_set_int(&sc[0], (s0i + 1) / 2);
-                        rustsecp256k1_v0_8_1_scalar_cond_negate(&sc[0], s0i & 1);
-                        rustsecp256k1_v0_8_1_scalar_set_int(&sc[1], (s1i + 1) / 2);
-                        rustsecp256k1_v0_8_1_scalar_cond_negate(&sc[1], s1i & 1);
+                        rustsecp256k1_v0_9_0_scalar_set_int(&sc[0], (s0i + 1) / 2);
+                        rustsecp256k1_v0_9_0_scalar_cond_negate(&sc[0], s0i & 1);
+                        rustsecp256k1_v0_9_0_scalar_set_int(&sc[1], (s1i + 1) / 2);
+                        rustsecp256k1_v0_9_0_scalar_cond_negate(&sc[1], s1i & 1);
 
-                        rustsecp256k1_v0_8_1_scalar_mul(&tmp1, &t0, &sc[0]);
-                        rustsecp256k1_v0_8_1_scalar_mul(&tmp2, &t1, &sc[1]);
-                        rustsecp256k1_v0_8_1_scalar_add(&tmp1, &tmp1, &tmp2);
+                        rustsecp256k1_v0_9_0_scalar_mul(&tmp1, &t0, &sc[0]);
+                        rustsecp256k1_v0_9_0_scalar_mul(&tmp2, &t1, &sc[1]);
+                        rustsecp256k1_v0_9_0_scalar_add(&tmp1, &tmp1, &tmp2);
 
-                        rustsecp256k1_v0_8_1_ecmult(&expected, &ptgj, &tmp1, &szero);
-                        CHECK(ecmult_multi(&ctx->error_callback, scratch, &actual, &szero, ecmult_multi_callback, &data, 2));
-                        CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&actual, &expected));
+                        rustsecp256k1_v0_9_0_ecmult(&expected, &ptgj, &tmp1, &rustsecp256k1_v0_9_0_scalar_zero);
+                        CHECK(ecmult_multi(&CTX->error_callback, scratch, &actual, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 2));
+                        CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&actual, &expected));
                     }
                 }
             }
@@ -4557,7 +4858,7 @@ void test_ecmult_multi(rustsecp256k1_v0_8_1_scratch *scratch, rustsecp256k1_v0_8
     }
 }
 
-int test_ecmult_multi_random(rustsecp256k1_v0_8_1_scratch *scratch) {
+static int test_ecmult_multi_random(rustsecp256k1_v0_9_0_scratch *scratch) {
     /* Large random test for ecmult_multi_* functions which exercises:
      * - Few or many inputs (0 up to 128, roughly exponentially distributed).
      * - Few or many 0*P or a*INF inputs (roughly uniformly distributed).
@@ -4571,48 +4872,48 @@ int test_ecmult_multi_random(rustsecp256k1_v0_8_1_scratch *scratch) {
      * scalars[0..filled-1] and gejs[0..filled-1] are the scalars and points
      * which form its normal inputs. */
     int filled = 0;
-    rustsecp256k1_v0_8_1_scalar g_scalar = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
-    rustsecp256k1_v0_8_1_scalar scalars[128];
-    rustsecp256k1_v0_8_1_gej gejs[128];
+    rustsecp256k1_v0_9_0_scalar g_scalar = rustsecp256k1_v0_9_0_scalar_zero;
+    rustsecp256k1_v0_9_0_scalar scalars[128];
+    rustsecp256k1_v0_9_0_gej gejs[128];
     /* The expected result, and the computed result. */
-    rustsecp256k1_v0_8_1_gej expected, computed;
+    rustsecp256k1_v0_9_0_gej expected, computed;
     /* Temporaries. */
-    rustsecp256k1_v0_8_1_scalar sc_tmp;
-    rustsecp256k1_v0_8_1_ge ge_tmp;
+    rustsecp256k1_v0_9_0_scalar sc_tmp;
+    rustsecp256k1_v0_9_0_ge ge_tmp;
     /* Variables needed for the actual input to ecmult_multi. */
-    rustsecp256k1_v0_8_1_ge ges[128];
+    rustsecp256k1_v0_9_0_ge ges[128];
     ecmult_multi_data data;
 
     int i;
     /* Which multiplication function to use */
-    int fn = rustsecp256k1_v0_8_1_testrand_int(3);
-    rustsecp256k1_v0_8_1_ecmult_multi_func ecmult_multi = fn == 0 ? rustsecp256k1_v0_8_1_ecmult_multi_var :
-                                               fn == 1 ? rustsecp256k1_v0_8_1_ecmult_strauss_batch_single :
-                                               rustsecp256k1_v0_8_1_ecmult_pippenger_batch_single;
+    int fn = rustsecp256k1_v0_9_0_testrand_int(3);
+    rustsecp256k1_v0_9_0_ecmult_multi_func ecmult_multi = fn == 0 ? rustsecp256k1_v0_9_0_ecmult_multi_var :
+                                               fn == 1 ? rustsecp256k1_v0_9_0_ecmult_strauss_batch_single :
+                                               rustsecp256k1_v0_9_0_ecmult_pippenger_batch_single;
     /* Simulate exponentially distributed num. */
-    int num_bits = 2 + rustsecp256k1_v0_8_1_testrand_int(6);
+    int num_bits = 2 + rustsecp256k1_v0_9_0_testrand_int(6);
     /* Number of (scalar, point) inputs (excluding g). */
-    int num = rustsecp256k1_v0_8_1_testrand_int((1 << num_bits) + 1);
+    int num = rustsecp256k1_v0_9_0_testrand_int((1 << num_bits) + 1);
     /* Number of those which are nonzero. */
-    int num_nonzero = rustsecp256k1_v0_8_1_testrand_int(num + 1);
+    int num_nonzero = rustsecp256k1_v0_9_0_testrand_int(num + 1);
     /* Whether we're aiming to create an input with nonzero expected result. */
-    int nonzero_result = rustsecp256k1_v0_8_1_testrand_bits(1);
+    int nonzero_result = rustsecp256k1_v0_9_0_testrand_bits(1);
     /* Whether we will provide nonzero g multiplicand. In some cases our hand
      * is forced here based on num_nonzero and nonzero_result. */
     int g_nonzero = num_nonzero == 0 ? nonzero_result :
                     num_nonzero == 1 && !nonzero_result ? 1 :
-                    (int)rustsecp256k1_v0_8_1_testrand_bits(1);
+                    (int)rustsecp256k1_v0_9_0_testrand_bits(1);
     /* Which g_scalar pointer to pass into ecmult_multi(). */
-    const rustsecp256k1_v0_8_1_scalar* g_scalar_ptr = (g_nonzero || rustsecp256k1_v0_8_1_testrand_bits(1)) ? &g_scalar : NULL;
+    const rustsecp256k1_v0_9_0_scalar* g_scalar_ptr = (g_nonzero || rustsecp256k1_v0_9_0_testrand_bits(1)) ? &g_scalar : NULL;
     /* How many EC multiplications were performed in this function. */
     int mults = 0;
     /* How many randomization steps to apply to the input list. */
-    int rands = (int)rustsecp256k1_v0_8_1_testrand_bits(3);
+    int rands = (int)rustsecp256k1_v0_9_0_testrand_bits(3);
     if (rands > num_nonzero) rands = num_nonzero;
 
-    rustsecp256k1_v0_8_1_gej_set_infinity(&expected);
-    rustsecp256k1_v0_8_1_gej_set_infinity(&gejs[0]);
-    rustsecp256k1_v0_8_1_scalar_set_int(&scalars[0], 0);
+    rustsecp256k1_v0_9_0_gej_set_infinity(&expected);
+    rustsecp256k1_v0_9_0_gej_set_infinity(&gejs[0]);
+    rustsecp256k1_v0_9_0_scalar_set_int(&scalars[0], 0);
 
     if (g_nonzero) {
         /* If g_nonzero, set g_scalar to nonzero value r. */
@@ -4621,10 +4922,10 @@ int test_ecmult_multi_random(rustsecp256k1_v0_8_1_scratch *scratch) {
             /* If expected=0 is desired, add a (a*r, -(1/a)*g) term to compensate. */
             CHECK(num_nonzero > filled);
             random_scalar_order_test(&sc_tmp);
-            rustsecp256k1_v0_8_1_scalar_mul(&scalars[filled], &sc_tmp, &g_scalar);
-            rustsecp256k1_v0_8_1_scalar_inverse_var(&sc_tmp, &sc_tmp);
-            rustsecp256k1_v0_8_1_scalar_negate(&sc_tmp, &sc_tmp);
-            rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &gejs[filled], &sc_tmp);
+            rustsecp256k1_v0_9_0_scalar_mul(&scalars[filled], &sc_tmp, &g_scalar);
+            rustsecp256k1_v0_9_0_scalar_inverse_var(&sc_tmp, &sc_tmp);
+            rustsecp256k1_v0_9_0_scalar_negate(&sc_tmp, &sc_tmp);
+            rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &gejs[filled], &sc_tmp);
             ++filled;
             ++mults;
         }
@@ -4634,14 +4935,14 @@ int test_ecmult_multi_random(rustsecp256k1_v0_8_1_scratch *scratch) {
         /* If a nonzero result is desired, and there is space, add a random nonzero term. */
         random_scalar_order_test(&scalars[filled]);
         random_group_element_test(&ge_tmp);
-        rustsecp256k1_v0_8_1_gej_set_ge(&gejs[filled], &ge_tmp);
+        rustsecp256k1_v0_9_0_gej_set_ge(&gejs[filled], &ge_tmp);
         ++filled;
     }
 
     if (nonzero_result) {
         /* Compute the expected result using normal ecmult. */
         CHECK(filled <= 1);
-        rustsecp256k1_v0_8_1_ecmult(&expected, &gejs[0], &scalars[0], &g_scalar);
+        rustsecp256k1_v0_9_0_ecmult(&expected, &gejs[0], &scalars[0], &g_scalar);
         mults += filled + g_nonzero;
     }
 
@@ -4652,13 +4953,13 @@ int test_ecmult_multi_random(rustsecp256k1_v0_8_1_scratch *scratch) {
     /* Add entries to scalars,gejs so that there are num of them. All the added entries
      * either have scalar=0 or point=infinity, so these do not change the expected result. */
     while (filled < num) {
-        if (rustsecp256k1_v0_8_1_testrand_bits(1)) {
-            rustsecp256k1_v0_8_1_gej_set_infinity(&gejs[filled]);
+        if (rustsecp256k1_v0_9_0_testrand_bits(1)) {
+            rustsecp256k1_v0_9_0_gej_set_infinity(&gejs[filled]);
             random_scalar_order_test(&scalars[filled]);
         } else {
-            rustsecp256k1_v0_8_1_scalar_set_int(&scalars[filled], 0);
+            rustsecp256k1_v0_9_0_scalar_set_int(&scalars[filled], 0);
             random_group_element_test(&ge_tmp);
-            rustsecp256k1_v0_8_1_gej_set_ge(&gejs[filled], &ge_tmp);
+            rustsecp256k1_v0_9_0_gej_set_ge(&gejs[filled], &ge_tmp);
         }
         ++filled;
     }
@@ -4668,13 +4969,13 @@ int test_ecmult_multi_random(rustsecp256k1_v0_8_1_scratch *scratch) {
      * convert some of them to be both non-0-scalar and non-infinity-point. */
     for (i = 0; i < rands; ++i) {
         int j;
-        rustsecp256k1_v0_8_1_scalar v, iv;
+        rustsecp256k1_v0_9_0_scalar v, iv;
         /* Shuffle the entries. */
         for (j = 0; j < num_nonzero; ++j) {
-            int k = rustsecp256k1_v0_8_1_testrand_int(num_nonzero - j);
+            int k = rustsecp256k1_v0_9_0_testrand_int(num_nonzero - j);
             if (k != 0) {
-                rustsecp256k1_v0_8_1_gej gej = gejs[j];
-                rustsecp256k1_v0_8_1_scalar sc = scalars[j];
+                rustsecp256k1_v0_9_0_gej gej = gejs[j];
+                rustsecp256k1_v0_9_0_scalar sc = scalars[j];
                 gejs[j] = gejs[j + k];
                 scalars[j] = scalars[j + k];
                 gejs[j + k] = gej;
@@ -4684,26 +4985,26 @@ int test_ecmult_multi_random(rustsecp256k1_v0_8_1_scratch *scratch) {
         /* Perturb all consecutive pairs of inputs:
          * a*P + b*Q -> (a+b)*P + b*(Q-P). */
         for (j = 0; j + 1 < num_nonzero; j += 2) {
-            rustsecp256k1_v0_8_1_gej gej;
-            rustsecp256k1_v0_8_1_scalar_add(&scalars[j], &scalars[j], &scalars[j+1]);
-            rustsecp256k1_v0_8_1_gej_neg(&gej, &gejs[j]);
-            rustsecp256k1_v0_8_1_gej_add_var(&gejs[j+1], &gejs[j+1], &gej, NULL);
+            rustsecp256k1_v0_9_0_gej gej;
+            rustsecp256k1_v0_9_0_scalar_add(&scalars[j], &scalars[j], &scalars[j+1]);
+            rustsecp256k1_v0_9_0_gej_neg(&gej, &gejs[j]);
+            rustsecp256k1_v0_9_0_gej_add_var(&gejs[j+1], &gejs[j+1], &gej, NULL);
         }
         /* Transform the last input: a*P -> (v*a) * ((1/v)*P). */
         CHECK(num_nonzero >= 1);
         random_scalar_order_test(&v);
-        rustsecp256k1_v0_8_1_scalar_inverse(&iv, &v);
-        rustsecp256k1_v0_8_1_scalar_mul(&scalars[num_nonzero - 1], &scalars[num_nonzero - 1], &v);
-        rustsecp256k1_v0_8_1_ecmult(&gejs[num_nonzero - 1], &gejs[num_nonzero - 1], &iv, NULL);
+        rustsecp256k1_v0_9_0_scalar_inverse(&iv, &v);
+        rustsecp256k1_v0_9_0_scalar_mul(&scalars[num_nonzero - 1], &scalars[num_nonzero - 1], &v);
+        rustsecp256k1_v0_9_0_ecmult(&gejs[num_nonzero - 1], &gejs[num_nonzero - 1], &iv, NULL);
         ++mults;
     }
 
     /* Shuffle all entries (0..num-1). */
     for (i = 0; i < num; ++i) {
-        int j = rustsecp256k1_v0_8_1_testrand_int(num - i);
+        int j = rustsecp256k1_v0_9_0_testrand_int(num - i);
         if (j != 0) {
-            rustsecp256k1_v0_8_1_gej gej = gejs[i];
-            rustsecp256k1_v0_8_1_scalar sc = scalars[i];
+            rustsecp256k1_v0_9_0_gej gej = gejs[i];
+            rustsecp256k1_v0_9_0_scalar sc = scalars[i];
             gejs[i] = gejs[i + j];
             scalars[i] = scalars[i + j];
             gejs[i + j] = gej;
@@ -4712,49 +5013,47 @@ int test_ecmult_multi_random(rustsecp256k1_v0_8_1_scratch *scratch) {
     }
 
     /* Compute affine versions of all inputs. */
-    rustsecp256k1_v0_8_1_ge_set_all_gej_var(ges, gejs, filled);
+    rustsecp256k1_v0_9_0_ge_set_all_gej_var(ges, gejs, filled);
     /* Invoke ecmult_multi code. */
     data.sc = scalars;
     data.pt = ges;
-    CHECK(ecmult_multi(&ctx->error_callback, scratch, &computed, g_scalar_ptr, ecmult_multi_callback, &data, filled));
+    CHECK(ecmult_multi(&CTX->error_callback, scratch, &computed, g_scalar_ptr, ecmult_multi_callback, &data, filled));
     mults += num_nonzero + g_nonzero;
     /* Compare with expected result. */
-    CHECK(rustsecp256k1_v0_8_1_gej_eq_var(&computed, &expected));
+    CHECK(rustsecp256k1_v0_9_0_gej_eq_var(&computed, &expected));
     return mults;
 }
 
-void test_ecmult_multi_batch_single(rustsecp256k1_v0_8_1_ecmult_multi_func ecmult_multi) {
-    rustsecp256k1_v0_8_1_scalar szero;
-    rustsecp256k1_v0_8_1_scalar sc;
-    rustsecp256k1_v0_8_1_ge pt;
-    rustsecp256k1_v0_8_1_gej r;
+static void test_ecmult_multi_batch_single(rustsecp256k1_v0_9_0_ecmult_multi_func ecmult_multi) {
+    rustsecp256k1_v0_9_0_scalar sc;
+    rustsecp256k1_v0_9_0_ge pt;
+    rustsecp256k1_v0_9_0_gej r;
     ecmult_multi_data data;
-    rustsecp256k1_v0_8_1_scratch *scratch_empty;
+    rustsecp256k1_v0_9_0_scratch *scratch_empty;
 
     random_group_element_test(&pt);
     random_scalar_order(&sc);
     data.sc = &sc;
     data.pt = &pt;
-    rustsecp256k1_v0_8_1_scalar_set_int(&szero, 0);
 
     /* Try to multiply 1 point, but scratch space is empty.*/
-    scratch_empty = rustsecp256k1_v0_8_1_scratch_create(&ctx->error_callback, 0);
-    CHECK(!ecmult_multi(&ctx->error_callback, scratch_empty, &r, &szero, ecmult_multi_callback, &data, 1));
-    rustsecp256k1_v0_8_1_scratch_destroy(&ctx->error_callback, scratch_empty);
+    scratch_empty = rustsecp256k1_v0_9_0_scratch_create(&CTX->error_callback, 0);
+    CHECK(!ecmult_multi(&CTX->error_callback, scratch_empty, &r, &rustsecp256k1_v0_9_0_scalar_zero, ecmult_multi_callback, &data, 1));
+    rustsecp256k1_v0_9_0_scratch_destroy(&CTX->error_callback, scratch_empty);
 }
 
-void test_rustsecp256k1_v0_8_1_pippenger_bucket_window_inv(void) {
+static void test_rustsecp256k1_v0_9_0_pippenger_bucket_window_inv(void) {
     int i;
 
-    CHECK(rustsecp256k1_v0_8_1_pippenger_bucket_window_inv(0) == 0);
+    CHECK(rustsecp256k1_v0_9_0_pippenger_bucket_window_inv(0) == 0);
     for(i = 1; i <= PIPPENGER_MAX_BUCKET_WINDOW; i++) {
         /* Bucket_window of 8 is not used with endo */
         if (i == 8) {
             continue;
         }
-        CHECK(rustsecp256k1_v0_8_1_pippenger_bucket_window(rustsecp256k1_v0_8_1_pippenger_bucket_window_inv(i)) == i);
+        CHECK(rustsecp256k1_v0_9_0_pippenger_bucket_window(rustsecp256k1_v0_9_0_pippenger_bucket_window_inv(i)) == i);
         if (i != PIPPENGER_MAX_BUCKET_WINDOW) {
-            CHECK(rustsecp256k1_v0_8_1_pippenger_bucket_window(rustsecp256k1_v0_8_1_pippenger_bucket_window_inv(i)+1) > i);
+            CHECK(rustsecp256k1_v0_9_0_pippenger_bucket_window(rustsecp256k1_v0_9_0_pippenger_bucket_window_inv(i)+1) > i);
         }
     }
 }
@@ -4763,10 +5062,10 @@ void test_rustsecp256k1_v0_8_1_pippenger_bucket_window_inv(void) {
  * Probabilistically test the function returning the maximum number of possible points
  * for a given scratch space.
  */
-void test_ecmult_multi_pippenger_max_points(void) {
-    size_t scratch_size = rustsecp256k1_v0_8_1_testrand_bits(8);
-    size_t max_size = rustsecp256k1_v0_8_1_pippenger_scratch_size(rustsecp256k1_v0_8_1_pippenger_bucket_window_inv(PIPPENGER_MAX_BUCKET_WINDOW-1)+512, 12);
-    rustsecp256k1_v0_8_1_scratch *scratch;
+static void test_ecmult_multi_pippenger_max_points(void) {
+    size_t scratch_size = rustsecp256k1_v0_9_0_testrand_bits(8);
+    size_t max_size = rustsecp256k1_v0_9_0_pippenger_scratch_size(rustsecp256k1_v0_9_0_pippenger_bucket_window_inv(PIPPENGER_MAX_BUCKET_WINDOW-1)+512, 12);
+    rustsecp256k1_v0_9_0_scratch *scratch;
     size_t n_points_supported;
     int bucket_window = 0;
 
@@ -4774,183 +5073,181 @@ void test_ecmult_multi_pippenger_max_points(void) {
         size_t i;
         size_t total_alloc;
         size_t checkpoint;
-        scratch = rustsecp256k1_v0_8_1_scratch_create(&ctx->error_callback, scratch_size);
+        scratch = rustsecp256k1_v0_9_0_scratch_create(&CTX->error_callback, scratch_size);
         CHECK(scratch != NULL);
-        checkpoint = rustsecp256k1_v0_8_1_scratch_checkpoint(&ctx->error_callback, scratch);
-        n_points_supported = rustsecp256k1_v0_8_1_pippenger_max_points(&ctx->error_callback, scratch);
+        checkpoint = rustsecp256k1_v0_9_0_scratch_checkpoint(&CTX->error_callback, scratch);
+        n_points_supported = rustsecp256k1_v0_9_0_pippenger_max_points(&CTX->error_callback, scratch);
         if (n_points_supported == 0) {
-            rustsecp256k1_v0_8_1_scratch_destroy(&ctx->error_callback, scratch);
+            rustsecp256k1_v0_9_0_scratch_destroy(&CTX->error_callback, scratch);
             continue;
         }
-        bucket_window = rustsecp256k1_v0_8_1_pippenger_bucket_window(n_points_supported);
+        bucket_window = rustsecp256k1_v0_9_0_pippenger_bucket_window(n_points_supported);
         /* allocate `total_alloc` bytes over `PIPPENGER_SCRATCH_OBJECTS` many allocations */
-        total_alloc = rustsecp256k1_v0_8_1_pippenger_scratch_size(n_points_supported, bucket_window);
+        total_alloc = rustsecp256k1_v0_9_0_pippenger_scratch_size(n_points_supported, bucket_window);
         for (i = 0; i < PIPPENGER_SCRATCH_OBJECTS - 1; i++) {
-            CHECK(rustsecp256k1_v0_8_1_scratch_alloc(&ctx->error_callback, scratch, 1));
+            CHECK(rustsecp256k1_v0_9_0_scratch_alloc(&CTX->error_callback, scratch, 1));
             total_alloc--;
         }
-        CHECK(rustsecp256k1_v0_8_1_scratch_alloc(&ctx->error_callback, scratch, total_alloc));
-        rustsecp256k1_v0_8_1_scratch_apply_checkpoint(&ctx->error_callback, scratch, checkpoint);
-        rustsecp256k1_v0_8_1_scratch_destroy(&ctx->error_callback, scratch);
+        CHECK(rustsecp256k1_v0_9_0_scratch_alloc(&CTX->error_callback, scratch, total_alloc));
+        rustsecp256k1_v0_9_0_scratch_apply_checkpoint(&CTX->error_callback, scratch, checkpoint);
+        rustsecp256k1_v0_9_0_scratch_destroy(&CTX->error_callback, scratch);
     }
     CHECK(bucket_window == PIPPENGER_MAX_BUCKET_WINDOW);
 }
 
-void test_ecmult_multi_batch_size_helper(void) {
+static void test_ecmult_multi_batch_size_helper(void) {
     size_t n_batches, n_batch_points, max_n_batch_points, n;
 
     max_n_batch_points = 0;
     n = 1;
-    CHECK(rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 0);
 
     max_n_batch_points = 1;
     n = 0;
-    CHECK(rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
     CHECK(n_batches == 0);
     CHECK(n_batch_points == 0);
 
     max_n_batch_points = 2;
     n = 5;
-    CHECK(rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
     CHECK(n_batches == 3);
     CHECK(n_batch_points == 2);
 
     max_n_batch_points = ECMULT_MAX_POINTS_PER_BATCH;
     n = ECMULT_MAX_POINTS_PER_BATCH;
-    CHECK(rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
     CHECK(n_batches == 1);
     CHECK(n_batch_points == ECMULT_MAX_POINTS_PER_BATCH);
 
     max_n_batch_points = ECMULT_MAX_POINTS_PER_BATCH + 1;
     n = ECMULT_MAX_POINTS_PER_BATCH + 1;
-    CHECK(rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
     CHECK(n_batches == 2);
     CHECK(n_batch_points == ECMULT_MAX_POINTS_PER_BATCH/2 + 1);
 
     max_n_batch_points = 1;
     n = SIZE_MAX;
-    CHECK(rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
     CHECK(n_batches == SIZE_MAX);
     CHECK(n_batch_points == 1);
 
     max_n_batch_points = 2;
     n = SIZE_MAX;
-    CHECK(rustsecp256k1_v0_8_1_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecmult_multi_batch_size_helper(&n_batches, &n_batch_points, max_n_batch_points, n) == 1);
     CHECK(n_batches == SIZE_MAX/2 + 1);
     CHECK(n_batch_points == 2);
 }
 
 /**
- * Run rustsecp256k1_v0_8_1_ecmult_multi_var with num points and a scratch space restricted to
+ * Run rustsecp256k1_v0_9_0_ecmult_multi_var with num points and a scratch space restricted to
  * 1 <= i <= num points.
  */
-void test_ecmult_multi_batching(void) {
+static void test_ecmult_multi_batching(void) {
     static const int n_points = 2*ECMULT_PIPPENGER_THRESHOLD;
-    rustsecp256k1_v0_8_1_scalar scG;
-    rustsecp256k1_v0_8_1_scalar szero;
-    rustsecp256k1_v0_8_1_scalar *sc = (rustsecp256k1_v0_8_1_scalar *)checked_malloc(&ctx->error_callback, sizeof(rustsecp256k1_v0_8_1_scalar) * n_points);
-    rustsecp256k1_v0_8_1_ge *pt = (rustsecp256k1_v0_8_1_ge *)checked_malloc(&ctx->error_callback, sizeof(rustsecp256k1_v0_8_1_ge) * n_points);
-    rustsecp256k1_v0_8_1_gej r;
-    rustsecp256k1_v0_8_1_gej r2;
+    rustsecp256k1_v0_9_0_scalar scG;
+    rustsecp256k1_v0_9_0_scalar *sc = (rustsecp256k1_v0_9_0_scalar *)checked_malloc(&CTX->error_callback, sizeof(rustsecp256k1_v0_9_0_scalar) * n_points);
+    rustsecp256k1_v0_9_0_ge *pt = (rustsecp256k1_v0_9_0_ge *)checked_malloc(&CTX->error_callback, sizeof(rustsecp256k1_v0_9_0_ge) * n_points);
+    rustsecp256k1_v0_9_0_gej r;
+    rustsecp256k1_v0_9_0_gej r2;
     ecmult_multi_data data;
     int i;
-    rustsecp256k1_v0_8_1_scratch *scratch;
+    rustsecp256k1_v0_9_0_scratch *scratch;
 
-    rustsecp256k1_v0_8_1_gej_set_infinity(&r2);
-    rustsecp256k1_v0_8_1_scalar_set_int(&szero, 0);
+    rustsecp256k1_v0_9_0_gej_set_infinity(&r2);
 
     /* Get random scalars and group elements and compute result */
     random_scalar_order(&scG);
-    rustsecp256k1_v0_8_1_ecmult(&r2, &r2, &szero, &scG);
+    rustsecp256k1_v0_9_0_ecmult(&r2, &r2, &rustsecp256k1_v0_9_0_scalar_zero, &scG);
     for(i = 0; i < n_points; i++) {
-        rustsecp256k1_v0_8_1_ge ptg;
-        rustsecp256k1_v0_8_1_gej ptgj;
+        rustsecp256k1_v0_9_0_ge ptg;
+        rustsecp256k1_v0_9_0_gej ptgj;
         random_group_element_test(&ptg);
-        rustsecp256k1_v0_8_1_gej_set_ge(&ptgj, &ptg);
+        rustsecp256k1_v0_9_0_gej_set_ge(&ptgj, &ptg);
         pt[i] = ptg;
         random_scalar_order(&sc[i]);
-        rustsecp256k1_v0_8_1_ecmult(&ptgj, &ptgj, &sc[i], NULL);
-        rustsecp256k1_v0_8_1_gej_add_var(&r2, &r2, &ptgj, NULL);
+        rustsecp256k1_v0_9_0_ecmult(&ptgj, &ptgj, &sc[i], NULL);
+        rustsecp256k1_v0_9_0_gej_add_var(&r2, &r2, &ptgj, NULL);
     }
     data.sc = sc;
     data.pt = pt;
-    rustsecp256k1_v0_8_1_gej_neg(&r2, &r2);
+    rustsecp256k1_v0_9_0_gej_neg(&r2, &r2);
 
     /* Test with empty scratch space. It should compute the correct result using
      * ecmult_mult_simple algorithm which doesn't require a scratch space. */
-    scratch = rustsecp256k1_v0_8_1_scratch_create(&ctx->error_callback, 0);
-    CHECK(rustsecp256k1_v0_8_1_ecmult_multi_var(&ctx->error_callback, scratch, &r, &scG, ecmult_multi_callback, &data, n_points));
-    rustsecp256k1_v0_8_1_gej_add_var(&r, &r, &r2, NULL);
-    CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&r));
-    rustsecp256k1_v0_8_1_scratch_destroy(&ctx->error_callback, scratch);
+    scratch = rustsecp256k1_v0_9_0_scratch_create(&CTX->error_callback, 0);
+    CHECK(rustsecp256k1_v0_9_0_ecmult_multi_var(&CTX->error_callback, scratch, &r, &scG, ecmult_multi_callback, &data, n_points));
+    rustsecp256k1_v0_9_0_gej_add_var(&r, &r, &r2, NULL);
+    CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&r));
+    rustsecp256k1_v0_9_0_scratch_destroy(&CTX->error_callback, scratch);
 
     /* Test with space for 1 point in pippenger. That's not enough because
      * ecmult_multi selects strauss which requires more memory. It should
      * therefore select the simple algorithm. */
-    scratch = rustsecp256k1_v0_8_1_scratch_create(&ctx->error_callback, rustsecp256k1_v0_8_1_pippenger_scratch_size(1, 1) + PIPPENGER_SCRATCH_OBJECTS*ALIGNMENT);
-    CHECK(rustsecp256k1_v0_8_1_ecmult_multi_var(&ctx->error_callback, scratch, &r, &scG, ecmult_multi_callback, &data, n_points));
-    rustsecp256k1_v0_8_1_gej_add_var(&r, &r, &r2, NULL);
-    CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&r));
-    rustsecp256k1_v0_8_1_scratch_destroy(&ctx->error_callback, scratch);
+    scratch = rustsecp256k1_v0_9_0_scratch_create(&CTX->error_callback, rustsecp256k1_v0_9_0_pippenger_scratch_size(1, 1) + PIPPENGER_SCRATCH_OBJECTS*ALIGNMENT);
+    CHECK(rustsecp256k1_v0_9_0_ecmult_multi_var(&CTX->error_callback, scratch, &r, &scG, ecmult_multi_callback, &data, n_points));
+    rustsecp256k1_v0_9_0_gej_add_var(&r, &r, &r2, NULL);
+    CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&r));
+    rustsecp256k1_v0_9_0_scratch_destroy(&CTX->error_callback, scratch);
 
     for(i = 1; i <= n_points; i++) {
         if (i > ECMULT_PIPPENGER_THRESHOLD) {
-            int bucket_window = rustsecp256k1_v0_8_1_pippenger_bucket_window(i);
-            size_t scratch_size = rustsecp256k1_v0_8_1_pippenger_scratch_size(i, bucket_window);
-            scratch = rustsecp256k1_v0_8_1_scratch_create(&ctx->error_callback, scratch_size + PIPPENGER_SCRATCH_OBJECTS*ALIGNMENT);
+            int bucket_window = rustsecp256k1_v0_9_0_pippenger_bucket_window(i);
+            size_t scratch_size = rustsecp256k1_v0_9_0_pippenger_scratch_size(i, bucket_window);
+            scratch = rustsecp256k1_v0_9_0_scratch_create(&CTX->error_callback, scratch_size + PIPPENGER_SCRATCH_OBJECTS*ALIGNMENT);
         } else {
-            size_t scratch_size = rustsecp256k1_v0_8_1_strauss_scratch_size(i);
-            scratch = rustsecp256k1_v0_8_1_scratch_create(&ctx->error_callback, scratch_size + STRAUSS_SCRATCH_OBJECTS*ALIGNMENT);
+            size_t scratch_size = rustsecp256k1_v0_9_0_strauss_scratch_size(i);
+            scratch = rustsecp256k1_v0_9_0_scratch_create(&CTX->error_callback, scratch_size + STRAUSS_SCRATCH_OBJECTS*ALIGNMENT);
         }
-        CHECK(rustsecp256k1_v0_8_1_ecmult_multi_var(&ctx->error_callback, scratch, &r, &scG, ecmult_multi_callback, &data, n_points));
-        rustsecp256k1_v0_8_1_gej_add_var(&r, &r, &r2, NULL);
-        CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&r));
-        rustsecp256k1_v0_8_1_scratch_destroy(&ctx->error_callback, scratch);
+        CHECK(rustsecp256k1_v0_9_0_ecmult_multi_var(&CTX->error_callback, scratch, &r, &scG, ecmult_multi_callback, &data, n_points));
+        rustsecp256k1_v0_9_0_gej_add_var(&r, &r, &r2, NULL);
+        CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&r));
+        rustsecp256k1_v0_9_0_scratch_destroy(&CTX->error_callback, scratch);
     }
     free(sc);
     free(pt);
 }
 
-void run_ecmult_multi_tests(void) {
-    rustsecp256k1_v0_8_1_scratch *scratch;
-    int64_t todo = (int64_t)320 * count;
+static void run_ecmult_multi_tests(void) {
+    rustsecp256k1_v0_9_0_scratch *scratch;
+    int64_t todo = (int64_t)320 * COUNT;
 
-    test_rustsecp256k1_v0_8_1_pippenger_bucket_window_inv();
+    test_rustsecp256k1_v0_9_0_pippenger_bucket_window_inv();
     test_ecmult_multi_pippenger_max_points();
-    scratch = rustsecp256k1_v0_8_1_scratch_create(&ctx->error_callback, 819200);
-    test_ecmult_multi(scratch, rustsecp256k1_v0_8_1_ecmult_multi_var);
-    test_ecmult_multi(NULL, rustsecp256k1_v0_8_1_ecmult_multi_var);
-    test_ecmult_multi(scratch, rustsecp256k1_v0_8_1_ecmult_pippenger_batch_single);
-    test_ecmult_multi_batch_single(rustsecp256k1_v0_8_1_ecmult_pippenger_batch_single);
-    test_ecmult_multi(scratch, rustsecp256k1_v0_8_1_ecmult_strauss_batch_single);
-    test_ecmult_multi_batch_single(rustsecp256k1_v0_8_1_ecmult_strauss_batch_single);
+    scratch = rustsecp256k1_v0_9_0_scratch_create(&CTX->error_callback, 819200);
+    test_ecmult_multi(scratch, rustsecp256k1_v0_9_0_ecmult_multi_var);
+    test_ecmult_multi(NULL, rustsecp256k1_v0_9_0_ecmult_multi_var);
+    test_ecmult_multi(scratch, rustsecp256k1_v0_9_0_ecmult_pippenger_batch_single);
+    test_ecmult_multi_batch_single(rustsecp256k1_v0_9_0_ecmult_pippenger_batch_single);
+    test_ecmult_multi(scratch, rustsecp256k1_v0_9_0_ecmult_strauss_batch_single);
+    test_ecmult_multi_batch_single(rustsecp256k1_v0_9_0_ecmult_strauss_batch_single);
     while (todo > 0) {
         todo -= test_ecmult_multi_random(scratch);
     }
-    rustsecp256k1_v0_8_1_scratch_destroy(&ctx->error_callback, scratch);
+    rustsecp256k1_v0_9_0_scratch_destroy(&CTX->error_callback, scratch);
 
     /* Run test_ecmult_multi with space for exactly one point */
-    scratch = rustsecp256k1_v0_8_1_scratch_create(&ctx->error_callback, rustsecp256k1_v0_8_1_strauss_scratch_size(1) + STRAUSS_SCRATCH_OBJECTS*ALIGNMENT);
-    test_ecmult_multi(scratch, rustsecp256k1_v0_8_1_ecmult_multi_var);
-    rustsecp256k1_v0_8_1_scratch_destroy(&ctx->error_callback, scratch);
+    scratch = rustsecp256k1_v0_9_0_scratch_create(&CTX->error_callback, rustsecp256k1_v0_9_0_strauss_scratch_size(1) + STRAUSS_SCRATCH_OBJECTS*ALIGNMENT);
+    test_ecmult_multi(scratch, rustsecp256k1_v0_9_0_ecmult_multi_var);
+    rustsecp256k1_v0_9_0_scratch_destroy(&CTX->error_callback, scratch);
 
     test_ecmult_multi_batch_size_helper();
     test_ecmult_multi_batching();
 }
 
-void test_wnaf(const rustsecp256k1_v0_8_1_scalar *number, int w) {
-    rustsecp256k1_v0_8_1_scalar x, two, t;
+static void test_wnaf(const rustsecp256k1_v0_9_0_scalar *number, int w) {
+    rustsecp256k1_v0_9_0_scalar x, two, t;
     int wnaf[256];
     int zeroes = -1;
     int i;
     int bits;
-    rustsecp256k1_v0_8_1_scalar_set_int(&x, 0);
-    rustsecp256k1_v0_8_1_scalar_set_int(&two, 2);
-    bits = rustsecp256k1_v0_8_1_ecmult_wnaf(wnaf, 256, number, w);
+    rustsecp256k1_v0_9_0_scalar_set_int(&x, 0);
+    rustsecp256k1_v0_9_0_scalar_set_int(&two, 2);
+    bits = rustsecp256k1_v0_9_0_ecmult_wnaf(wnaf, 256, number, w);
     CHECK(bits <= 256);
     for (i = bits-1; i >= 0; i--) {
         int v = wnaf[i];
-        rustsecp256k1_v0_8_1_scalar_mul(&x, &x, &two);
+        rustsecp256k1_v0_9_0_scalar_mul(&x, &x, &two);
         if (v) {
             CHECK(zeroes == -1 || zeroes >= w-1); /* check that distance between non-zero elements is at least w-1 */
             zeroes=0;
@@ -4962,109 +5259,109 @@ void test_wnaf(const rustsecp256k1_v0_8_1_scalar *number, int w) {
             zeroes++;
         }
         if (v >= 0) {
-            rustsecp256k1_v0_8_1_scalar_set_int(&t, v);
+            rustsecp256k1_v0_9_0_scalar_set_int(&t, v);
         } else {
-            rustsecp256k1_v0_8_1_scalar_set_int(&t, -v);
-            rustsecp256k1_v0_8_1_scalar_negate(&t, &t);
+            rustsecp256k1_v0_9_0_scalar_set_int(&t, -v);
+            rustsecp256k1_v0_9_0_scalar_negate(&t, &t);
         }
-        rustsecp256k1_v0_8_1_scalar_add(&x, &x, &t);
+        rustsecp256k1_v0_9_0_scalar_add(&x, &x, &t);
     }
-    CHECK(rustsecp256k1_v0_8_1_scalar_eq(&x, number)); /* check that wnaf represents number */
+    CHECK(rustsecp256k1_v0_9_0_scalar_eq(&x, number)); /* check that wnaf represents number */
 }
 
-void test_constant_wnaf_negate(const rustsecp256k1_v0_8_1_scalar *number) {
-    rustsecp256k1_v0_8_1_scalar neg1 = *number;
-    rustsecp256k1_v0_8_1_scalar neg2 = *number;
+static void test_constant_wnaf_negate(const rustsecp256k1_v0_9_0_scalar *number) {
+    rustsecp256k1_v0_9_0_scalar neg1 = *number;
+    rustsecp256k1_v0_9_0_scalar neg2 = *number;
     int sign1 = 1;
     int sign2 = 1;
 
-    if (!rustsecp256k1_v0_8_1_scalar_get_bits(&neg1, 0, 1)) {
-        rustsecp256k1_v0_8_1_scalar_negate(&neg1, &neg1);
+    if (!rustsecp256k1_v0_9_0_scalar_get_bits(&neg1, 0, 1)) {
+        rustsecp256k1_v0_9_0_scalar_negate(&neg1, &neg1);
         sign1 = -1;
     }
-    sign2 = rustsecp256k1_v0_8_1_scalar_cond_negate(&neg2, rustsecp256k1_v0_8_1_scalar_is_even(&neg2));
+    sign2 = rustsecp256k1_v0_9_0_scalar_cond_negate(&neg2, rustsecp256k1_v0_9_0_scalar_is_even(&neg2));
     CHECK(sign1 == sign2);
-    CHECK(rustsecp256k1_v0_8_1_scalar_eq(&neg1, &neg2));
+    CHECK(rustsecp256k1_v0_9_0_scalar_eq(&neg1, &neg2));
 }
 
-void test_constant_wnaf(const rustsecp256k1_v0_8_1_scalar *number, int w) {
-    rustsecp256k1_v0_8_1_scalar x, shift;
+static void test_constant_wnaf(const rustsecp256k1_v0_9_0_scalar *number, int w) {
+    rustsecp256k1_v0_9_0_scalar x, shift;
     int wnaf[256] = {0};
     int i;
     int skew;
     int bits = 256;
-    rustsecp256k1_v0_8_1_scalar num = *number;
-    rustsecp256k1_v0_8_1_scalar scalar_skew;
+    rustsecp256k1_v0_9_0_scalar num = *number;
+    rustsecp256k1_v0_9_0_scalar scalar_skew;
 
-    rustsecp256k1_v0_8_1_scalar_set_int(&x, 0);
-    rustsecp256k1_v0_8_1_scalar_set_int(&shift, 1 << w);
+    rustsecp256k1_v0_9_0_scalar_set_int(&x, 0);
+    rustsecp256k1_v0_9_0_scalar_set_int(&shift, 1 << w);
     for (i = 0; i < 16; ++i) {
-        rustsecp256k1_v0_8_1_scalar_shr_int(&num, 8);
+        rustsecp256k1_v0_9_0_scalar_shr_int(&num, 8);
     }
     bits = 128;
-    skew = rustsecp256k1_v0_8_1_wnaf_const(wnaf, &num, w, bits);
+    skew = rustsecp256k1_v0_9_0_wnaf_const(wnaf, &num, w, bits);
 
     for (i = WNAF_SIZE_BITS(bits, w); i >= 0; --i) {
-        rustsecp256k1_v0_8_1_scalar t;
+        rustsecp256k1_v0_9_0_scalar t;
         int v = wnaf[i];
         CHECK(v != 0); /* check nonzero */
         CHECK(v & 1);  /* check parity */
         CHECK(v > -(1 << w)); /* check range above */
         CHECK(v < (1 << w));  /* check range below */
 
-        rustsecp256k1_v0_8_1_scalar_mul(&x, &x, &shift);
+        rustsecp256k1_v0_9_0_scalar_mul(&x, &x, &shift);
         if (v >= 0) {
-            rustsecp256k1_v0_8_1_scalar_set_int(&t, v);
+            rustsecp256k1_v0_9_0_scalar_set_int(&t, v);
         } else {
-            rustsecp256k1_v0_8_1_scalar_set_int(&t, -v);
-            rustsecp256k1_v0_8_1_scalar_negate(&t, &t);
+            rustsecp256k1_v0_9_0_scalar_set_int(&t, -v);
+            rustsecp256k1_v0_9_0_scalar_negate(&t, &t);
         }
-        rustsecp256k1_v0_8_1_scalar_add(&x, &x, &t);
+        rustsecp256k1_v0_9_0_scalar_add(&x, &x, &t);
     }
     /* Skew num because when encoding numbers as odd we use an offset */
-    rustsecp256k1_v0_8_1_scalar_set_int(&scalar_skew, skew);
-    rustsecp256k1_v0_8_1_scalar_add(&num, &num, &scalar_skew);
-    CHECK(rustsecp256k1_v0_8_1_scalar_eq(&x, &num));
+    rustsecp256k1_v0_9_0_scalar_set_int(&scalar_skew, skew);
+    rustsecp256k1_v0_9_0_scalar_add(&num, &num, &scalar_skew);
+    CHECK(rustsecp256k1_v0_9_0_scalar_eq(&x, &num));
 }
 
-void test_fixed_wnaf(const rustsecp256k1_v0_8_1_scalar *number, int w) {
-    rustsecp256k1_v0_8_1_scalar x, shift;
+static void test_fixed_wnaf(const rustsecp256k1_v0_9_0_scalar *number, int w) {
+    rustsecp256k1_v0_9_0_scalar x, shift;
     int wnaf[256] = {0};
     int i;
     int skew;
-    rustsecp256k1_v0_8_1_scalar num = *number;
+    rustsecp256k1_v0_9_0_scalar num = *number;
 
-    rustsecp256k1_v0_8_1_scalar_set_int(&x, 0);
-    rustsecp256k1_v0_8_1_scalar_set_int(&shift, 1 << w);
+    rustsecp256k1_v0_9_0_scalar_set_int(&x, 0);
+    rustsecp256k1_v0_9_0_scalar_set_int(&shift, 1 << w);
     for (i = 0; i < 16; ++i) {
-        rustsecp256k1_v0_8_1_scalar_shr_int(&num, 8);
+        rustsecp256k1_v0_9_0_scalar_shr_int(&num, 8);
     }
-    skew = rustsecp256k1_v0_8_1_wnaf_fixed(wnaf, &num, w);
+    skew = rustsecp256k1_v0_9_0_wnaf_fixed(wnaf, &num, w);
 
     for (i = WNAF_SIZE(w)-1; i >= 0; --i) {
-        rustsecp256k1_v0_8_1_scalar t;
+        rustsecp256k1_v0_9_0_scalar t;
         int v = wnaf[i];
         CHECK(v == 0 || v & 1);  /* check parity */
         CHECK(v > -(1 << w)); /* check range above */
         CHECK(v < (1 << w));  /* check range below */
 
-        rustsecp256k1_v0_8_1_scalar_mul(&x, &x, &shift);
+        rustsecp256k1_v0_9_0_scalar_mul(&x, &x, &shift);
         if (v >= 0) {
-            rustsecp256k1_v0_8_1_scalar_set_int(&t, v);
+            rustsecp256k1_v0_9_0_scalar_set_int(&t, v);
         } else {
-            rustsecp256k1_v0_8_1_scalar_set_int(&t, -v);
-            rustsecp256k1_v0_8_1_scalar_negate(&t, &t);
+            rustsecp256k1_v0_9_0_scalar_set_int(&t, -v);
+            rustsecp256k1_v0_9_0_scalar_negate(&t, &t);
         }
-        rustsecp256k1_v0_8_1_scalar_add(&x, &x, &t);
+        rustsecp256k1_v0_9_0_scalar_add(&x, &x, &t);
     }
     /* If skew is 1 then add 1 to num */
-    rustsecp256k1_v0_8_1_scalar_cadd_bit(&num, 0, skew == 1);
-    CHECK(rustsecp256k1_v0_8_1_scalar_eq(&x, &num));
+    rustsecp256k1_v0_9_0_scalar_cadd_bit(&num, 0, skew == 1);
+    CHECK(rustsecp256k1_v0_9_0_scalar_eq(&x, &num));
 }
 
 /* Checks that the first 8 elements of wnaf are equal to wnaf_expected and the
  * rest is 0.*/
-void test_fixed_wnaf_small_helper(int *wnaf, int *wnaf_expected, int w) {
+static void test_fixed_wnaf_small_helper(int *wnaf, int *wnaf_expected, int w) {
     int i;
     for (i = WNAF_SIZE(w)-1; i >= 8; --i) {
         CHECK(wnaf[i] == 0);
@@ -5074,23 +5371,23 @@ void test_fixed_wnaf_small_helper(int *wnaf, int *wnaf_expected, int w) {
     }
 }
 
-void test_fixed_wnaf_small(void) {
+static void test_fixed_wnaf_small(void) {
     int w = 4;
     int wnaf[256] = {0};
     int i;
     int skew;
-    rustsecp256k1_v0_8_1_scalar num;
+    rustsecp256k1_v0_9_0_scalar num;
 
-    rustsecp256k1_v0_8_1_scalar_set_int(&num, 0);
-    skew = rustsecp256k1_v0_8_1_wnaf_fixed(wnaf, &num, w);
+    rustsecp256k1_v0_9_0_scalar_set_int(&num, 0);
+    skew = rustsecp256k1_v0_9_0_wnaf_fixed(wnaf, &num, w);
     for (i = WNAF_SIZE(w)-1; i >= 0; --i) {
         int v = wnaf[i];
         CHECK(v == 0);
     }
     CHECK(skew == 0);
 
-    rustsecp256k1_v0_8_1_scalar_set_int(&num, 1);
-    skew = rustsecp256k1_v0_8_1_wnaf_fixed(wnaf, &num, w);
+    rustsecp256k1_v0_9_0_scalar_set_int(&num, 1);
+    skew = rustsecp256k1_v0_9_0_wnaf_fixed(wnaf, &num, w);
     for (i = WNAF_SIZE(w)-1; i >= 1; --i) {
         int v = wnaf[i];
         CHECK(v == 0);
@@ -5100,37 +5397,37 @@ void test_fixed_wnaf_small(void) {
 
     {
         int wnaf_expected[8] = { 0xf, 0xf, 0xf, 0xf, 0xf, 0xf, 0xf, 0xf };
-        rustsecp256k1_v0_8_1_scalar_set_int(&num, 0xffffffff);
-        skew = rustsecp256k1_v0_8_1_wnaf_fixed(wnaf, &num, w);
+        rustsecp256k1_v0_9_0_scalar_set_int(&num, 0xffffffff);
+        skew = rustsecp256k1_v0_9_0_wnaf_fixed(wnaf, &num, w);
         test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
         CHECK(skew == 0);
     }
     {
         int wnaf_expected[8] = { -1, -1, -1, -1, -1, -1, -1, 0xf };
-        rustsecp256k1_v0_8_1_scalar_set_int(&num, 0xeeeeeeee);
-        skew = rustsecp256k1_v0_8_1_wnaf_fixed(wnaf, &num, w);
+        rustsecp256k1_v0_9_0_scalar_set_int(&num, 0xeeeeeeee);
+        skew = rustsecp256k1_v0_9_0_wnaf_fixed(wnaf, &num, w);
         test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
         CHECK(skew == 1);
     }
     {
         int wnaf_expected[8] = { 1, 0, 1, 0, 1, 0, 1, 0 };
-        rustsecp256k1_v0_8_1_scalar_set_int(&num, 0x01010101);
-        skew = rustsecp256k1_v0_8_1_wnaf_fixed(wnaf, &num, w);
+        rustsecp256k1_v0_9_0_scalar_set_int(&num, 0x01010101);
+        skew = rustsecp256k1_v0_9_0_wnaf_fixed(wnaf, &num, w);
         test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
         CHECK(skew == 0);
     }
     {
         int wnaf_expected[8] = { -0xf, 0, 0xf, -0xf, 0, 0xf, 1, 0 };
-        rustsecp256k1_v0_8_1_scalar_set_int(&num, 0x01ef1ef1);
-        skew = rustsecp256k1_v0_8_1_wnaf_fixed(wnaf, &num, w);
+        rustsecp256k1_v0_9_0_scalar_set_int(&num, 0x01ef1ef1);
+        skew = rustsecp256k1_v0_9_0_wnaf_fixed(wnaf, &num, w);
         test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
         CHECK(skew == 0);
     }
 }
 
-void run_wnaf(void) {
+static void run_wnaf(void) {
     int i;
-    rustsecp256k1_v0_8_1_scalar n = {{0}};
+    rustsecp256k1_v0_9_0_scalar n = {{0}};
 
     test_constant_wnaf(&n, 4);
     /* Sanity check: 1 and 2 are the smallest odd and even numbers and should
@@ -5140,82 +5437,81 @@ void run_wnaf(void) {
     n.d[0] = 2;
     test_constant_wnaf(&n, 4);
     /* Test -1, because it's a special case in wnaf_const */
-    n = rustsecp256k1_v0_8_1_scalar_one;
-    rustsecp256k1_v0_8_1_scalar_negate(&n, &n);
+    n = rustsecp256k1_v0_9_0_scalar_one;
+    rustsecp256k1_v0_9_0_scalar_negate(&n, &n);
     test_constant_wnaf(&n, 4);
 
     /* Test -2, which may not lead to overflows in wnaf_const */
-    rustsecp256k1_v0_8_1_scalar_add(&n, &rustsecp256k1_v0_8_1_scalar_one, &rustsecp256k1_v0_8_1_scalar_one);
-    rustsecp256k1_v0_8_1_scalar_negate(&n, &n);
+    rustsecp256k1_v0_9_0_scalar_add(&n, &rustsecp256k1_v0_9_0_scalar_one, &rustsecp256k1_v0_9_0_scalar_one);
+    rustsecp256k1_v0_9_0_scalar_negate(&n, &n);
     test_constant_wnaf(&n, 4);
 
     /* Test (1/2) - 1 = 1/-2 and 1/2 = (1/-2) + 1
        as corner cases of negation handling in wnaf_const */
-    rustsecp256k1_v0_8_1_scalar_inverse(&n, &n);
+    rustsecp256k1_v0_9_0_scalar_inverse(&n, &n);
     test_constant_wnaf(&n, 4);
 
-    rustsecp256k1_v0_8_1_scalar_add(&n, &n, &rustsecp256k1_v0_8_1_scalar_one);
+    rustsecp256k1_v0_9_0_scalar_add(&n, &n, &rustsecp256k1_v0_9_0_scalar_one);
     test_constant_wnaf(&n, 4);
 
     /* Test 0 for fixed wnaf */
     test_fixed_wnaf_small();
     /* Random tests */
-    for (i = 0; i < count; i++) {
+    for (i = 0; i < COUNT; i++) {
         random_scalar_order(&n);
         test_wnaf(&n, 4+(i%10));
         test_constant_wnaf_negate(&n);
         test_constant_wnaf(&n, 4 + (i % 10));
         test_fixed_wnaf(&n, 4 + (i % 10));
     }
-    rustsecp256k1_v0_8_1_scalar_set_int(&n, 0);
-    CHECK(rustsecp256k1_v0_8_1_scalar_cond_negate(&n, 1) == -1);
-    CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(&n));
-    CHECK(rustsecp256k1_v0_8_1_scalar_cond_negate(&n, 0) == 1);
-    CHECK(rustsecp256k1_v0_8_1_scalar_is_zero(&n));
+    rustsecp256k1_v0_9_0_scalar_set_int(&n, 0);
+    CHECK(rustsecp256k1_v0_9_0_scalar_cond_negate(&n, 1) == -1);
+    CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(&n));
+    CHECK(rustsecp256k1_v0_9_0_scalar_cond_negate(&n, 0) == 1);
+    CHECK(rustsecp256k1_v0_9_0_scalar_is_zero(&n));
 }
 
-static int test_ecmult_accumulate_cb(rustsecp256k1_v0_8_1_scalar* sc, rustsecp256k1_v0_8_1_ge* pt, size_t idx, void* data) {
-    const rustsecp256k1_v0_8_1_scalar* indata = (const rustsecp256k1_v0_8_1_scalar*)data;
+static int test_ecmult_accumulate_cb(rustsecp256k1_v0_9_0_scalar* sc, rustsecp256k1_v0_9_0_ge* pt, size_t idx, void* data) {
+    const rustsecp256k1_v0_9_0_scalar* indata = (const rustsecp256k1_v0_9_0_scalar*)data;
     *sc = *indata;
-    *pt = rustsecp256k1_v0_8_1_ge_const_g;
+    *pt = rustsecp256k1_v0_9_0_ge_const_g;
     CHECK(idx == 0);
     return 1;
 }
 
-void test_ecmult_accumulate(rustsecp256k1_v0_8_1_sha256* acc, const rustsecp256k1_v0_8_1_scalar* x, rustsecp256k1_v0_8_1_scratch* scratch) {
+static void test_ecmult_accumulate(rustsecp256k1_v0_9_0_sha256* acc, const rustsecp256k1_v0_9_0_scalar* x, rustsecp256k1_v0_9_0_scratch* scratch) {
     /* Compute x*G in 6 different ways, serialize it uncompressed, and feed it into acc. */
-    rustsecp256k1_v0_8_1_gej rj1, rj2, rj3, rj4, rj5, rj6, gj, infj;
-    rustsecp256k1_v0_8_1_ge r;
-    const rustsecp256k1_v0_8_1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
+    rustsecp256k1_v0_9_0_gej rj1, rj2, rj3, rj4, rj5, rj6, gj, infj;
+    rustsecp256k1_v0_9_0_ge r;
     unsigned char bytes[65];
     size_t size = 65;
-    rustsecp256k1_v0_8_1_gej_set_ge(&gj, &rustsecp256k1_v0_8_1_ge_const_g);
-    rustsecp256k1_v0_8_1_gej_set_infinity(&infj);
-    rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj1, x);
-    rustsecp256k1_v0_8_1_ecmult(&rj2, &gj, x, &zero);
-    rustsecp256k1_v0_8_1_ecmult(&rj3, &infj, &zero, x);
-    rustsecp256k1_v0_8_1_ecmult_multi_var(NULL, scratch, &rj4, x, NULL, NULL, 0);
-    rustsecp256k1_v0_8_1_ecmult_multi_var(NULL, scratch, &rj5, &zero, test_ecmult_accumulate_cb, (void*)x, 1);
-    rustsecp256k1_v0_8_1_ecmult_const(&rj6, &rustsecp256k1_v0_8_1_ge_const_g, x, 256);
-    rustsecp256k1_v0_8_1_ge_set_gej_var(&r, &rj1);
+    rustsecp256k1_v0_9_0_gej_set_ge(&gj, &rustsecp256k1_v0_9_0_ge_const_g);
+    rustsecp256k1_v0_9_0_gej_set_infinity(&infj);
+    rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &rj1, x);
+    rustsecp256k1_v0_9_0_ecmult(&rj2, &gj, x, &rustsecp256k1_v0_9_0_scalar_zero);
+    rustsecp256k1_v0_9_0_ecmult(&rj3, &infj, &rustsecp256k1_v0_9_0_scalar_zero, x);
+    rustsecp256k1_v0_9_0_ecmult_multi_var(NULL, scratch, &rj4, x, NULL, NULL, 0);
+    rustsecp256k1_v0_9_0_ecmult_multi_var(NULL, scratch, &rj5, &rustsecp256k1_v0_9_0_scalar_zero, test_ecmult_accumulate_cb, (void*)x, 1);
+    rustsecp256k1_v0_9_0_ecmult_const(&rj6, &rustsecp256k1_v0_9_0_ge_const_g, x);
+    rustsecp256k1_v0_9_0_ge_set_gej_var(&r, &rj1);
     ge_equals_gej(&r, &rj2);
     ge_equals_gej(&r, &rj3);
     ge_equals_gej(&r, &rj4);
     ge_equals_gej(&r, &rj5);
     ge_equals_gej(&r, &rj6);
-    if (rustsecp256k1_v0_8_1_ge_is_infinity(&r)) {
+    if (rustsecp256k1_v0_9_0_ge_is_infinity(&r)) {
         /* Store infinity as 0x00 */
         const unsigned char zerobyte[1] = {0};
-        rustsecp256k1_v0_8_1_sha256_write(acc, zerobyte, 1);
+        rustsecp256k1_v0_9_0_sha256_write(acc, zerobyte, 1);
     } else {
         /* Store other points using their uncompressed serialization. */
-        rustsecp256k1_v0_8_1_eckey_pubkey_serialize(&r, bytes, &size, 0);
+        rustsecp256k1_v0_9_0_eckey_pubkey_serialize(&r, bytes, &size, 0);
         CHECK(size == 65);
-        rustsecp256k1_v0_8_1_sha256_write(acc, bytes, size);
+        rustsecp256k1_v0_9_0_sha256_write(acc, bytes, size);
     }
 }
 
-void test_ecmult_constants_2bit(void) {
+static void test_ecmult_constants_2bit(void) {
     /* Using test_ecmult_accumulate, test ecmult for:
      * - For i in 0..36:
      *   - Key i
@@ -5224,11 +5520,11 @@ void test_ecmult_constants_2bit(void) {
      *   - For j in 1..255 (only odd values):
      *     - Key (j*2^i) mod order
      */
-    rustsecp256k1_v0_8_1_scalar x;
-    rustsecp256k1_v0_8_1_sha256 acc;
+    rustsecp256k1_v0_9_0_scalar x;
+    rustsecp256k1_v0_9_0_sha256 acc;
     unsigned char b32[32];
     int i, j;
-    rustsecp256k1_v0_8_1_scratch_space *scratch = rustsecp256k1_v0_8_1_scratch_space_create(ctx, 65536);
+    rustsecp256k1_v0_9_0_scratch_space *scratch = rustsecp256k1_v0_9_0_scratch_space_create(CTX, 65536);
 
     /* Expected hash of all the computed points; created with an independent
      * implementation. */
@@ -5238,28 +5534,28 @@ void test_ecmult_constants_2bit(void) {
         0x3a, 0x75, 0x87, 0x60, 0x1a, 0xf9, 0x63, 0x60,
         0xd0, 0xcb, 0x1f, 0xaa, 0x85, 0x9a, 0xb7, 0xb4
     };
-    rustsecp256k1_v0_8_1_sha256_initialize(&acc);
+    rustsecp256k1_v0_9_0_sha256_initialize(&acc);
     for (i = 0; i <= 36; ++i) {
-        rustsecp256k1_v0_8_1_scalar_set_int(&x, i);
+        rustsecp256k1_v0_9_0_scalar_set_int(&x, i);
         test_ecmult_accumulate(&acc, &x, scratch);
-        rustsecp256k1_v0_8_1_scalar_negate(&x, &x);
+        rustsecp256k1_v0_9_0_scalar_negate(&x, &x);
         test_ecmult_accumulate(&acc, &x, scratch);
     };
     for (i = 0; i < 256; ++i) {
         for (j = 1; j < 256; j += 2) {
             int k;
-            rustsecp256k1_v0_8_1_scalar_set_int(&x, j);
-            for (k = 0; k < i; ++k) rustsecp256k1_v0_8_1_scalar_add(&x, &x, &x);
+            rustsecp256k1_v0_9_0_scalar_set_int(&x, j);
+            for (k = 0; k < i; ++k) rustsecp256k1_v0_9_0_scalar_add(&x, &x, &x);
             test_ecmult_accumulate(&acc, &x, scratch);
         }
     }
-    rustsecp256k1_v0_8_1_sha256_finalize(&acc, b32);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(b32, expected32, 32) == 0);
+    rustsecp256k1_v0_9_0_sha256_finalize(&acc, b32);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(b32, expected32, 32) == 0);
 
-    rustsecp256k1_v0_8_1_scratch_space_destroy(ctx, scratch);
+    rustsecp256k1_v0_9_0_scratch_space_destroy(CTX, scratch);
 }
 
-void test_ecmult_constants_sha(uint32_t prefix, size_t iter, const unsigned char* expected32) {
+static void test_ecmult_constants_sha(uint32_t prefix, size_t iter, const unsigned char* expected32) {
     /* Using test_ecmult_accumulate, test ecmult for:
      * - Key 0
      * - Key 1
@@ -5267,42 +5563,42 @@ void test_ecmult_constants_sha(uint32_t prefix, size_t iter, const unsigned char
      * - For i in range(iter):
      *   - Key SHA256(LE32(prefix) || LE16(i))
      */
-    rustsecp256k1_v0_8_1_scalar x;
-    rustsecp256k1_v0_8_1_sha256 acc;
+    rustsecp256k1_v0_9_0_scalar x;
+    rustsecp256k1_v0_9_0_sha256 acc;
     unsigned char b32[32];
     unsigned char inp[6];
     size_t i;
-    rustsecp256k1_v0_8_1_scratch_space *scratch = rustsecp256k1_v0_8_1_scratch_space_create(ctx, 65536);
+    rustsecp256k1_v0_9_0_scratch_space *scratch = rustsecp256k1_v0_9_0_scratch_space_create(CTX, 65536);
 
     inp[0] = prefix & 0xFF;
     inp[1] = (prefix >> 8) & 0xFF;
     inp[2] = (prefix >> 16) & 0xFF;
     inp[3] = (prefix >> 24) & 0xFF;
-    rustsecp256k1_v0_8_1_sha256_initialize(&acc);
-    rustsecp256k1_v0_8_1_scalar_set_int(&x, 0);
+    rustsecp256k1_v0_9_0_sha256_initialize(&acc);
+    rustsecp256k1_v0_9_0_scalar_set_int(&x, 0);
     test_ecmult_accumulate(&acc, &x, scratch);
-    rustsecp256k1_v0_8_1_scalar_set_int(&x, 1);
+    rustsecp256k1_v0_9_0_scalar_set_int(&x, 1);
     test_ecmult_accumulate(&acc, &x, scratch);
-    rustsecp256k1_v0_8_1_scalar_negate(&x, &x);
+    rustsecp256k1_v0_9_0_scalar_negate(&x, &x);
     test_ecmult_accumulate(&acc, &x, scratch);
 
     for (i = 0; i < iter; ++i) {
-        rustsecp256k1_v0_8_1_sha256 gen;
+        rustsecp256k1_v0_9_0_sha256 gen;
         inp[4] = i & 0xff;
         inp[5] = (i >> 8) & 0xff;
-        rustsecp256k1_v0_8_1_sha256_initialize(&gen);
-        rustsecp256k1_v0_8_1_sha256_write(&gen, inp, sizeof(inp));
-        rustsecp256k1_v0_8_1_sha256_finalize(&gen, b32);
-        rustsecp256k1_v0_8_1_scalar_set_b32(&x, b32, NULL);
+        rustsecp256k1_v0_9_0_sha256_initialize(&gen);
+        rustsecp256k1_v0_9_0_sha256_write(&gen, inp, sizeof(inp));
+        rustsecp256k1_v0_9_0_sha256_finalize(&gen, b32);
+        rustsecp256k1_v0_9_0_scalar_set_b32(&x, b32, NULL);
         test_ecmult_accumulate(&acc, &x, scratch);
     }
-    rustsecp256k1_v0_8_1_sha256_finalize(&acc, b32);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(b32, expected32, 32) == 0);
+    rustsecp256k1_v0_9_0_sha256_finalize(&acc, b32);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(b32, expected32, 32) == 0);
 
-    rustsecp256k1_v0_8_1_scratch_space_destroy(ctx, scratch);
+    rustsecp256k1_v0_9_0_scratch_space_destroy(CTX, scratch);
 }
 
-void run_ecmult_constants(void) {
+static void run_ecmult_constants(void) {
     /* Expected hashes of all points in the tests below. Computed using an
      * independent implementation. */
     static const unsigned char expected32_6bit20[32] = {
@@ -5336,42 +5632,42 @@ void run_ecmult_constants(void) {
     }
 }
 
-void test_ecmult_gen_blind(void) {
+static void test_ecmult_gen_blind(void) {
     /* Test ecmult_gen() blinding and confirm that the blinding changes, the affine points match, and the z's don't match. */
-    rustsecp256k1_v0_8_1_scalar key;
-    rustsecp256k1_v0_8_1_scalar b;
+    rustsecp256k1_v0_9_0_scalar key;
+    rustsecp256k1_v0_9_0_scalar b;
     unsigned char seed32[32];
-    rustsecp256k1_v0_8_1_gej pgej;
-    rustsecp256k1_v0_8_1_gej pgej2;
-    rustsecp256k1_v0_8_1_gej i;
-    rustsecp256k1_v0_8_1_ge pge;
+    rustsecp256k1_v0_9_0_gej pgej;
+    rustsecp256k1_v0_9_0_gej pgej2;
+    rustsecp256k1_v0_9_0_gej i;
+    rustsecp256k1_v0_9_0_ge pge;
     random_scalar_order_test(&key);
-    rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &pgej, &key);
-    rustsecp256k1_v0_8_1_testrand256(seed32);
-    b = ctx->ecmult_gen_ctx.blind;
-    i = ctx->ecmult_gen_ctx.initial;
-    rustsecp256k1_v0_8_1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, seed32);
-    CHECK(!rustsecp256k1_v0_8_1_scalar_eq(&b, &ctx->ecmult_gen_ctx.blind));
-    rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &pgej2, &key);
+    rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &pgej, &key);
+    rustsecp256k1_v0_9_0_testrand256(seed32);
+    b = CTX->ecmult_gen_ctx.blind;
+    i = CTX->ecmult_gen_ctx.initial;
+    rustsecp256k1_v0_9_0_ecmult_gen_blind(&CTX->ecmult_gen_ctx, seed32);
+    CHECK(!rustsecp256k1_v0_9_0_scalar_eq(&b, &CTX->ecmult_gen_ctx.blind));
+    rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &pgej2, &key);
     CHECK(!gej_xyz_equals_gej(&pgej, &pgej2));
-    CHECK(!gej_xyz_equals_gej(&i, &ctx->ecmult_gen_ctx.initial));
-    rustsecp256k1_v0_8_1_ge_set_gej(&pge, &pgej);
+    CHECK(!gej_xyz_equals_gej(&i, &CTX->ecmult_gen_ctx.initial));
+    rustsecp256k1_v0_9_0_ge_set_gej(&pge, &pgej);
     ge_equals_gej(&pge, &pgej2);
 }
 
-void test_ecmult_gen_blind_reset(void) {
+static void test_ecmult_gen_blind_reset(void) {
     /* Test ecmult_gen() blinding reset and confirm that the blinding is consistent. */
-    rustsecp256k1_v0_8_1_scalar b;
-    rustsecp256k1_v0_8_1_gej initial;
-    rustsecp256k1_v0_8_1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, 0);
-    b = ctx->ecmult_gen_ctx.blind;
-    initial = ctx->ecmult_gen_ctx.initial;
-    rustsecp256k1_v0_8_1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, 0);
-    CHECK(rustsecp256k1_v0_8_1_scalar_eq(&b, &ctx->ecmult_gen_ctx.blind));
-    CHECK(gej_xyz_equals_gej(&initial, &ctx->ecmult_gen_ctx.initial));
+    rustsecp256k1_v0_9_0_scalar b;
+    rustsecp256k1_v0_9_0_gej initial;
+    rustsecp256k1_v0_9_0_ecmult_gen_blind(&CTX->ecmult_gen_ctx, 0);
+    b = CTX->ecmult_gen_ctx.blind;
+    initial = CTX->ecmult_gen_ctx.initial;
+    rustsecp256k1_v0_9_0_ecmult_gen_blind(&CTX->ecmult_gen_ctx, 0);
+    CHECK(rustsecp256k1_v0_9_0_scalar_eq(&b, &CTX->ecmult_gen_ctx.blind));
+    CHECK(gej_xyz_equals_gej(&initial, &CTX->ecmult_gen_ctx.initial));
 }
 
-void run_ecmult_gen_blind(void) {
+static void run_ecmult_gen_blind(void) {
     int i;
     test_ecmult_gen_blind_reset();
     for (i = 0; i < 10; i++) {
@@ -5380,46 +5676,46 @@ void run_ecmult_gen_blind(void) {
 }
 
 /***** ENDOMORPHISH TESTS *****/
-void test_scalar_split(const rustsecp256k1_v0_8_1_scalar* full) {
-    rustsecp256k1_v0_8_1_scalar s, s1, slam;
+static void test_scalar_split(const rustsecp256k1_v0_9_0_scalar* full) {
+    rustsecp256k1_v0_9_0_scalar s, s1, slam;
     const unsigned char zero[32] = {0};
     unsigned char tmp[32];
 
-    rustsecp256k1_v0_8_1_scalar_split_lambda(&s1, &slam, full);
+    rustsecp256k1_v0_9_0_scalar_split_lambda(&s1, &slam, full);
 
     /* check slam*lambda + s1 == full */
-    rustsecp256k1_v0_8_1_scalar_mul(&s, &rustsecp256k1_v0_8_1_const_lambda, &slam);
-    rustsecp256k1_v0_8_1_scalar_add(&s, &s, &s1);
-    CHECK(rustsecp256k1_v0_8_1_scalar_eq(&s, full));
+    rustsecp256k1_v0_9_0_scalar_mul(&s, &rustsecp256k1_v0_9_0_const_lambda, &slam);
+    rustsecp256k1_v0_9_0_scalar_add(&s, &s, &s1);
+    CHECK(rustsecp256k1_v0_9_0_scalar_eq(&s, full));
 
     /* check that both are <= 128 bits in size */
-    if (rustsecp256k1_v0_8_1_scalar_is_high(&s1)) {
-        rustsecp256k1_v0_8_1_scalar_negate(&s1, &s1);
+    if (rustsecp256k1_v0_9_0_scalar_is_high(&s1)) {
+        rustsecp256k1_v0_9_0_scalar_negate(&s1, &s1);
     }
-    if (rustsecp256k1_v0_8_1_scalar_is_high(&slam)) {
-        rustsecp256k1_v0_8_1_scalar_negate(&slam, &slam);
+    if (rustsecp256k1_v0_9_0_scalar_is_high(&slam)) {
+        rustsecp256k1_v0_9_0_scalar_negate(&slam, &slam);
     }
 
-    rustsecp256k1_v0_8_1_scalar_get_b32(tmp, &s1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zero, tmp, 16) == 0);
-    rustsecp256k1_v0_8_1_scalar_get_b32(tmp, &slam);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zero, tmp, 16) == 0);
+    rustsecp256k1_v0_9_0_scalar_get_b32(tmp, &s1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zero, tmp, 16) == 0);
+    rustsecp256k1_v0_9_0_scalar_get_b32(tmp, &slam);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zero, tmp, 16) == 0);
 }
 
 
-void run_endomorphism_tests(void) {
+static void run_endomorphism_tests(void) {
     unsigned i;
-    static rustsecp256k1_v0_8_1_scalar s;
-    test_scalar_split(&rustsecp256k1_v0_8_1_scalar_zero);
-    test_scalar_split(&rustsecp256k1_v0_8_1_scalar_one);
-    rustsecp256k1_v0_8_1_scalar_negate(&s,&rustsecp256k1_v0_8_1_scalar_one);
+    static rustsecp256k1_v0_9_0_scalar s;
+    test_scalar_split(&rustsecp256k1_v0_9_0_scalar_zero);
+    test_scalar_split(&rustsecp256k1_v0_9_0_scalar_one);
+    rustsecp256k1_v0_9_0_scalar_negate(&s,&rustsecp256k1_v0_9_0_scalar_one);
     test_scalar_split(&s);
-    test_scalar_split(&rustsecp256k1_v0_8_1_const_lambda);
-    rustsecp256k1_v0_8_1_scalar_add(&s, &rustsecp256k1_v0_8_1_const_lambda, &rustsecp256k1_v0_8_1_scalar_one);
+    test_scalar_split(&rustsecp256k1_v0_9_0_const_lambda);
+    rustsecp256k1_v0_9_0_scalar_add(&s, &rustsecp256k1_v0_9_0_const_lambda, &rustsecp256k1_v0_9_0_scalar_one);
     test_scalar_split(&s);
 
-    for (i = 0; i < 100U * count; ++i) {
-        rustsecp256k1_v0_8_1_scalar full;
+    for (i = 0; i < 100U * COUNT; ++i) {
+        rustsecp256k1_v0_9_0_scalar full;
         random_scalar_order_test(&full);
         test_scalar_split(&full);
     }
@@ -5428,19 +5724,19 @@ void run_endomorphism_tests(void) {
     }
 }
 
-void ec_pubkey_parse_pointtest(const unsigned char *input, int xvalid, int yvalid) {
+static void ec_pubkey_parse_pointtest(const unsigned char *input, int xvalid, int yvalid) {
     unsigned char pubkeyc[65];
-    rustsecp256k1_v0_8_1_pubkey pubkey;
-    rustsecp256k1_v0_8_1_ge ge;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
+    rustsecp256k1_v0_9_0_ge ge;
     size_t pubkeyclen;
     int32_t ecount;
     ecount = 0;
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
     for (pubkeyclen = 3; pubkeyclen <= 65; pubkeyclen++) {
         /* Smaller sizes are tested exhaustively elsewhere. */
         int32_t i;
         memcpy(&pubkeyc[1], input, 64);
-        VG_UNDEF(&pubkeyc[pubkeyclen], 65 - pubkeyclen);
+        SECP256K1_CHECKMEM_UNDEFINE(&pubkeyc[pubkeyclen], 65 - pubkeyclen);
         for (i = 0; i < 256; i++) {
             /* Try all type bytes. */
             int xpass;
@@ -5459,51 +5755,51 @@ void ec_pubkey_parse_pointtest(const unsigned char *input, int xvalid, int yvali
                 unsigned char pubkeyo[65];
                 size_t outl;
                 memset(&pubkey, 0, sizeof(pubkey));
-                VG_UNDEF(&pubkey, sizeof(pubkey));
+                SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
                 ecount = 0;
-                CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, pubkeyc, pubkeyclen) == 1);
-                VG_CHECK(&pubkey, sizeof(pubkey));
+                CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, pubkeyc, pubkeyclen) == 1);
+                SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
                 outl = 65;
-                VG_UNDEF(pubkeyo, 65);
-                CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, pubkeyo, &outl, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
-                VG_CHECK(pubkeyo, outl);
+                SECP256K1_CHECKMEM_UNDEFINE(pubkeyo, 65);
+                CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, pubkeyo, &outl, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
+                SECP256K1_CHECKMEM_CHECK(pubkeyo, outl);
                 CHECK(outl == 33);
-                CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkeyo[1], &pubkeyc[1], 32) == 0);
+                CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkeyo[1], &pubkeyc[1], 32) == 0);
                 CHECK((pubkeyclen != 33) || (pubkeyo[0] == pubkeyc[0]));
                 if (ypass) {
                     /* This test isn't always done because we decode with alternative signs, so the y won't match. */
                     CHECK(pubkeyo[0] == ysign);
-                    CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 1);
+                    CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 1);
                     memset(&pubkey, 0, sizeof(pubkey));
-                    VG_UNDEF(&pubkey, sizeof(pubkey));
-                    rustsecp256k1_v0_8_1_pubkey_save(&pubkey, &ge);
-                    VG_CHECK(&pubkey, sizeof(pubkey));
+                    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+                    rustsecp256k1_v0_9_0_pubkey_save(&pubkey, &ge);
+                    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
                     outl = 65;
-                    VG_UNDEF(pubkeyo, 65);
-                    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, pubkeyo, &outl, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 1);
-                    VG_CHECK(pubkeyo, outl);
+                    SECP256K1_CHECKMEM_UNDEFINE(pubkeyo, 65);
+                    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, pubkeyo, &outl, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 1);
+                    SECP256K1_CHECKMEM_CHECK(pubkeyo, outl);
                     CHECK(outl == 65);
                     CHECK(pubkeyo[0] == 4);
-                    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkeyo[1], input, 64) == 0);
+                    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkeyo[1], input, 64) == 0);
                 }
                 CHECK(ecount == 0);
             } else {
                 /* These cases must fail to parse. */
                 memset(&pubkey, 0xfe, sizeof(pubkey));
                 ecount = 0;
-                VG_UNDEF(&pubkey, sizeof(pubkey));
-                CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, pubkeyc, pubkeyclen) == 0);
-                VG_CHECK(&pubkey, sizeof(pubkey));
+                SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+                CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, pubkeyc, pubkeyclen) == 0);
+                SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
                 CHECK(ecount == 0);
-                CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 0);
+                CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 0);
                 CHECK(ecount == 1);
             }
         }
     }
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, NULL, NULL);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, NULL, NULL);
 }
 
-void run_ec_pubkey_parse_test(void) {
+static void run_ec_pubkey_parse_test(void) {
 #define SECP256K1_EC_PARSE_TEST_NVALID (12)
     const unsigned char valid[SECP256K1_EC_PARSE_TEST_NVALID][64] = {
         {
@@ -5684,37 +5980,37 @@ void run_ec_pubkey_parse_test(void) {
     };
     unsigned char sout[65];
     unsigned char shortkey[2];
-    rustsecp256k1_v0_8_1_ge ge;
-    rustsecp256k1_v0_8_1_pubkey pubkey;
+    rustsecp256k1_v0_9_0_ge ge;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
     size_t len;
     int32_t i;
     int32_t ecount;
     int32_t ecount2;
     ecount = 0;
     /* Nothing should be reading this far into pubkeyc. */
-    VG_UNDEF(&pubkeyc[65], 1);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkeyc[65], 1);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
     /* Zero length claimed, fail, zeroize, no illegal arg error. */
     memset(&pubkey, 0xfe, sizeof(pubkey));
     ecount = 0;
-    VG_UNDEF(shortkey, 2);
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, shortkey, 0) == 0);
-    VG_CHECK(&pubkey, sizeof(pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(shortkey, 2);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, shortkey, 0) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 0);
     CHECK(ecount == 1);
     /* Length one claimed, fail, zeroize, no illegal arg error. */
     for (i = 0; i < 256 ; i++) {
         memset(&pubkey, 0xfe, sizeof(pubkey));
         ecount = 0;
         shortkey[0] = i;
-        VG_UNDEF(&shortkey[1], 1);
-        VG_UNDEF(&pubkey, sizeof(pubkey));
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, shortkey, 1) == 0);
-        VG_CHECK(&pubkey, sizeof(pubkey));
+        SECP256K1_CHECKMEM_UNDEFINE(&shortkey[1], 1);
+        SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, shortkey, 1) == 0);
+        SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
         CHECK(ecount == 0);
-        CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 0);
+        CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 0);
         CHECK(ecount == 1);
     }
     /* Length two claimed, fail, zeroize, no illegal arg error. */
@@ -5723,102 +6019,102 @@ void run_ec_pubkey_parse_test(void) {
         ecount = 0;
         shortkey[0] = i & 255;
         shortkey[1] = i >> 8;
-        VG_UNDEF(&pubkey, sizeof(pubkey));
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, shortkey, 2) == 0);
-        VG_CHECK(&pubkey, sizeof(pubkey));
+        SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, shortkey, 2) == 0);
+        SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
         CHECK(ecount == 0);
-        CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 0);
+        CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 0);
         CHECK(ecount == 1);
     }
     memset(&pubkey, 0xfe, sizeof(pubkey));
     ecount = 0;
-    VG_UNDEF(&pubkey, sizeof(pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
     /* 33 bytes claimed on otherwise valid input starting with 0x04, fail, zeroize output, no illegal arg error. */
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, pubkeyc, 33) == 0);
-    VG_CHECK(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, pubkeyc, 33) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 0);
     CHECK(ecount == 1);
     /* NULL pubkey, illegal arg error. Pubkey isn't rewritten before this step, since it's NULL into the parser. */
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, NULL, pubkeyc, 65) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, NULL, pubkeyc, 65) == 0);
     CHECK(ecount == 2);
     /* NULL input string. Illegal arg and zeroize output. */
     memset(&pubkey, 0xfe, sizeof(pubkey));
     ecount = 0;
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, NULL, 65) == 0);
-    VG_CHECK(&pubkey, sizeof(pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, NULL, 65) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 0);
     CHECK(ecount == 2);
     /* 64 bytes claimed on input starting with 0x04, fail, zeroize output, no illegal arg error. */
     memset(&pubkey, 0xfe, sizeof(pubkey));
     ecount = 0;
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, pubkeyc, 64) == 0);
-    VG_CHECK(&pubkey, sizeof(pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, pubkeyc, 64) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 0);
     CHECK(ecount == 1);
     /* 66 bytes claimed, fail, zeroize output, no illegal arg error. */
     memset(&pubkey, 0xfe, sizeof(pubkey));
     ecount = 0;
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, pubkeyc, 66) == 0);
-    VG_CHECK(&pubkey, sizeof(pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, pubkeyc, 66) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 0);
     CHECK(ecount == 1);
     /* Valid parse. */
     memset(&pubkey, 0, sizeof(pubkey));
     ecount = 0;
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, pubkeyc, 65) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(rustsecp256k1_v0_8_1_context_static, &pubkey, pubkeyc, 65) == 1);
-    VG_CHECK(&pubkey, sizeof(pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, pubkeyc, 65) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(rustsecp256k1_v0_9_0_context_static, &pubkey, pubkeyc, 65) == 1);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
     CHECK(ecount == 0);
-    VG_UNDEF(&ge, sizeof(ge));
-    CHECK(rustsecp256k1_v0_8_1_pubkey_load(ctx, &ge, &pubkey) == 1);
-    VG_CHECK(&ge.x, sizeof(ge.x));
-    VG_CHECK(&ge.y, sizeof(ge.y));
-    VG_CHECK(&ge.infinity, sizeof(ge.infinity));
-    ge_equals_ge(&rustsecp256k1_v0_8_1_ge_const_g, &ge);
+    SECP256K1_CHECKMEM_UNDEFINE(&ge, sizeof(ge));
+    CHECK(rustsecp256k1_v0_9_0_pubkey_load(CTX, &ge, &pubkey) == 1);
+    SECP256K1_CHECKMEM_CHECK(&ge.x, sizeof(ge.x));
+    SECP256K1_CHECKMEM_CHECK(&ge.y, sizeof(ge.y));
+    SECP256K1_CHECKMEM_CHECK(&ge.infinity, sizeof(ge.infinity));
+    ge_equals_ge(&rustsecp256k1_v0_9_0_ge_const_g, &ge);
     CHECK(ecount == 0);
-    /* rustsecp256k1_v0_8_1_ec_pubkey_serialize illegal args. */
+    /* rustsecp256k1_v0_9_0_ec_pubkey_serialize illegal args. */
     ecount = 0;
     len = 65;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, NULL, &len, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, NULL, &len, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 0);
     CHECK(ecount == 1);
     CHECK(len == 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, sout, NULL, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, sout, NULL, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 0);
     CHECK(ecount == 2);
     len = 65;
-    VG_UNDEF(sout, 65);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, sout, &len, NULL, SECP256K1_EC_UNCOMPRESSED) == 0);
-    VG_CHECK(sout, 65);
+    SECP256K1_CHECKMEM_UNDEFINE(sout, 65);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, sout, &len, NULL, SECP256K1_EC_UNCOMPRESSED) == 0);
+    SECP256K1_CHECKMEM_CHECK(sout, 65);
     CHECK(ecount == 3);
     CHECK(len == 0);
     len = 65;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, sout, &len, &pubkey, ~0) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, sout, &len, &pubkey, ~0) == 0);
     CHECK(ecount == 4);
     CHECK(len == 0);
     len = 65;
-    VG_UNDEF(sout, 65);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, sout, &len, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 1);
-    VG_CHECK(sout, 65);
+    SECP256K1_CHECKMEM_UNDEFINE(sout, 65);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, sout, &len, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 1);
+    SECP256K1_CHECKMEM_CHECK(sout, 65);
     CHECK(ecount == 4);
     CHECK(len == 65);
     /* Multiple illegal args. Should still set arg error only once. */
     ecount = 0;
     ecount2 = 11;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, NULL, NULL, 65) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, NULL, NULL, 65) == 0);
     CHECK(ecount == 1);
     /* Does the illegal arg callback actually change the behavior? */
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, uncounting_illegal_callback_fn, &ecount2);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, NULL, NULL, 65) == 0);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, uncounting_illegal_callback_fn, &ecount2);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, NULL, NULL, 65) == 0);
     CHECK(ecount == 1);
     CHECK(ecount2 == 10);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, NULL, NULL);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, NULL, NULL);
     /* Try a bunch of prefabbed points with all possible encodings. */
     for (i = 0; i < SECP256K1_EC_PARSE_TEST_NVALID; i++) {
         ec_pubkey_parse_pointtest(valid[i], 1, 1);
@@ -5831,263 +6127,263 @@ void run_ec_pubkey_parse_test(void) {
     }
 }
 
-void run_eckey_edge_case_test(void) {
+static void run_eckey_edge_case_test(void) {
     const unsigned char orderc[32] = {
         0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
         0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe,
         0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0, 0x3b,
         0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41, 0x41
     };
-    const unsigned char zeros[sizeof(rustsecp256k1_v0_8_1_pubkey)] = {0x00};
+    const unsigned char zeros[sizeof(rustsecp256k1_v0_9_0_pubkey)] = {0x00};
     unsigned char ctmp[33];
     unsigned char ctmp2[33];
-    rustsecp256k1_v0_8_1_pubkey pubkey;
-    rustsecp256k1_v0_8_1_pubkey pubkey2;
-    rustsecp256k1_v0_8_1_pubkey pubkey_one;
-    rustsecp256k1_v0_8_1_pubkey pubkey_negone;
-    const rustsecp256k1_v0_8_1_pubkey *pubkeys[3];
+    rustsecp256k1_v0_9_0_pubkey pubkey;
+    rustsecp256k1_v0_9_0_pubkey pubkey2;
+    rustsecp256k1_v0_9_0_pubkey pubkey_one;
+    rustsecp256k1_v0_9_0_pubkey pubkey_negone;
+    const rustsecp256k1_v0_9_0_pubkey *pubkeys[3];
     size_t len;
     int32_t ecount;
     /* Group order is too large, reject. */
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, orderc) == 0);
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, orderc) == 0);
-    VG_CHECK(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, orderc) == 0);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, orderc) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) == 0);
     /* Maximum value is too large, reject. */
     memset(ctmp, 255, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, ctmp) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, ctmp) == 0);
     memset(&pubkey, 1, sizeof(pubkey));
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, ctmp) == 0);
-    VG_CHECK(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) == 0);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, ctmp) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) == 0);
     /* Zero is too small, reject. */
     memset(ctmp, 0, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, ctmp) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, ctmp) == 0);
     memset(&pubkey, 1, sizeof(pubkey));
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, ctmp) == 0);
-    VG_CHECK(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) == 0);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, ctmp) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) == 0);
     /* One must be accepted. */
     ctmp[31] = 0x01;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, ctmp) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, ctmp) == 1);
     memset(&pubkey, 0, sizeof(pubkey));
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, ctmp) == 1);
-    VG_CHECK(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) > 0);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, ctmp) == 1);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) > 0);
     pubkey_one = pubkey;
     /* Group order + 1 is too large, reject. */
     memcpy(ctmp, orderc, 32);
     ctmp[31] = 0x42;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, ctmp) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, ctmp) == 0);
     memset(&pubkey, 1, sizeof(pubkey));
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, ctmp) == 0);
-    VG_CHECK(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) == 0);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, ctmp) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) == 0);
     /* -1 must be accepted. */
     ctmp[31] = 0x40;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, ctmp) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, ctmp) == 1);
     memset(&pubkey, 0, sizeof(pubkey));
-    VG_UNDEF(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, ctmp) == 1);
-    VG_CHECK(&pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) > 0);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, ctmp) == 1);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) > 0);
     pubkey_negone = pubkey;
     /* Tweak of zero leaves the value unchanged. */
     memset(ctmp2, 0, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, ctmp, ctmp2) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(orderc, ctmp, 31) == 0 && ctmp[31] == 0x40);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_add(CTX, ctmp, ctmp2) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(orderc, ctmp, 31) == 0 && ctmp[31] == 0x40);
     memcpy(&pubkey2, &pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, &pubkey, ctmp2) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, &pubkey, ctmp2) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
     /* Multiply tweak of zero zeroizes the output. */
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(ctx, ctmp, ctmp2) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros, ctmp, 32) == 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(ctx, &pubkey, ctmp2) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(CTX, ctmp, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros, ctmp, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(CTX, &pubkey, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
     memcpy(&pubkey, &pubkey2, sizeof(pubkey));
     /* If seckey_tweak_add or seckey_tweak_mul are called with an overflowing
     seckey, the seckey is zeroized. */
     memcpy(ctmp, orderc, 32);
     memset(ctmp2, 0, 32);
     ctmp2[31] = 0x01;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, ctmp2) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, ctmp) == 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, ctmp, ctmp2) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros, ctmp, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, ctmp2) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, ctmp) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_add(CTX, ctmp, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros, ctmp, 32) == 0);
     memcpy(ctmp, orderc, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(ctx, ctmp, ctmp2) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros, ctmp, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(CTX, ctmp, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros, ctmp, 32) == 0);
     /* If seckey_tweak_add or seckey_tweak_mul are called with an overflowing
     tweak, the seckey is zeroized. */
     memcpy(ctmp, orderc, 32);
     ctmp[31] = 0x40;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, ctmp, orderc) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros, ctmp, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_add(CTX, ctmp, orderc) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros, ctmp, 32) == 0);
     memcpy(ctmp, orderc, 32);
     ctmp[31] = 0x40;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(ctx, ctmp, orderc) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros, ctmp, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(CTX, ctmp, orderc) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros, ctmp, 32) == 0);
     memcpy(ctmp, orderc, 32);
     ctmp[31] = 0x40;
     /* If pubkey_tweak_add or pubkey_tweak_mul are called with an overflowing
     tweak, the pubkey is zeroized. */
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, &pubkey, orderc) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, &pubkey, orderc) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
     memcpy(&pubkey, &pubkey2, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(ctx, &pubkey, orderc) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(CTX, &pubkey, orderc) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
     memcpy(&pubkey, &pubkey2, sizeof(pubkey));
-    /* If the resulting key in rustsecp256k1_v0_8_1_ec_seckey_tweak_add and
-     * rustsecp256k1_v0_8_1_ec_pubkey_tweak_add is 0 the functions fail and in the latter
+    /* If the resulting key in rustsecp256k1_v0_9_0_ec_seckey_tweak_add and
+     * rustsecp256k1_v0_9_0_ec_pubkey_tweak_add is 0 the functions fail and in the latter
      * case the pubkey is zeroized. */
     memcpy(ctmp, orderc, 32);
     ctmp[31] = 0x40;
     memset(ctmp2, 0, 32);
     ctmp2[31] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, ctmp2, ctmp) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(zeros, ctmp2, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_add(CTX, ctmp2, ctmp) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(zeros, ctmp2, 32) == 0);
     ctmp2[31] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, &pubkey, ctmp2) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, &pubkey, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
     memcpy(&pubkey, &pubkey2, sizeof(pubkey));
     /* Tweak computation wraps and results in a key of 1. */
     ctmp2[31] = 2;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, ctmp2, ctmp) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(ctmp2, zeros, 31) == 0 && ctmp2[31] == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_add(CTX, ctmp2, ctmp) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(ctmp2, zeros, 31) == 0 && ctmp2[31] == 1);
     ctmp2[31] = 2;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, &pubkey, ctmp2) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, &pubkey, ctmp2) == 1);
     ctmp2[31] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey2, ctmp2) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey2, ctmp2) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
     /* Tweak mul * 2 = 1+1. */
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, &pubkey, ctmp2) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, &pubkey, ctmp2) == 1);
     ctmp2[31] = 2;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(ctx, &pubkey2, ctmp2) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(CTX, &pubkey2, ctmp2) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
     /* Test argument errors. */
     ecount = 0;
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
     CHECK(ecount == 0);
     /* Zeroize pubkey on parse error. */
     memset(&pubkey, 0, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, &pubkey, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, &pubkey, ctmp2) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(pubkey)) == 0);
     memcpy(&pubkey, &pubkey2, sizeof(pubkey));
     memset(&pubkey2, 0, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(ctx, &pubkey2, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(CTX, &pubkey2, ctmp2) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey2, zeros, sizeof(pubkey2)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey2, zeros, sizeof(pubkey2)) == 0);
     /* Plain argument errors. */
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, ctmp) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, ctmp) == 1);
     CHECK(ecount == 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, NULL) == 0);
     CHECK(ecount == 1);
     ecount = 0;
     memset(ctmp2, 0, 32);
     ctmp2[31] = 4;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, NULL, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, NULL, ctmp2) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, &pubkey, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, &pubkey, NULL) == 0);
     CHECK(ecount == 2);
     ecount = 0;
     memset(ctmp2, 0, 32);
     ctmp2[31] = 4;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(ctx, NULL, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(CTX, NULL, ctmp2) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(ctx, &pubkey, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(CTX, &pubkey, NULL) == 0);
     CHECK(ecount == 2);
     ecount = 0;
     memset(ctmp2, 0, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, NULL, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_add(CTX, NULL, ctmp2) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, ctmp, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_add(CTX, ctmp, NULL) == 0);
     CHECK(ecount == 2);
     ecount = 0;
     memset(ctmp2, 0, 32);
     ctmp2[31] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(ctx, NULL, ctmp2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(CTX, NULL, ctmp2) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(ctx, ctmp, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(CTX, ctmp, NULL) == 0);
     CHECK(ecount == 2);
     ecount = 0;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, NULL, ctmp) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, NULL, ctmp) == 0);
     CHECK(ecount == 1);
     memset(&pubkey, 1, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, NULL) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, NULL) == 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) == 0);
-    /* rustsecp256k1_v0_8_1_ec_pubkey_combine tests. */
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) == 0);
+    /* rustsecp256k1_v0_9_0_ec_pubkey_combine tests. */
     ecount = 0;
     pubkeys[0] = &pubkey_one;
-    VG_UNDEF(&pubkeys[0], sizeof(rustsecp256k1_v0_8_1_pubkey *));
-    VG_UNDEF(&pubkeys[1], sizeof(rustsecp256k1_v0_8_1_pubkey *));
-    VG_UNDEF(&pubkeys[2], sizeof(rustsecp256k1_v0_8_1_pubkey *));
-    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    VG_UNDEF(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_combine(ctx, &pubkey, pubkeys, 0) == 0);
-    VG_CHECK(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) == 0);
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkeys[0], sizeof(rustsecp256k1_v0_9_0_pubkey *));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkeys[1], sizeof(rustsecp256k1_v0_9_0_pubkey *));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkeys[2], sizeof(rustsecp256k1_v0_9_0_pubkey *));
+    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_combine(CTX, &pubkey, pubkeys, 0) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) == 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_combine(ctx, NULL, pubkeys, 1) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_combine(CTX, NULL, pubkeys, 1) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) == 0);
     CHECK(ecount == 2);
-    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    VG_UNDEF(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_combine(ctx, &pubkey, NULL, 1) == 0);
-    VG_CHECK(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) == 0);
+    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_combine(CTX, &pubkey, NULL, 1) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) == 0);
     CHECK(ecount == 3);
     pubkeys[0] = &pubkey_negone;
-    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    VG_UNDEF(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_combine(ctx, &pubkey, pubkeys, 1) == 1);
-    VG_CHECK(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) > 0);
+    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_combine(CTX, &pubkey, pubkeys, 1) == 1);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) > 0);
     CHECK(ecount == 3);
     len = 33;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, ctmp, &len, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, ctmp2, &len, &pubkey_negone, SECP256K1_EC_COMPRESSED) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(ctmp, ctmp2, 33) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, ctmp, &len, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, ctmp2, &len, &pubkey_negone, SECP256K1_EC_COMPRESSED) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(ctmp, ctmp2, 33) == 0);
     /* Result is infinity. */
     pubkeys[0] = &pubkey_one;
     pubkeys[1] = &pubkey_negone;
-    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    VG_UNDEF(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_combine(ctx, &pubkey, pubkeys, 2) == 0);
-    VG_CHECK(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) == 0);
+    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_combine(CTX, &pubkey, pubkeys, 2) == 0);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) == 0);
     CHECK(ecount == 3);
     /* Passes through infinity but comes out one. */
     pubkeys[2] = &pubkey_one;
-    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    VG_UNDEF(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_combine(ctx, &pubkey, pubkeys, 3) == 1);
-    VG_CHECK(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) > 0);
+    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_combine(CTX, &pubkey, pubkeys, 3) == 1);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) > 0);
     CHECK(ecount == 3);
     len = 33;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, ctmp, &len, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, ctmp2, &len, &pubkey_one, SECP256K1_EC_COMPRESSED) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(ctmp, ctmp2, 33) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, ctmp, &len, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, ctmp2, &len, &pubkey_one, SECP256K1_EC_COMPRESSED) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(ctmp, ctmp2, 33) == 0);
     /* Adds to two. */
     pubkeys[1] = &pubkey_one;
-    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    VG_UNDEF(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_combine(ctx, &pubkey, pubkeys, 2) == 1);
-    VG_CHECK(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_8_1_pubkey)) > 0);
+    memset(&pubkey, 255, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    SECP256K1_CHECKMEM_UNDEFINE(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_combine(CTX, &pubkey, pubkeys, 2) == 1);
+    SECP256K1_CHECKMEM_CHECK(&pubkey, sizeof(rustsecp256k1_v0_9_0_pubkey));
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, zeros, sizeof(rustsecp256k1_v0_9_0_pubkey)) > 0);
     CHECK(ecount == 3);
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, NULL, NULL);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, NULL, NULL);
 }
 
-void run_eckey_negate_test(void) {
+static void run_eckey_negate_test(void) {
     unsigned char seckey[32];
     unsigned char seckey_tmp[32];
 
@@ -6095,22 +6391,22 @@ void run_eckey_negate_test(void) {
     memcpy(seckey_tmp, seckey, 32);
 
     /* Verify negation changes the key and changes it back */
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_negate(ctx, seckey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(seckey, seckey_tmp, 32) != 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_negate(ctx, seckey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(seckey, seckey_tmp, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_negate(CTX, seckey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(seckey, seckey_tmp, 32) != 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_negate(CTX, seckey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(seckey, seckey_tmp, 32) == 0);
 
     /* Check that privkey alias gives same result */
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_negate(ctx, seckey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_privkey_negate(ctx, seckey_tmp) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(seckey, seckey_tmp, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_negate(CTX, seckey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_privkey_negate(CTX, seckey_tmp) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(seckey, seckey_tmp, 32) == 0);
 
     /* Negating all 0s fails */
     memset(seckey, 0, 32);
     memset(seckey_tmp, 0, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_negate(ctx, seckey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_negate(CTX, seckey) == 0);
     /* Check that seckey is not modified */
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(seckey, seckey_tmp, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(seckey, seckey_tmp, 32) == 0);
 
     /* Negating an overflowing seckey fails and the seckey is zeroed. In this
      * test, the seckey has 16 random bytes to ensure that ec_seckey_negate
@@ -6118,30 +6414,30 @@ void run_eckey_negate_test(void) {
     random_scalar_order_b32(seckey);
     memset(seckey, 0xFF, 16);
     memset(seckey_tmp, 0, 32);
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_negate(ctx, seckey) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(seckey, seckey_tmp, 32) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_negate(CTX, seckey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(seckey, seckey_tmp, 32) == 0);
 }
 
-void random_sign(rustsecp256k1_v0_8_1_scalar *sigr, rustsecp256k1_v0_8_1_scalar *sigs, const rustsecp256k1_v0_8_1_scalar *key, const rustsecp256k1_v0_8_1_scalar *msg, int *recid) {
-    rustsecp256k1_v0_8_1_scalar nonce;
+static void random_sign(rustsecp256k1_v0_9_0_scalar *sigr, rustsecp256k1_v0_9_0_scalar *sigs, const rustsecp256k1_v0_9_0_scalar *key, const rustsecp256k1_v0_9_0_scalar *msg, int *recid) {
+    rustsecp256k1_v0_9_0_scalar nonce;
     do {
         random_scalar_order_test(&nonce);
-    } while(!rustsecp256k1_v0_8_1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, sigr, sigs, key, msg, &nonce, recid));
+    } while(!rustsecp256k1_v0_9_0_ecdsa_sig_sign(&CTX->ecmult_gen_ctx, sigr, sigs, key, msg, &nonce, recid));
 }
 
-void test_ecdsa_sign_verify(void) {
-    rustsecp256k1_v0_8_1_gej pubj;
-    rustsecp256k1_v0_8_1_ge pub;
-    rustsecp256k1_v0_8_1_scalar one;
-    rustsecp256k1_v0_8_1_scalar msg, key;
-    rustsecp256k1_v0_8_1_scalar sigr, sigs;
+static void test_ecdsa_sign_verify(void) {
+    rustsecp256k1_v0_9_0_gej pubj;
+    rustsecp256k1_v0_9_0_ge pub;
+    rustsecp256k1_v0_9_0_scalar one;
+    rustsecp256k1_v0_9_0_scalar msg, key;
+    rustsecp256k1_v0_9_0_scalar sigr, sigs;
     int getrec;
     int recid;
     random_scalar_order_test(&msg);
     random_scalar_order_test(&key);
-    rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &pubj, &key);
-    rustsecp256k1_v0_8_1_ge_set_gej(&pub, &pubj);
-    getrec = rustsecp256k1_v0_8_1_testrand_bits(1);
+    rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &pubj, &key);
+    rustsecp256k1_v0_9_0_ge_set_gej(&pub, &pubj);
+    getrec = rustsecp256k1_v0_9_0_testrand_bits(1);
     /* The specific way in which this conditional is written sidesteps a potential bug in clang.
        See the commit messages of the commit that introduced this comment for details. */
     if (getrec) {
@@ -6150,15 +6446,15 @@ void test_ecdsa_sign_verify(void) {
     } else {
         random_sign(&sigr, &sigs, &key, &msg, NULL);
     }
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sigr, &sigs, &pub, &msg));
-    rustsecp256k1_v0_8_1_scalar_set_int(&one, 1);
-    rustsecp256k1_v0_8_1_scalar_add(&msg, &msg, &one);
-    CHECK(!rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sigr, &sigs, &pub, &msg));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sigr, &sigs, &pub, &msg));
+    rustsecp256k1_v0_9_0_scalar_set_int(&one, 1);
+    rustsecp256k1_v0_9_0_scalar_add(&msg, &msg, &one);
+    CHECK(!rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sigr, &sigs, &pub, &msg));
 }
 
-void run_ecdsa_sign_verify(void) {
+static void run_ecdsa_sign_verify(void) {
     int i;
-    for (i = 0; i < 10*count; i++) {
+    for (i = 0; i < 10*COUNT; i++) {
         test_ecdsa_sign_verify();
     }
 }
@@ -6210,201 +6506,201 @@ static int nonce_function_test_retry(unsigned char *nonce32, const unsigned char
    return nonce_function_rfc6979(nonce32, msg32, key32, algo16, data, counter - 5);
 }
 
-int is_empty_signature(const rustsecp256k1_v0_8_1_ecdsa_signature *sig) {
-    static const unsigned char res[sizeof(rustsecp256k1_v0_8_1_ecdsa_signature)] = {0};
-    return rustsecp256k1_v0_8_1_memcmp_var(sig, res, sizeof(rustsecp256k1_v0_8_1_ecdsa_signature)) == 0;
+static int is_empty_signature(const rustsecp256k1_v0_9_0_ecdsa_signature *sig) {
+    static const unsigned char res[sizeof(rustsecp256k1_v0_9_0_ecdsa_signature)] = {0};
+    return rustsecp256k1_v0_9_0_memcmp_var(sig, res, sizeof(rustsecp256k1_v0_9_0_ecdsa_signature)) == 0;
 }
 
-void test_ecdsa_end_to_end(void) {
+static void test_ecdsa_end_to_end(void) {
     unsigned char extra[32] = {0x00};
     unsigned char privkey[32];
     unsigned char message[32];
     unsigned char privkey2[32];
-    rustsecp256k1_v0_8_1_ecdsa_signature signature[6];
-    rustsecp256k1_v0_8_1_scalar r, s;
+    rustsecp256k1_v0_9_0_ecdsa_signature signature[6];
+    rustsecp256k1_v0_9_0_scalar r, s;
     unsigned char sig[74];
     size_t siglen = 74;
     unsigned char pubkeyc[65];
     size_t pubkeyclen = 65;
-    rustsecp256k1_v0_8_1_pubkey pubkey;
-    rustsecp256k1_v0_8_1_pubkey pubkey_tmp;
+    rustsecp256k1_v0_9_0_pubkey pubkey;
+    rustsecp256k1_v0_9_0_pubkey pubkey_tmp;
     unsigned char seckey[300];
     size_t seckeylen = 300;
 
     /* Generate a random key and message. */
     {
-        rustsecp256k1_v0_8_1_scalar msg, key;
+        rustsecp256k1_v0_9_0_scalar msg, key;
         random_scalar_order_test(&msg);
         random_scalar_order_test(&key);
-        rustsecp256k1_v0_8_1_scalar_get_b32(privkey, &key);
-        rustsecp256k1_v0_8_1_scalar_get_b32(message, &msg);
+        rustsecp256k1_v0_9_0_scalar_get_b32(privkey, &key);
+        rustsecp256k1_v0_9_0_scalar_get_b32(message, &msg);
     }
 
     /* Construct and verify corresponding public key. */
-    CHECK(rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, privkey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, privkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_seckey_verify(CTX, privkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, privkey) == 1);
 
     /* Verify exporting and importing public key. */
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, pubkeyc, &pubkeyclen, &pubkey, rustsecp256k1_v0_8_1_testrand_bits(1) == 1 ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED));
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_serialize(CTX, pubkeyc, &pubkeyclen, &pubkey, rustsecp256k1_v0_9_0_testrand_bits(1) == 1 ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED));
     memset(&pubkey, 0, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pubkey, pubkeyc, pubkeyclen) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, pubkeyc, pubkeyclen) == 1);
 
     /* Verify negation changes the key and changes it back */
     memcpy(&pubkey_tmp, &pubkey, sizeof(pubkey));
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_negate(ctx, &pubkey_tmp) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey_tmp, &pubkey, sizeof(pubkey)) != 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_negate(ctx, &pubkey_tmp) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey_tmp, &pubkey, sizeof(pubkey)) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_negate(CTX, &pubkey_tmp) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey_tmp, &pubkey, sizeof(pubkey)) != 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_negate(CTX, &pubkey_tmp) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey_tmp, &pubkey, sizeof(pubkey)) == 0);
 
     /* Verify private key import and export. */
-    CHECK(ec_privkey_export_der(ctx, seckey, &seckeylen, privkey, rustsecp256k1_v0_8_1_testrand_bits(1) == 1));
-    CHECK(ec_privkey_import_der(ctx, privkey2, seckey, seckeylen) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(privkey, privkey2, 32) == 0);
+    CHECK(ec_privkey_export_der(CTX, seckey, &seckeylen, privkey, rustsecp256k1_v0_9_0_testrand_bits(1) == 1));
+    CHECK(ec_privkey_import_der(CTX, privkey2, seckey, seckeylen) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(privkey, privkey2, 32) == 0);
 
     /* Optionally tweak the keys using addition. */
-    if (rustsecp256k1_v0_8_1_testrand_int(3) == 0) {
+    if (rustsecp256k1_v0_9_0_testrand_int(3) == 0) {
         int ret1;
         int ret2;
         int ret3;
         unsigned char rnd[32];
         unsigned char privkey_tmp[32];
-        rustsecp256k1_v0_8_1_pubkey pubkey2;
-        rustsecp256k1_v0_8_1_testrand256_test(rnd);
+        rustsecp256k1_v0_9_0_pubkey pubkey2;
+        rustsecp256k1_v0_9_0_testrand256_test(rnd);
         memcpy(privkey_tmp, privkey, 32);
-        ret1 = rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, privkey, rnd);
-        ret2 = rustsecp256k1_v0_8_1_ec_pubkey_tweak_add(ctx, &pubkey, rnd);
+        ret1 = rustsecp256k1_v0_9_0_ec_seckey_tweak_add(CTX, privkey, rnd);
+        ret2 = rustsecp256k1_v0_9_0_ec_pubkey_tweak_add(CTX, &pubkey, rnd);
         /* Check that privkey alias gives same result */
-        ret3 = rustsecp256k1_v0_8_1_ec_privkey_tweak_add(ctx, privkey_tmp, rnd);
+        ret3 = rustsecp256k1_v0_9_0_ec_privkey_tweak_add(CTX, privkey_tmp, rnd);
         CHECK(ret1 == ret2);
         CHECK(ret2 == ret3);
         if (ret1 == 0) {
             return;
         }
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(privkey, privkey_tmp, 32) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey2, privkey) == 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(privkey, privkey_tmp, 32) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey2, privkey) == 1);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
     }
 
     /* Optionally tweak the keys using multiplication. */
-    if (rustsecp256k1_v0_8_1_testrand_int(3) == 0) {
+    if (rustsecp256k1_v0_9_0_testrand_int(3) == 0) {
         int ret1;
         int ret2;
         int ret3;
         unsigned char rnd[32];
         unsigned char privkey_tmp[32];
-        rustsecp256k1_v0_8_1_pubkey pubkey2;
-        rustsecp256k1_v0_8_1_testrand256_test(rnd);
+        rustsecp256k1_v0_9_0_pubkey pubkey2;
+        rustsecp256k1_v0_9_0_testrand256_test(rnd);
         memcpy(privkey_tmp, privkey, 32);
-        ret1 = rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(ctx, privkey, rnd);
-        ret2 = rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul(ctx, &pubkey, rnd);
+        ret1 = rustsecp256k1_v0_9_0_ec_seckey_tweak_mul(CTX, privkey, rnd);
+        ret2 = rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul(CTX, &pubkey, rnd);
         /* Check that privkey alias gives same result */
-        ret3 = rustsecp256k1_v0_8_1_ec_privkey_tweak_mul(ctx, privkey_tmp, rnd);
+        ret3 = rustsecp256k1_v0_9_0_ec_privkey_tweak_mul(CTX, privkey_tmp, rnd);
         CHECK(ret1 == ret2);
         CHECK(ret2 == ret3);
         if (ret1 == 0) {
             return;
         }
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(privkey, privkey_tmp, 32) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey2, privkey) == 1);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(privkey, privkey_tmp, 32) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey2, privkey) == 1);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
     }
 
     /* Sign. */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &signature[0], message, privkey, NULL, NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &signature[4], message, privkey, NULL, NULL) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &signature[1], message, privkey, NULL, extra) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &signature[0], message, privkey, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &signature[4], message, privkey, NULL, NULL) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &signature[1], message, privkey, NULL, extra) == 1);
     extra[31] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &signature[2], message, privkey, NULL, extra) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &signature[2], message, privkey, NULL, extra) == 1);
     extra[31] = 0;
     extra[0] = 1;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &signature[3], message, privkey, NULL, extra) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&signature[0], &signature[4], sizeof(signature[0])) == 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&signature[0], &signature[1], sizeof(signature[0])) != 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&signature[0], &signature[2], sizeof(signature[0])) != 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&signature[0], &signature[3], sizeof(signature[0])) != 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&signature[1], &signature[2], sizeof(signature[0])) != 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&signature[1], &signature[3], sizeof(signature[0])) != 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&signature[2], &signature[3], sizeof(signature[0])) != 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &signature[3], message, privkey, NULL, extra) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&signature[0], &signature[4], sizeof(signature[0])) == 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&signature[0], &signature[1], sizeof(signature[0])) != 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&signature[0], &signature[2], sizeof(signature[0])) != 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&signature[0], &signature[3], sizeof(signature[0])) != 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&signature[1], &signature[2], sizeof(signature[0])) != 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&signature[1], &signature[3], sizeof(signature[0])) != 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&signature[2], &signature[3], sizeof(signature[0])) != 0);
     /* Verify. */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[0], message, &pubkey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[1], message, &pubkey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[2], message, &pubkey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[3], message, &pubkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[0], message, &pubkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[1], message, &pubkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[2], message, &pubkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[3], message, &pubkey) == 1);
     /* Test lower-S form, malleate, verify and fail, test again, malleate again */
-    CHECK(!rustsecp256k1_v0_8_1_ecdsa_signature_normalize(ctx, NULL, &signature[0]));
-    rustsecp256k1_v0_8_1_ecdsa_signature_load(ctx, &r, &s, &signature[0]);
-    rustsecp256k1_v0_8_1_scalar_negate(&s, &s);
-    rustsecp256k1_v0_8_1_ecdsa_signature_save(&signature[5], &r, &s);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[5], message, &pubkey) == 0);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_normalize(ctx, NULL, &signature[5]));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_normalize(ctx, &signature[5], &signature[5]));
-    CHECK(!rustsecp256k1_v0_8_1_ecdsa_signature_normalize(ctx, NULL, &signature[5]));
-    CHECK(!rustsecp256k1_v0_8_1_ecdsa_signature_normalize(ctx, &signature[5], &signature[5]));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[5], message, &pubkey) == 1);
-    rustsecp256k1_v0_8_1_scalar_negate(&s, &s);
-    rustsecp256k1_v0_8_1_ecdsa_signature_save(&signature[5], &r, &s);
-    CHECK(!rustsecp256k1_v0_8_1_ecdsa_signature_normalize(ctx, NULL, &signature[5]));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[5], message, &pubkey) == 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&signature[5], &signature[0], 64) == 0);
+    CHECK(!rustsecp256k1_v0_9_0_ecdsa_signature_normalize(CTX, NULL, &signature[0]));
+    rustsecp256k1_v0_9_0_ecdsa_signature_load(CTX, &r, &s, &signature[0]);
+    rustsecp256k1_v0_9_0_scalar_negate(&s, &s);
+    rustsecp256k1_v0_9_0_ecdsa_signature_save(&signature[5], &r, &s);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[5], message, &pubkey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_normalize(CTX, NULL, &signature[5]));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_normalize(CTX, &signature[5], &signature[5]));
+    CHECK(!rustsecp256k1_v0_9_0_ecdsa_signature_normalize(CTX, NULL, &signature[5]));
+    CHECK(!rustsecp256k1_v0_9_0_ecdsa_signature_normalize(CTX, &signature[5], &signature[5]));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[5], message, &pubkey) == 1);
+    rustsecp256k1_v0_9_0_scalar_negate(&s, &s);
+    rustsecp256k1_v0_9_0_ecdsa_signature_save(&signature[5], &r, &s);
+    CHECK(!rustsecp256k1_v0_9_0_ecdsa_signature_normalize(CTX, NULL, &signature[5]));
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[5], message, &pubkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&signature[5], &signature[0], 64) == 0);
 
     /* Serialize/parse DER and verify again */
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, sig, &siglen, &signature[0]) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(CTX, sig, &siglen, &signature[0]) == 1);
     memset(&signature[0], 0, sizeof(signature[0]));
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &signature[0], sig, siglen) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[0], message, &pubkey) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &signature[0], sig, siglen) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[0], message, &pubkey) == 1);
     /* Serialize/destroy/parse DER and verify again. */
     siglen = 74;
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, sig, &siglen, &signature[0]) == 1);
-    sig[rustsecp256k1_v0_8_1_testrand_int(siglen)] += 1 + rustsecp256k1_v0_8_1_testrand_int(255);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &signature[0], sig, siglen) == 0 ||
-          rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &signature[0], message, &pubkey) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(CTX, sig, &siglen, &signature[0]) == 1);
+    sig[rustsecp256k1_v0_9_0_testrand_int(siglen)] += 1 + rustsecp256k1_v0_9_0_testrand_int(255);
+    CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &signature[0], sig, siglen) == 0 ||
+          rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &signature[0], message, &pubkey) == 0);
 }
 
-void test_random_pubkeys(void) {
-    rustsecp256k1_v0_8_1_ge elem;
-    rustsecp256k1_v0_8_1_ge elem2;
+static void test_random_pubkeys(void) {
+    rustsecp256k1_v0_9_0_ge elem;
+    rustsecp256k1_v0_9_0_ge elem2;
     unsigned char in[65];
     /* Generate some randomly sized pubkeys. */
-    size_t len = rustsecp256k1_v0_8_1_testrand_bits(2) == 0 ? 65 : 33;
-    if (rustsecp256k1_v0_8_1_testrand_bits(2) == 0) {
-        len = rustsecp256k1_v0_8_1_testrand_bits(6);
+    size_t len = rustsecp256k1_v0_9_0_testrand_bits(2) == 0 ? 65 : 33;
+    if (rustsecp256k1_v0_9_0_testrand_bits(2) == 0) {
+        len = rustsecp256k1_v0_9_0_testrand_bits(6);
     }
     if (len == 65) {
-      in[0] = rustsecp256k1_v0_8_1_testrand_bits(1) ? 4 : (rustsecp256k1_v0_8_1_testrand_bits(1) ? 6 : 7);
+      in[0] = rustsecp256k1_v0_9_0_testrand_bits(1) ? 4 : (rustsecp256k1_v0_9_0_testrand_bits(1) ? 6 : 7);
     } else {
-      in[0] = rustsecp256k1_v0_8_1_testrand_bits(1) ? 2 : 3;
+      in[0] = rustsecp256k1_v0_9_0_testrand_bits(1) ? 2 : 3;
     }
-    if (rustsecp256k1_v0_8_1_testrand_bits(3) == 0) {
-        in[0] = rustsecp256k1_v0_8_1_testrand_bits(8);
+    if (rustsecp256k1_v0_9_0_testrand_bits(3) == 0) {
+        in[0] = rustsecp256k1_v0_9_0_testrand_bits(8);
     }
     if (len > 1) {
-        rustsecp256k1_v0_8_1_testrand256(&in[1]);
+        rustsecp256k1_v0_9_0_testrand256(&in[1]);
     }
     if (len > 33) {
-        rustsecp256k1_v0_8_1_testrand256(&in[33]);
+        rustsecp256k1_v0_9_0_testrand256(&in[33]);
     }
-    if (rustsecp256k1_v0_8_1_eckey_pubkey_parse(&elem, in, len)) {
+    if (rustsecp256k1_v0_9_0_eckey_pubkey_parse(&elem, in, len)) {
         unsigned char out[65];
         unsigned char firstb;
         int res;
         size_t size = len;
         firstb = in[0];
         /* If the pubkey can be parsed, it should round-trip... */
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_serialize(&elem, out, &size, len == 33));
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_serialize(&elem, out, &size, len == 33));
         CHECK(size == len);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&in[1], &out[1], len-1) == 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&in[1], &out[1], len-1) == 0);
         /* ... except for the type of hybrid inputs. */
         if ((in[0] != 6) && (in[0] != 7)) {
             CHECK(in[0] == out[0]);
         }
         size = 65;
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_serialize(&elem, in, &size, 0));
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_serialize(&elem, in, &size, 0));
         CHECK(size == 65);
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_parse(&elem2, in, size));
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_parse(&elem2, in, size));
         ge_equals_ge(&elem,&elem2);
         /* Check that the X9.62 hybrid type is checked. */
-        in[0] = rustsecp256k1_v0_8_1_testrand_bits(1) ? 6 : 7;
-        res = rustsecp256k1_v0_8_1_eckey_pubkey_parse(&elem2, in, size);
+        in[0] = rustsecp256k1_v0_9_0_testrand_bits(1) ? 6 : 7;
+        res = rustsecp256k1_v0_9_0_eckey_pubkey_parse(&elem2, in, size);
         if (firstb == 2 || firstb == 3) {
             if (in[0] == firstb + 4) {
               CHECK(res);
@@ -6414,13 +6710,13 @@ void test_random_pubkeys(void) {
         }
         if (res) {
             ge_equals_ge(&elem,&elem2);
-            CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_serialize(&elem, out, &size, 0));
-            CHECK(rustsecp256k1_v0_8_1_memcmp_var(&in[1], &out[1], 64) == 0);
+            CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_serialize(&elem, out, &size, 0));
+            CHECK(rustsecp256k1_v0_9_0_memcmp_var(&in[1], &out[1], 64) == 0);
         }
     }
 }
 
-void run_pubkey_comparison(void) {
+static void run_pubkey_comparison(void) {
     unsigned char pk1_ser[33] = {
         0x02,
         0x58, 0x84, 0xb3, 0xa2, 0x4b, 0x97, 0x37, 0x88, 0x92, 0x38, 0xa6, 0x26, 0x62, 0x52, 0x35, 0x11,
@@ -6431,93 +6727,93 @@ void run_pubkey_comparison(void) {
         0xde, 0x36, 0x0e, 0x87, 0x59, 0x8f, 0x3c, 0x01, 0x36, 0x2a, 0x2a, 0xb8, 0xc6, 0xf4, 0x5e, 0x4d,
         0xb2, 0xc2, 0xd5, 0x03, 0xa7, 0xf9, 0xf1, 0x4f, 0xa8, 0xfa, 0x95, 0xa8, 0xe9, 0x69, 0x76, 0x1c
     };
-    rustsecp256k1_v0_8_1_pubkey pk1;
-    rustsecp256k1_v0_8_1_pubkey pk2;
+    rustsecp256k1_v0_9_0_pubkey pk1;
+    rustsecp256k1_v0_9_0_pubkey pk2;
     int32_t ecount = 0;
 
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pk1, pk1_ser, sizeof(pk1_ser)) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pk2, pk2_ser, sizeof(pk2_ser)) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pk1, pk1_ser, sizeof(pk1_ser)) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pk2, pk2_ser, sizeof(pk2_ser)) == 1);
 
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, NULL, &pk2) < 0);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, NULL, &pk2) < 0);
     CHECK(ecount == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk1, NULL) > 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk1, NULL) > 0);
     CHECK(ecount == 2);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk1, &pk2) < 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk2, &pk1) > 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk1, &pk1) == 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk2, &pk2) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk1, &pk2) < 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk2, &pk1) > 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk1, &pk1) == 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk2, &pk2) == 0);
     CHECK(ecount == 2);
     {
-        rustsecp256k1_v0_8_1_pubkey pk_tmp;
+        rustsecp256k1_v0_9_0_pubkey pk_tmp;
         memset(&pk_tmp, 0, sizeof(pk_tmp)); /* illegal pubkey */
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk_tmp, &pk2) < 0);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk_tmp, &pk2) < 0);
         CHECK(ecount == 3);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk_tmp, &pk_tmp) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk_tmp, &pk_tmp) == 0);
         CHECK(ecount == 5);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk2, &pk_tmp) > 0);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk2, &pk_tmp) > 0);
         CHECK(ecount == 6);
     }
 
-    rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, NULL, NULL);
+    rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, NULL, NULL);
 
     /* Make pk2 the same as pk1 but with 3 rather than 2. Note that in
      * an uncompressed encoding, these would have the opposite ordering */
     pk1_ser[0] = 3;
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_parse(ctx, &pk2, pk1_ser, sizeof(pk1_ser)) == 1);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk1, &pk2) < 0);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_cmp(ctx, &pk2, &pk1) > 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pk2, pk1_ser, sizeof(pk1_ser)) == 1);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk1, &pk2) < 0);
+    CHECK(rustsecp256k1_v0_9_0_ec_pubkey_cmp(CTX, &pk2, &pk1) > 0);
 }
 
-void run_random_pubkeys(void) {
+static void run_random_pubkeys(void) {
     int i;
-    for (i = 0; i < 10*count; i++) {
+    for (i = 0; i < 10*COUNT; i++) {
         test_random_pubkeys();
     }
 }
 
-void run_ecdsa_end_to_end(void) {
+static void run_ecdsa_end_to_end(void) {
     int i;
-    for (i = 0; i < 64*count; i++) {
+    for (i = 0; i < 64*COUNT; i++) {
         test_ecdsa_end_to_end();
     }
 }
 
-int test_ecdsa_der_parse(const unsigned char *sig, size_t siglen, int certainly_der, int certainly_not_der) {
+static int test_ecdsa_der_parse(const unsigned char *sig, size_t siglen, int certainly_der, int certainly_not_der) {
     static const unsigned char zeroes[32] = {0};
 
     int ret = 0;
 
-    rustsecp256k1_v0_8_1_ecdsa_signature sig_der;
+    rustsecp256k1_v0_9_0_ecdsa_signature sig_der;
     unsigned char roundtrip_der[2048];
     unsigned char compact_der[64];
     size_t len_der = 2048;
     int parsed_der = 0, valid_der = 0, roundtrips_der = 0;
 
-    rustsecp256k1_v0_8_1_ecdsa_signature sig_der_lax;
+    rustsecp256k1_v0_9_0_ecdsa_signature sig_der_lax;
     unsigned char roundtrip_der_lax[2048];
     unsigned char compact_der_lax[64];
     size_t len_der_lax = 2048;
     int parsed_der_lax = 0, valid_der_lax = 0, roundtrips_der_lax = 0;
 
-    parsed_der = rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig_der, sig, siglen);
+    parsed_der = rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig_der, sig, siglen);
     if (parsed_der) {
-        ret |= (!rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact(ctx, compact_der, &sig_der)) << 0;
-        valid_der = (rustsecp256k1_v0_8_1_memcmp_var(compact_der, zeroes, 32) != 0) && (rustsecp256k1_v0_8_1_memcmp_var(compact_der + 32, zeroes, 32) != 0);
+        ret |= (!rustsecp256k1_v0_9_0_ecdsa_signature_serialize_compact(CTX, compact_der, &sig_der)) << 0;
+        valid_der = (rustsecp256k1_v0_9_0_memcmp_var(compact_der, zeroes, 32) != 0) && (rustsecp256k1_v0_9_0_memcmp_var(compact_der + 32, zeroes, 32) != 0);
     }
     if (valid_der) {
-        ret |= (!rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, roundtrip_der, &len_der, &sig_der)) << 1;
-        roundtrips_der = (len_der == siglen) && rustsecp256k1_v0_8_1_memcmp_var(roundtrip_der, sig, siglen) == 0;
+        ret |= (!rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(CTX, roundtrip_der, &len_der, &sig_der)) << 1;
+        roundtrips_der = (len_der == siglen) && rustsecp256k1_v0_9_0_memcmp_var(roundtrip_der, sig, siglen) == 0;
     }
 
-    parsed_der_lax = rustsecp256k1_v0_8_1_ecdsa_signature_parse_der_lax(ctx, &sig_der_lax, sig, siglen);
+    parsed_der_lax = rustsecp256k1_v0_9_0_ecdsa_signature_parse_der_lax(CTX, &sig_der_lax, sig, siglen);
     if (parsed_der_lax) {
-        ret |= (!rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact(ctx, compact_der_lax, &sig_der_lax)) << 10;
-        valid_der_lax = (rustsecp256k1_v0_8_1_memcmp_var(compact_der_lax, zeroes, 32) != 0) && (rustsecp256k1_v0_8_1_memcmp_var(compact_der_lax + 32, zeroes, 32) != 0);
+        ret |= (!rustsecp256k1_v0_9_0_ecdsa_signature_serialize_compact(CTX, compact_der_lax, &sig_der_lax)) << 10;
+        valid_der_lax = (rustsecp256k1_v0_9_0_memcmp_var(compact_der_lax, zeroes, 32) != 0) && (rustsecp256k1_v0_9_0_memcmp_var(compact_der_lax + 32, zeroes, 32) != 0);
     }
     if (valid_der_lax) {
-        ret |= (!rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, roundtrip_der_lax, &len_der_lax, &sig_der_lax)) << 11;
-        roundtrips_der_lax = (len_der_lax == siglen) && rustsecp256k1_v0_8_1_memcmp_var(roundtrip_der_lax, sig, siglen) == 0;
+        ret |= (!rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(CTX, roundtrip_der_lax, &len_der_lax, &sig_der_lax)) << 11;
+        roundtrips_der_lax = (len_der_lax == siglen) && rustsecp256k1_v0_9_0_memcmp_var(roundtrip_der_lax, sig, siglen) == 0;
     }
 
     if (certainly_der) {
@@ -6533,7 +6829,7 @@ int test_ecdsa_der_parse(const unsigned char *sig, size_t siglen, int certainly_
     if (valid_der) {
         ret |= (!roundtrips_der_lax) << 12;
         ret |= (len_der != len_der_lax) << 13;
-        ret |= ((len_der != len_der_lax) || (rustsecp256k1_v0_8_1_memcmp_var(roundtrip_der_lax, roundtrip_der, len_der) != 0)) << 14;
+        ret |= ((len_der != len_der_lax) || (rustsecp256k1_v0_9_0_memcmp_var(roundtrip_der_lax, roundtrip_der, len_der) != 0)) << 14;
     }
     ret |= (roundtrips_der != roundtrips_der_lax) << 15;
     if (parsed_der) {
@@ -6557,27 +6853,27 @@ static void assign_big_endian(unsigned char *ptr, size_t ptrlen, uint32_t val) {
 
 static void damage_array(unsigned char *sig, size_t *len) {
     int pos;
-    int action = rustsecp256k1_v0_8_1_testrand_bits(3);
+    int action = rustsecp256k1_v0_9_0_testrand_bits(3);
     if (action < 1 && *len > 3) {
         /* Delete a byte. */
-        pos = rustsecp256k1_v0_8_1_testrand_int(*len);
+        pos = rustsecp256k1_v0_9_0_testrand_int(*len);
         memmove(sig + pos, sig + pos + 1, *len - pos - 1);
         (*len)--;
         return;
     } else if (action < 2 && *len < 2048) {
         /* Insert a byte. */
-        pos = rustsecp256k1_v0_8_1_testrand_int(1 + *len);
+        pos = rustsecp256k1_v0_9_0_testrand_int(1 + *len);
         memmove(sig + pos + 1, sig + pos, *len - pos);
-        sig[pos] = rustsecp256k1_v0_8_1_testrand_bits(8);
+        sig[pos] = rustsecp256k1_v0_9_0_testrand_bits(8);
         (*len)++;
         return;
     } else if (action < 4) {
         /* Modify a byte. */
-        sig[rustsecp256k1_v0_8_1_testrand_int(*len)] += 1 + rustsecp256k1_v0_8_1_testrand_int(255);
+        sig[rustsecp256k1_v0_9_0_testrand_int(*len)] += 1 + rustsecp256k1_v0_9_0_testrand_int(255);
         return;
     } else { /* action < 8 */
         /* Modify a bit. */
-        sig[rustsecp256k1_v0_8_1_testrand_int(*len)] ^= 1 << rustsecp256k1_v0_8_1_testrand_bits(3);
+        sig[rustsecp256k1_v0_9_0_testrand_int(*len)] ^= 1 << rustsecp256k1_v0_9_0_testrand_bits(3);
         return;
     }
 }
@@ -6590,23 +6886,23 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     int n;
 
     *len = 0;
-    der = rustsecp256k1_v0_8_1_testrand_bits(2) == 0;
+    der = rustsecp256k1_v0_9_0_testrand_bits(2) == 0;
     *certainly_der = der;
     *certainly_not_der = 0;
-    indet = der ? 0 : rustsecp256k1_v0_8_1_testrand_int(10) == 0;
+    indet = der ? 0 : rustsecp256k1_v0_9_0_testrand_int(10) == 0;
 
     for (n = 0; n < 2; n++) {
         /* We generate two classes of numbers: nlow==1 "low" ones (up to 32 bytes), nlow==0 "high" ones (32 bytes with 129 top bits set, or larger than 32 bytes) */
-        nlow[n] = der ? 1 : (rustsecp256k1_v0_8_1_testrand_bits(3) != 0);
+        nlow[n] = der ? 1 : (rustsecp256k1_v0_9_0_testrand_bits(3) != 0);
         /* The length of the number in bytes (the first byte of which will always be nonzero) */
-        nlen[n] = nlow[n] ? rustsecp256k1_v0_8_1_testrand_int(33) : 32 + rustsecp256k1_v0_8_1_testrand_int(200) * rustsecp256k1_v0_8_1_testrand_bits(3) / 8;
+        nlen[n] = nlow[n] ? rustsecp256k1_v0_9_0_testrand_int(33) : 32 + rustsecp256k1_v0_9_0_testrand_int(200) * rustsecp256k1_v0_9_0_testrand_bits(3) / 8;
         CHECK(nlen[n] <= 232);
         /* The top bit of the number. */
-        nhbit[n] = (nlow[n] == 0 && nlen[n] == 32) ? 1 : (nlen[n] == 0 ? 0 : rustsecp256k1_v0_8_1_testrand_bits(1));
+        nhbit[n] = (nlow[n] == 0 && nlen[n] == 32) ? 1 : (nlen[n] == 0 ? 0 : rustsecp256k1_v0_9_0_testrand_bits(1));
         /* The top byte of the number (after the potential hardcoded 16 0xFF characters for "high" 32 bytes numbers) */
-        nhbyte[n] = nlen[n] == 0 ? 0 : (nhbit[n] ? 128 + rustsecp256k1_v0_8_1_testrand_bits(7) : 1 + rustsecp256k1_v0_8_1_testrand_int(127));
+        nhbyte[n] = nlen[n] == 0 ? 0 : (nhbit[n] ? 128 + rustsecp256k1_v0_9_0_testrand_bits(7) : 1 + rustsecp256k1_v0_9_0_testrand_int(127));
         /* The number of zero bytes in front of the number (which is 0 or 1 in case of DER, otherwise we extend up to 300 bytes) */
-        nzlen[n] = der ? ((nlen[n] == 0 || nhbit[n]) ? 1 : 0) : (nlow[n] ? rustsecp256k1_v0_8_1_testrand_int(3) : rustsecp256k1_v0_8_1_testrand_int(300 - nlen[n]) * rustsecp256k1_v0_8_1_testrand_bits(3) / 8);
+        nzlen[n] = der ? ((nlen[n] == 0 || nhbit[n]) ? 1 : 0) : (nlow[n] ? rustsecp256k1_v0_9_0_testrand_int(3) : rustsecp256k1_v0_9_0_testrand_int(300 - nlen[n]) * rustsecp256k1_v0_9_0_testrand_bits(3) / 8);
         if (nzlen[n] > ((nlen[n] == 0 || nhbit[n]) ? 1 : 0)) {
             *certainly_not_der = 1;
         }
@@ -6615,7 +6911,7 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
         nlenlen[n] = nlen[n] + nzlen[n] < 128 ? 0 : (nlen[n] + nzlen[n] < 256 ? 1 : 2);
         if (!der) {
             /* nlenlen[n] max 127 bytes */
-            int add = rustsecp256k1_v0_8_1_testrand_int(127 - nlenlen[n]) * rustsecp256k1_v0_8_1_testrand_bits(4) * rustsecp256k1_v0_8_1_testrand_bits(4) / 256;
+            int add = rustsecp256k1_v0_9_0_testrand_int(127 - nlenlen[n]) * rustsecp256k1_v0_9_0_testrand_bits(4) * rustsecp256k1_v0_9_0_testrand_bits(4) / 256;
             nlenlen[n] += add;
             if (add != 0) {
                 *certainly_not_der = 1;
@@ -6629,7 +6925,7 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     CHECK(tlen <= 856);
 
     /* The length of the garbage inside the tuple. */
-    elen = (der || indet) ? 0 : rustsecp256k1_v0_8_1_testrand_int(980 - tlen) * rustsecp256k1_v0_8_1_testrand_bits(3) / 8;
+    elen = (der || indet) ? 0 : rustsecp256k1_v0_9_0_testrand_int(980 - tlen) * rustsecp256k1_v0_9_0_testrand_bits(3) / 8;
     if (elen != 0) {
         *certainly_not_der = 1;
     }
@@ -6637,7 +6933,7 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     CHECK(tlen <= 980);
 
     /* The length of the garbage after the end of the tuple. */
-    glen = der ? 0 : rustsecp256k1_v0_8_1_testrand_int(990 - tlen) * rustsecp256k1_v0_8_1_testrand_bits(3) / 8;
+    glen = der ? 0 : rustsecp256k1_v0_9_0_testrand_int(990 - tlen) * rustsecp256k1_v0_9_0_testrand_bits(3) / 8;
     if (glen != 0) {
         *certainly_not_der = 1;
     }
@@ -6652,7 +6948,7 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     } else {
         int tlenlen = tlen < 128 ? 0 : (tlen < 256 ? 1 : 2);
         if (!der) {
-            int add = rustsecp256k1_v0_8_1_testrand_int(127 - tlenlen) * rustsecp256k1_v0_8_1_testrand_bits(4) * rustsecp256k1_v0_8_1_testrand_bits(4) / 256;
+            int add = rustsecp256k1_v0_9_0_testrand_int(127 - tlenlen) * rustsecp256k1_v0_9_0_testrand_bits(4) * rustsecp256k1_v0_9_0_testrand_bits(4) / 256;
             tlenlen += add;
             if (add != 0) {
                 *certainly_not_der = 1;
@@ -6703,13 +6999,13 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
             nlen[n]--;
         }
         /* Generate remaining random bytes of number */
-        rustsecp256k1_v0_8_1_testrand_bytes_test(sig + *len, nlen[n]);
+        rustsecp256k1_v0_9_0_testrand_bytes_test(sig + *len, nlen[n]);
         *len += nlen[n];
         nlen[n] = 0;
     }
 
     /* Generate random garbage inside tuple. */
-    rustsecp256k1_v0_8_1_testrand_bytes_test(sig + *len, elen);
+    rustsecp256k1_v0_9_0_testrand_bytes_test(sig + *len, elen);
     *len += elen;
 
     /* Generate end-of-contents bytes. */
@@ -6721,16 +7017,16 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     CHECK(tlen + glen <= 1121);
 
     /* Generate random garbage outside tuple. */
-    rustsecp256k1_v0_8_1_testrand_bytes_test(sig + *len, glen);
+    rustsecp256k1_v0_9_0_testrand_bytes_test(sig + *len, glen);
     *len += glen;
     tlen += glen;
     CHECK(tlen <= 1121);
     CHECK(tlen == *len);
 }
 
-void run_ecdsa_der_parse(void) {
+static void run_ecdsa_der_parse(void) {
     int i,j;
-    for (i = 0; i < 200 * count; i++) {
+    for (i = 0; i < 200 * COUNT; i++) {
         unsigned char buffer[2048];
         size_t buflen = 0;
         int certainly_der = 0;
@@ -6760,24 +7056,24 @@ void run_ecdsa_der_parse(void) {
 }
 
 /* Tests several edge cases. */
-void test_ecdsa_edge_cases(void) {
+static void test_ecdsa_edge_cases(void) {
     int t;
-    rustsecp256k1_v0_8_1_ecdsa_signature sig;
+    rustsecp256k1_v0_9_0_ecdsa_signature sig;
 
     /* Test the case where ECDSA recomputes a point that is infinity. */
     {
-        rustsecp256k1_v0_8_1_gej keyj;
-        rustsecp256k1_v0_8_1_ge key;
-        rustsecp256k1_v0_8_1_scalar msg;
-        rustsecp256k1_v0_8_1_scalar sr, ss;
-        rustsecp256k1_v0_8_1_scalar_set_int(&ss, 1);
-        rustsecp256k1_v0_8_1_scalar_negate(&ss, &ss);
-        rustsecp256k1_v0_8_1_scalar_inverse(&ss, &ss);
-        rustsecp256k1_v0_8_1_scalar_set_int(&sr, 1);
-        rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &keyj, &sr);
-        rustsecp256k1_v0_8_1_ge_set_gej(&key, &keyj);
+        rustsecp256k1_v0_9_0_gej keyj;
+        rustsecp256k1_v0_9_0_ge key;
+        rustsecp256k1_v0_9_0_scalar msg;
+        rustsecp256k1_v0_9_0_scalar sr, ss;
+        rustsecp256k1_v0_9_0_scalar_set_int(&ss, 1);
+        rustsecp256k1_v0_9_0_scalar_negate(&ss, &ss);
+        rustsecp256k1_v0_9_0_scalar_inverse(&ss, &ss);
+        rustsecp256k1_v0_9_0_scalar_set_int(&sr, 1);
+        rustsecp256k1_v0_9_0_ecmult_gen(&CTX->ecmult_gen_ctx, &keyj, &sr);
+        rustsecp256k1_v0_9_0_ge_set_gej(&key, &keyj);
         msg = ss;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
     }
 
     /* Verify signature with r of zero fails. */
@@ -6789,14 +7085,14 @@ void test_ecdsa_edge_cases(void) {
             0x3b, 0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41,
             0x41
         };
-        rustsecp256k1_v0_8_1_ge key;
-        rustsecp256k1_v0_8_1_scalar msg;
-        rustsecp256k1_v0_8_1_scalar sr, ss;
-        rustsecp256k1_v0_8_1_scalar_set_int(&ss, 1);
-        rustsecp256k1_v0_8_1_scalar_set_int(&msg, 0);
-        rustsecp256k1_v0_8_1_scalar_set_int(&sr, 0);
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_parse(&key, pubkey_mods_zero, 33));
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify( &sr, &ss, &key, &msg) == 0);
+        rustsecp256k1_v0_9_0_ge key;
+        rustsecp256k1_v0_9_0_scalar msg;
+        rustsecp256k1_v0_9_0_scalar sr, ss;
+        rustsecp256k1_v0_9_0_scalar_set_int(&ss, 1);
+        rustsecp256k1_v0_9_0_scalar_set_int(&msg, 0);
+        rustsecp256k1_v0_9_0_scalar_set_int(&sr, 0);
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_parse(&key, pubkey_mods_zero, 33));
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify( &sr, &ss, &key, &msg) == 0);
     }
 
     /* Verify signature with s of zero fails. */
@@ -6808,14 +7104,14 @@ void test_ecdsa_edge_cases(void) {
             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
             0x01
         };
-        rustsecp256k1_v0_8_1_ge key;
-        rustsecp256k1_v0_8_1_scalar msg;
-        rustsecp256k1_v0_8_1_scalar sr, ss;
-        rustsecp256k1_v0_8_1_scalar_set_int(&ss, 0);
-        rustsecp256k1_v0_8_1_scalar_set_int(&msg, 0);
-        rustsecp256k1_v0_8_1_scalar_set_int(&sr, 1);
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_parse(&key, pubkey, 33));
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
+        rustsecp256k1_v0_9_0_ge key;
+        rustsecp256k1_v0_9_0_scalar msg;
+        rustsecp256k1_v0_9_0_scalar sr, ss;
+        rustsecp256k1_v0_9_0_scalar_set_int(&ss, 0);
+        rustsecp256k1_v0_9_0_scalar_set_int(&msg, 0);
+        rustsecp256k1_v0_9_0_scalar_set_int(&sr, 1);
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_parse(&key, pubkey, 33));
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
     }
 
     /* Verify signature with message 0 passes. */
@@ -6834,23 +7130,23 @@ void test_ecdsa_edge_cases(void) {
             0x3b, 0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41,
             0x43
         };
-        rustsecp256k1_v0_8_1_ge key;
-        rustsecp256k1_v0_8_1_ge key2;
-        rustsecp256k1_v0_8_1_scalar msg;
-        rustsecp256k1_v0_8_1_scalar sr, ss;
-        rustsecp256k1_v0_8_1_scalar_set_int(&ss, 2);
-        rustsecp256k1_v0_8_1_scalar_set_int(&msg, 0);
-        rustsecp256k1_v0_8_1_scalar_set_int(&sr, 2);
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_parse(&key, pubkey, 33));
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_parse(&key2, pubkey2, 33));
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 1);
-        rustsecp256k1_v0_8_1_scalar_negate(&ss, &ss);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 1);
-        rustsecp256k1_v0_8_1_scalar_set_int(&ss, 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 0);
+        rustsecp256k1_v0_9_0_ge key;
+        rustsecp256k1_v0_9_0_ge key2;
+        rustsecp256k1_v0_9_0_scalar msg;
+        rustsecp256k1_v0_9_0_scalar sr, ss;
+        rustsecp256k1_v0_9_0_scalar_set_int(&ss, 2);
+        rustsecp256k1_v0_9_0_scalar_set_int(&msg, 0);
+        rustsecp256k1_v0_9_0_scalar_set_int(&sr, 2);
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_parse(&key, pubkey, 33));
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_parse(&key2, pubkey2, 33));
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 1);
+        rustsecp256k1_v0_9_0_scalar_negate(&ss, &ss);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 1);
+        rustsecp256k1_v0_9_0_scalar_set_int(&ss, 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 0);
     }
 
     /* Verify signature with message 1 passes. */
@@ -6875,24 +7171,24 @@ void test_ecdsa_edge_cases(void) {
             0x45, 0x51, 0x23, 0x19, 0x50, 0xb7, 0x5f, 0xc4,
             0x40, 0x2d, 0xa1, 0x72, 0x2f, 0xc9, 0xba, 0xeb
         };
-        rustsecp256k1_v0_8_1_ge key;
-        rustsecp256k1_v0_8_1_ge key2;
-        rustsecp256k1_v0_8_1_scalar msg;
-        rustsecp256k1_v0_8_1_scalar sr, ss;
-        rustsecp256k1_v0_8_1_scalar_set_int(&ss, 1);
-        rustsecp256k1_v0_8_1_scalar_set_int(&msg, 1);
-        rustsecp256k1_v0_8_1_scalar_set_b32(&sr, csr, NULL);
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_parse(&key, pubkey, 33));
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_parse(&key2, pubkey2, 33));
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 1);
-        rustsecp256k1_v0_8_1_scalar_negate(&ss, &ss);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 1);
-        rustsecp256k1_v0_8_1_scalar_set_int(&ss, 2);
-        rustsecp256k1_v0_8_1_scalar_inverse_var(&ss, &ss);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 0);
+        rustsecp256k1_v0_9_0_ge key;
+        rustsecp256k1_v0_9_0_ge key2;
+        rustsecp256k1_v0_9_0_scalar msg;
+        rustsecp256k1_v0_9_0_scalar sr, ss;
+        rustsecp256k1_v0_9_0_scalar_set_int(&ss, 1);
+        rustsecp256k1_v0_9_0_scalar_set_int(&msg, 1);
+        rustsecp256k1_v0_9_0_scalar_set_b32(&sr, csr, NULL);
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_parse(&key, pubkey, 33));
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_parse(&key2, pubkey2, 33));
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 1);
+        rustsecp256k1_v0_9_0_scalar_negate(&ss, &ss);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 1);
+        rustsecp256k1_v0_9_0_scalar_set_int(&ss, 2);
+        rustsecp256k1_v0_9_0_scalar_inverse_var(&ss, &ss);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key2, &msg) == 0);
     }
 
     /* Verify signature with message -1 passes. */
@@ -6910,25 +7206,25 @@ void test_ecdsa_edge_cases(void) {
             0x45, 0x51, 0x23, 0x19, 0x50, 0xb7, 0x5f, 0xc4,
             0x40, 0x2d, 0xa1, 0x72, 0x2f, 0xc9, 0xba, 0xee
         };
-        rustsecp256k1_v0_8_1_ge key;
-        rustsecp256k1_v0_8_1_scalar msg;
-        rustsecp256k1_v0_8_1_scalar sr, ss;
-        rustsecp256k1_v0_8_1_scalar_set_int(&ss, 1);
-        rustsecp256k1_v0_8_1_scalar_set_int(&msg, 1);
-        rustsecp256k1_v0_8_1_scalar_negate(&msg, &msg);
-        rustsecp256k1_v0_8_1_scalar_set_b32(&sr, csr, NULL);
-        CHECK(rustsecp256k1_v0_8_1_eckey_pubkey_parse(&key, pubkey, 33));
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
-        rustsecp256k1_v0_8_1_scalar_negate(&ss, &ss);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
-        rustsecp256k1_v0_8_1_scalar_set_int(&ss, 3);
-        rustsecp256k1_v0_8_1_scalar_inverse_var(&ss, &ss);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
+        rustsecp256k1_v0_9_0_ge key;
+        rustsecp256k1_v0_9_0_scalar msg;
+        rustsecp256k1_v0_9_0_scalar sr, ss;
+        rustsecp256k1_v0_9_0_scalar_set_int(&ss, 1);
+        rustsecp256k1_v0_9_0_scalar_set_int(&msg, 1);
+        rustsecp256k1_v0_9_0_scalar_negate(&msg, &msg);
+        rustsecp256k1_v0_9_0_scalar_set_b32(&sr, csr, NULL);
+        CHECK(rustsecp256k1_v0_9_0_eckey_pubkey_parse(&key, pubkey, 33));
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
+        rustsecp256k1_v0_9_0_scalar_negate(&ss, &ss);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 1);
+        rustsecp256k1_v0_9_0_scalar_set_int(&ss, 3);
+        rustsecp256k1_v0_9_0_scalar_inverse_var(&ss, &ss);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sig_verify(&sr, &ss, &key, &msg) == 0);
     }
 
     /* Signature where s would be zero. */
     {
-        rustsecp256k1_v0_8_1_pubkey pubkey;
+        rustsecp256k1_v0_9_0_pubkey pubkey;
         size_t siglen;
         int32_t ecount;
         unsigned char signature[72];
@@ -6957,71 +7253,71 @@ void test_ecdsa_edge_cases(void) {
             0x65, 0xdf, 0xdd, 0x31, 0xb9, 0x3e, 0x29, 0xa9,
         };
         ecount = 0;
-        rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg, key, precomputed_nonce_function, nonce) == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg, key, precomputed_nonce_function, nonce2) == 0);
+        rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, msg, key, precomputed_nonce_function, nonce) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, msg, key, precomputed_nonce_function, nonce2) == 0);
         msg[31] = 0xaa;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg, key, precomputed_nonce_function, nonce) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, msg, key, precomputed_nonce_function, nonce) == 1);
         CHECK(ecount == 0);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, NULL, msg, key, precomputed_nonce_function, nonce2) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, NULL, msg, key, precomputed_nonce_function, nonce2) == 0);
         CHECK(ecount == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, NULL, key, precomputed_nonce_function, nonce2) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, NULL, key, precomputed_nonce_function, nonce2) == 0);
         CHECK(ecount == 2);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg, NULL, precomputed_nonce_function, nonce2) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, msg, NULL, precomputed_nonce_function, nonce2) == 0);
         CHECK(ecount == 3);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg, key, precomputed_nonce_function, nonce2) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, key) == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, NULL, msg, &pubkey) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, msg, key, precomputed_nonce_function, nonce2) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, key) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, NULL, msg, &pubkey) == 0);
         CHECK(ecount == 4);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, NULL, &pubkey) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, NULL, &pubkey) == 0);
         CHECK(ecount == 5);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg, NULL) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg, NULL) == 0);
         CHECK(ecount == 6);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg, &pubkey) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg, &pubkey) == 1);
         CHECK(ecount == 6);
-        CHECK(rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, NULL) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_create(CTX, &pubkey, NULL) == 0);
         CHECK(ecount == 7);
         /* That pubkeyload fails via an ARGCHECK is a little odd but makes sense because pubkeys are an opaque data type. */
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg, &pubkey) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_verify(CTX, &sig, msg, &pubkey) == 0);
         CHECK(ecount == 8);
         siglen = 72;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, NULL, &siglen, &sig) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(CTX, NULL, &siglen, &sig) == 0);
         CHECK(ecount == 9);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, signature, NULL, &sig) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(CTX, signature, NULL, &sig) == 0);
         CHECK(ecount == 10);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, signature, &siglen, NULL) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(CTX, signature, &siglen, NULL) == 0);
         CHECK(ecount == 11);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, signature, &siglen, &sig) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(CTX, signature, &siglen, &sig) == 1);
         CHECK(ecount == 11);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, NULL, signature, siglen) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, NULL, signature, siglen) == 0);
         CHECK(ecount == 12);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, NULL, siglen) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, NULL, siglen) == 0);
         CHECK(ecount == 13);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_der(ctx, &sig, signature, siglen) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &sig, signature, siglen) == 1);
         CHECK(ecount == 13);
         siglen = 10;
         /* Too little room for a signature does not fail via ARGCHECK. */
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, signature, &siglen, &sig) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der(CTX, signature, &siglen, &sig) == 0);
         CHECK(ecount == 13);
         ecount = 0;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_normalize(ctx, NULL, NULL) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_normalize(CTX, NULL, NULL) == 0);
         CHECK(ecount == 1);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact(ctx, NULL, &sig) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_compact(CTX, NULL, &sig) == 0);
         CHECK(ecount == 2);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact(ctx, signature, NULL) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_compact(CTX, signature, NULL) == 0);
         CHECK(ecount == 3);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact(ctx, signature, &sig) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_serialize_compact(CTX, signature, &sig) == 1);
         CHECK(ecount == 3);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(ctx, NULL, signature) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(CTX, NULL, signature) == 0);
         CHECK(ecount == 4);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(ctx, &sig, NULL) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(CTX, &sig, NULL) == 0);
         CHECK(ecount == 5);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(ctx, &sig, signature) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(CTX, &sig, signature) == 1);
         CHECK(ecount == 5);
         memset(signature, 255, 64);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact(ctx, &sig, signature) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(CTX, &sig, signature) == 0);
         CHECK(ecount == 5);
-        rustsecp256k1_v0_8_1_context_set_illegal_callback(ctx, NULL, NULL);
+        rustsecp256k1_v0_9_0_context_set_illegal_callback(CTX, NULL, NULL);
     }
 
     /* Nonce function corner cases. */
@@ -7030,43 +7326,43 @@ void test_ecdsa_edge_cases(void) {
         int i;
         unsigned char key[32];
         unsigned char msg[32];
-        rustsecp256k1_v0_8_1_ecdsa_signature sig2;
-        rustsecp256k1_v0_8_1_scalar sr[512], ss;
+        rustsecp256k1_v0_9_0_ecdsa_signature sig2;
+        rustsecp256k1_v0_9_0_scalar sr[512], ss;
         const unsigned char *extra;
         extra = t == 0 ? NULL : zero;
         memset(msg, 0, 32);
         msg[31] = 1;
         /* High key results in signature failure. */
         memset(key, 0xFF, 32);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg, key, NULL, extra) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, msg, key, NULL, extra) == 0);
         CHECK(is_empty_signature(&sig));
         /* Zero key results in signature failure. */
         memset(key, 0, 32);
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg, key, NULL, extra) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, msg, key, NULL, extra) == 0);
         CHECK(is_empty_signature(&sig));
         /* Nonce function failure results in signature failure. */
         key[31] = 1;
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg, key, nonce_function_test_fail, extra) == 0);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, msg, key, nonce_function_test_fail, extra) == 0);
         CHECK(is_empty_signature(&sig));
         /* The retry loop successfully makes its way to the first good value. */
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg, key, nonce_function_test_retry, extra) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig, msg, key, nonce_function_test_retry, extra) == 1);
         CHECK(!is_empty_signature(&sig));
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig2, msg, key, nonce_function_rfc6979, extra) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig2, msg, key, nonce_function_rfc6979, extra) == 1);
         CHECK(!is_empty_signature(&sig2));
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&sig, &sig2, sizeof(sig)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&sig, &sig2, sizeof(sig)) == 0);
         /* The default nonce function is deterministic. */
-        CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig2, msg, key, NULL, extra) == 1);
+        CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig2, msg, key, NULL, extra) == 1);
         CHECK(!is_empty_signature(&sig2));
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(&sig, &sig2, sizeof(sig)) == 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(&sig, &sig2, sizeof(sig)) == 0);
         /* The default nonce function changes output with different messages. */
         for(i = 0; i < 256; i++) {
             int j;
             msg[0] = i;
-            CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig2, msg, key, NULL, extra) == 1);
+            CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig2, msg, key, NULL, extra) == 1);
             CHECK(!is_empty_signature(&sig2));
-            rustsecp256k1_v0_8_1_ecdsa_signature_load(ctx, &sr[i], &ss, &sig2);
+            rustsecp256k1_v0_9_0_ecdsa_signature_load(CTX, &sr[i], &ss, &sig2);
             for (j = 0; j < i; j++) {
-                CHECK(!rustsecp256k1_v0_8_1_scalar_eq(&sr[i], &sr[j]));
+                CHECK(!rustsecp256k1_v0_9_0_scalar_eq(&sr[i], &sr[j]));
             }
         }
         msg[0] = 0;
@@ -7075,11 +7371,11 @@ void test_ecdsa_edge_cases(void) {
         for(i = 256; i < 512; i++) {
             int j;
             key[0] = i - 256;
-            CHECK(rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig2, msg, key, NULL, extra) == 1);
+            CHECK(rustsecp256k1_v0_9_0_ecdsa_sign(CTX, &sig2, msg, key, NULL, extra) == 1);
             CHECK(!is_empty_signature(&sig2));
-            rustsecp256k1_v0_8_1_ecdsa_signature_load(ctx, &sr[i], &ss, &sig2);
+            rustsecp256k1_v0_9_0_ecdsa_signature_load(CTX, &sr[i], &ss, &sig2);
             for (j = 0; j < i; j++) {
-                CHECK(!rustsecp256k1_v0_8_1_scalar_eq(&sr[i], &sr[j]));
+                CHECK(!rustsecp256k1_v0_9_0_scalar_eq(&sr[i], &sr[j]));
             }
         }
         key[0] = 0;
@@ -7092,24 +7388,24 @@ void test_ecdsa_edge_cases(void) {
         unsigned char nonce2[32];
         unsigned char nonce3[32];
         unsigned char nonce4[32];
-        VG_UNDEF(nonce,32);
-        VG_UNDEF(nonce2,32);
-        VG_UNDEF(nonce3,32);
-        VG_UNDEF(nonce4,32);
+        SECP256K1_CHECKMEM_UNDEFINE(nonce,32);
+        SECP256K1_CHECKMEM_UNDEFINE(nonce2,32);
+        SECP256K1_CHECKMEM_UNDEFINE(nonce3,32);
+        SECP256K1_CHECKMEM_UNDEFINE(nonce4,32);
         CHECK(nonce_function_rfc6979(nonce, zeros, zeros, NULL, NULL, 0) == 1);
-        VG_CHECK(nonce,32);
+        SECP256K1_CHECKMEM_CHECK(nonce,32);
         CHECK(nonce_function_rfc6979(nonce2, zeros, zeros, zeros, NULL, 0) == 1);
-        VG_CHECK(nonce2,32);
+        SECP256K1_CHECKMEM_CHECK(nonce2,32);
         CHECK(nonce_function_rfc6979(nonce3, zeros, zeros, NULL, (void *)zeros, 0) == 1);
-        VG_CHECK(nonce3,32);
+        SECP256K1_CHECKMEM_CHECK(nonce3,32);
         CHECK(nonce_function_rfc6979(nonce4, zeros, zeros, zeros, (void *)zeros, 0) == 1);
-        VG_CHECK(nonce4,32);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonce, nonce2, 32) != 0);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonce, nonce3, 32) != 0);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonce, nonce4, 32) != 0);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonce2, nonce3, 32) != 0);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonce2, nonce4, 32) != 0);
-        CHECK(rustsecp256k1_v0_8_1_memcmp_var(nonce3, nonce4, 32) != 0);
+        SECP256K1_CHECKMEM_CHECK(nonce4,32);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonce, nonce2, 32) != 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonce, nonce3, 32) != 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonce, nonce4, 32) != 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonce2, nonce3, 32) != 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonce2, nonce4, 32) != 0);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(nonce3, nonce4, 32) != 0);
     }
 
 
@@ -7123,16 +7419,54 @@ void test_ecdsa_edge_cases(void) {
             0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41, 0x41,
         };
         size_t outlen = 300;
-        CHECK(!ec_privkey_export_der(ctx, privkey, &outlen, seckey, 0));
+        CHECK(!ec_privkey_export_der(CTX, privkey, &outlen, seckey, 0));
         outlen = 300;
-        CHECK(!ec_privkey_export_der(ctx, privkey, &outlen, seckey, 1));
+        CHECK(!ec_privkey_export_der(CTX, privkey, &outlen, seckey, 1));
     }
 }
 
-void run_ecdsa_edge_cases(void) {
+static void run_ecdsa_edge_cases(void) {
     test_ecdsa_edge_cases();
 }
 
+/** Wycheproof tests
+
+The tests check for known attacks (range checks in (r,s), arithmetic errors, malleability).
+*/
+static void test_ecdsa_wycheproof(void) {
+    #include "wycheproof/ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.h"
+
+    int t;
+    for (t = 0; t < SECP256K1_ECDSA_WYCHEPROOF_NUMBER_TESTVECTORS; t++) {
+        rustsecp256k1_v0_9_0_ecdsa_signature signature;
+        rustsecp256k1_v0_9_0_sha256 hasher;
+        rustsecp256k1_v0_9_0_pubkey pubkey;
+        const unsigned char *msg, *sig, *pk;
+        unsigned char out[32] = {0};
+        int actual_verify = 0;
+
+        memset(&pubkey, 0, sizeof(pubkey));
+        pk = &wycheproof_ecdsa_public_keys[testvectors[t].pk_offset];
+        CHECK(rustsecp256k1_v0_9_0_ec_pubkey_parse(CTX, &pubkey, pk, 65) == 1);
+
+        rustsecp256k1_v0_9_0_sha256_initialize(&hasher);
+        msg = &wycheproof_ecdsa_messages[testvectors[t].msg_offset];
+        rustsecp256k1_v0_9_0_sha256_write(&hasher, msg, testvectors[t].msg_len);
+        rustsecp256k1_v0_9_0_sha256_finalize(&hasher, out);
+
+        sig = &wycheproof_ecdsa_signatures[testvectors[t].sig_offset];
+        if (rustsecp256k1_v0_9_0_ecdsa_signature_parse_der(CTX, &signature, sig, testvectors[t].sig_len) == 1) {
+            actual_verify = rustsecp256k1_v0_9_0_ecdsa_verify(CTX, (const rustsecp256k1_v0_9_0_ecdsa_signature *)&signature, out, &pubkey);
+        }
+        CHECK(testvectors[t].expected_verify == actual_verify);
+    }
+}
+
+/* Tests cases from Wycheproof test suite. */
+static void run_ecdsa_wycheproof(void) {
+    test_ecdsa_wycheproof();
+}
+
 #ifdef ENABLE_MODULE_ECDH
 # include "modules/ecdh/tests_impl.h"
 #endif
@@ -7149,182 +7483,199 @@ void run_ecdsa_edge_cases(void) {
 # include "modules/schnorrsig/tests_impl.h"
 #endif
 
-void run_rustsecp256k1_v0_8_1_memczero_test(void) {
+#ifdef ENABLE_MODULE_ELLSWIFT
+# include "modules/ellswift/tests_impl.h"
+#endif
+
+static void run_rustsecp256k1_v0_9_0_memczero_test(void) {
     unsigned char buf1[6] = {1, 2, 3, 4, 5, 6};
     unsigned char buf2[sizeof(buf1)];
 
-    /* rustsecp256k1_v0_8_1_memczero(..., ..., 0) is a noop. */
+    /* rustsecp256k1_v0_9_0_memczero(..., ..., 0) is a noop. */
     memcpy(buf2, buf1, sizeof(buf1));
-    rustsecp256k1_v0_8_1_memczero(buf1, sizeof(buf1), 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(buf1, buf2, sizeof(buf1)) == 0);
+    rustsecp256k1_v0_9_0_memczero(buf1, sizeof(buf1), 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(buf1, buf2, sizeof(buf1)) == 0);
 
-    /* rustsecp256k1_v0_8_1_memczero(..., ..., 1) zeros the buffer. */
+    /* rustsecp256k1_v0_9_0_memczero(..., ..., 1) zeros the buffer. */
     memset(buf2, 0, sizeof(buf2));
-    rustsecp256k1_v0_8_1_memczero(buf1, sizeof(buf1) , 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(buf1, buf2, sizeof(buf1)) == 0);
+    rustsecp256k1_v0_9_0_memczero(buf1, sizeof(buf1) , 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(buf1, buf2, sizeof(buf1)) == 0);
 }
 
-void run_rustsecp256k1_v0_8_1_byteorder_tests(void) {
-    const uint32_t x = 0xFF03AB45;
-    const unsigned char x_be[4] = {0xFF, 0x03, 0xAB, 0x45};
-    unsigned char buf[4];
-    uint32_t x_;
+static void run_rustsecp256k1_v0_9_0_byteorder_tests(void) {
+    {
+        const uint32_t x = 0xFF03AB45;
+        const unsigned char x_be[4] = {0xFF, 0x03, 0xAB, 0x45};
+        unsigned char buf[4];
+        uint32_t x_;
+
+        rustsecp256k1_v0_9_0_write_be32(buf, x);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(buf, x_be, sizeof(buf)) == 0);
+
+        x_ = rustsecp256k1_v0_9_0_read_be32(buf);
+        CHECK(x == x_);
+    }
+
+    {
+        const uint64_t x = 0xCAFE0123BEEF4567;
+        const unsigned char x_be[8] = {0xCA, 0xFE, 0x01, 0x23, 0xBE, 0xEF, 0x45, 0x67};
+        unsigned char buf[8];
+        uint64_t x_;
 
-    rustsecp256k1_v0_8_1_write_be32(buf, x);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(buf, x_be, sizeof(buf)) == 0);
+        rustsecp256k1_v0_9_0_write_be64(buf, x);
+        CHECK(rustsecp256k1_v0_9_0_memcmp_var(buf, x_be, sizeof(buf)) == 0);
 
-    x_ = rustsecp256k1_v0_8_1_read_be32(buf);
-    CHECK(x == x_);
+        x_ = rustsecp256k1_v0_9_0_read_be64(buf);
+        CHECK(x == x_);
+    }
 }
 
-void int_cmov_test(void) {
+static void int_cmov_test(void) {
     int r = INT_MAX;
     int a = 0;
 
-    rustsecp256k1_v0_8_1_int_cmov(&r, &a, 0);
+    rustsecp256k1_v0_9_0_int_cmov(&r, &a, 0);
     CHECK(r == INT_MAX);
 
     r = 0; a = INT_MAX;
-    rustsecp256k1_v0_8_1_int_cmov(&r, &a, 1);
+    rustsecp256k1_v0_9_0_int_cmov(&r, &a, 1);
     CHECK(r == INT_MAX);
 
     a = 0;
-    rustsecp256k1_v0_8_1_int_cmov(&r, &a, 1);
+    rustsecp256k1_v0_9_0_int_cmov(&r, &a, 1);
     CHECK(r == 0);
 
     a = 1;
-    rustsecp256k1_v0_8_1_int_cmov(&r, &a, 1);
+    rustsecp256k1_v0_9_0_int_cmov(&r, &a, 1);
     CHECK(r == 1);
 
     r = 1; a = 0;
-    rustsecp256k1_v0_8_1_int_cmov(&r, &a, 0);
+    rustsecp256k1_v0_9_0_int_cmov(&r, &a, 0);
     CHECK(r == 1);
 
 }
 
-void fe_cmov_test(void) {
-    static const rustsecp256k1_v0_8_1_fe zero = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0);
-    static const rustsecp256k1_v0_8_1_fe one = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
-    static const rustsecp256k1_v0_8_1_fe max = SECP256K1_FE_CONST(
+static void fe_cmov_test(void) {
+    static const rustsecp256k1_v0_9_0_fe zero = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 0);
+    static const rustsecp256k1_v0_9_0_fe one = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
+    static const rustsecp256k1_v0_9_0_fe max = SECP256K1_FE_CONST(
         0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL,
         0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL
     );
-    rustsecp256k1_v0_8_1_fe r = max;
-    rustsecp256k1_v0_8_1_fe a = zero;
+    rustsecp256k1_v0_9_0_fe r = max;
+    rustsecp256k1_v0_9_0_fe a = zero;
 
-    rustsecp256k1_v0_8_1_fe_cmov(&r, &a, 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &max, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_cmov(&r, &a, 0);
+    CHECK(fe_identical(&r, &max));
 
     r = zero; a = max;
-    rustsecp256k1_v0_8_1_fe_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &max, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_cmov(&r, &a, 1);
+    CHECK(fe_identical(&r, &max));
 
     a = zero;
-    rustsecp256k1_v0_8_1_fe_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &zero, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_cmov(&r, &a, 1);
+    CHECK(fe_identical(&r, &zero));
 
     a = one;
-    rustsecp256k1_v0_8_1_fe_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &one, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_cmov(&r, &a, 1);
+    CHECK(fe_identical(&r, &one));
 
     r = one; a = zero;
-    rustsecp256k1_v0_8_1_fe_cmov(&r, &a, 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &one, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_cmov(&r, &a, 0);
+    CHECK(fe_identical(&r, &one));
 }
 
-void fe_storage_cmov_test(void) {
-    static const rustsecp256k1_v0_8_1_fe_storage zero = SECP256K1_FE_STORAGE_CONST(0, 0, 0, 0, 0, 0, 0, 0);
-    static const rustsecp256k1_v0_8_1_fe_storage one = SECP256K1_FE_STORAGE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
-    static const rustsecp256k1_v0_8_1_fe_storage max = SECP256K1_FE_STORAGE_CONST(
+static void fe_storage_cmov_test(void) {
+    static const rustsecp256k1_v0_9_0_fe_storage zero = SECP256K1_FE_STORAGE_CONST(0, 0, 0, 0, 0, 0, 0, 0);
+    static const rustsecp256k1_v0_9_0_fe_storage one = SECP256K1_FE_STORAGE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
+    static const rustsecp256k1_v0_9_0_fe_storage max = SECP256K1_FE_STORAGE_CONST(
         0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL,
         0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL
     );
-    rustsecp256k1_v0_8_1_fe_storage r = max;
-    rustsecp256k1_v0_8_1_fe_storage a = zero;
+    rustsecp256k1_v0_9_0_fe_storage r = max;
+    rustsecp256k1_v0_9_0_fe_storage a = zero;
 
-    rustsecp256k1_v0_8_1_fe_storage_cmov(&r, &a, 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &max, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_storage_cmov(&r, &a, 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &max, sizeof(r)) == 0);
 
     r = zero; a = max;
-    rustsecp256k1_v0_8_1_fe_storage_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &max, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_storage_cmov(&r, &a, 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &max, sizeof(r)) == 0);
 
     a = zero;
-    rustsecp256k1_v0_8_1_fe_storage_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &zero, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_storage_cmov(&r, &a, 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &zero, sizeof(r)) == 0);
 
     a = one;
-    rustsecp256k1_v0_8_1_fe_storage_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &one, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_storage_cmov(&r, &a, 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &one, sizeof(r)) == 0);
 
     r = one; a = zero;
-    rustsecp256k1_v0_8_1_fe_storage_cmov(&r, &a, 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &one, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_fe_storage_cmov(&r, &a, 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &one, sizeof(r)) == 0);
 }
 
-void scalar_cmov_test(void) {
-    static const rustsecp256k1_v0_8_1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
-    static const rustsecp256k1_v0_8_1_scalar one = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
-    static const rustsecp256k1_v0_8_1_scalar max = SECP256K1_SCALAR_CONST(
-        0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL,
-        0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL
+static void scalar_cmov_test(void) {
+    static const rustsecp256k1_v0_9_0_scalar max = SECP256K1_SCALAR_CONST(
+        0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
+        0xBAAEDCE6UL, 0xAF48A03BUL, 0xBFD25E8CUL, 0xD0364140UL
     );
-    rustsecp256k1_v0_8_1_scalar r = max;
-    rustsecp256k1_v0_8_1_scalar a = zero;
+    rustsecp256k1_v0_9_0_scalar r = max;
+    rustsecp256k1_v0_9_0_scalar a = rustsecp256k1_v0_9_0_scalar_zero;
 
-    rustsecp256k1_v0_8_1_scalar_cmov(&r, &a, 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &max, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_scalar_cmov(&r, &a, 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &max, sizeof(r)) == 0);
 
-    r = zero; a = max;
-    rustsecp256k1_v0_8_1_scalar_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &max, sizeof(r)) == 0);
+    r = rustsecp256k1_v0_9_0_scalar_zero; a = max;
+    rustsecp256k1_v0_9_0_scalar_cmov(&r, &a, 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &max, sizeof(r)) == 0);
 
-    a = zero;
-    rustsecp256k1_v0_8_1_scalar_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &zero, sizeof(r)) == 0);
+    a = rustsecp256k1_v0_9_0_scalar_zero;
+    rustsecp256k1_v0_9_0_scalar_cmov(&r, &a, 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &rustsecp256k1_v0_9_0_scalar_zero, sizeof(r)) == 0);
 
-    a = one;
-    rustsecp256k1_v0_8_1_scalar_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &one, sizeof(r)) == 0);
+    a = rustsecp256k1_v0_9_0_scalar_one;
+    rustsecp256k1_v0_9_0_scalar_cmov(&r, &a, 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &rustsecp256k1_v0_9_0_scalar_one, sizeof(r)) == 0);
 
-    r = one; a = zero;
-    rustsecp256k1_v0_8_1_scalar_cmov(&r, &a, 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &one, sizeof(r)) == 0);
+    r = rustsecp256k1_v0_9_0_scalar_one; a = rustsecp256k1_v0_9_0_scalar_zero;
+    rustsecp256k1_v0_9_0_scalar_cmov(&r, &a, 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &rustsecp256k1_v0_9_0_scalar_one, sizeof(r)) == 0);
 }
 
-void ge_storage_cmov_test(void) {
-    static const rustsecp256k1_v0_8_1_ge_storage zero = SECP256K1_GE_STORAGE_CONST(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
-    static const rustsecp256k1_v0_8_1_ge_storage one = SECP256K1_GE_STORAGE_CONST(0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1);
-    static const rustsecp256k1_v0_8_1_ge_storage max = SECP256K1_GE_STORAGE_CONST(
+static void ge_storage_cmov_test(void) {
+    static const rustsecp256k1_v0_9_0_ge_storage zero = SECP256K1_GE_STORAGE_CONST(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+    static const rustsecp256k1_v0_9_0_ge_storage one = SECP256K1_GE_STORAGE_CONST(0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1);
+    static const rustsecp256k1_v0_9_0_ge_storage max = SECP256K1_GE_STORAGE_CONST(
         0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL,
         0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL,
         0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL,
         0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL
     );
-    rustsecp256k1_v0_8_1_ge_storage r = max;
-    rustsecp256k1_v0_8_1_ge_storage a = zero;
+    rustsecp256k1_v0_9_0_ge_storage r = max;
+    rustsecp256k1_v0_9_0_ge_storage a = zero;
 
-    rustsecp256k1_v0_8_1_ge_storage_cmov(&r, &a, 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &max, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_ge_storage_cmov(&r, &a, 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &max, sizeof(r)) == 0);
 
     r = zero; a = max;
-    rustsecp256k1_v0_8_1_ge_storage_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &max, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_ge_storage_cmov(&r, &a, 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &max, sizeof(r)) == 0);
 
     a = zero;
-    rustsecp256k1_v0_8_1_ge_storage_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &zero, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_ge_storage_cmov(&r, &a, 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &zero, sizeof(r)) == 0);
 
     a = one;
-    rustsecp256k1_v0_8_1_ge_storage_cmov(&r, &a, 1);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &one, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_ge_storage_cmov(&r, &a, 1);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &one, sizeof(r)) == 0);
 
     r = one; a = zero;
-    rustsecp256k1_v0_8_1_ge_storage_cmov(&r, &a, 0);
-    CHECK(rustsecp256k1_v0_8_1_memcmp_var(&r, &one, sizeof(r)) == 0);
+    rustsecp256k1_v0_9_0_ge_storage_cmov(&r, &a, 0);
+    CHECK(rustsecp256k1_v0_9_0_memcmp_var(&r, &one, sizeof(r)) == 0);
 }
 
-void run_cmov_tests(void) {
+static void run_cmov_tests(void) {
     int_cmov_test();
     fe_cmov_test();
     fe_storage_cmov_test();
@@ -7343,41 +7694,60 @@ int main(int argc, char **argv) {
 
     /* find iteration count */
     if (argc > 1) {
-        count = strtol(argv[1], NULL, 0);
+        COUNT = strtol(argv[1], NULL, 0);
     } else {
         const char* env = getenv("SECP256K1_TEST_ITERS");
         if (env && strlen(env) > 0) {
-            count = strtol(env, NULL, 0);
+            COUNT = strtol(env, NULL, 0);
         }
     }
-    if (count <= 0) {
+    if (COUNT <= 0) {
         fputs("An iteration count of 0 or less is not allowed.\n", stderr);
         return EXIT_FAILURE;
     }
-    printf("test count = %i\n", count);
+    printf("test count = %i\n", COUNT);
+
+    /* run test RNG tests (must run before we really initialize the test RNG) */
+    run_xoshiro256pp_tests();
 
     /* find random seed */
-    rustsecp256k1_v0_8_1_testrand_init(argc > 2 ? argv[2] : NULL);
+    rustsecp256k1_v0_9_0_testrand_init(argc > 2 ? argv[2] : NULL);
 
-    /* initialize */
-    run_selftest_tests();
-    run_context_tests(0);
-    run_context_tests(1);
-    run_scratch_tests();
+    /*** Setup test environment ***/
 
-    ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
+    /* Create a global context available to all tests */
+    CTX = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
     /* Randomize the context only with probability 15/16
        to make sure we test without context randomization from time to time.
        TODO Reconsider this when recalibrating the tests. */
-    if (rustsecp256k1_v0_8_1_testrand_bits(4)) {
+    if (rustsecp256k1_v0_9_0_testrand_bits(4)) {
         unsigned char rand32[32];
-        rustsecp256k1_v0_8_1_testrand256(rand32);
-        CHECK(rustsecp256k1_v0_8_1_context_randomize(ctx, rand32));
+        rustsecp256k1_v0_9_0_testrand256(rand32);
+        CHECK(rustsecp256k1_v0_9_0_context_randomize(CTX, rand32));
     }
+    /* Make a writable copy of rustsecp256k1_v0_9_0_context_static in order to test the effect of API functions
+       that write to the context. The API does not support cloning the static context, so we use
+       memcpy instead. The user is not supposed to copy a context but we should still ensure that
+       the API functions handle copies of the static context gracefully. */
+    STATIC_CTX = malloc(sizeof(*rustsecp256k1_v0_9_0_context_static));
+    CHECK(STATIC_CTX != NULL);
+    memcpy(STATIC_CTX, rustsecp256k1_v0_9_0_context_static, sizeof(rustsecp256k1_v0_9_0_context));
+    CHECK(!rustsecp256k1_v0_9_0_context_is_proper(STATIC_CTX));
+
+    /*** Run actual tests ***/
+
+    /* selftest tests */
+    run_selftest_tests();
 
-    run_rand_bits();
-    run_rand_int();
+    /* context tests */
+    run_proper_context_tests(0); run_proper_context_tests(1);
+    run_static_context_tests(0); run_static_context_tests(1);
+    run_deprecated_context_flags_test();
 
+    /* scratch tests */
+    run_scratch_tests();
+
+    /* integer arithmetic tests */
 #ifdef SECP256K1_WIDEMUL_INT128
     run_int128_tests();
 #endif
@@ -7385,6 +7755,7 @@ int main(int argc, char **argv) {
     run_modinv_tests();
     run_inverse_tests();
 
+    /* hash tests */
     run_sha256_known_output_tests();
     run_sha256_counter_tests();
     run_hmac_sha256_tests();
@@ -7398,6 +7769,7 @@ int main(int argc, char **argv) {
     run_field_half();
     run_field_misc();
     run_field_convert();
+    run_field_be32_overflow();
     run_fe_mul();
     run_sqr();
     run_sqrt();
@@ -7437,12 +7809,14 @@ int main(int argc, char **argv) {
 #endif
 
     /* ecdsa tests */
+    run_ec_illegal_argument_tests();
     run_pubkey_comparison();
     run_random_pubkeys();
     run_ecdsa_der_parse();
     run_ecdsa_sign_verify();
     run_ecdsa_end_to_end();
     run_ecdsa_edge_cases();
+    run_ecdsa_wycheproof();
 
 #ifdef ENABLE_MODULE_RECOVERY
     /* ECDSA pubkey recovery tests */
@@ -7457,16 +7831,21 @@ int main(int argc, char **argv) {
     run_schnorrsig_tests();
 #endif
 
+#ifdef ENABLE_MODULE_ELLSWIFT
+    run_ellswift_tests();
+#endif
+
     /* util tests */
-    run_rustsecp256k1_v0_8_1_memczero_test();
-    run_rustsecp256k1_v0_8_1_byteorder_tests();
+    run_rustsecp256k1_v0_9_0_memczero_test();
+    run_rustsecp256k1_v0_9_0_byteorder_tests();
 
     run_cmov_tests();
 
-    rustsecp256k1_v0_8_1_testrand_finish();
+    /*** Tear down test environment ***/
+    free(STATIC_CTX);
+    rustsecp256k1_v0_9_0_context_destroy(CTX);
 
-    /* shutdown */
-    rustsecp256k1_v0_8_1_context_destroy(ctx);
+    rustsecp256k1_v0_9_0_testrand_finish();
 
     printf("no problems found\n");
     return 0;
diff --git a/secp256k1-sys/depend/secp256k1/src/tests_exhaustive.c b/secp256k1-sys/depend/secp256k1/src/tests_exhaustive.c
index 34364b72f..e4c6915e7 100644
--- a/secp256k1-sys/depend/secp256k1/src/tests_exhaustive.c
+++ b/secp256k1-sys/depend/secp256k1/src/tests_exhaustive.c
@@ -4,10 +4,6 @@
  * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
  ***********************************************************************/
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <time.h>
@@ -17,52 +13,74 @@
 #define EXHAUSTIVE_TEST_ORDER 13
 #endif
 
+/* These values of B are all values in [1, 8] that result in a curve with even order. */
+#define EXHAUSTIVE_TEST_CURVE_HAS_EVEN_ORDER (SECP256K1_B == 1 || SECP256K1_B == 6 || SECP256K1_B == 8)
+
+#ifdef USE_EXTERNAL_DEFAULT_CALLBACKS
+    #pragma message("Ignoring USE_EXTERNAL_CALLBACKS in exhaustive_tests.")
+    #undef USE_EXTERNAL_DEFAULT_CALLBACKS
+#endif
 #include "secp256k1.c"
+
 #include "../include/secp256k1.h"
 #include "assumptions.h"
 #include "group.h"
 #include "testrand_impl.h"
 #include "ecmult_compute_table_impl.h"
 #include "ecmult_gen_compute_table_impl.h"
+#include "util.h"
 
 static int count = 2;
 
 /** stolen from tests.c */
-void ge_equals_ge(const rustsecp256k1_v0_8_1_ge *a, const rustsecp256k1_v0_8_1_ge *b) {
+static void ge_equals_ge(const rustsecp256k1_v0_9_0_ge *a, const rustsecp256k1_v0_9_0_ge *b) {
     CHECK(a->infinity == b->infinity);
     if (a->infinity) {
         return;
     }
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&a->x, &b->x));
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&a->y, &b->y));
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&a->x, &b->x));
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&a->y, &b->y));
 }
 
-void ge_equals_gej(const rustsecp256k1_v0_8_1_ge *a, const rustsecp256k1_v0_8_1_gej *b) {
-    rustsecp256k1_v0_8_1_fe z2s;
-    rustsecp256k1_v0_8_1_fe u1, u2, s1, s2;
+static void ge_equals_gej(const rustsecp256k1_v0_9_0_ge *a, const rustsecp256k1_v0_9_0_gej *b) {
+    rustsecp256k1_v0_9_0_fe z2s;
+    rustsecp256k1_v0_9_0_fe u1, u2, s1, s2;
     CHECK(a->infinity == b->infinity);
     if (a->infinity) {
         return;
     }
     /* Check a.x * b.z^2 == b.x && a.y * b.z^3 == b.y, to avoid inverses. */
-    rustsecp256k1_v0_8_1_fe_sqr(&z2s, &b->z);
-    rustsecp256k1_v0_8_1_fe_mul(&u1, &a->x, &z2s);
-    u2 = b->x; rustsecp256k1_v0_8_1_fe_normalize_weak(&u2);
-    rustsecp256k1_v0_8_1_fe_mul(&s1, &a->y, &z2s); rustsecp256k1_v0_8_1_fe_mul(&s1, &s1, &b->z);
-    s2 = b->y; rustsecp256k1_v0_8_1_fe_normalize_weak(&s2);
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&u1, &u2));
-    CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&s1, &s2));
+    rustsecp256k1_v0_9_0_fe_sqr(&z2s, &b->z);
+    rustsecp256k1_v0_9_0_fe_mul(&u1, &a->x, &z2s);
+    u2 = b->x;
+    rustsecp256k1_v0_9_0_fe_mul(&s1, &a->y, &z2s); rustsecp256k1_v0_9_0_fe_mul(&s1, &s1, &b->z);
+    s2 = b->y;
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&u1, &u2));
+    CHECK(rustsecp256k1_v0_9_0_fe_equal(&s1, &s2));
 }
 
-void random_fe(rustsecp256k1_v0_8_1_fe *x) {
+static void random_fe(rustsecp256k1_v0_9_0_fe *x) {
     unsigned char bin[32];
     do {
-        rustsecp256k1_v0_8_1_testrand256(bin);
-        if (rustsecp256k1_v0_8_1_fe_set_b32(x, bin)) {
+        rustsecp256k1_v0_9_0_testrand256(bin);
+        if (rustsecp256k1_v0_9_0_fe_set_b32_limit(x, bin)) {
             return;
         }
     } while(1);
 }
+
+static void random_fe_non_zero(rustsecp256k1_v0_9_0_fe *nz) {
+    int tries = 10;
+    while (--tries >= 0) {
+        random_fe(nz);
+        rustsecp256k1_v0_9_0_fe_normalize(nz);
+        if (!rustsecp256k1_v0_9_0_fe_is_zero(nz)) {
+            break;
+        }
+    }
+    /* Infinitesimal probability of spurious failure here */
+    CHECK(tries >= 0);
+}
 /** END stolen from tests.c */
 
 static uint32_t num_cores = 1;
@@ -74,10 +92,10 @@ SECP256K1_INLINE static int skip_section(uint64_t* iter) {
     return ((((uint32_t)*iter ^ (*iter >> 32)) * num_cores) >> 32) != this_core;
 }
 
-int rustsecp256k1_v0_8_1_nonce_function_smallint(unsigned char *nonce32, const unsigned char *msg32,
+static int rustsecp256k1_v0_9_0_nonce_function_smallint(unsigned char *nonce32, const unsigned char *msg32,
                                       const unsigned char *key32, const unsigned char *algo16,
                                       void *data, unsigned int attempt) {
-    rustsecp256k1_v0_8_1_scalar s;
+    rustsecp256k1_v0_9_0_scalar s;
     int *idata = data;
     (void)msg32;
     (void)key32;
@@ -89,210 +107,237 @@ int rustsecp256k1_v0_8_1_nonce_function_smallint(unsigned char *nonce32, const u
     if (attempt > 0) {
         *idata = (*idata + 1) % EXHAUSTIVE_TEST_ORDER;
     }
-    rustsecp256k1_v0_8_1_scalar_set_int(&s, *idata);
-    rustsecp256k1_v0_8_1_scalar_get_b32(nonce32, &s);
+    rustsecp256k1_v0_9_0_scalar_set_int(&s, *idata);
+    rustsecp256k1_v0_9_0_scalar_get_b32(nonce32, &s);
     return 1;
 }
 
-void test_exhaustive_endomorphism(const rustsecp256k1_v0_8_1_ge *group) {
+static void test_exhaustive_endomorphism(const rustsecp256k1_v0_9_0_ge *group) {
     int i;
     for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
-        rustsecp256k1_v0_8_1_ge res;
-        rustsecp256k1_v0_8_1_ge_mul_lambda(&res, &group[i]);
+        rustsecp256k1_v0_9_0_ge res;
+        rustsecp256k1_v0_9_0_ge_mul_lambda(&res, &group[i]);
         ge_equals_ge(&group[i * EXHAUSTIVE_TEST_LAMBDA % EXHAUSTIVE_TEST_ORDER], &res);
     }
 }
 
-void test_exhaustive_addition(const rustsecp256k1_v0_8_1_ge *group, const rustsecp256k1_v0_8_1_gej *groupj) {
+static void test_exhaustive_addition(const rustsecp256k1_v0_9_0_ge *group, const rustsecp256k1_v0_9_0_gej *groupj) {
     int i, j;
     uint64_t iter = 0;
 
     /* Sanity-check (and check infinity functions) */
-    CHECK(rustsecp256k1_v0_8_1_ge_is_infinity(&group[0]));
-    CHECK(rustsecp256k1_v0_8_1_gej_is_infinity(&groupj[0]));
+    CHECK(rustsecp256k1_v0_9_0_ge_is_infinity(&group[0]));
+    CHECK(rustsecp256k1_v0_9_0_gej_is_infinity(&groupj[0]));
     for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) {
-        CHECK(!rustsecp256k1_v0_8_1_ge_is_infinity(&group[i]));
-        CHECK(!rustsecp256k1_v0_8_1_gej_is_infinity(&groupj[i]));
+        CHECK(!rustsecp256k1_v0_9_0_ge_is_infinity(&group[i]));
+        CHECK(!rustsecp256k1_v0_9_0_gej_is_infinity(&groupj[i]));
     }
 
     /* Check all addition formulae */
     for (j = 0; j < EXHAUSTIVE_TEST_ORDER; j++) {
-        rustsecp256k1_v0_8_1_fe fe_inv;
+        rustsecp256k1_v0_9_0_fe fe_inv;
         if (skip_section(&iter)) continue;
-        rustsecp256k1_v0_8_1_fe_inv(&fe_inv, &groupj[j].z);
+        rustsecp256k1_v0_9_0_fe_inv(&fe_inv, &groupj[j].z);
         for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
-            rustsecp256k1_v0_8_1_ge zless_gej;
-            rustsecp256k1_v0_8_1_gej tmp;
+            rustsecp256k1_v0_9_0_ge zless_gej;
+            rustsecp256k1_v0_9_0_gej tmp;
             /* add_var */
-            rustsecp256k1_v0_8_1_gej_add_var(&tmp, &groupj[i], &groupj[j], NULL);
+            rustsecp256k1_v0_9_0_gej_add_var(&tmp, &groupj[i], &groupj[j], NULL);
             ge_equals_gej(&group[(i + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
             /* add_ge */
             if (j > 0) {
-                rustsecp256k1_v0_8_1_gej_add_ge(&tmp, &groupj[i], &group[j]);
+                rustsecp256k1_v0_9_0_gej_add_ge(&tmp, &groupj[i], &group[j]);
                 ge_equals_gej(&group[(i + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
             }
             /* add_ge_var */
-            rustsecp256k1_v0_8_1_gej_add_ge_var(&tmp, &groupj[i], &group[j], NULL);
+            rustsecp256k1_v0_9_0_gej_add_ge_var(&tmp, &groupj[i], &group[j], NULL);
             ge_equals_gej(&group[(i + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
             /* add_zinv_var */
             zless_gej.infinity = groupj[j].infinity;
             zless_gej.x = groupj[j].x;
             zless_gej.y = groupj[j].y;
-            rustsecp256k1_v0_8_1_gej_add_zinv_var(&tmp, &groupj[i], &zless_gej, &fe_inv);
+            rustsecp256k1_v0_9_0_gej_add_zinv_var(&tmp, &groupj[i], &zless_gej, &fe_inv);
             ge_equals_gej(&group[(i + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
         }
     }
 
     /* Check doubling */
     for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
-        rustsecp256k1_v0_8_1_gej tmp;
-        rustsecp256k1_v0_8_1_gej_double(&tmp, &groupj[i]);
+        rustsecp256k1_v0_9_0_gej tmp;
+        rustsecp256k1_v0_9_0_gej_double(&tmp, &groupj[i]);
         ge_equals_gej(&group[(2 * i) % EXHAUSTIVE_TEST_ORDER], &tmp);
-        rustsecp256k1_v0_8_1_gej_double_var(&tmp, &groupj[i], NULL);
+        rustsecp256k1_v0_9_0_gej_double_var(&tmp, &groupj[i], NULL);
         ge_equals_gej(&group[(2 * i) % EXHAUSTIVE_TEST_ORDER], &tmp);
     }
 
     /* Check negation */
     for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) {
-        rustsecp256k1_v0_8_1_ge tmp;
-        rustsecp256k1_v0_8_1_gej tmpj;
-        rustsecp256k1_v0_8_1_ge_neg(&tmp, &group[i]);
+        rustsecp256k1_v0_9_0_ge tmp;
+        rustsecp256k1_v0_9_0_gej tmpj;
+        rustsecp256k1_v0_9_0_ge_neg(&tmp, &group[i]);
         ge_equals_ge(&group[EXHAUSTIVE_TEST_ORDER - i], &tmp);
-        rustsecp256k1_v0_8_1_gej_neg(&tmpj, &groupj[i]);
+        rustsecp256k1_v0_9_0_gej_neg(&tmpj, &groupj[i]);
         ge_equals_gej(&group[EXHAUSTIVE_TEST_ORDER - i], &tmpj);
     }
 }
 
-void test_exhaustive_ecmult(const rustsecp256k1_v0_8_1_ge *group, const rustsecp256k1_v0_8_1_gej *groupj) {
+static void test_exhaustive_ecmult(const rustsecp256k1_v0_9_0_ge *group, const rustsecp256k1_v0_9_0_gej *groupj) {
     int i, j, r_log;
     uint64_t iter = 0;
     for (r_log = 1; r_log < EXHAUSTIVE_TEST_ORDER; r_log++) {
         for (j = 0; j < EXHAUSTIVE_TEST_ORDER; j++) {
             if (skip_section(&iter)) continue;
             for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
-                rustsecp256k1_v0_8_1_gej tmp;
-                rustsecp256k1_v0_8_1_scalar na, ng;
-                rustsecp256k1_v0_8_1_scalar_set_int(&na, i);
-                rustsecp256k1_v0_8_1_scalar_set_int(&ng, j);
+                rustsecp256k1_v0_9_0_gej tmp;
+                rustsecp256k1_v0_9_0_scalar na, ng;
+                rustsecp256k1_v0_9_0_scalar_set_int(&na, i);
+                rustsecp256k1_v0_9_0_scalar_set_int(&ng, j);
 
-                rustsecp256k1_v0_8_1_ecmult(&tmp, &groupj[r_log], &na, &ng);
+                rustsecp256k1_v0_9_0_ecmult(&tmp, &groupj[r_log], &na, &ng);
                 ge_equals_gej(&group[(i * r_log + j) % EXHAUSTIVE_TEST_ORDER], &tmp);
 
-                if (i > 0) {
-                    rustsecp256k1_v0_8_1_ecmult_const(&tmp, &group[i], &ng, 256);
-                    ge_equals_gej(&group[(i * j) % EXHAUSTIVE_TEST_ORDER], &tmp);
-                }
+            }
+        }
+    }
+
+    for (j = 0; j < EXHAUSTIVE_TEST_ORDER; j++) {
+        for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
+            int ret;
+            rustsecp256k1_v0_9_0_gej tmp;
+            rustsecp256k1_v0_9_0_fe xn, xd, tmpf;
+            rustsecp256k1_v0_9_0_scalar ng;
+
+            if (skip_section(&iter)) continue;
+
+            rustsecp256k1_v0_9_0_scalar_set_int(&ng, j);
+
+            /* Test rustsecp256k1_v0_9_0_ecmult_const. */
+            rustsecp256k1_v0_9_0_ecmult_const(&tmp, &group[i], &ng);
+            ge_equals_gej(&group[(i * j) % EXHAUSTIVE_TEST_ORDER], &tmp);
+
+            if (i != 0 && j != 0) {
+                /* Test rustsecp256k1_v0_9_0_ecmult_const_xonly with all curve X coordinates, and xd=NULL. */
+                ret = rustsecp256k1_v0_9_0_ecmult_const_xonly(&tmpf, &group[i].x, NULL, &ng, 0);
+                CHECK(ret);
+                CHECK(rustsecp256k1_v0_9_0_fe_equal(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
+
+                /* Test rustsecp256k1_v0_9_0_ecmult_const_xonly with all curve X coordinates, with random xd. */
+                random_fe_non_zero(&xd);
+                rustsecp256k1_v0_9_0_fe_mul(&xn, &xd, &group[i].x);
+                ret = rustsecp256k1_v0_9_0_ecmult_const_xonly(&tmpf, &xn, &xd, &ng, 0);
+                CHECK(ret);
+                CHECK(rustsecp256k1_v0_9_0_fe_equal(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
             }
         }
     }
 }
 
 typedef struct {
-    rustsecp256k1_v0_8_1_scalar sc[2];
-    rustsecp256k1_v0_8_1_ge pt[2];
+    rustsecp256k1_v0_9_0_scalar sc[2];
+    rustsecp256k1_v0_9_0_ge pt[2];
 } ecmult_multi_data;
 
-static int ecmult_multi_callback(rustsecp256k1_v0_8_1_scalar *sc, rustsecp256k1_v0_8_1_ge *pt, size_t idx, void *cbdata) {
+static int ecmult_multi_callback(rustsecp256k1_v0_9_0_scalar *sc, rustsecp256k1_v0_9_0_ge *pt, size_t idx, void *cbdata) {
     ecmult_multi_data *data = (ecmult_multi_data*) cbdata;
     *sc = data->sc[idx];
     *pt = data->pt[idx];
     return 1;
 }
 
-void test_exhaustive_ecmult_multi(const rustsecp256k1_v0_8_1_context *ctx, const rustsecp256k1_v0_8_1_ge *group) {
+static void test_exhaustive_ecmult_multi(const rustsecp256k1_v0_9_0_context *ctx, const rustsecp256k1_v0_9_0_ge *group) {
     int i, j, k, x, y;
     uint64_t iter = 0;
-    rustsecp256k1_v0_8_1_scratch *scratch = rustsecp256k1_v0_8_1_scratch_create(&ctx->error_callback, 4096);
+    rustsecp256k1_v0_9_0_scratch *scratch = rustsecp256k1_v0_9_0_scratch_create(&ctx->error_callback, 4096);
     for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++) {
         for (j = 0; j < EXHAUSTIVE_TEST_ORDER; j++) {
             for (k = 0; k < EXHAUSTIVE_TEST_ORDER; k++) {
                 for (x = 0; x < EXHAUSTIVE_TEST_ORDER; x++) {
                     if (skip_section(&iter)) continue;
                     for (y = 0; y < EXHAUSTIVE_TEST_ORDER; y++) {
-                        rustsecp256k1_v0_8_1_gej tmp;
-                        rustsecp256k1_v0_8_1_scalar g_sc;
+                        rustsecp256k1_v0_9_0_gej tmp;
+                        rustsecp256k1_v0_9_0_scalar g_sc;
                         ecmult_multi_data data;
 
-                        rustsecp256k1_v0_8_1_scalar_set_int(&data.sc[0], i);
-                        rustsecp256k1_v0_8_1_scalar_set_int(&data.sc[1], j);
-                        rustsecp256k1_v0_8_1_scalar_set_int(&g_sc, k);
+                        rustsecp256k1_v0_9_0_scalar_set_int(&data.sc[0], i);
+                        rustsecp256k1_v0_9_0_scalar_set_int(&data.sc[1], j);
+                        rustsecp256k1_v0_9_0_scalar_set_int(&g_sc, k);
                         data.pt[0] = group[x];
                         data.pt[1] = group[y];
 
-                        rustsecp256k1_v0_8_1_ecmult_multi_var(&ctx->error_callback, scratch, &tmp, &g_sc, ecmult_multi_callback, &data, 2);
+                        rustsecp256k1_v0_9_0_ecmult_multi_var(&ctx->error_callback, scratch, &tmp, &g_sc, ecmult_multi_callback, &data, 2);
                         ge_equals_gej(&group[(i * x + j * y + k) % EXHAUSTIVE_TEST_ORDER], &tmp);
                     }
                 }
             }
         }
     }
-    rustsecp256k1_v0_8_1_scratch_destroy(&ctx->error_callback, scratch);
+    rustsecp256k1_v0_9_0_scratch_destroy(&ctx->error_callback, scratch);
 }
 
-void r_from_k(rustsecp256k1_v0_8_1_scalar *r, const rustsecp256k1_v0_8_1_ge *group, int k, int* overflow) {
-    rustsecp256k1_v0_8_1_fe x;
+static void r_from_k(rustsecp256k1_v0_9_0_scalar *r, const rustsecp256k1_v0_9_0_ge *group, int k, int* overflow) {
+    rustsecp256k1_v0_9_0_fe x;
     unsigned char x_bin[32];
     k %= EXHAUSTIVE_TEST_ORDER;
     x = group[k].x;
-    rustsecp256k1_v0_8_1_fe_normalize(&x);
-    rustsecp256k1_v0_8_1_fe_get_b32(x_bin, &x);
-    rustsecp256k1_v0_8_1_scalar_set_b32(r, x_bin, overflow);
+    rustsecp256k1_v0_9_0_fe_normalize(&x);
+    rustsecp256k1_v0_9_0_fe_get_b32(x_bin, &x);
+    rustsecp256k1_v0_9_0_scalar_set_b32(r, x_bin, overflow);
 }
 
-void test_exhaustive_verify(const rustsecp256k1_v0_8_1_context *ctx, const rustsecp256k1_v0_8_1_ge *group) {
+static void test_exhaustive_verify(const rustsecp256k1_v0_9_0_context *ctx, const rustsecp256k1_v0_9_0_ge *group) {
     int s, r, msg, key;
     uint64_t iter = 0;
     for (s = 1; s < EXHAUSTIVE_TEST_ORDER; s++) {
         for (r = 1; r < EXHAUSTIVE_TEST_ORDER; r++) {
             for (msg = 1; msg < EXHAUSTIVE_TEST_ORDER; msg++) {
                 for (key = 1; key < EXHAUSTIVE_TEST_ORDER; key++) {
-                    rustsecp256k1_v0_8_1_ge nonconst_ge;
-                    rustsecp256k1_v0_8_1_ecdsa_signature sig;
-                    rustsecp256k1_v0_8_1_pubkey pk;
-                    rustsecp256k1_v0_8_1_scalar sk_s, msg_s, r_s, s_s;
-                    rustsecp256k1_v0_8_1_scalar s_times_k_s, msg_plus_r_times_sk_s;
+                    rustsecp256k1_v0_9_0_ge nonconst_ge;
+                    rustsecp256k1_v0_9_0_ecdsa_signature sig;
+                    rustsecp256k1_v0_9_0_pubkey pk;
+                    rustsecp256k1_v0_9_0_scalar sk_s, msg_s, r_s, s_s;
+                    rustsecp256k1_v0_9_0_scalar s_times_k_s, msg_plus_r_times_sk_s;
                     int k, should_verify;
                     unsigned char msg32[32];
 
                     if (skip_section(&iter)) continue;
 
-                    rustsecp256k1_v0_8_1_scalar_set_int(&s_s, s);
-                    rustsecp256k1_v0_8_1_scalar_set_int(&r_s, r);
-                    rustsecp256k1_v0_8_1_scalar_set_int(&msg_s, msg);
-                    rustsecp256k1_v0_8_1_scalar_set_int(&sk_s, key);
+                    rustsecp256k1_v0_9_0_scalar_set_int(&s_s, s);
+                    rustsecp256k1_v0_9_0_scalar_set_int(&r_s, r);
+                    rustsecp256k1_v0_9_0_scalar_set_int(&msg_s, msg);
+                    rustsecp256k1_v0_9_0_scalar_set_int(&sk_s, key);
 
                     /* Verify by hand */
                     /* Run through every k value that gives us this r and check that *one* works.
                      * Note there could be none, there could be multiple, ECDSA is weird. */
                     should_verify = 0;
                     for (k = 0; k < EXHAUSTIVE_TEST_ORDER; k++) {
-                        rustsecp256k1_v0_8_1_scalar check_x_s;
+                        rustsecp256k1_v0_9_0_scalar check_x_s;
                         r_from_k(&check_x_s, group, k, NULL);
                         if (r_s == check_x_s) {
-                            rustsecp256k1_v0_8_1_scalar_set_int(&s_times_k_s, k);
-                            rustsecp256k1_v0_8_1_scalar_mul(&s_times_k_s, &s_times_k_s, &s_s);
-                            rustsecp256k1_v0_8_1_scalar_mul(&msg_plus_r_times_sk_s, &r_s, &sk_s);
-                            rustsecp256k1_v0_8_1_scalar_add(&msg_plus_r_times_sk_s, &msg_plus_r_times_sk_s, &msg_s);
-                            should_verify |= rustsecp256k1_v0_8_1_scalar_eq(&s_times_k_s, &msg_plus_r_times_sk_s);
+                            rustsecp256k1_v0_9_0_scalar_set_int(&s_times_k_s, k);
+                            rustsecp256k1_v0_9_0_scalar_mul(&s_times_k_s, &s_times_k_s, &s_s);
+                            rustsecp256k1_v0_9_0_scalar_mul(&msg_plus_r_times_sk_s, &r_s, &sk_s);
+                            rustsecp256k1_v0_9_0_scalar_add(&msg_plus_r_times_sk_s, &msg_plus_r_times_sk_s, &msg_s);
+                            should_verify |= rustsecp256k1_v0_9_0_scalar_eq(&s_times_k_s, &msg_plus_r_times_sk_s);
                         }
                     }
                     /* nb we have a "high s" rule */
-                    should_verify &= !rustsecp256k1_v0_8_1_scalar_is_high(&s_s);
+                    should_verify &= !rustsecp256k1_v0_9_0_scalar_is_high(&s_s);
 
                     /* Verify by calling verify */
-                    rustsecp256k1_v0_8_1_ecdsa_signature_save(&sig, &r_s, &s_s);
+                    rustsecp256k1_v0_9_0_ecdsa_signature_save(&sig, &r_s, &s_s);
                     memcpy(&nonconst_ge, &group[sk_s], sizeof(nonconst_ge));
-                    rustsecp256k1_v0_8_1_pubkey_save(&pk, &nonconst_ge);
-                    rustsecp256k1_v0_8_1_scalar_get_b32(msg32, &msg_s);
+                    rustsecp256k1_v0_9_0_pubkey_save(&pk, &nonconst_ge);
+                    rustsecp256k1_v0_9_0_scalar_get_b32(msg32, &msg_s);
                     CHECK(should_verify ==
-                          rustsecp256k1_v0_8_1_ecdsa_verify(ctx, &sig, msg32, &pk));
+                          rustsecp256k1_v0_9_0_ecdsa_verify(ctx, &sig, msg32, &pk));
                 }
             }
         }
     }
 }
 
-void test_exhaustive_sign(const rustsecp256k1_v0_8_1_context *ctx, const rustsecp256k1_v0_8_1_ge *group) {
+static void test_exhaustive_sign(const rustsecp256k1_v0_9_0_context *ctx, const rustsecp256k1_v0_9_0_ge *group) {
     int i, j, k;
     uint64_t iter = 0;
 
@@ -303,18 +348,18 @@ void test_exhaustive_sign(const rustsecp256k1_v0_8_1_context *ctx, const rustsec
             for (k = 1; k < EXHAUSTIVE_TEST_ORDER; k++) {  /* nonce */
                 const int starting_k = k;
                 int ret;
-                rustsecp256k1_v0_8_1_ecdsa_signature sig;
-                rustsecp256k1_v0_8_1_scalar sk, msg, r, s, expected_r;
+                rustsecp256k1_v0_9_0_ecdsa_signature sig;
+                rustsecp256k1_v0_9_0_scalar sk, msg, r, s, expected_r;
                 unsigned char sk32[32], msg32[32];
-                rustsecp256k1_v0_8_1_scalar_set_int(&msg, i);
-                rustsecp256k1_v0_8_1_scalar_set_int(&sk, j);
-                rustsecp256k1_v0_8_1_scalar_get_b32(sk32, &sk);
-                rustsecp256k1_v0_8_1_scalar_get_b32(msg32, &msg);
+                rustsecp256k1_v0_9_0_scalar_set_int(&msg, i);
+                rustsecp256k1_v0_9_0_scalar_set_int(&sk, j);
+                rustsecp256k1_v0_9_0_scalar_get_b32(sk32, &sk);
+                rustsecp256k1_v0_9_0_scalar_get_b32(msg32, &msg);
 
-                ret = rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &sig, msg32, sk32, rustsecp256k1_v0_8_1_nonce_function_smallint, &k);
+                ret = rustsecp256k1_v0_9_0_ecdsa_sign(ctx, &sig, msg32, sk32, rustsecp256k1_v0_9_0_nonce_function_smallint, &k);
                 CHECK(ret == 1);
 
-                rustsecp256k1_v0_8_1_ecdsa_signature_load(ctx, &r, &s, &sig);
+                rustsecp256k1_v0_9_0_ecdsa_signature_load(ctx, &r, &s, &sig);
                 /* Note that we compute expected_r *after* signing -- this is important
                  * because our nonce-computing function function might change k during
                  * signing. */
@@ -353,12 +398,16 @@ void test_exhaustive_sign(const rustsecp256k1_v0_8_1_context *ctx, const rustsec
 #include "modules/schnorrsig/tests_exhaustive_impl.h"
 #endif
 
+#ifdef ENABLE_MODULE_ELLSWIFT
+#include "modules/ellswift/tests_exhaustive_impl.h"
+#endif
+
 int main(int argc, char** argv) {
     int i;
-    rustsecp256k1_v0_8_1_gej groupj[EXHAUSTIVE_TEST_ORDER];
-    rustsecp256k1_v0_8_1_ge group[EXHAUSTIVE_TEST_ORDER];
+    rustsecp256k1_v0_9_0_gej groupj[EXHAUSTIVE_TEST_ORDER];
+    rustsecp256k1_v0_9_0_ge group[EXHAUSTIVE_TEST_ORDER];
     unsigned char rand32[32];
-    rustsecp256k1_v0_8_1_context *ctx;
+    rustsecp256k1_v0_9_0_context *ctx;
 
     /* Disable buffering for stdout to improve reliability of getting
      * diagnostic information. Happens right at the start of main because
@@ -377,7 +426,7 @@ int main(int argc, char** argv) {
     printf("test count = %i\n", count);
 
     /* find random seed */
-    rustsecp256k1_v0_8_1_testrand_init(argc > 2 ? argv[2] : NULL);
+    rustsecp256k1_v0_9_0_testrand_init(argc > 2 ? argv[2] : NULL);
 
     /* set up split processing */
     if (argc > 4) {
@@ -391,43 +440,43 @@ int main(int argc, char** argv) {
     }
 
     /* Recreate the ecmult{,_gen} tables using the right generator (as selected via EXHAUSTIVE_TEST_ORDER) */
-    rustsecp256k1_v0_8_1_ecmult_gen_compute_table(&rustsecp256k1_v0_8_1_ecmult_gen_prec_table[0][0], &rustsecp256k1_v0_8_1_ge_const_g, ECMULT_GEN_PREC_BITS);
-    rustsecp256k1_v0_8_1_ecmult_compute_two_tables(rustsecp256k1_v0_8_1_pre_g, rustsecp256k1_v0_8_1_pre_g_128, WINDOW_G, &rustsecp256k1_v0_8_1_ge_const_g);
+    rustsecp256k1_v0_9_0_ecmult_gen_compute_table(&rustsecp256k1_v0_9_0_ecmult_gen_prec_table[0][0], &rustsecp256k1_v0_9_0_ge_const_g, ECMULT_GEN_PREC_BITS);
+    rustsecp256k1_v0_9_0_ecmult_compute_two_tables(rustsecp256k1_v0_9_0_pre_g, rustsecp256k1_v0_9_0_pre_g_128, WINDOW_G, &rustsecp256k1_v0_9_0_ge_const_g);
 
     while (count--) {
         /* Build context */
-        ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_NONE);
-        rustsecp256k1_v0_8_1_testrand256(rand32);
-        CHECK(rustsecp256k1_v0_8_1_context_randomize(ctx, rand32));
+        ctx = rustsecp256k1_v0_9_0_context_create(SECP256K1_CONTEXT_NONE);
+        rustsecp256k1_v0_9_0_testrand256(rand32);
+        CHECK(rustsecp256k1_v0_9_0_context_randomize(ctx, rand32));
 
         /* Generate the entire group */
-        rustsecp256k1_v0_8_1_gej_set_infinity(&groupj[0]);
-        rustsecp256k1_v0_8_1_ge_set_gej(&group[0], &groupj[0]);
+        rustsecp256k1_v0_9_0_gej_set_infinity(&groupj[0]);
+        rustsecp256k1_v0_9_0_ge_set_gej(&group[0], &groupj[0]);
         for (i = 1; i < EXHAUSTIVE_TEST_ORDER; i++) {
-            rustsecp256k1_v0_8_1_gej_add_ge(&groupj[i], &groupj[i - 1], &rustsecp256k1_v0_8_1_ge_const_g);
-            rustsecp256k1_v0_8_1_ge_set_gej(&group[i], &groupj[i]);
+            rustsecp256k1_v0_9_0_gej_add_ge(&groupj[i], &groupj[i - 1], &rustsecp256k1_v0_9_0_ge_const_g);
+            rustsecp256k1_v0_9_0_ge_set_gej(&group[i], &groupj[i]);
             if (count != 0) {
                 /* Set a different random z-value for each Jacobian point, except z=1
                    is used in the last iteration. */
-                rustsecp256k1_v0_8_1_fe z;
+                rustsecp256k1_v0_9_0_fe z;
                 random_fe(&z);
-                rustsecp256k1_v0_8_1_gej_rescale(&groupj[i], &z);
+                rustsecp256k1_v0_9_0_gej_rescale(&groupj[i], &z);
             }
 
             /* Verify against ecmult_gen */
             {
-                rustsecp256k1_v0_8_1_scalar scalar_i;
-                rustsecp256k1_v0_8_1_gej generatedj;
-                rustsecp256k1_v0_8_1_ge generated;
+                rustsecp256k1_v0_9_0_scalar scalar_i;
+                rustsecp256k1_v0_9_0_gej generatedj;
+                rustsecp256k1_v0_9_0_ge generated;
 
-                rustsecp256k1_v0_8_1_scalar_set_int(&scalar_i, i);
-                rustsecp256k1_v0_8_1_ecmult_gen(&ctx->ecmult_gen_ctx, &generatedj, &scalar_i);
-                rustsecp256k1_v0_8_1_ge_set_gej(&generated, &generatedj);
+                rustsecp256k1_v0_9_0_scalar_set_int(&scalar_i, i);
+                rustsecp256k1_v0_9_0_ecmult_gen(&ctx->ecmult_gen_ctx, &generatedj, &scalar_i);
+                rustsecp256k1_v0_9_0_ge_set_gej(&generated, &generatedj);
 
                 CHECK(group[i].infinity == 0);
                 CHECK(generated.infinity == 0);
-                CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&generated.x, &group[i].x));
-                CHECK(rustsecp256k1_v0_8_1_fe_equal_var(&generated.y, &group[i].y));
+                CHECK(rustsecp256k1_v0_9_0_fe_equal(&generated.x, &group[i].x));
+                CHECK(rustsecp256k1_v0_9_0_fe_equal(&generated.y, &group[i].y));
             }
         }
 
@@ -448,11 +497,20 @@ int main(int argc, char** argv) {
 #ifdef ENABLE_MODULE_SCHNORRSIG
         test_exhaustive_schnorrsig(ctx);
 #endif
+#ifdef ENABLE_MODULE_ELLSWIFT
+    /* The ellswift algorithm does have additional edge cases when operating on
+     * curves of even order, which are not included in the code as secp256k1 is
+     * of odd order. Skip the ellswift tests if the used exhaustive tests curve
+     * is even-ordered accordingly. */
+    #if !EXHAUSTIVE_TEST_CURVE_HAS_EVEN_ORDER
+        test_exhaustive_ellswift(ctx, group);
+    #endif
+#endif
 
-        rustsecp256k1_v0_8_1_context_destroy(ctx);
+        rustsecp256k1_v0_9_0_context_destroy(ctx);
     }
 
-    rustsecp256k1_v0_8_1_testrand_finish();
+    rustsecp256k1_v0_9_0_testrand_finish();
 
     printf("no problems found\n");
     return 0;
diff --git a/secp256k1-sys/depend/secp256k1/src/util.h b/secp256k1-sys/depend/secp256k1/src/util.h
index 5bcda024c..5de62d4ed 100644
--- a/secp256k1-sys/depend/secp256k1/src/util.h
+++ b/secp256k1-sys/depend/secp256k1/src/util.h
@@ -7,10 +7,10 @@
 #ifndef SECP256K1_UTIL_H
 #define SECP256K1_UTIL_H
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
-
+#include "../include/secp256k1.h"
+extern int rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact(
+        const rustsecp256k1_v0_9_0_context *ctx,
+        rustsecp256k1_v0_9_0_ecdsa_signature *sig, const unsigned char *input64);
 #include <stdlib.h>
 #include <stdint.h>
 #include <stdio.h>
@@ -21,38 +21,83 @@
 #define DEBUG_CONFIG_MSG(x) "DEBUG_CONFIG: " x
 #define DEBUG_CONFIG_DEF(x) DEBUG_CONFIG_MSG(#x "=" STR(x))
 
+/* Debug helper for printing arrays of unsigned char. */
+#define PRINT_BUF(buf, len) do { \
+    printf("%s[%lu] = ", #buf, (unsigned long)len); \
+    print_buf_plain(buf, len); \
+} while(0)
+
+static void print_buf_plain(const unsigned char *buf, size_t len) {
+    size_t i;
+    printf("{");
+    for (i = 0; i < len; i++) {
+        if (i % 8 == 0) {
+            printf("\n    ");
+        } else {
+            printf(" ");
+        }
+        printf("0x%02X,", buf[i]);
+    }
+    printf("\n}\n");
+}
+
+# if (!defined(__STDC_VERSION__) || (__STDC_VERSION__ < 199901L) )
+#  if SECP256K1_GNUC_PREREQ(2,7)
+#   define SECP256K1_INLINE __inline__
+#  elif (defined(_MSC_VER))
+#   define SECP256K1_INLINE __inline
+#  else
+#   define SECP256K1_INLINE
+#  endif
+# else
+#  define SECP256K1_INLINE inline
+# endif
+
+/** Assert statically that expr is an integer constant expression, and run stmt.
+ *
+ * Useful for example to enforce that magnitude arguments are constant.
+ */
+#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
+    switch(42) { \
+        case /* ERROR: integer argument is not constant */ expr: \
+            break; \
+        default: ; \
+    } \
+    stmt; \
+} while(0)
+
 typedef struct {
     void (*fn)(const char *text, void* data);
     const void* data;
-} rustsecp256k1_v0_8_1_callback;
+} rustsecp256k1_v0_9_0_callback;
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_callback_call(const rustsecp256k1_v0_8_1_callback * const cb, const char * const text) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_callback_call(const rustsecp256k1_v0_9_0_callback * const cb, const char * const text) {
     cb->fn(text, (void*)cb->data);
 }
 
 #ifndef USE_EXTERNAL_DEFAULT_CALLBACKS
-static void rustsecp256k1_v0_8_1_default_illegal_callback_fn(const char* str, void* data) {
+static void rustsecp256k1_v0_9_0_default_illegal_callback_fn(const char* str, void* data) {
     (void)data;
     fprintf(stderr, "[libsecp256k1] illegal argument: %s\n", str);
     abort();
 }
-static void rustsecp256k1_v0_8_1_default_error_callback_fn(const char* str, void* data) {
+static void rustsecp256k1_v0_9_0_default_error_callback_fn(const char* str, void* data) {
     (void)data;
     fprintf(stderr, "[libsecp256k1] internal consistency check failed: %s\n", str);
     abort();
 }
 #else
-void rustsecp256k1_v0_8_1_default_illegal_callback_fn(const char* str, void* data);
-void rustsecp256k1_v0_8_1_default_error_callback_fn(const char* str, void* data);
+void rustsecp256k1_v0_9_0_default_illegal_callback_fn(const char* str, void* data);
+void rustsecp256k1_v0_9_0_default_error_callback_fn(const char* str, void* data);
 #endif
 
-static const rustsecp256k1_v0_8_1_callback default_illegal_callback = {
-    rustsecp256k1_v0_8_1_default_illegal_callback_fn,
+static const rustsecp256k1_v0_9_0_callback default_illegal_callback = {
+    rustsecp256k1_v0_9_0_default_illegal_callback_fn,
     NULL
 };
 
-static const rustsecp256k1_v0_8_1_callback default_error_callback = {
-    rustsecp256k1_v0_8_1_default_error_callback_fn,
+static const rustsecp256k1_v0_9_0_callback default_error_callback = {
+    rustsecp256k1_v0_9_0_default_error_callback_fn,
     NULL
 };
 
@@ -101,24 +146,13 @@ static const rustsecp256k1_v0_8_1_callback default_error_callback = {
 #define VERIFY_SETUP(stmt)
 #endif
 
-/* Define `VG_UNDEF` and `VG_CHECK` when VALGRIND is defined  */
-#if !defined(VG_CHECK)
-# if defined(VALGRIND)
-#  include <valgrind/memcheck.h>
-#  define VG_UNDEF(x,y) VALGRIND_MAKE_MEM_UNDEFINED((x),(y))
-#  define VG_CHECK(x,y) VALGRIND_CHECK_MEM_IS_DEFINED((x),(y))
-# else
-#  define VG_UNDEF(x,y)
-#  define VG_CHECK(x,y)
-# endif
-#endif
-
-/* Like `VG_CHECK` but on VERIFY only */
-#if defined(VERIFY)
-#define VG_CHECK_VERIFY(x,y) VG_CHECK((x), (y))
-#else
-#define VG_CHECK_VERIFY(x,y)
-#endif
+static SECP256K1_INLINE void *checked_malloc(const rustsecp256k1_v0_9_0_callback* cb, size_t size) {
+    void *ret = malloc(size);
+    if (ret == NULL) {
+        rustsecp256k1_v0_9_0_callback_call(cb, "Out of memory");
+    }
+    return ret;
+}
 
 #if defined(__BIGGEST_ALIGNMENT__)
 #define ALIGNMENT __BIGGEST_ALIGNMENT__
@@ -163,7 +197,7 @@ static const rustsecp256k1_v0_8_1_callback default_error_callback = {
 #endif
 
 /* Zero memory if flag == 1. Flag must be 0 or 1. Constant time. */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_memczero(void *s, size_t len, int flag) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_memczero(void *s, size_t len, int flag) {
     unsigned char *p = (unsigned char *)s;
     /* Access flag with a volatile-qualified lvalue.
        This prevents clang from figuring out (after inlining) that flag can
@@ -182,7 +216,7 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_memczero(void *s, size_t len,
  * We use this to avoid possible compiler bugs with memcmp, e.g.
  * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189
  */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_memcmp_var(const void *s1, const void *s2, size_t n) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_memcmp_var(const void *s1, const void *s2, size_t n) {
     const unsigned char *p1 = s1, *p2 = s2;
     size_t i;
 
@@ -196,7 +230,7 @@ static SECP256K1_INLINE int rustsecp256k1_v0_8_1_memcmp_var(const void *s1, cons
 }
 
 /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time.  Both *r and *a must be initialized and non-negative.*/
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_int_cmov(int *r, const int *a, int flag) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_int_cmov(int *r, const int *a, int flag) {
     unsigned int mask0, mask1, r_masked, a_masked;
     /* Access flag with a volatile-qualified lvalue.
        This prevents clang from figuring out (after inlining) that flag can
@@ -251,31 +285,31 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_int_cmov(int *r, const int *a,
 
 /* Determine the number of trailing zero bits in a (non-zero) 32-bit x.
  * This function is only intended to be used as fallback for
- * rustsecp256k1_v0_8_1_ctz32_var, but permits it to be tested separately. */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz32_var_debruijn(uint32_t x) {
+ * rustsecp256k1_v0_9_0_ctz32_var, but permits it to be tested separately. */
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_ctz32_var_debruijn(uint32_t x) {
     static const uint8_t debruijn[32] = {
         0x00, 0x01, 0x02, 0x18, 0x03, 0x13, 0x06, 0x19, 0x16, 0x04, 0x14, 0x0A,
         0x10, 0x07, 0x0C, 0x1A, 0x1F, 0x17, 0x12, 0x05, 0x15, 0x09, 0x0F, 0x0B,
         0x1E, 0x11, 0x08, 0x0E, 0x1D, 0x0D, 0x1C, 0x1B
     };
-    return debruijn[((x & -x) * 0x04D7651F) >> 27];
+    return debruijn[(uint32_t)((x & -x) * 0x04D7651FU) >> 27];
 }
 
 /* Determine the number of trailing zero bits in a (non-zero) 64-bit x.
  * This function is only intended to be used as fallback for
- * rustsecp256k1_v0_8_1_ctz64_var, but permits it to be tested separately. */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz64_var_debruijn(uint64_t x) {
+ * rustsecp256k1_v0_9_0_ctz64_var, but permits it to be tested separately. */
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_ctz64_var_debruijn(uint64_t x) {
     static const uint8_t debruijn[64] = {
         0, 1, 2, 53, 3, 7, 54, 27, 4, 38, 41, 8, 34, 55, 48, 28,
         62, 5, 39, 46, 44, 42, 22, 9, 24, 35, 59, 56, 49, 18, 29, 11,
         63, 52, 6, 26, 37, 40, 33, 47, 61, 45, 43, 21, 23, 58, 17, 10,
         51, 25, 36, 32, 60, 20, 57, 16, 50, 31, 19, 15, 30, 14, 13, 12
     };
-    return debruijn[((x & -x) * 0x022FDD63CC95386D) >> 58];
+    return debruijn[(uint64_t)((x & -x) * 0x022FDD63CC95386DU) >> 58];
 }
 
 /* Determine the number of trailing zero bits in a (non-zero) 32-bit x. */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz32_var(uint32_t x) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_ctz32_var(uint32_t x) {
     VERIFY_CHECK(x != 0);
 #if (__has_builtin(__builtin_ctz) || SECP256K1_GNUC_PREREQ(3,4))
     /* If the unsigned type is sufficient to represent the largest uint32_t, consider __builtin_ctz. */
@@ -288,12 +322,12 @@ static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz32_var(uint32_t x) {
     return __builtin_ctzl(x);
 #else
     /* If no suitable CTZ builtin is available, use a (variable time) software emulation. */
-    return rustsecp256k1_v0_8_1_ctz32_var_debruijn(x);
+    return rustsecp256k1_v0_9_0_ctz32_var_debruijn(x);
 #endif
 }
 
 /* Determine the number of trailing zero bits in a (non-zero) 64-bit x. */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz64_var(uint64_t x) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_ctz64_var(uint64_t x) {
     VERIFY_CHECK(x != 0);
 #if (__has_builtin(__builtin_ctzl) || SECP256K1_GNUC_PREREQ(3,4))
     /* If the unsigned long type is sufficient to represent the largest uint64_t, consider __builtin_ctzl. */
@@ -306,12 +340,12 @@ static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz64_var(uint64_t x) {
     return __builtin_ctzll(x);
 #else
     /* If no suitable CTZ builtin is available, use a (variable time) software emulation. */
-    return rustsecp256k1_v0_8_1_ctz64_var_debruijn(x);
+    return rustsecp256k1_v0_9_0_ctz64_var_debruijn(x);
 #endif
 }
 
 /* Read a uint32_t in big endian */
-SECP256K1_INLINE static uint32_t rustsecp256k1_v0_8_1_read_be32(const unsigned char* p) {
+SECP256K1_INLINE static uint32_t rustsecp256k1_v0_9_0_read_be32(const unsigned char* p) {
     return (uint32_t)p[0] << 24 |
            (uint32_t)p[1] << 16 |
            (uint32_t)p[2] << 8  |
@@ -319,11 +353,35 @@ SECP256K1_INLINE static uint32_t rustsecp256k1_v0_8_1_read_be32(const unsigned c
 }
 
 /* Write a uint32_t in big endian */
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_write_be32(unsigned char* p, uint32_t x) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_write_be32(unsigned char* p, uint32_t x) {
     p[3] = x;
     p[2] = x >>  8;
     p[1] = x >> 16;
     p[0] = x >> 24;
 }
 
+/* Read a uint64_t in big endian */
+SECP256K1_INLINE static uint64_t rustsecp256k1_v0_9_0_read_be64(const unsigned char* p) {
+    return (uint64_t)p[0] << 56 |
+           (uint64_t)p[1] << 48 |
+           (uint64_t)p[2] << 40 |
+           (uint64_t)p[3] << 32 |
+           (uint64_t)p[4] << 24 |
+           (uint64_t)p[5] << 16 |
+           (uint64_t)p[6] << 8  |
+           (uint64_t)p[7];
+}
+
+/* Write a uint64_t in big endian */
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_write_be64(unsigned char* p, uint64_t x) {
+    p[7] = x;
+    p[6] = x >>  8;
+    p[5] = x >> 16;
+    p[4] = x >> 24;
+    p[3] = x >> 32;
+    p[2] = x >> 40;
+    p[1] = x >> 48;
+    p[0] = x >> 56;
+}
+
 #endif /* SECP256K1_UTIL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/util.h.orig b/secp256k1-sys/depend/secp256k1/src/util.h.orig
index 78b0b5bf2..613901ef3 100644
--- a/secp256k1-sys/depend/secp256k1/src/util.h.orig
+++ b/secp256k1-sys/depend/secp256k1/src/util.h.orig
@@ -7,9 +7,7 @@
 #ifndef SECP256K1_UTIL_H
 #define SECP256K1_UTIL_H
 
-#if defined HAVE_CONFIG_H
-#include "libsecp256k1-config.h"
-#endif
+#include "../include/secp256k1.h"
 
 #include <stdlib.h>
 #include <stdint.h>
@@ -21,38 +19,83 @@
 #define DEBUG_CONFIG_MSG(x) "DEBUG_CONFIG: " x
 #define DEBUG_CONFIG_DEF(x) DEBUG_CONFIG_MSG(#x "=" STR(x))
 
+/* Debug helper for printing arrays of unsigned char. */
+#define PRINT_BUF(buf, len) do { \
+    printf("%s[%lu] = ", #buf, (unsigned long)len); \
+    print_buf_plain(buf, len); \
+} while(0)
+
+static void print_buf_plain(const unsigned char *buf, size_t len) {
+    size_t i;
+    printf("{");
+    for (i = 0; i < len; i++) {
+        if (i % 8 == 0) {
+            printf("\n    ");
+        } else {
+            printf(" ");
+        }
+        printf("0x%02X,", buf[i]);
+    }
+    printf("\n}\n");
+}
+
+# if (!defined(__STDC_VERSION__) || (__STDC_VERSION__ < 199901L) )
+#  if SECP256K1_GNUC_PREREQ(2,7)
+#   define SECP256K1_INLINE __inline__
+#  elif (defined(_MSC_VER))
+#   define SECP256K1_INLINE __inline
+#  else
+#   define SECP256K1_INLINE
+#  endif
+# else
+#  define SECP256K1_INLINE inline
+# endif
+
+/** Assert statically that expr is an integer constant expression, and run stmt.
+ *
+ * Useful for example to enforce that magnitude arguments are constant.
+ */
+#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
+    switch(42) { \
+        case /* ERROR: integer argument is not constant */ expr: \
+            break; \
+        default: ; \
+    } \
+    stmt; \
+} while(0)
+
 typedef struct {
     void (*fn)(const char *text, void* data);
     const void* data;
-} rustsecp256k1_v0_8_1_callback;
+} rustsecp256k1_v0_9_0_callback;
 
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_callback_call(const rustsecp256k1_v0_8_1_callback * const cb, const char * const text) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_callback_call(const rustsecp256k1_v0_9_0_callback * const cb, const char * const text) {
     cb->fn(text, (void*)cb->data);
 }
 
 #ifndef USE_EXTERNAL_DEFAULT_CALLBACKS
-static void rustsecp256k1_v0_8_1_default_illegal_callback_fn(const char* str, void* data) {
+static void rustsecp256k1_v0_9_0_default_illegal_callback_fn(const char* str, void* data) {
     (void)data;
     fprintf(stderr, "[libsecp256k1] illegal argument: %s\n", str);
     abort();
 }
-static void rustsecp256k1_v0_8_1_default_error_callback_fn(const char* str, void* data) {
+static void rustsecp256k1_v0_9_0_default_error_callback_fn(const char* str, void* data) {
     (void)data;
     fprintf(stderr, "[libsecp256k1] internal consistency check failed: %s\n", str);
     abort();
 }
 #else
-void rustsecp256k1_v0_8_1_default_illegal_callback_fn(const char* str, void* data);
-void rustsecp256k1_v0_8_1_default_error_callback_fn(const char* str, void* data);
+void rustsecp256k1_v0_9_0_default_illegal_callback_fn(const char* str, void* data);
+void rustsecp256k1_v0_9_0_default_error_callback_fn(const char* str, void* data);
 #endif
 
-static const rustsecp256k1_v0_8_1_callback default_illegal_callback = {
-    rustsecp256k1_v0_8_1_default_illegal_callback_fn,
+static const rustsecp256k1_v0_9_0_callback default_illegal_callback = {
+    rustsecp256k1_v0_9_0_default_illegal_callback_fn,
     NULL
 };
 
-static const rustsecp256k1_v0_8_1_callback default_error_callback = {
-    rustsecp256k1_v0_8_1_default_error_callback_fn,
+static const rustsecp256k1_v0_9_0_callback default_error_callback = {
+    rustsecp256k1_v0_9_0_default_error_callback_fn,
     NULL
 };
 
@@ -101,37 +144,10 @@ static const rustsecp256k1_v0_8_1_callback default_error_callback = {
 #define VERIFY_SETUP(stmt)
 #endif
 
-/* Define `VG_UNDEF` and `VG_CHECK` when VALGRIND is defined  */
-#if !defined(VG_CHECK)
-# if defined(VALGRIND)
-#  include <valgrind/memcheck.h>
-#  define VG_UNDEF(x,y) VALGRIND_MAKE_MEM_UNDEFINED((x),(y))
-#  define VG_CHECK(x,y) VALGRIND_CHECK_MEM_IS_DEFINED((x),(y))
-# else
-#  define VG_UNDEF(x,y)
-#  define VG_CHECK(x,y)
-# endif
-#endif
-
-/* Like `VG_CHECK` but on VERIFY only */
-#if defined(VERIFY)
-#define VG_CHECK_VERIFY(x,y) VG_CHECK((x), (y))
-#else
-#define VG_CHECK_VERIFY(x,y)
-#endif
-
-static SECP256K1_INLINE void *checked_malloc(const rustsecp256k1_v0_8_1_callback* cb, size_t size) {
+static SECP256K1_INLINE void *checked_malloc(const rustsecp256k1_v0_9_0_callback* cb, size_t size) {
     void *ret = malloc(size);
     if (ret == NULL) {
-        rustsecp256k1_v0_8_1_callback_call(cb, "Out of memory");
-    }
-    return ret;
-}
-
-static SECP256K1_INLINE void *checked_realloc(const rustsecp256k1_v0_8_1_callback* cb, void *ptr, size_t size) {
-    void *ret = realloc(ptr, size);
-    if (ret == NULL) {
-        rustsecp256k1_v0_8_1_callback_call(cb, "Out of memory");
+        rustsecp256k1_v0_9_0_callback_call(cb, "Out of memory");
     }
     return ret;
 }
@@ -179,7 +195,7 @@ static SECP256K1_INLINE void *checked_realloc(const rustsecp256k1_v0_8_1_callbac
 #endif
 
 /* Zero memory if flag == 1. Flag must be 0 or 1. Constant time. */
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_memczero(void *s, size_t len, int flag) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_memczero(void *s, size_t len, int flag) {
     unsigned char *p = (unsigned char *)s;
     /* Access flag with a volatile-qualified lvalue.
        This prevents clang from figuring out (after inlining) that flag can
@@ -198,7 +214,7 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_memczero(void *s, size_t len,
  * We use this to avoid possible compiler bugs with memcmp, e.g.
  * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189
  */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_memcmp_var(const void *s1, const void *s2, size_t n) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_memcmp_var(const void *s1, const void *s2, size_t n) {
     const unsigned char *p1 = s1, *p2 = s2;
     size_t i;
 
@@ -212,7 +228,7 @@ static SECP256K1_INLINE int rustsecp256k1_v0_8_1_memcmp_var(const void *s1, cons
 }
 
 /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time.  Both *r and *a must be initialized and non-negative.*/
-static SECP256K1_INLINE void rustsecp256k1_v0_8_1_int_cmov(int *r, const int *a, int flag) {
+static SECP256K1_INLINE void rustsecp256k1_v0_9_0_int_cmov(int *r, const int *a, int flag) {
     unsigned int mask0, mask1, r_masked, a_masked;
     /* Access flag with a volatile-qualified lvalue.
        This prevents clang from figuring out (after inlining) that flag can
@@ -267,31 +283,31 @@ static SECP256K1_INLINE void rustsecp256k1_v0_8_1_int_cmov(int *r, const int *a,
 
 /* Determine the number of trailing zero bits in a (non-zero) 32-bit x.
  * This function is only intended to be used as fallback for
- * rustsecp256k1_v0_8_1_ctz32_var, but permits it to be tested separately. */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz32_var_debruijn(uint32_t x) {
+ * rustsecp256k1_v0_9_0_ctz32_var, but permits it to be tested separately. */
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_ctz32_var_debruijn(uint32_t x) {
     static const uint8_t debruijn[32] = {
         0x00, 0x01, 0x02, 0x18, 0x03, 0x13, 0x06, 0x19, 0x16, 0x04, 0x14, 0x0A,
         0x10, 0x07, 0x0C, 0x1A, 0x1F, 0x17, 0x12, 0x05, 0x15, 0x09, 0x0F, 0x0B,
         0x1E, 0x11, 0x08, 0x0E, 0x1D, 0x0D, 0x1C, 0x1B
     };
-    return debruijn[((x & -x) * 0x04D7651F) >> 27];
+    return debruijn[(uint32_t)((x & -x) * 0x04D7651FU) >> 27];
 }
 
 /* Determine the number of trailing zero bits in a (non-zero) 64-bit x.
  * This function is only intended to be used as fallback for
- * rustsecp256k1_v0_8_1_ctz64_var, but permits it to be tested separately. */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz64_var_debruijn(uint64_t x) {
+ * rustsecp256k1_v0_9_0_ctz64_var, but permits it to be tested separately. */
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_ctz64_var_debruijn(uint64_t x) {
     static const uint8_t debruijn[64] = {
         0, 1, 2, 53, 3, 7, 54, 27, 4, 38, 41, 8, 34, 55, 48, 28,
         62, 5, 39, 46, 44, 42, 22, 9, 24, 35, 59, 56, 49, 18, 29, 11,
         63, 52, 6, 26, 37, 40, 33, 47, 61, 45, 43, 21, 23, 58, 17, 10,
         51, 25, 36, 32, 60, 20, 57, 16, 50, 31, 19, 15, 30, 14, 13, 12
     };
-    return debruijn[((x & -x) * 0x022FDD63CC95386D) >> 58];
+    return debruijn[(uint64_t)((x & -x) * 0x022FDD63CC95386DU) >> 58];
 }
 
 /* Determine the number of trailing zero bits in a (non-zero) 32-bit x. */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz32_var(uint32_t x) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_ctz32_var(uint32_t x) {
     VERIFY_CHECK(x != 0);
 #if (__has_builtin(__builtin_ctz) || SECP256K1_GNUC_PREREQ(3,4))
     /* If the unsigned type is sufficient to represent the largest uint32_t, consider __builtin_ctz. */
@@ -304,12 +320,12 @@ static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz32_var(uint32_t x) {
     return __builtin_ctzl(x);
 #else
     /* If no suitable CTZ builtin is available, use a (variable time) software emulation. */
-    return rustsecp256k1_v0_8_1_ctz32_var_debruijn(x);
+    return rustsecp256k1_v0_9_0_ctz32_var_debruijn(x);
 #endif
 }
 
 /* Determine the number of trailing zero bits in a (non-zero) 64-bit x. */
-static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz64_var(uint64_t x) {
+static SECP256K1_INLINE int rustsecp256k1_v0_9_0_ctz64_var(uint64_t x) {
     VERIFY_CHECK(x != 0);
 #if (__has_builtin(__builtin_ctzl) || SECP256K1_GNUC_PREREQ(3,4))
     /* If the unsigned long type is sufficient to represent the largest uint64_t, consider __builtin_ctzl. */
@@ -322,12 +338,12 @@ static SECP256K1_INLINE int rustsecp256k1_v0_8_1_ctz64_var(uint64_t x) {
     return __builtin_ctzll(x);
 #else
     /* If no suitable CTZ builtin is available, use a (variable time) software emulation. */
-    return rustsecp256k1_v0_8_1_ctz64_var_debruijn(x);
+    return rustsecp256k1_v0_9_0_ctz64_var_debruijn(x);
 #endif
 }
 
 /* Read a uint32_t in big endian */
-SECP256K1_INLINE static uint32_t rustsecp256k1_v0_8_1_read_be32(const unsigned char* p) {
+SECP256K1_INLINE static uint32_t rustsecp256k1_v0_9_0_read_be32(const unsigned char* p) {
     return (uint32_t)p[0] << 24 |
            (uint32_t)p[1] << 16 |
            (uint32_t)p[2] << 8  |
@@ -335,11 +351,35 @@ SECP256K1_INLINE static uint32_t rustsecp256k1_v0_8_1_read_be32(const unsigned c
 }
 
 /* Write a uint32_t in big endian */
-SECP256K1_INLINE static void rustsecp256k1_v0_8_1_write_be32(unsigned char* p, uint32_t x) {
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_write_be32(unsigned char* p, uint32_t x) {
     p[3] = x;
     p[2] = x >>  8;
     p[1] = x >> 16;
     p[0] = x >> 24;
 }
 
+/* Read a uint64_t in big endian */
+SECP256K1_INLINE static uint64_t rustsecp256k1_v0_9_0_read_be64(const unsigned char* p) {
+    return (uint64_t)p[0] << 56 |
+           (uint64_t)p[1] << 48 |
+           (uint64_t)p[2] << 40 |
+           (uint64_t)p[3] << 32 |
+           (uint64_t)p[4] << 24 |
+           (uint64_t)p[5] << 16 |
+           (uint64_t)p[6] << 8  |
+           (uint64_t)p[7];
+}
+
+/* Write a uint64_t in big endian */
+SECP256K1_INLINE static void rustsecp256k1_v0_9_0_write_be64(unsigned char* p, uint64_t x) {
+    p[7] = x;
+    p[6] = x >>  8;
+    p[5] = x >> 16;
+    p[4] = x >> 24;
+    p[3] = x >> 32;
+    p[2] = x >> 40;
+    p[1] = x >> 48;
+    p[0] = x >> 56;
+}
+
 #endif /* SECP256K1_UTIL_H */
diff --git a/secp256k1-sys/depend/secp256k1/src/valgrind_ctime_test.c b/secp256k1-sys/depend/secp256k1/src/valgrind_ctime_test.c
deleted file mode 100644
index 1fed2b0f6..000000000
--- a/secp256k1-sys/depend/secp256k1/src/valgrind_ctime_test.c
+++ /dev/null
@@ -1,171 +0,0 @@
-/***********************************************************************
- * Copyright (c) 2020 Gregory Maxwell                                  *
- * Distributed under the MIT software license, see the accompanying    *
- * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
- ***********************************************************************/
-
-#include <valgrind/memcheck.h>
-#include <stdio.h>
-
-#include "../include/secp256k1.h"
-#include "assumptions.h"
-#include "util.h"
-
-#ifdef ENABLE_MODULE_ECDH
-# include "../include/rustsecp256k1_v0_8_1_ecdh.h"
-#endif
-
-#ifdef ENABLE_MODULE_RECOVERY
-# include "../include/rustsecp256k1_v0_8_1_recovery.h"
-#endif
-
-#ifdef ENABLE_MODULE_EXTRAKEYS
-# include "../include/rustsecp256k1_v0_8_1_extrakeys.h"
-#endif
-
-#ifdef ENABLE_MODULE_SCHNORRSIG
-#include "../include/secp256k1_schnorrsig.h"
-#endif
-
-void run_tests(rustsecp256k1_v0_8_1_context *ctx, unsigned char *key);
-
-int main(void) {
-    rustsecp256k1_v0_8_1_context* ctx;
-    unsigned char key[32];
-    int ret, i;
-
-    if (!RUNNING_ON_VALGRIND) {
-        fprintf(stderr, "This test can only usefully be run inside valgrind.\n");
-        fprintf(stderr, "Usage: libtool --mode=execute valgrind ./valgrind_ctime_test\n");
-        return 1;
-    }
-    ctx = rustsecp256k1_v0_8_1_context_create(SECP256K1_CONTEXT_DECLASSIFY);
-    /** In theory, testing with a single secret input should be sufficient:
-     *  If control flow depended on secrets the tool would generate an error.
-     */
-    for (i = 0; i < 32; i++) {
-        key[i] = i + 65;
-    }
-
-    run_tests(ctx, key);
-
-    /* Test context randomisation. Do this last because it leaves the context
-     * tainted. */
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = rustsecp256k1_v0_8_1_context_randomize(ctx, key);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret);
-
-    rustsecp256k1_v0_8_1_context_destroy(ctx);
-    return 0;
-}
-
-void run_tests(rustsecp256k1_v0_8_1_context *ctx, unsigned char *key) {
-    rustsecp256k1_v0_8_1_ecdsa_signature signature;
-    rustsecp256k1_v0_8_1_pubkey pubkey;
-    size_t siglen = 74;
-    size_t outputlen = 33;
-    int i;
-    int ret;
-    unsigned char msg[32];
-    unsigned char sig[74];
-    unsigned char spubkey[33];
-#ifdef ENABLE_MODULE_RECOVERY
-    rustsecp256k1_v0_8_1_ecdsa_recoverable_signature recoverable_signature;
-    int recid;
-#endif
-#ifdef ENABLE_MODULE_EXTRAKEYS
-    rustsecp256k1_v0_8_1_keypair keypair;
-#endif
-
-    for (i = 0; i < 32; i++) {
-        msg[i] = i + 1;
-    }
-
-    /* Test keygen. */
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = rustsecp256k1_v0_8_1_ec_pubkey_create(ctx, &pubkey, key);
-    VALGRIND_MAKE_MEM_DEFINED(&pubkey, sizeof(rustsecp256k1_v0_8_1_pubkey));
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret);
-    CHECK(rustsecp256k1_v0_8_1_ec_pubkey_serialize(ctx, spubkey, &outputlen, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
-
-    /* Test signing. */
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = rustsecp256k1_v0_8_1_ecdsa_sign(ctx, &signature, msg, key, NULL, NULL);
-    VALGRIND_MAKE_MEM_DEFINED(&signature, sizeof(rustsecp256k1_v0_8_1_ecdsa_signature));
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der(ctx, sig, &siglen, &signature));
-
-#ifdef ENABLE_MODULE_ECDH
-    /* Test ECDH. */
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = rustsecp256k1_v0_8_1_ecdh(ctx, msg, &pubkey, key, NULL, NULL);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-#endif
-
-#ifdef ENABLE_MODULE_RECOVERY
-    /* Test signing a recoverable signature. */
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = rustsecp256k1_v0_8_1_ecdsa_sign_recoverable(ctx, &recoverable_signature, msg, key, NULL, NULL);
-    VALGRIND_MAKE_MEM_DEFINED(&recoverable_signature, sizeof(recoverable_signature));
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret);
-    CHECK(rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, &recoverable_signature));
-    CHECK(recid >= 0 && recid <= 3);
-#endif
-
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = rustsecp256k1_v0_8_1_ec_seckey_verify(ctx, key);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = rustsecp256k1_v0_8_1_ec_seckey_negate(ctx, key);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    VALGRIND_MAKE_MEM_UNDEFINED(msg, 32);
-    ret = rustsecp256k1_v0_8_1_ec_seckey_tweak_add(ctx, key, msg);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    VALGRIND_MAKE_MEM_UNDEFINED(msg, 32);
-    ret = rustsecp256k1_v0_8_1_ec_seckey_tweak_mul(ctx, key, msg);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-
-    /* Test keypair_create and keypair_xonly_tweak_add. */
-#ifdef ENABLE_MODULE_EXTRAKEYS
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, key);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-
-    /* The tweak is not treated as a secret in keypair_tweak_add */
-    VALGRIND_MAKE_MEM_DEFINED(msg, 32);
-    ret = rustsecp256k1_v0_8_1_keypair_xonly_tweak_add(ctx, &keypair, msg);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    VALGRIND_MAKE_MEM_UNDEFINED(&keypair, sizeof(keypair));
-    ret = rustsecp256k1_v0_8_1_keypair_sec(ctx, key, &keypair);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-#endif
-
-#ifdef ENABLE_MODULE_SCHNORRSIG
-    VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
-    ret = rustsecp256k1_v0_8_1_keypair_create(ctx, &keypair, key);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-    ret = rustsecp256k1_v0_8_1_schnorrsig_sign32(ctx, sig, msg, &keypair, NULL);
-    VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
-    CHECK(ret == 1);
-#endif
-}
diff --git a/secp256k1-sys/depend/secp256k1/src/wycheproof/WYCHEPROOF_COPYING b/secp256k1-sys/depend/secp256k1/src/wycheproof/WYCHEPROOF_COPYING
new file mode 100644
index 000000000..b02bfba05
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/wycheproof/WYCHEPROOF_COPYING
@@ -0,0 +1,212 @@
+* The file `ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.json` in this directory
+  comes from Google's project Wycheproof with git commit
+  `b063b4aedae951c69df014cd25fa6d69ae9e8cb9`, see
+  https://github.com/google/wycheproof/blob/b063b4aedae951c69df014cd25fa6d69ae9e8cb9/testvectors_v1/ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.json
+
+* The file `ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.h` is generated from
+  `ecdsa_rustsecp256k1_v0_9_0_sha256_bitcoin_test.json` using the script
+  `tests_wycheproof_generate.py`.
+
+-------------------------------------------------------------------------------
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/secp256k1-sys/depend/secp256k1/src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.h b/secp256k1-sys/depend/secp256k1/src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.h
new file mode 100644
index 000000000..736737fd6
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.h
@@ -0,0 +1,1564 @@
+/* Note: this file was autogenerated using tests_wycheproof_generate.py. Do not edit. */
+#define SECP256K1_ECDSA_WYCHEPROOF_NUMBER_TESTVECTORS (463)
+
+typedef struct {
+    size_t pk_offset;
+    size_t msg_offset;
+    size_t msg_len;
+    size_t sig_offset;
+    size_t sig_len;
+    int expected_verify;
+} wycheproof_ecdsa_testvector;
+
+static const unsigned char wycheproof_ecdsa_messages[]    = { 0x31,0x32,0x33,0x34,0x30,0x30,
+  0x32,0x35,0x35,0x38,0x35,
+  0x34,0x32,0x36,0x34,0x37,0x39,0x37,0x32,0x34,
+  0x37,0x31,0x33,0x38,0x36,0x38,0x34,0x38,0x39,0x31,
+  0x31,0x30,0x33,0x35,0x39,0x33,0x33,0x31,0x36,0x36,0x38,
+  0x33,0x39,0x34,0x39,0x34,0x30,0x31,0x32,0x31,0x35,
+  0x31,0x33,0x34,0x34,0x32,0x39,0x33,0x30,0x37,0x39,
+  0x33,0x37,0x30,0x36,0x32,0x31,0x31,0x37,0x31,0x32,
+  0x33,0x34,0x33,0x36,0x38,0x38,0x37,0x31,0x32,
+  0x31,0x33,0x35,0x31,0x35,0x33,0x30,0x33,0x37,0x30,
+  0x36,0x35,0x35,0x33,0x32,0x30,0x33,0x31,0x32,0x36,
+  0x31,0x35,0x36,0x34,0x33,0x34,0x36,0x36,0x30,0x33,
+  0x34,0x34,0x32,0x39,0x35,0x33,0x39,0x31,0x31,0x37,
+  0x31,0x30,0x39,0x35,0x33,0x32,0x36,0x31,0x33,0x35,0x31,
+  0x35,0x39,0x38,0x37,0x33,0x35,0x30,0x30,0x34,0x31,
+  0x33,0x34,0x36,0x33,0x30,0x30,0x36,0x38,0x37,0x38,
+  0x39,0x38,0x31,0x37,0x33,0x32,0x30,0x32,0x38,0x37,
+  0x33,0x32,0x32,0x32,0x30,0x34,0x31,0x30,0x34,0x36,
+  0x36,0x36,0x36,0x36,0x33,0x30,0x37,0x31,0x30,0x34,
+  0x31,0x30,0x33,0x35,0x39,0x35,0x31,0x38,0x39,0x38,
+  0x31,0x38,0x34,0x36,0x35,0x39,0x37,0x31,0x39,0x35,
+  0x33,0x31,0x33,0x36,0x30,0x34,0x36,0x31,0x38,0x39,
+  0x32,0x36,0x36,0x33,0x37,0x38,0x34,0x32,0x35,0x34,
+  0x31,0x36,0x35,0x32,0x31,0x30,0x30,0x35,0x32,0x34,
+  0x35,0x37,0x34,0x38,0x30,0x38,0x31,0x36,0x39,0x36,
+  0x36,0x33,0x34,0x33,0x39,0x31,0x33,0x34,0x36,0x38,
+  0x31,0x35,0x34,0x31,0x31,0x30,0x33,0x35,0x39,0x38,
+  0x31,0x30,0x34,0x37,0x38,0x35,0x38,0x30,0x31,0x32,0x38,
+  0x31,0x30,0x35,0x33,0x36,0x32,0x38,0x35,0x35,0x36,0x38,
+  0x39,0x35,0x33,0x39,0x30,0x34,0x31,0x30,0x35,
+  0x39,0x37,0x38,0x38,0x34,0x38,0x30,0x33,0x39,
+  0x33,0x36,0x31,0x30,0x36,0x37,0x32,0x34,0x34,0x32,
+  0x31,0x30,0x35,0x34,0x32,0x34,0x30,0x37,0x30,0x35,
+  0x35,0x31,0x37,0x34,0x34,0x34,0x38,0x31,0x39,0x37,
+  0x31,0x39,0x36,0x37,0x35,0x36,0x31,0x32,0x35,0x31,
+  0x33,0x34,0x34,0x37,0x32,0x35,0x33,0x33,0x34,0x33,
+  0x33,0x36,0x38,0x32,0x36,0x34,0x33,0x31,0x38,
+  0x33,0x32,0x36,0x31,0x31,0x39,0x38,0x36,0x30,0x38,
+  0x39,0x36,0x37,0x38,0x37,0x38,0x31,0x30,0x39,0x34,
+  0x34,0x39,0x35,0x38,0x38,0x32,0x33,0x38,0x32,0x33,
+  0x38,0x32,0x34,0x36,0x33,0x37,0x38,0x33,0x37,
+  0x31,0x31,0x30,0x32,0x30,0x38,0x33,0x33,0x37,0x37,0x36,
+  0x31,0x33,0x33,0x38,0x37,0x31,0x36,0x34,0x38,
+  0x33,0x32,0x32,0x31,0x34,0x34,0x31,0x36,0x32,
+  0x31,0x30,0x36,0x38,0x36,0x36,0x35,0x35,0x35,0x34,0x36,
+  0x36,0x32,0x31,0x35,0x35,0x32,0x34,0x36,
+  0x37,0x30,0x33,0x30,0x38,0x31,0x38,0x37,0x37,0x34,
+  0x35,0x39,0x32,0x34,0x35,0x32,0x33,0x37,0x34,0x34,
+  0x31,0x34,0x39,0x35,0x35,0x38,0x36,0x36,0x32,0x31,
+  0x34,0x30,0x30,0x35,0x33,0x31,0x34,0x34,0x30,0x36,
+  0x33,0x30,0x39,0x36,0x34,0x35,0x37,0x35,0x31,0x32,
+  0x32,0x37,0x38,0x34,0x30,0x32,0x35,0x36,0x32,0x30,
+  0x32,0x36,0x31,0x38,0x37,0x38,0x37,0x34,0x31,0x38,
+  0x31,0x36,0x34,0x32,0x36,0x32,0x35,0x32,0x36,0x32,
+  0x36,0x38,0x32,0x34,0x31,0x38,0x39,0x34,0x33,0x36,
+  0x34,0x38,0x34,0x32,0x34,0x35,0x34,0x32,0x35,
+  0x4d,0x73,0x67,
+  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+  0x4d,0x65,0x73,0x73,0x61,0x67,0x65};
+
+static const unsigned char wycheproof_ecdsa_public_keys[] = { 0x04,0xb8,0x38,0xff,0x44,0xe5,0xbc,0x17,0x7b,0xf2,0x11,0x89,0xd0,0x76,0x60,0x82,0xfc,0x9d,0x84,0x32,0x26,0x88,0x7f,0xc9,0x76,0x03,0x71,0x10,0x0b,0x7e,0xe2,0x0a,0x6f,0xf0,0xc9,0xd7,0x5b,0xfb,0xa7,0xb3,0x1a,0x6b,0xca,0x19,0x74,0x49,0x6e,0xeb,0x56,0xde,0x35,0x70,0x71,0x95,0x5d,0x83,0xc4,0xb1,0xba,0xda,0xa0,0xb2,0x18,0x32,0xe9,
+  0x04,0x07,0x31,0x0f,0x90,0xa9,0xea,0xe1,0x49,0xa0,0x84,0x02,0xf5,0x41,0x94,0xa0,0xf7,0xb4,0xac,0x42,0x7b,0xf8,0xd9,0xbd,0x6c,0x76,0x81,0x07,0x1d,0xc4,0x7d,0xc3,0x62,0x26,0xa6,0xd3,0x7a,0xc4,0x6d,0x61,0xfd,0x60,0x0c,0x0b,0xf1,0xbf,0xf8,0x76,0x89,0xed,0x11,0x7d,0xda,0x6b,0x0e,0x59,0x31,0x8a,0xe0,0x10,0xa1,0x97,0xa2,0x6c,0xa0,
+  0x04,0xbc,0x97,0xe7,0x58,0x5e,0xec,0xad,0x48,0xe1,0x66,0x83,0xbc,0x40,0x91,0x70,0x8e,0x1a,0x93,0x0c,0x68,0x3f,0xc4,0x70,0x01,0xd4,0xb3,0x83,0x59,0x4f,0x2c,0x4e,0x22,0x70,0x59,0x89,0xcf,0x69,0xda,0xea,0xdd,0x4e,0x4e,0x4b,0x81,0x51,0xed,0x88,0x8d,0xfe,0xc2,0x0f,0xb0,0x17,0x28,0xd8,0x9d,0x56,0xb3,0xf3,0x8f,0x2a,0xe9,0xc8,0xc5,
+  0x04,0x44,0xad,0x33,0x9a,0xfb,0xc2,0x1e,0x9a,0xbf,0x7b,0x60,0x2a,0x5c,0xa5,0x35,0xea,0x37,0x81,0x35,0xb6,0xd1,0x0d,0x81,0x31,0x0b,0xdd,0x82,0x93,0xd1,0xdf,0x32,0x52,0xb6,0x3f,0xf7,0xd0,0x77,0x47,0x70,0xf8,0xfe,0x1d,0x17,0x22,0xfa,0x83,0xac,0xd0,0x2f,0x43,0x4e,0x4f,0xc1,0x10,0xa0,0xcc,0x8f,0x6d,0xdd,0xd3,0x7d,0x56,0xc4,0x63,
+  0x04,0x12,0x60,0xc2,0x12,0x2c,0x9e,0x24,0x4e,0x1a,0xf5,0x15,0x1b,0xed,0xe0,0xc3,0xae,0x23,0xb5,0x4d,0x7c,0x59,0x68,0x81,0xd3,0xee,0xba,0xd2,0x1f,0x37,0xdd,0x87,0x8c,0x5c,0x9a,0x0c,0x1a,0x9a,0xde,0x76,0x73,0x7a,0x88,0x11,0xbd,0x6a,0x7f,0x92,0x87,0xc9,0x78,0xee,0x39,0x6a,0xa8,0x9c,0x11,0xe4,0x72,0x29,0xd2,0xcc,0xb5,0x52,0xf0,
+  0x04,0x18,0x77,0x04,0x5b,0xe2,0x5d,0x34,0xa1,0xd0,0x60,0x0f,0x9d,0x5c,0x00,0xd0,0x64,0x5a,0x2a,0x54,0x37,0x9b,0x6c,0xee,0xfa,0xd2,0xe6,0xbf,0x5c,0x2a,0x33,0x52,0xce,0x82,0x1a,0x53,0x2c,0xc1,0x75,0x1e,0xe1,0xd3,0x6d,0x41,0xc3,0xd6,0xab,0x4e,0x9b,0x14,0x3e,0x44,0xec,0x46,0xd7,0x34,0x78,0xea,0x6a,0x79,0xa5,0xc0,0xe5,0x41,0x59,
+  0x04,0x45,0x54,0x39,0xfc,0xc3,0xd2,0xde,0xec,0xed,0xde,0xae,0xce,0x60,0xe7,0xbd,0x17,0x30,0x4f,0x36,0xeb,0xb6,0x02,0xad,0xf5,0xa2,0x2e,0x0b,0x8f,0x1d,0xb4,0x6a,0x50,0xae,0xc3,0x8f,0xb2,0xba,0xf2,0x21,0xe9,0xa8,0xd1,0x88,0x7c,0x7b,0xf6,0x22,0x2d,0xd1,0x83,0x46,0x34,0xe7,0x72,0x63,0x31,0x5a,0xf6,0xd2,0x36,0x09,0xd0,0x4f,0x77,
+  0x04,0x2e,0x1f,0x46,0x6b,0x02,0x4c,0x0c,0x3a,0xce,0x24,0x37,0xde,0x09,0x12,0x7f,0xed,0x04,0xb7,0x06,0xf9,0x4b,0x19,0xa2,0x1b,0xb1,0xc2,0xac,0xf3,0x5c,0xec,0xe7,0x18,0x04,0x49,0xae,0x35,0x23,0xd7,0x25,0x34,0xe9,0x64,0x97,0x2c,0xfd,0x3b,0x38,0xaf,0x0b,0xdd,0xd9,0x61,0x9e,0x5a,0xf2,0x23,0xe4,0xd1,0xa4,0x0f,0x34,0xcf,0x9f,0x1d,
+  0x04,0x8e,0x7a,0xbd,0xbb,0xd1,0x8d,0xe7,0x45,0x23,0x74,0xc1,0x87,0x9a,0x1c,0x3b,0x01,0xd1,0x32,0x61,0xe7,0xd4,0x57,0x1c,0x3b,0x47,0xa1,0xc7,0x6c,0x55,0xa2,0x33,0x73,0x26,0xed,0x89,0x7c,0xd5,0x17,0xa4,0xf5,0x34,0x9d,0xb8,0x09,0x78,0x0f,0x6d,0x2f,0x2b,0x9f,0x62,0x99,0xd8,0xb5,0xa8,0x90,0x77,0xf1,0x11,0x9a,0x71,0x8f,0xd7,0xb3,
+  0x04,0x7b,0x33,0x3d,0x43,0x40,0xd3,0xd7,0x18,0xdd,0x3e,0x6a,0xff,0x7d,0xe7,0xbb,0xf8,0xb7,0x2b,0xfd,0x61,0x6c,0x84,0x20,0x05,0x60,0x52,0x84,0x23,0x76,0xb9,0xaf,0x19,0x42,0x11,0x7c,0x5a,0xfe,0xac,0x75,0x5d,0x6f,0x37,0x6f,0xc6,0x32,0x9a,0x7d,0x76,0x05,0x1b,0x87,0x12,0x3a,0x4a,0x5d,0x0b,0xc4,0xa5,0x39,0x38,0x0f,0x03,0xde,0x7b,
+  0x04,0xd3,0x0c,0xa4,0xa0,0xdd,0xb6,0x61,0x6c,0x85,0x1d,0x30,0xce,0xd6,0x82,0xc4,0x0f,0x83,0xc6,0x27,0x58,0xa1,0xf2,0x75,0x99,0x88,0xd6,0x76,0x3a,0x88,0xf1,0xc0,0xe5,0x03,0xa8,0x0d,0x54,0x15,0x65,0x0d,0x41,0x23,0x97,0x84,0xe8,0xe2,0xfb,0x12,0x35,0xe9,0xfe,0x99,0x1d,0x11,0x2e,0xbb,0x81,0x18,0x6c,0xbf,0x0d,0xa2,0xde,0x3a,0xff,
+  0x04,0x48,0x96,0x9b,0x39,0x99,0x12,0x97,0xb3,0x32,0xa6,0x52,0xd3,0xee,0x6e,0x01,0xe9,0x09,0xb3,0x99,0x04,0xe7,0x1f,0xa2,0x35,0x4a,0x78,0x30,0xc7,0x75,0x0b,0xaf,0x24,0xb4,0x01,0x2d,0x1b,0x83,0x0d,0x19,0x9c,0xcb,0x1f,0xc9,0x72,0xb3,0x2b,0xfd,0xed,0x55,0xf0,0x9c,0xd6,0x2d,0x25,0x7e,0x5e,0x84,0x4e,0x27,0xe5,0x7a,0x15,0x94,0xec,
+  0x04,0x02,0xef,0x4d,0x6d,0x6c,0xfd,0x5a,0x94,0xf1,0xd7,0x78,0x42,0x26,0xe3,0xe2,0xa6,0xc0,0xa4,0x36,0xc5,0x58,0x39,0x61,0x9f,0x38,0xfb,0x44,0x72,0xb5,0xf9,0xee,0x77,0x7e,0xb4,0xac,0xd4,0xee,0xbd,0xa5,0xcd,0x72,0x87,0x5f,0xfd,0x2a,0x2f,0x26,0x22,0x9c,0x2d,0xc6,0xb4,0x65,0x00,0x91,0x9a,0x43,0x2c,0x86,0x73,0x9f,0x3a,0xe8,0x66,
+  0x04,0x46,0x4f,0x4f,0xf7,0x15,0x72,0x9c,0xae,0x50,0x72,0xca,0x3b,0xd8,0x01,0xd3,0x19,0x5b,0x67,0xae,0xc6,0x5e,0x9b,0x01,0xaa,0xd2,0x0a,0x29,0x43,0xdc,0xbc,0xb5,0x84,0xb1,0xaf,0xd2,0x9d,0x31,0xa3,0x9a,0x11,0xd5,0x70,0xaa,0x15,0x97,0x43,0x9b,0x3b,0x2d,0x19,0x71,0xbf,0x2f,0x1a,0xbf,0x15,0x43,0x2d,0x02,0x07,0xb1,0x0d,0x1d,0x08,
+  0x04,0x15,0x7f,0x8f,0xdd,0xf3,0x73,0xeb,0x5f,0x49,0xcf,0xcf,0x10,0xd8,0xb8,0x53,0xcf,0x91,0xcb,0xcd,0x7d,0x66,0x5c,0x35,0x22,0xba,0x7d,0xd7,0x38,0xdd,0xb7,0x9a,0x4c,0xde,0xad,0xf1,0xa5,0xc4,0x48,0xea,0x3c,0x9f,0x41,0x91,0xa8,0x99,0x9a,0xbf,0xcc,0x75,0x7a,0xc6,0xd6,0x45,0x67,0xef,0x07,0x2c,0x47,0xfe,0xc6,0x13,0x44,0x3b,0x8f,
+  0x04,0x09,0x34,0xa5,0x37,0x46,0x6c,0x07,0x43,0x0e,0x2c,0x48,0xfe,0xb9,0x90,0xbb,0x19,0xfb,0x78,0xce,0xcc,0x9c,0xee,0x42,0x4e,0xa4,0xd1,0x30,0x29,0x1a,0xa2,0x37,0xf0,0xd4,0xf9,0x2d,0x23,0xb4,0x62,0x80,0x4b,0x5b,0x68,0xc5,0x25,0x58,0xc0,0x1c,0x99,0x96,0xdb,0xf7,0x27,0xfc,0xca,0xbb,0xee,0xdb,0x96,0x21,0xa4,0x00,0x53,0x5a,0xfa,
+  0x04,0xd6,0xef,0x20,0xbe,0x66,0xc8,0x93,0xf7,0x41,0xa9,0xbf,0x90,0xd9,0xb7,0x46,0x75,0xd1,0xc2,0xa3,0x12,0x96,0x39,0x7a,0xcb,0x3e,0xf1,0x74,0xfd,0x0b,0x30,0x0c,0x65,0x4a,0x0c,0x95,0x47,0x8c,0xa0,0x03,0x99,0x16,0x2d,0x7f,0x0f,0x2d,0xc8,0x9e,0xfd,0xc2,0xb2,0x8a,0x30,0xfb,0xab,0xe2,0x85,0x85,0x72,0x95,0xa4,0xb0,0xc4,0xe2,0x65,
+  0x04,0xb7,0x29,0x1d,0x14,0x04,0xe0,0xc0,0xc0,0x7d,0xab,0x93,0x72,0x18,0x9f,0x4b,0xd5,0x8d,0x2c,0xea,0xa8,0xd1,0x5e,0xde,0x54,0x4d,0x95,0x14,0x54,0x5b,0xa9,0xee,0x06,0x29,0xc9,0xa6,0x3d,0x5e,0x30,0x87,0x69,0xcc,0x30,0xec,0x27,0x6a,0x41,0x0e,0x64,0x64,0xa2,0x7e,0xea,0xfd,0x9e,0x59,0x9d,0xb1,0x0f,0x05,0x3a,0x4f,0xe4,0xa8,0x29,
+  0x04,0x6e,0x28,0x30,0x33,0x05,0xd6,0x42,0xcc,0xb9,0x23,0xb7,0x22,0xea,0x86,0xb2,0xa0,0xbc,0x8e,0x37,0x35,0xec,0xb2,0x6e,0x84,0x9b,0x19,0xc9,0xf7,0x6b,0x2f,0xdb,0xb8,0x18,0x6e,0x80,0xd6,0x4d,0x8c,0xab,0x16,0x4f,0x52,0x38,0xf5,0x31,0x84,0x61,0xbf,0x89,0xd4,0xd9,0x6e,0xe6,0x54,0x4c,0x81,0x6c,0x75,0x66,0x94,0x77,0x74,0xe0,0xf6,
+  0x04,0x37,0x5b,0xda,0x93,0xf6,0xaf,0x92,0xfb,0x5f,0x8f,0x4b,0x1b,0x5f,0x05,0x34,0xe3,0xba,0xfa,0xb3,0x4c,0xb7,0xad,0x9f,0xb9,0xd0,0xb7,0x22,0xe4,0xa5,0xc3,0x02,0xa9,0xa0,0x0b,0x9f,0x38,0x7a,0x5a,0x39,0x60,0x97,0xaa,0x21,0x62,0xfc,0x5b,0xbc,0xf4,0xa5,0x26,0x33,0x72,0xf6,0x81,0xc9,0x4d,0xa5,0x1e,0x97,0x99,0x12,0x09,0x90,0xfd,
+  0x04,0xd7,0x5b,0x68,0x21,0x6b,0xab,0xe0,0x3a,0xe2,0x57,0xe9,0x4b,0x4e,0x3b,0xf1,0xc5,0x2f,0x44,0xe3,0xdf,0x26,0x6d,0x15,0x24,0xff,0x8c,0x5e,0xa6,0x9d,0xa7,0x31,0x97,0xda,0x4b,0xff,0x9e,0xd1,0xc5,0x3f,0x44,0x91,0x7a,0x67,0xd7,0xb9,0x78,0x59,0x8e,0x89,0xdf,0x35,0x9e,0x3d,0x59,0x13,0xea,0xea,0x24,0xf3,0xae,0x25,0x9a,0xbc,0x44,
+  0x04,0x78,0xbc,0xda,0x14,0x0a,0xed,0x23,0xd4,0x30,0xcb,0x23,0xc3,0xdc,0x0d,0x01,0xf4,0x23,0xdb,0x13,0x4e,0xe9,0x4a,0x3a,0x8c,0xb4,0x83,0xf2,0xde,0xac,0x2a,0xc6,0x53,0x11,0x81,0x14,0xf6,0xf3,0x30,0x45,0xd4,0xe9,0xed,0x91,0x07,0x08,0x50,0x07,0xbf,0xbd,0xdf,0x8f,0x58,0xfe,0x7a,0x1a,0x24,0x45,0xd6,0x6a,0x99,0x00,0x45,0x47,0x6e,
+  0x04,0xbb,0x79,0xf6,0x18,0x57,0xf7,0x43,0xbf,0xa1,0xb6,0xe7,0x11,0x1c,0xe4,0x09,0x43,0x77,0x25,0x69,0x69,0xe4,0xe1,0x51,0x59,0x12,0x3d,0x95,0x48,0xac,0xc3,0xbe,0x6c,0x1f,0x9d,0x9f,0x88,0x60,0xdc,0xff,0xd3,0xeb,0x36,0xdd,0x6c,0x31,0xff,0x2e,0x72,0x26,0xc2,0x00,0x9c,0x4c,0x94,0xd8,0xd7,0xd2,0xb5,0x68,0x6b,0xf7,0xab,0xd6,0x77,
+  0x04,0x93,0x59,0x18,0x27,0xd9,0xe6,0x71,0x3b,0x4e,0x9f,0xae,0xa6,0x2c,0x72,0xb2,0x8d,0xfe,0xfa,0x68,0xe0,0xc0,0x51,0x60,0xb5,0xd6,0xaa,0xe8,0x8f,0xd2,0xe3,0x6c,0x36,0x07,0x3f,0x55,0x45,0xad,0x5a,0xf4,0x10,0xaf,0x26,0xaf,0xff,0x68,0x65,0x4c,0xf7,0x2d,0x45,0xe4,0x93,0x48,0x93,0x11,0x20,0x32,0x47,0x34,0x7a,0x89,0x0f,0x45,0x18,
+  0x04,0x31,0xed,0x30,0x81,0xae,0xfe,0x00,0x1e,0xb6,0x40,0x20,0x69,0xee,0x2c,0xcc,0x18,0x62,0x93,0x7b,0x85,0x99,0x51,0x44,0xdb,0xa9,0x50,0x39,0x43,0x58,0x7b,0xf0,0xda,0xda,0x01,0xb8,0xcc,0x4d,0xf3,0x4f,0x5a,0xb3,0xb1,0xa3,0x59,0x61,0x52,0x08,0x94,0x6e,0x5e,0xe3,0x5f,0x98,0xee,0x77,0x5b,0x8c,0xce,0xcd,0x86,0xcc,0xc1,0x65,0x0f,
+  0x04,0x7d,0xff,0x66,0xfa,0x98,0x50,0x9f,0xf3,0xe2,0xe5,0x10,0x45,0xf4,0x39,0x05,0x23,0xdc,0xcd,0xa4,0x3a,0x3b,0xc2,0x88,0x5e,0x58,0xc2,0x48,0x09,0x09,0x90,0xee,0xa8,0x54,0xc7,0x6c,0x2b,0x9a,0xde,0xb6,0xbb,0x57,0x18,0x23,0xe0,0x7f,0xd7,0xc6,0x5c,0x86,0x39,0xcf,0x9d,0x90,0x52,0x60,0x06,0x4c,0x8e,0x76,0x75,0xce,0x6d,0x98,0xb4,
+  0x04,0x42,0x80,0x50,0x9a,0xab,0x64,0xed,0xfc,0x0b,0x4a,0x29,0x67,0xe4,0xcb,0xce,0x84,0x9c,0xb5,0x44,0xe4,0xa7,0x73,0x13,0xc8,0xe6,0xec,0xe5,0x79,0xfb,0xd7,0x42,0x0a,0x2e,0x89,0xfe,0x5c,0xc1,0x92,0x7d,0x55,0x4e,0x6a,0x3b,0xb1,0x40,0x33,0xea,0x7c,0x92,0x2c,0xd7,0x5c,0xba,0x2c,0x74,0x15,0xfd,0xab,0x52,0xf2,0x0b,0x18,0x60,0xf1,
+  0x04,0x4f,0x8d,0xf1,0x45,0x19,0x4e,0x3c,0x4f,0xc3,0xee,0xa2,0x6d,0x43,0xce,0x75,0xb4,0x02,0xd6,0xb1,0x74,0x72,0xdd,0xcb,0xb2,0x54,0xb8,0xa7,0x9b,0x0b,0xf3,0xd9,0xcb,0x2a,0xa2,0x0d,0x82,0x84,0x4c,0xb2,0x66,0x34,0x4e,0x71,0xca,0x78,0xf2,0xad,0x27,0xa7,0x5a,0x09,0xe5,0xbc,0x0f,0xa5,0x7e,0x4e,0xfd,0x9d,0x46,0x5a,0x08,0x88,0xdb,
+  0x04,0x95,0x98,0xa5,0x7d,0xd6,0x7e,0xc3,0xe1,0x6b,0x58,0x7a,0x33,0x8a,0xa3,0xa1,0x0a,0x3a,0x39,0x13,0xb4,0x1a,0x3a,0xf3,0x2e,0x3e,0xd3,0xff,0x01,0x35,0x8c,0x6b,0x14,0x12,0x28,0x19,0xed,0xf8,0x07,0x4b,0xbc,0x52,0x1f,0x7d,0x4c,0xdc,0xe8,0x2f,0xef,0x7a,0x51,0x67,0x06,0xaf,0xfb,0xa1,0xd9,0x3d,0x9d,0xea,0x9c,0xca,0xe1,0xa2,0x07,
+  0x04,0x91,0x71,0xfe,0xc3,0xca,0x20,0x80,0x6b,0xc0,0x84,0xf1,0x2f,0x07,0x60,0x91,0x1b,0x60,0x99,0x0b,0xd8,0x0e,0x5b,0x2a,0x71,0xca,0x03,0xa0,0x48,0xb2,0x0f,0x83,0x7e,0x63,0x4f,0xd1,0x78,0x63,0x76,0x1b,0x29,0x58,0xd2,0xbe,0x4e,0x14,0x9f,0x8d,0x3d,0x7a,0xbb,0xdc,0x18,0xbe,0x03,0xf4,0x51,0xab,0x6c,0x17,0xfa,0x0a,0x1f,0x83,0x30,
+  0x04,0x77,0x7c,0x89,0x30,0xb6,0xe1,0xd2,0x71,0x10,0x0f,0xe6,0x8c,0xe9,0x3f,0x16,0x3f,0xa3,0x76,0x12,0xc5,0xff,0xf6,0x7f,0x4a,0x62,0xfc,0x3b,0xaf,0xaf,0x3d,0x17,0xa9,0xed,0x73,0xd8,0x6f,0x60,0xa5,0x1b,0x5e,0xd9,0x13,0x53,0xa3,0xb0,0x54,0xed,0xc0,0xaa,0x92,0xc9,0xeb,0xcb,0xd0,0xb7,0x5d,0x18,0x8f,0xdc,0x88,0x27,0x91,0xd6,0x8d,
+  0x04,0xea,0xbc,0x24,0x8f,0x62,0x6e,0x0a,0x63,0xe1,0xeb,0x81,0xc4,0x3d,0x46,0x1a,0x39,0xa1,0xdb,0xa8,0x81,0xeb,0x6e,0xe2,0x15,0x2b,0x07,0xc3,0x2d,0x71,0xbc,0xf4,0x70,0x06,0x03,0xca,0xa8,0xb9,0xd3,0x3d,0xb1,0x3a,0xf4,0x4c,0x6e,0xfb,0xec,0x8a,0x19,0x8e,0xd6,0x12,0x4a,0xc9,0xeb,0x17,0xea,0xaf,0xd2,0x82,0x4a,0x54,0x5e,0xc0,0x00,
+  0x04,0x9f,0x7a,0x13,0xad,0xa1,0x58,0xa5,0x5f,0x9d,0xdf,0x1a,0x45,0xf0,0x44,0xf0,0x73,0xd9,0xb8,0x00,0x30,0xef,0xdc,0xfc,0x9f,0x9f,0x58,0x41,0x8f,0xbc,0xea,0xf0,0x01,0xf8,0xad,0xa0,0x17,0x50,0x90,0xf8,0x0d,0x47,0x22,0x7d,0x67,0x13,0xb6,0x74,0x0f,0x9a,0x00,0x91,0xd8,0x8a,0x83,0x7d,0x0a,0x1c,0xd7,0x7b,0x58,0xa8,0xf2,0x8d,0x73,
+  0x04,0x11,0xc4,0xf3,0xe4,0x61,0xcd,0x01,0x9b,0x5c,0x06,0xea,0x0c,0xea,0x4c,0x40,0x90,0xc3,0xcc,0x3e,0x3c,0x5d,0x9f,0x3c,0x6d,0x65,0xb4,0x36,0x82,0x6d,0xa9,0xb4,0xdb,0xbb,0xeb,0x7a,0x77,0xe4,0xcb,0xfd,0xa2,0x07,0x09,0x7c,0x43,0x42,0x37,0x05,0xf7,0x2c,0x80,0x47,0x6d,0xa3,0xda,0xc4,0x0a,0x48,0x3b,0x0a,0xb0,0xf2,0xea,0xd1,0xcb,
+  0x04,0xe2,0xe1,0x86,0x82,0xd5,0x31,0x23,0xaa,0x01,0xa6,0xc5,0xd0,0x0b,0x0c,0x62,0x3d,0x67,0x1b,0x46,0x2e,0xa8,0x0b,0xdd,0xd6,0x52,0x27,0xfd,0x51,0x05,0x98,0x8a,0xa4,0x16,0x19,0x07,0xb3,0xfd,0x25,0x04,0x4a,0x94,0x9e,0xa4,0x1c,0x8e,0x2e,0xa8,0x45,0x9d,0xc6,0xf1,0x65,0x48,0x56,0xb8,0xb6,0x1b,0x31,0x54,0x3b,0xb1,0xb4,0x5b,0xdb,
+  0x04,0x90,0xf8,0xd4,0xca,0x73,0xde,0x08,0xa6,0x56,0x4a,0xaf,0x00,0x52,0x47,0xb6,0xf0,0xff,0xe9,0x78,0x50,0x4d,0xce,0x52,0x60,0x5f,0x46,0xb7,0xc3,0xe5,0x61,0x97,0xda,0xfa,0xdb,0xe5,0x28,0xeb,0x70,0xd9,0xee,0x7e,0xa0,0xe7,0x07,0x02,0xdb,0x54,0xf7,0x21,0x51,0x4c,0x7b,0x86,0x04,0xac,0x2c,0xb2,0x14,0xf1,0xde,0xcb,0x7e,0x38,0x3d,
+  0x04,0x82,0x4c,0x19,0x5c,0x73,0xcf,0xfd,0xf0,0x38,0xd1,0x01,0xbc,0xe1,0x68,0x7b,0x5c,0x3b,0x61,0x46,0xf3,0x95,0xc8,0x85,0x97,0x6f,0x77,0x53,0xb2,0x37,0x6b,0x94,0x8e,0x3c,0xde,0xfa,0x6f,0xc3,0x47,0xd1,0x3e,0x4d,0xcb,0xc6,0x3a,0x0b,0x03,0xa1,0x65,0x18,0x0c,0xd2,0xbe,0x14,0x31,0xa0,0xcf,0x74,0xce,0x1e,0xa2,0x50,0x82,0xd2,0xbc,
+  0x04,0x27,0x88,0xa5,0x2f,0x07,0x8e,0xb3,0xf2,0x02,0xc4,0xfa,0x73,0xe0,0xd3,0x38,0x6f,0xaf,0x3d,0xf6,0xbe,0x85,0x60,0x03,0x63,0x6f,0x59,0x99,0x22,0xd4,0xf5,0x26,0x8f,0x30,0xb4,0xf2,0x07,0xc9,0x19,0xbb,0xdf,0x5e,0x67,0xa8,0xbe,0x42,0x65,0xa8,0x17,0x47,0x54,0xb3,0xab,0xa8,0xf1,0x6e,0x57,0x5b,0x77,0xff,0x4d,0x5a,0x7e,0xb6,0x4f,
+  0x04,0xd5,0x33,0xb7,0x89,0xa4,0xaf,0x89,0x0f,0xa7,0xa8,0x2a,0x1f,0xae,0x58,0xc4,0x04,0xf9,0xa6,0x2a,0x50,0xb4,0x9a,0xda,0xfa,0xb3,0x49,0xc5,0x13,0xb4,0x15,0x08,0x74,0x01,0xb4,0x17,0x1b,0x80,0x3e,0x76,0xb3,0x4a,0x98,0x61,0xe1,0x0f,0x7b,0xc2,0x89,0xa0,0x66,0xfd,0x01,0xbd,0x29,0xf8,0x4c,0x98,0x7a,0x10,0xa5,0xfb,0x18,0xc2,0xd4,
+  0x04,0x3a,0x31,0x50,0x79,0x8c,0x8a,0xf6,0x9d,0x1e,0x6e,0x98,0x1f,0x3a,0x45,0x40,0x2b,0xa1,0xd7,0x32,0xf4,0xbe,0x83,0x30,0xc5,0x16,0x4f,0x49,0xe1,0x0e,0xc5,0x55,0xb4,0x22,0x1b,0xd8,0x42,0xbc,0x5e,0x4d,0x97,0xef,0xf3,0x71,0x65,0xf6,0x0e,0x39,0x98,0xa4,0x24,0xd7,0x2a,0x45,0x0c,0xf9,0x5e,0xa4,0x77,0xc7,0x82,0x87,0xd0,0x34,0x3a,
+  0x04,0x3b,0x37,0xdf,0x5f,0xb3,0x47,0xc6,0x9a,0x0f,0x17,0xd8,0x5c,0x0c,0x7c,0xa8,0x37,0x36,0x88,0x3a,0x82,0x5e,0x13,0x14,0x3d,0x0f,0xcf,0xc8,0x10,0x1e,0x85,0x1e,0x80,0x0d,0xe3,0xc0,0x90,0xb6,0xca,0x21,0xba,0x54,0x35,0x17,0x33,0x0c,0x04,0xb1,0x2f,0x94,0x8c,0x6b,0xad,0xf1,0x4a,0x63,0xab,0xff,0xdf,0x4e,0xf8,0xc7,0x53,0x70,0x26,
+  0x04,0xfe,0xb5,0x16,0x3b,0x0e,0xce,0x30,0xff,0x3e,0x03,0xc7,0xd5,0x5c,0x43,0x80,0xfa,0x2f,0xa8,0x1e,0xe2,0xc0,0x35,0x49,0x42,0xff,0x6f,0x08,0xc9,0x9d,0x0c,0xd8,0x2c,0xe8,0x7d,0xe0,0x5e,0xe1,0xbd,0xa0,0x89,0xd3,0xe4,0xe2,0x48,0xfa,0x0f,0x72,0x11,0x02,0xac,0xff,0xfd,0xf5,0x0e,0x65,0x4b,0xe2,0x81,0x43,0x39,0x99,0xdf,0x89,0x7e,
+  0x04,0x23,0x8c,0xed,0x00,0x1c,0xf2,0x2b,0x88,0x53,0xe0,0x2e,0xdc,0x89,0xcb,0xec,0xa5,0x05,0x0b,0xa7,0xe0,0x42,0xa7,0xa7,0x7f,0x93,0x82,0xcd,0x41,0x49,0x22,0x89,0x76,0x40,0x68,0x3d,0x30,0x94,0x64,0x38,0x40,0xf2,0x95,0x89,0x0a,0xa4,0xc1,0x8a,0xa3,0x9b,0x41,0xd7,0x7d,0xd0,0xfb,0x3b,0xb2,0x70,0x0e,0x4f,0x9e,0xc2,0x84,0xff,0xc2,
+  0x04,0x96,0x1c,0xf6,0x48,0x17,0xc0,0x6c,0x0e,0x51,0xb3,0xc2,0x73,0x6c,0x92,0x2f,0xde,0x18,0xbd,0x8c,0x49,0x06,0xfc,0xd7,0xf5,0xef,0x66,0xc4,0x67,0x85,0x08,0xf3,0x5e,0xd2,0xc5,0xd1,0x81,0x68,0xcf,0xbe,0x70,0xf2,0xf1,0x23,0xbd,0x74,0x19,0x23,0x2b,0xb9,0x2d,0xd6,0x91,0x13,0xe2,0x94,0x10,0x61,0x88,0x94,0x81,0xc5,0xa0,0x27,0xbf,
+  0x04,0x13,0x68,0x1e,0xae,0x16,0x8c,0xd4,0xea,0x7c,0xf2,0xe2,0xa4,0x5d,0x05,0x27,0x42,0xd1,0x0a,0x9f,0x64,0xe7,0x96,0x86,0x7d,0xbd,0xcb,0x82,0x9f,0xe0,0xb1,0x02,0x88,0x16,0x52,0x87,0x60,0xd1,0x77,0x37,0x6c,0x09,0xdf,0x79,0xde,0x39,0x55,0x7c,0x32,0x9c,0xc1,0x75,0x35,0x17,0xac,0xff,0xe8,0xfa,0x2e,0xc2,0x98,0x02,0x6b,0x83,0x84,
+  0x04,0x5a,0xa7,0xab,0xfd,0xb6,0xb4,0x08,0x6d,0x54,0x33,0x25,0xe5,0xd7,0x9c,0x6e,0x95,0xce,0x42,0xf8,0x66,0xd2,0xbb,0x84,0x90,0x96,0x33,0xa0,0x4b,0xb1,0xaa,0x31,0xc2,0x91,0xc8,0x00,0x88,0x79,0x49,0x05,0xe1,0xda,0x33,0x33,0x6d,0x87,0x4e,0x2f,0x91,0xcc,0xf4,0x5c,0xc5,0x91,0x85,0xbe,0xde,0x5d,0xd6,0xf3,0xf7,0xac,0xaa,0xe1,0x8b,
+  0x04,0x00,0x27,0x77,0x91,0xb3,0x05,0xa4,0x5b,0x2b,0x39,0x59,0x0b,0x2f,0x05,0xd3,0x39,0x2a,0x6c,0x81,0x82,0xce,0xf4,0xeb,0x54,0x01,0x20,0xe0,0xf5,0xc2,0x06,0xc3,0xe4,0x64,0x10,0x82,0x33,0xfb,0x0b,0x8c,0x3a,0xc8,0x92,0xd7,0x9e,0xf8,0xe0,0xfb,0xf9,0x2e,0xd1,0x33,0xad,0xdb,0x45,0x54,0x27,0x01,0x32,0x58,0x4d,0xc5,0x2e,0xef,0x41,
+  0x04,0x6e,0xfa,0x09,0x2b,0x68,0xde,0x94,0x60,0xf0,0xbc,0xc9,0x19,0x00,0x5a,0x5f,0x6e,0x80,0xe1,0x9d,0xe9,0x89,0x68,0xbe,0x3c,0xd2,0xc7,0x70,0xa9,0x94,0x9b,0xfb,0x1a,0xc7,0x5e,0x6e,0x50,0x87,0xd6,0x55,0x0d,0x5f,0x9b,0xeb,0x1e,0x79,0xe5,0x02,0x93,0x07,0xbc,0x25,0x52,0x35,0xe2,0xd5,0xdc,0x99,0x24,0x1a,0xc3,0xab,0x88,0x6c,0x49,
+  0x04,0x72,0xd4,0xa1,0x9c,0x4f,0x9d,0x2c,0xf5,0x84,0x8e,0xa4,0x04,0x45,0xb7,0x0d,0x46,0x96,0xb5,0xf0,0x2d,0x63,0x2c,0x0c,0x65,0x4c,0xc7,0xd7,0xee,0xb0,0xc6,0xd0,0x58,0xe8,0xc4,0xcd,0x99,0x43,0xe4,0x59,0x17,0x4c,0x7a,0xc0,0x1f,0xa7,0x42,0x19,0x8e,0x47,0xe6,0xc1,0x9a,0x6b,0xdb,0x0c,0x4f,0x6c,0x23,0x78,0x31,0xc1,0xb3,0xf9,0x42,
+  0x04,0x2a,0x8e,0xa2,0xf5,0x0d,0xcc,0xed,0x0c,0x21,0x75,0x75,0xbd,0xfa,0x7c,0xd4,0x7d,0x1c,0x6f,0x10,0x00,0x41,0xec,0x0e,0x35,0x51,0x27,0x94,0xc1,0xbe,0x7e,0x74,0x02,0x58,0xf8,0xc1,0x71,0x22,0xed,0x30,0x3f,0xda,0x71,0x43,0xeb,0x58,0xbe,0xde,0x70,0x29,0x5b,0x65,0x32,0x66,0x01,0x3b,0x0b,0x0e,0xbd,0x3f,0x05,0x31,0x37,0xf6,0xec,
+  0x04,0x88,0xde,0x68,0x9c,0xe9,0xaf,0x1e,0x94,0xbe,0x6a,0x20,0x89,0xc8,0xa8,0xb1,0x25,0x3f,0xfd,0xbb,0x6c,0x8e,0x9c,0x86,0x24,0x9b,0xa2,0x20,0x00,0x1a,0x4a,0xd3,0xb8,0x0c,0x49,0x98,0xe5,0x48,0x42,0xf4,0x13,0xb9,0xed,0xb1,0x82,0x5a,0xcb,0xb6,0x33,0x5e,0x81,0xe4,0xd1,0x84,0xb2,0xb0,0x1c,0x8b,0xeb,0xdc,0x85,0xd1,0xf2,0x89,0x46,
+  0x04,0xfe,0xa2,0xd3,0x1f,0x70,0xf9,0x0d,0x5f,0xb3,0xe0,0x0e,0x18,0x6a,0xc4,0x2a,0xb3,0xc1,0x61,0x5c,0xee,0x71,0x4e,0x0b,0x4e,0x11,0x31,0xb3,0xd4,0xd8,0x22,0x5b,0xf7,0xb0,0x37,0xa1,0x8d,0xf2,0xac,0x15,0x34,0x3f,0x30,0xf7,0x40,0x67,0xdd,0xf2,0x9e,0x81,0x7d,0x5f,0x77,0xf8,0xdc,0xe0,0x57,0x14,0xda,0x59,0xc0,0x94,0xf0,0xcd,0xa9,
+  0x04,0x72,0x58,0x91,0x1e,0x3d,0x42,0x33,0x49,0x16,0x64,0x79,0xdb,0xe0,0xb8,0x34,0x1a,0xf7,0xfb,0xd0,0x3d,0x0a,0x7e,0x10,0xed,0xcc,0xb3,0x6b,0x6c,0xee,0xa5,0xa3,0xdb,0x17,0xac,0x2b,0x89,0x92,0x79,0x11,0x28,0xfa,0x3b,0x96,0xdc,0x2f,0xbd,0x4c,0xa3,0xbf,0xa7,0x82,0xef,0x28,0x32,0xfc,0x66,0x56,0x94,0x3d,0xb1,0x8e,0x73,0x46,0xb0,
+  0x04,0x4f,0x28,0x46,0x1d,0xea,0x64,0x47,0x4d,0x6b,0xb3,0x4d,0x14,0x99,0xc9,0x7d,0x37,0xb9,0xe9,0x56,0x33,0xdf,0x1c,0xee,0xea,0xac,0xd4,0x50,0x16,0xc9,0x8b,0x39,0x14,0xc8,0x81,0x88,0x10,0xb8,0xcc,0x06,0xdd,0xb4,0x0e,0x8a,0x12,0x61,0xc5,0x28,0xfa,0xa5,0x89,0x45,0x5d,0x5a,0x6d,0xf9,0x3b,0x77,0xbc,0x5e,0x0e,0x49,0x3c,0x74,0x70,
+  0x04,0x74,0xf2,0xa8,0x14,0xfb,0x5d,0x8e,0xca,0x91,0xa6,0x9b,0x5e,0x60,0x71,0x27,0x32,0xb3,0x93,0x7d,0xe3,0x28,0x29,0xbe,0x97,0x4e,0xd7,0xb6,0x8c,0x5c,0x2f,0x5d,0x66,0xef,0xf0,0xf0,0x7c,0x56,0xf9,0x87,0xa6,0x57,0xf4,0x21,0x96,0x20,0x5f,0x58,0x8c,0x0f,0x1d,0x96,0xfd,0x8a,0x63,0xa5,0xf2,0x38,0xb4,0x8f,0x47,0x87,0x88,0xfe,0x3b,
+  0x04,0x19,0x5b,0x51,0xa7,0xcc,0x4a,0x21,0xb8,0x27,0x4a,0x70,0xa9,0x0d,0xe7,0x79,0x81,0x4c,0x3c,0x8c,0xa3,0x58,0x32,0x82,0x08,0xc0,0x9a,0x29,0xf3,0x36,0xb8,0x2d,0x6a,0xb2,0x41,0x6b,0x7c,0x92,0xff,0xfd,0xc2,0x9c,0x3b,0x12,0x82,0xdd,0x2a,0x77,0xa4,0xd0,0x4d,0xf7,0xf7,0x45,0x20,0x47,0x39,0x3d,0x84,0x99,0x89,0xc5,0xce,0xe9,0xad,
+  0x04,0x62,0x2f,0xc7,0x47,0x32,0x03,0x4b,0xec,0x2d,0xdf,0x3b,0xc1,0x6d,0x34,0xb3,0xd1,0xf7,0xa3,0x27,0xdd,0x2a,0x8c,0x19,0xba,0xb4,0xbb,0x4f,0xe3,0xa2,0x4b,0x58,0xaa,0x73,0x6b,0x2f,0x2f,0xae,0x76,0xf4,0xdf,0xae,0xcc,0x90,0x96,0x33,0x3b,0x01,0x32,0x8d,0x51,0xeb,0x3f,0xda,0x9c,0x92,0x27,0xe9,0x0d,0x0b,0x44,0x99,0x83,0xc4,0xf0,
+  0x04,0x1f,0x7f,0x85,0xca,0xf2,0xd7,0x55,0x0e,0x7a,0xf9,0xb6,0x50,0x23,0xeb,0xb4,0xdc,0xe3,0x45,0x03,0x11,0x69,0x23,0x09,0xdb,0x26,0x99,0x69,0xb8,0x34,0xb6,0x11,0xc7,0x08,0x27,0xf4,0x5b,0x78,0x02,0x0e,0xcb,0xba,0xf4,0x84,0xfd,0xd5,0xbf,0xaa,0xe6,0x87,0x0f,0x11,0x84,0xc2,0x15,0x81,0xba,0xf6,0xef,0x82,0xbd,0x7b,0x53,0x0f,0x93,
+  0x04,0x49,0xc1,0x97,0xdc,0x80,0xad,0x1d,0xa4,0x7a,0x43,0x42,0xb9,0x38,0x93,0xe8,0xe1,0xfb,0x0b,0xb9,0x4f,0xc3,0x3a,0x83,0xe7,0x83,0xc0,0x0b,0x24,0xc7,0x81,0x37,0x7a,0xef,0xc2,0x0d,0xa9,0x2b,0xac,0x76,0x29,0x51,0xf7,0x24,0x74,0xbe,0xcc,0x73,0x4d,0x4c,0xc2,0x2b,0xa8,0x1b,0x89,0x5e,0x28,0x2f,0xda,0xc4,0xdf,0x7a,0xf0,0xf3,0x7d,
+  0x04,0xd8,0xcb,0x68,0x51,0x7b,0x61,0x6a,0x56,0x40,0x0a,0xa3,0x86,0x86,0x35,0xe5,0x4b,0x6f,0x69,0x95,0x98,0xa2,0xf6,0x16,0x77,0x57,0x65,0x49,0x80,0xba,0xf6,0xac,0xbe,0x7e,0xc8,0xcf,0x44,0x9c,0x84,0x9a,0xa0,0x34,0x61,0xa3,0x0e,0xfa,0xda,0x41,0x45,0x3c,0x57,0xc6,0xe6,0xfb,0xc9,0x3b,0xbc,0x6f,0xa4,0x9a,0xda,0x6d,0xc0,0x55,0x5c,
+  0x04,0x03,0x07,0x13,0xfb,0x63,0xf2,0xaa,0x6f,0xe2,0xca,0xdf,0x1b,0x20,0xef,0xc2,0x59,0xc7,0x74,0x45,0xda,0xfa,0x87,0xda,0xc3,0x98,0xb8,0x40,0x65,0xca,0x34,0x7d,0xf3,0xb2,0x27,0x81,0x8d,0xe1,0xa3,0x9b,0x58,0x9c,0xb0,0x71,0xd8,0x3e,0x53,0x17,0xcc,0xcd,0xc2,0x33,0x8e,0x51,0xe3,0x12,0xfe,0x31,0xd8,0xdc,0x34,0xa4,0x80,0x17,0x50,
+  0x04,0xba,0xbb,0x36,0x77,0xb0,0x95,0x58,0x02,0xd8,0xe9,0x29,0xa4,0x13,0x55,0x64,0x0e,0xaf,0x1e,0xa1,0x35,0x3f,0x8a,0x77,0x13,0x31,0xc4,0x94,0x6e,0x34,0x80,0xaf,0xa7,0x25,0x2f,0x19,0x6c,0x87,0xed,0x3d,0x2a,0x59,0xd3,0xb1,0xb5,0x59,0x13,0x7f,0xed,0x00,0x13,0xfe,0xce,0xfc,0x19,0xfb,0x5a,0x92,0x68,0x2b,0x9b,0xca,0x51,0xb9,0x50,
+  0x04,0x1a,0xab,0x20,0x18,0x79,0x34,0x71,0x11,0x1a,0x8a,0x0e,0x9b,0x14,0x3f,0xde,0x02,0xfc,0x95,0x92,0x07,0x96,0xd3,0xa6,0x3d,0xe3,0x29,0xb4,0x24,0x39,0x6f,0xba,0x60,0xbb,0xe4,0x13,0x07,0x05,0x17,0x47,0x92,0x44,0x1b,0x31,0x8d,0x3a,0xa3,0x1d,0xfe,0x85,0x77,0x82,0x1e,0x9b,0x44,0x6e,0xc5,0x73,0xd2,0x72,0xe0,0x36,0xc4,0xeb,0xe9,
+  0x04,0x8c,0xb0,0xb9,0x09,0x49,0x9c,0x83,0xea,0x80,0x6c,0xd8,0x85,0xb1,0xdd,0x46,0x7a,0x01,0x19,0xf0,0x6a,0x88,0xa0,0x27,0x6e,0xb0,0xcf,0xda,0x27,0x45,0x35,0xa8,0xff,0x47,0xb5,0x42,0x88,0x33,0xbc,0x3f,0x2c,0x8b,0xf9,0xd9,0x04,0x11,0x58,0xcf,0x33,0x71,0x8a,0x69,0x96,0x1c,0xd0,0x17,0x29,0xbc,0x00,0x11,0xd1,0xe5,0x86,0xab,0x75,
+  0x04,0x8f,0x03,0xcf,0x1a,0x42,0x27,0x2b,0xb1,0x53,0x27,0x23,0x09,0x3f,0x72,0xe6,0xfe,0xea,0xc8,0x5e,0x17,0x00,0xe9,0xfb,0xe9,0xa6,0xa2,0xdd,0x64,0x2d,0x74,0xbf,0x5d,0x3b,0x89,0xa7,0x18,0x9d,0xad,0x8c,0xf7,0x5f,0xc2,0x2f,0x6f,0x15,0x8a,0xa2,0x7f,0x9c,0x2c,0xa0,0x0d,0xac,0xa7,0x85,0xbe,0x33,0x58,0xf2,0xbd,0xa3,0x86,0x2c,0xa0,
+  0x04,0x44,0xde,0x3b,0x9c,0x7a,0x57,0xa8,0xc9,0xe8,0x20,0x95,0x27,0x53,0x42,0x1e,0x7d,0x98,0x7b,0xb3,0xd7,0x9f,0x71,0xf0,0x13,0x80,0x5c,0x89,0x7e,0x01,0x8f,0x8a,0xce,0xa2,0x46,0x07,0x58,0xc8,0xf9,0x8d,0x3f,0xdc,0xe1,0x21,0xa9,0x43,0x65,0x9e,0x37,0x2c,0x32,0x6f,0xff,0x2e,0x5f,0xc2,0xae,0x7f,0xa3,0xf7,0x9d,0xaa,0xe1,0x3c,0x12,
+  0x04,0x6f,0xb8,0xb2,0xb4,0x8e,0x33,0x03,0x12,0x68,0xad,0x6a,0x51,0x74,0x84,0xdc,0x88,0x39,0xea,0x90,0xf6,0x66,0x9e,0xa0,0xc7,0xac,0x32,0x33,0xe2,0xac,0x31,0x39,0x4a,0x0a,0xc8,0xbb,0xe7,0xf7,0x3c,0x2f,0xf4,0xdf,0x99,0x78,0x72,0x7a,0xc1,0xdf,0xc2,0xfd,0x58,0x64,0x7d,0x20,0xf3,0x1f,0x99,0x10,0x53,0x16,0xb6,0x46,0x71,0xf2,0x04,
+  0x04,0xbe,0xa7,0x11,0x22,0xa0,0x48,0x69,0x3e,0x90,0x5f,0xf6,0x02,0xb3,0xcf,0x9d,0xd1,0x8a,0xf6,0x9b,0x9f,0xc9,0xd8,0x43,0x1d,0x2b,0x1d,0xd2,0x6b,0x94,0x2c,0x95,0xe6,0xf4,0x3c,0x7b,0x8b,0x95,0xeb,0x62,0x08,0x2c,0x12,0xdb,0x9d,0xbd,0xa7,0xfe,0x38,0xe4,0x5c,0xbe,0x4a,0x48,0x86,0x90,0x7f,0xb8,0x1b,0xdb,0x0c,0x5e,0xa9,0x24,0x6c,
+  0x04,0xda,0x91,0x8c,0x73,0x1b,0xa0,0x6a,0x20,0xcb,0x94,0xef,0x33,0xb7,0x78,0xe9,0x81,0xa4,0x04,0xa3,0x05,0xf1,0x94,0x1f,0xe3,0x36,0x66,0xb4,0x5b,0x03,0x35,0x31,0x56,0xe2,0xbb,0x26,0x94,0xf5,0x75,0xb4,0x51,0x83,0xbe,0x78,0xe5,0xc9,0xb5,0x21,0x0b,0xf3,0xbf,0x48,0x8f,0xd4,0xc8,0x29,0x45,0x16,0xd8,0x95,0x72,0xca,0x4f,0x53,0x91,
+  0x04,0x30,0x07,0xe9,0x2c,0x39,0x37,0xda,0xde,0x79,0x64,0xdf,0xa3,0x5b,0x0e,0xff,0x03,0x1f,0x7e,0xb0,0x2a,0xed,0x0a,0x03,0x14,0x41,0x11,0x06,0xcd,0xeb,0x70,0xfe,0x3d,0x5a,0x75,0x46,0xfc,0x05,0x52,0x99,0x7b,0x20,0xe3,0xd6,0xf4,0x13,0xe7,0x5e,0x2c,0xb6,0x6e,0x11,0x63,0x22,0x69,0x71,0x14,0xb7,0x9b,0xac,0x73,0x4b,0xfc,0x4d,0xc5,
+  0x04,0x60,0xe7,0x34,0xef,0x56,0x24,0xd3,0xcb,0xf0,0xdd,0xd3,0x75,0x01,0x1b,0xd6,0x63,0xd6,0xd6,0xae,0xbc,0x64,0x4e,0xb5,0x99,0xfd,0xf9,0x8d,0xbd,0xcd,0x18,0xce,0x9b,0xd2,0xd9,0x0b,0x3a,0xc3,0x1f,0x13,0x9a,0xf8,0x32,0xcc,0xcf,0x6c,0xcb,0xbb,0x2c,0x6e,0xa1,0x1f,0xa9,0x73,0x70,0xdc,0x99,0x06,0xda,0x47,0x4d,0x7d,0x8a,0x75,0x67,
+  0x04,0x85,0xa9,0x00,0xe9,0x78,0x58,0xf6,0x93,0xc0,0xb7,0xdf,0xa2,0x61,0xe3,0x80,0xda,0xd6,0xea,0x04,0x6d,0x1f,0x65,0xdd,0xee,0xed,0xd5,0xf7,0xd8,0xaf,0x0b,0xa3,0x37,0x69,0x74,0x4d,0x15,0xad,0xd4,0xf6,0xc0,0xbc,0x3b,0x0d,0xa2,0xae,0xc9,0x3b,0x34,0xcb,0x8c,0x65,0xf9,0x34,0x0d,0xdf,0x74,0xe7,0xb0,0x00,0x9e,0xee,0xcc,0xce,0x3c,
+  0x04,0x38,0x06,0x6f,0x75,0xd8,0x8e,0xfc,0x4c,0x93,0xde,0x36,0xf4,0x9e,0x03,0x7b,0x23,0x4c,0xc1,0x8b,0x1d,0xe5,0x60,0x87,0x50,0xa6,0x2c,0xab,0x03,0x45,0x40,0x10,0x46,0xa3,0xe8,0x4b,0xed,0x8c,0xfc,0xb8,0x19,0xef,0x4d,0x55,0x04,0x44,0xf2,0xce,0x4b,0x65,0x17,0x66,0xb6,0x9e,0x2e,0x29,0x01,0xf8,0x88,0x36,0xff,0x90,0x03,0x4f,0xed,
+  0x04,0x98,0xf6,0x81,0x77,0xdc,0x95,0xc1,0xb4,0xcb,0xfa,0x52,0x45,0x48,0x8c,0xa5,0x23,0xa7,0xd5,0x62,0x94,0x70,0xd0,0x35,0xd6,0x21,0xa4,0x43,0xc7,0x2f,0x39,0xaa,0xbf,0xa3,0x3d,0x29,0x54,0x6f,0xa1,0xc6,0x48,0xf2,0xc7,0xd5,0xcc,0xf7,0x0c,0xf1,0xce,0x4a,0xb7,0x9b,0x5d,0xb1,0xac,0x05,0x9d,0xbe,0xcd,0x06,0x8d,0xbd,0xff,0x1b,0x89,
+  0x04,0x5c,0x2b,0xbf,0xa2,0x3c,0x9b,0x9a,0xd0,0x7f,0x03,0x8a,0xa8,0x9b,0x49,0x30,0xbf,0x26,0x7d,0x94,0x01,0xe4,0x25,0x5d,0xe9,0xe8,0xda,0x0a,0x50,0x78,0xec,0x82,0x77,0xe3,0xe8,0x82,0xa3,0x1d,0x5e,0x6a,0x37,0x9e,0x07,0x93,0x98,0x3c,0xcd,0xed,0x39,0xb9,0x5c,0x43,0x53,0xab,0x2f,0xf0,0x1e,0xa5,0x36,0x9b,0xa4,0x7b,0x0c,0x31,0x91,
+  0x04,0x2e,0xa7,0x13,0x34,0x32,0x33,0x9c,0x69,0xd2,0x7f,0x9b,0x26,0x72,0x81,0xbd,0x2d,0xdd,0x5f,0x19,0xd6,0x33,0x8d,0x40,0x0a,0x05,0xcd,0x36,0x47,0xb1,0x57,0xa3,0x85,0x35,0x47,0x80,0x82,0x98,0x44,0x8e,0xdb,0x5e,0x70,0x1a,0xde,0x84,0xcd,0x5f,0xb1,0xac,0x95,0x67,0xba,0x5e,0x8f,0xb6,0x8a,0x6b,0x93,0x3e,0xc4,0xb5,0xcc,0x84,0xcc,
+  0x04,0x2e,0xa7,0x13,0x34,0x32,0x33,0x9c,0x69,0xd2,0x7f,0x9b,0x26,0x72,0x81,0xbd,0x2d,0xdd,0x5f,0x19,0xd6,0x33,0x8d,0x40,0x0a,0x05,0xcd,0x36,0x47,0xb1,0x57,0xa3,0x85,0xca,0xb8,0x7f,0x7d,0x67,0xbb,0x71,0x24,0xa1,0x8f,0xe5,0x21,0x7b,0x32,0xa0,0x4e,0x53,0x6a,0x98,0x45,0xa1,0x70,0x49,0x75,0x94,0x6c,0xc1,0x3a,0x4a,0x33,0x77,0x63,
+  0x04,0x8a,0xa2,0xc6,0x4f,0xa9,0xc6,0x43,0x75,0x63,0xab,0xfb,0xcb,0xd0,0x0b,0x20,0x48,0xd4,0x8c,0x18,0xc1,0x52,0xa2,0xa6,0xf4,0x90,0x36,0xde,0x76,0x47,0xeb,0xe8,0x2e,0x1c,0xe6,0x43,0x87,0x99,0x5c,0x68,0xa0,0x60,0xfa,0x3b,0xc0,0x39,0x9b,0x05,0xcc,0x06,0xee,0xc7,0xd5,0x98,0xf7,0x50,0x41,0xa4,0x91,0x7e,0x69,0x2b,0x7f,0x51,0xff,
+  0x04,0x39,0x14,0x27,0xff,0x7e,0xe7,0x80,0x13,0xc1,0x4a,0xec,0x7d,0x96,0xa8,0xa0,0x62,0x20,0x92,0x98,0xa7,0x83,0x83,0x5e,0x94,0xfd,0x65,0x49,0xd5,0x02,0xff,0xf7,0x1f,0xdd,0x66,0x24,0xec,0x34,0x3a,0xd9,0xfc,0xf4,0xd9,0x87,0x21,0x81,0xe5,0x9f,0x84,0x2f,0x9b,0xa4,0xcc,0xca,0xe0,0x9a,0x6c,0x09,0x72,0xfb,0x6a,0xc6,0xb4,0xc6,0xbd,
+  0x04,0xe7,0x62,0xb8,0xa2,0x19,0xb4,0xf1,0x80,0x21,0x9c,0xc7,0xa9,0x05,0x92,0x45,0xe4,0x96,0x1b,0xd1,0x91,0xc0,0x38,0x99,0x78,0x9c,0x7a,0x34,0xb8,0x9e,0x8c,0x13,0x8e,0xc1,0x53,0x3e,0xf0,0x41,0x9b,0xb7,0x37,0x6e,0x0b,0xfd,0xe9,0x31,0x9d,0x10,0xa0,0x69,0x68,0x79,0x1d,0x9e,0xa0,0xee,0xd9,0xc1,0xce,0x63,0x45,0xae,0xd9,0x75,0x9e,
+  0x04,0x9a,0xed,0xb0,0xd2,0x81,0xdb,0x16,0x4e,0x13,0x00,0x00,0xc5,0x69,0x7f,0xae,0x0f,0x30,0x5e,0xf8,0x48,0xbe,0x6f,0xff,0xb4,0x3a,0xc5,0x93,0xfb,0xb9,0x50,0xe9,0x52,0xfa,0x6f,0x63,0x33,0x59,0xbd,0xcd,0x82,0xb5,0x6b,0x0b,0x9f,0x96,0x5b,0x03,0x77,0x89,0xd4,0x6b,0x9a,0x81,0x41,0xb7,0x91,0xb2,0xae,0xfa,0x71,0x3f,0x96,0xc1,0x75,
+  0x04,0x8a,0xd4,0x45,0xdb,0x62,0x81,0x62,0x60,0xe4,0xe6,0x87,0xfd,0x18,0x84,0xe4,0x8b,0x9f,0xc0,0x63,0x6d,0x03,0x15,0x47,0xd6,0x33,0x15,0xe7,0x92,0xe1,0x9b,0xfa,0xee,0x1d,0xe6,0x4f,0x99,0xd5,0xf1,0xcd,0x8b,0x6e,0xc9,0xcb,0x0f,0x78,0x7a,0x65,0x4a,0xe8,0x69,0x93,0xba,0x3d,0xb1,0x00,0x8e,0xf4,0x3c,0xff,0x06,0x84,0xcb,0x22,0xbd,
+  0x04,0x1f,0x57,0x99,0xc9,0x5b,0xe8,0x90,0x63,0xb2,0x4f,0x26,0xe4,0x0c,0xb9,0x28,0xc1,0xa8,0x68,0xa7,0x6f,0xb0,0x09,0x46,0x07,0xe8,0x04,0x3d,0xb4,0x09,0xc9,0x1c,0x32,0xe7,0x57,0x24,0xe8,0x13,0xa4,0x19,0x1e,0x3a,0x83,0x90,0x07,0xf0,0x8e,0x2e,0x89,0x73,0x88,0xb0,0x6d,0x4a,0x00,0xde,0x6d,0xe6,0x0e,0x53,0x6d,0x91,0xfa,0xb5,0x66,
+  0x04,0xa3,0x33,0x1a,0x4e,0x1b,0x42,0x23,0xec,0x2c,0x02,0x7e,0xdd,0x48,0x2c,0x92,0x8a,0x14,0xed,0x35,0x8d,0x93,0xf1,0xd4,0x21,0x7d,0x39,0xab,0xf6,0x9f,0xcb,0x5c,0xcc,0x28,0xd6,0x84,0xd2,0xaa,0xab,0xcd,0x63,0x83,0x77,0x5c,0xaa,0x62,0x39,0xde,0x26,0xd4,0xc6,0x93,0x7b,0xb6,0x03,0xec,0xb4,0x19,0x60,0x82,0xf4,0xcf,0xfd,0x50,0x9d,
+  0x04,0x3f,0x39,0x52,0x19,0x97,0x74,0xc7,0xcf,0x39,0xb3,0x8b,0x66,0xcb,0x10,0x42,0xa6,0x26,0x0d,0x86,0x80,0x80,0x38,0x45,0xe4,0xd4,0x33,0xad,0xba,0x3b,0xb2,0x48,0x18,0x5e,0xa4,0x95,0xb6,0x8c,0xbc,0x7e,0xd4,0x17,0x3e,0xe6,0x3c,0x90,0x42,0xdc,0x50,0x26,0x25,0xc7,0xeb,0x7e,0x21,0xfb,0x02,0xca,0x9a,0x91,0x14,0xe0,0xa3,0xa1,0x8d,
+  0x04,0xcd,0xfb,0x8c,0x0f,0x42,0x2e,0x14,0x4e,0x13,0x7c,0x24,0x12,0xc8,0x6c,0x17,0x1f,0x5f,0xe3,0xfa,0x3f,0x5b,0xbb,0x54,0x4e,0x90,0x76,0x28,0x8f,0x3c,0xed,0x78,0x6e,0x05,0x4f,0xd0,0x72,0x1b,0x77,0xc1,0x1c,0x79,0xbe,0xac,0xb3,0xc9,0x42,0x11,0xb0,0xa1,0x9b,0xda,0x08,0x65,0x2e,0xfe,0xaf,0x92,0x51,0x3a,0x3b,0x0a,0x16,0x36,0x98,
+  0x04,0x73,0x59,0x8a,0x6a,0x1c,0x68,0x27,0x8f,0xa6,0xbf,0xd0,0xce,0x40,0x64,0xe6,0x82,0x35,0xbc,0x1c,0x0f,0x6b,0x20,0xa9,0x28,0x10,0x8b,0xe3,0x36,0x73,0x0f,0x87,0xe3,0xcb,0xae,0x61,0x25,0x19,0xb5,0x03,0x2e,0xcc,0x85,0xae,0xd8,0x11,0x27,0x1a,0x95,0xfe,0x79,0x39,0xd5,0xd3,0x46,0x01,0x40,0xba,0x31,0x8f,0x4d,0x14,0xab,0xa3,0x1d,
+  0x04,0x58,0xde,0xbd,0x9a,0x7e,0xe2,0xc9,0xd5,0x91,0x32,0x47,0x8a,0x54,0x40,0xae,0x4d,0x5d,0x7e,0xd4,0x37,0x30,0x83,0x69,0xf9,0x2e,0xa8,0x6c,0x82,0x18,0x3f,0x10,0xa1,0x67,0x73,0xe7,0x6f,0x5e,0xdb,0xf4,0xda,0x0e,0x4f,0x1b,0xdf,0xfa,0xc0,0xf5,0x72,0x57,0xe1,0xdf,0xa4,0x65,0x84,0x29,0x31,0x30,0x9a,0x24,0x24,0x5f,0xda,0x6a,0x5d,
+  0x04,0x8b,0x90,0x4d,0xe4,0x79,0x67,0x34,0x0c,0x5f,0x8c,0x35,0x72,0xa7,0x20,0x92,0x4e,0xf7,0x57,0x86,0x37,0xfe,0xab,0x19,0x49,0xac,0xb2,0x41,0xa5,0xa6,0xac,0x3f,0x5b,0x95,0x09,0x04,0x49,0x6f,0x98,0x24,0xb1,0xd6,0x3f,0x33,0x13,0xba,0xe2,0x1b,0x89,0xfa,0xe8,0x9a,0xfd,0xfc,0x81,0x1b,0x5e,0xce,0x03,0xfd,0x5a,0xa3,0x01,0x86,0x4f,
+  0x04,0xf4,0x89,0x2b,0x6d,0x52,0x5c,0x77,0x1e,0x03,0x5f,0x2a,0x25,0x27,0x08,0xf3,0x78,0x4e,0x48,0x23,0x86,0x04,0xb4,0xf9,0x4d,0xc5,0x6e,0xaa,0x1e,0x54,0x6d,0x94,0x1a,0x34,0x6b,0x1a,0xa0,0xbc,0xe6,0x8b,0x1c,0x50,0xe5,0xb5,0x2f,0x50,0x9f,0xb5,0x52,0x2e,0x5c,0x25,0xe0,0x28,0xbc,0x8f,0x86,0x34,0x02,0xed,0xb7,0xbc,0xad,0x8b,0x1b,
+  0x04,0x79,0xbe,0x66,0x7e,0xf9,0xdc,0xbb,0xac,0x55,0xa0,0x62,0x95,0xce,0x87,0x0b,0x07,0x02,0x9b,0xfc,0xdb,0x2d,0xce,0x28,0xd9,0x59,0xf2,0x81,0x5b,0x16,0xf8,0x17,0x98,0x48,0x3a,0xda,0x77,0x26,0xa3,0xc4,0x65,0x5d,0xa4,0xfb,0xfc,0x0e,0x11,0x08,0xa8,0xfd,0x17,0xb4,0x48,0xa6,0x85,0x54,0x19,0x9c,0x47,0xd0,0x8f,0xfb,0x10,0xd4,0xb8,
+  0x04,0x79,0xbe,0x66,0x7e,0xf9,0xdc,0xbb,0xac,0x55,0xa0,0x62,0x95,0xce,0x87,0x0b,0x07,0x02,0x9b,0xfc,0xdb,0x2d,0xce,0x28,0xd9,0x59,0xf2,0x81,0x5b,0x16,0xf8,0x17,0x98,0xb7,0xc5,0x25,0x88,0xd9,0x5c,0x3b,0x9a,0xa2,0x5b,0x04,0x03,0xf1,0xee,0xf7,0x57,0x02,0xe8,0x4b,0xb7,0x59,0x7a,0xab,0xe6,0x63,0xb8,0x2f,0x6f,0x04,0xef,0x27,0x77,
+  0x04,0x78,0x2c,0x8e,0xd1,0x7e,0x3b,0x2a,0x78,0x3b,0x54,0x64,0xf3,0x3b,0x09,0x65,0x2a,0x71,0xc6,0x78,0xe0,0x5e,0xc5,0x1e,0x84,0xe2,0xbc,0xfc,0x66,0x3a,0x3d,0xe9,0x63,0xaf,0x9a,0xcb,0x42,0x80,0xb8,0xc7,0xf7,0xc4,0x2f,0x4e,0xf9,0xab,0xa6,0x24,0x5e,0xc1,0xec,0x17,0x12,0xfd,0x38,0xa0,0xfa,0x96,0x41,0x8d,0x8c,0xd6,0xaa,0x61,0x52,
+  0x04,0x6e,0x82,0x35,0x55,0x45,0x29,0x14,0x09,0x91,0x82,0xc6,0xb2,0xc1,0xd6,0xf0,0xb5,0xd2,0x8d,0x50,0xcc,0xd0,0x05,0xaf,0x2c,0xe1,0xbb,0xa5,0x41,0xaa,0x40,0xca,0xff,0x00,0x00,0x00,0x01,0x06,0x04,0x92,0xd5,0xa5,0x67,0x3e,0x0f,0x25,0xd8,0xd5,0x0f,0xb7,0xe5,0x8c,0x49,0xd8,0x6d,0x46,0xd4,0x21,0x69,0x55,0xe0,0xaa,0x3d,0x40,0xe1,
+  0x04,0x6e,0x82,0x35,0x55,0x45,0x29,0x14,0x09,0x91,0x82,0xc6,0xb2,0xc1,0xd6,0xf0,0xb5,0xd2,0x8d,0x50,0xcc,0xd0,0x05,0xaf,0x2c,0xe1,0xbb,0xa5,0x41,0xaa,0x40,0xca,0xff,0xff,0xff,0xff,0xfe,0xf9,0xfb,0x6d,0x2a,0x5a,0x98,0xc1,0xf0,0xda,0x27,0x2a,0xf0,0x48,0x1a,0x73,0xb6,0x27,0x92,0xb9,0x2b,0xde,0x96,0xaa,0x1e,0x55,0xc2,0xbb,0x4e,
+  0x04,0x00,0x00,0x00,0x01,0x3f,0xd2,0x22,0x48,0xd6,0x4d,0x95,0xf7,0x3c,0x29,0xb4,0x8a,0xb4,0x86,0x31,0x85,0x0b,0xe5,0x03,0xfd,0x00,0xf8,0x46,0x8b,0x5f,0x0f,0x70,0xe0,0xf6,0xee,0x7a,0xa4,0x3b,0xc2,0xc6,0xfd,0x25,0xb1,0xd8,0x26,0x92,0x41,0xcb,0xdd,0x9d,0xbb,0x0d,0xac,0x96,0xdc,0x96,0x23,0x1f,0x43,0x07,0x05,0xf8,0x38,0x71,0x7d,
+  0x04,0x25,0xaf,0xd6,0x89,0xac,0xab,0xae,0xd6,0x7c,0x1f,0x29,0x6d,0xe5,0x94,0x06,0xf8,0xc5,0x50,0xf5,0x71,0x46,0xa0,0xb4,0xec,0x2c,0x97,0x87,0x6d,0xff,0xff,0xff,0xff,0xfa,0x46,0xa7,0x6e,0x52,0x03,0x22,0xdf,0xbc,0x49,0x1e,0xc4,0xf0,0xcc,0x19,0x74,0x20,0xfc,0x4e,0xa5,0x88,0x3d,0x8f,0x6d,0xd5,0x3c,0x35,0x4b,0xc4,0xf6,0x7c,0x35,
+  0x04,0xd1,0x2e,0x6c,0x66,0xb6,0x77,0x34,0xc3,0xc8,0x4d,0x26,0x01,0xcf,0x5d,0x35,0xdc,0x09,0x7e,0x27,0x63,0x7f,0x0a,0xca,0x4a,0x4f,0xdb,0x74,0xb6,0xaa,0xdd,0x3b,0xb9,0x3f,0x5b,0xdf,0xf8,0x8b,0xd5,0x73,0x6d,0xf8,0x98,0xe6,0x99,0x00,0x6e,0xd7,0x50,0xf1,0x1c,0xf0,0x7c,0x58,0x66,0xcd,0x7a,0xd7,0x0c,0x71,0x21,0xff,0xff,0xff,0xff,
+  0x04,0x6d,0x4a,0x7f,0x60,0xd4,0x77,0x4a,0x4f,0x0a,0xa8,0xbb,0xde,0xdb,0x95,0x3c,0x7e,0xea,0x79,0x09,0x40,0x7e,0x31,0x64,0x75,0x56,0x64,0xbc,0x28,0x00,0x00,0x00,0x00,0xe6,0x59,0xd3,0x4e,0x4d,0xf3,0x8d,0x9e,0x8c,0x9e,0xaa,0xdf,0xba,0x36,0x61,0x2c,0x76,0x91,0x95,0xbe,0x86,0xc7,0x7a,0xac,0x3f,0x36,0xe7,0x8b,0x53,0x86,0x80,0xfb};
+
+static const unsigned char wycheproof_ecdsa_signatures[]  = { 0x30,0x46,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x21,0x00,0x90,0x0e,0x75,0xad,0x23,0x3f,0xcc,0x90,0x85,0x09,0xdb,0xff,0x59,0x22,0x64,0x7d,0xb3,0x7c,0x21,0xf4,0xaf,0xd3,0x20,0x3a,0xe8,0xdc,0x4a,0xe7,0x79,0x4b,0x0f,0x87,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x81,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x82,0x00,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x46,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x44,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x85,0x01,0x00,0x00,0x00,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x89,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x84,0x7f,0xff,0xff,0xff,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x84,0x80,0x00,0x00,0x00,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x84,0xff,0xff,0xff,0xff,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x85,0xff,0xff,0xff,0xff,0xff,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x88,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0xff,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x80,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,
+  0x30,0x47,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,
+  0x30,0x47,0x00,0x00,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,
+  0x30,0x47,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x05,0x00,
+  0x30,0x4a,0x49,0x81,0x77,0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x25,0x00,0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x47,0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x04,0xde,0xad,0xbe,0xef,
+  0x30,0x4d,0xaa,0x00,0xbb,0x00,0xcd,0x00,0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4d,0x22,0x29,0xaa,0x00,0xbb,0x00,0xcd,0x00,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4d,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x22,0x28,0xaa,0x00,0xbb,0x00,0xcd,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x81,
+  0x30,0x4b,0xaa,0x02,0xaa,0xbb,0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x80,0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,
+  0x30,0x80,0x31,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,
+  0x05,0x00,
+  0x2e,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x2f,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x31,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x32,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0xff,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x00,
+  0x30,0x49,0x30,0x01,0x02,0x30,0x44,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x44,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,
+  0x30,0x44,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x82,0x10,0x46,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+  0x30,0x80,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,
+  0x30,0x80,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,
+  0x30,0x80,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x05,0x00,0x00,0x00,
+  0x30,0x80,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x06,0x08,0x11,0x22,0x00,0x00,
+  0x30,0x80,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,0xfe,0x02,0xbe,0xef,
+  0x30,0x80,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x02,0xbe,0xef,
+  0x30,0x47,0x30,0x00,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x47,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x30,0x00,
+  0x30,0x48,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x02,0x01,0x00,
+  0x30,0x48,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0xbf,0x7f,0x00,
+  0x30,0x49,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0xa0,0x02,0x05,0x00,
+  0x30,0x47,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0xa0,0x00,
+  0x30,0x47,0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x23,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,
+  0x30,0x67,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x43,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x64,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x43,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xca,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x43,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x13,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x43,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x08,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x46,0x02,0x81,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x47,0x02,0x82,0x00,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x22,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x20,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4a,0x02,0x85,0x01,0x00,0x00,0x00,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4e,0x02,0x89,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x02,0x84,0x7f,0xff,0xff,0xff,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x02,0x84,0x80,0x00,0x00,0x00,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x02,0x84,0xff,0xff,0xff,0xff,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4a,0x02,0x85,0xff,0xff,0xff,0xff,0xff,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4d,0x02,0x88,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0xff,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x80,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x22,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x23,0x02,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x24,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,
+  0x30,0x47,0x02,0x23,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x00,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x47,0x02,0x23,0x00,0x00,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x47,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x00,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x47,0x02,0x23,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x05,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4a,0x22,0x26,0x49,0x81,0x77,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x22,0x25,0x25,0x00,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4d,0x22,0x23,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x00,0x04,0xde,0xad,0xbe,0xef,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x24,0x02,0x81,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4b,0x22,0x27,0xaa,0x02,0xaa,0xbb,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x22,0x80,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x00,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x22,0x80,0x03,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x00,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x24,0x05,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x00,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x01,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x03,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x04,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0xff,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x24,0x02,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x22,0x25,0x02,0x01,0x00,0x02,0x20,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x02,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0xe5,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x44,0x02,0x20,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x44,0x02,0x20,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x82,0x10,0x48,0x02,0x82,0x10,0x22,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x46,0x02,0x22,0xff,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x25,0x09,0x01,0x80,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x25,0x02,0x01,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x43,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xbb,
+  0x30,0x43,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa4,0x56,0xeb,0x31,0xba,
+  0x30,0x43,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf7,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x43,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x01,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x46,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x81,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x47,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x82,0x00,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x21,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x1f,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4a,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x85,0x01,0x00,0x00,0x00,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4e,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x89,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x84,0x7f,0xff,0xff,0xff,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x84,0x80,0x00,0x00,0x00,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x84,0xff,0xff,0xff,0xff,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4a,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x85,0xff,0xff,0xff,0xff,0xff,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4d,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x88,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0xff,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x80,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x47,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x22,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,
+  0x30,0x47,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x22,0x00,0x00,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x47,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x22,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x05,0x00,
+  0x30,0x4a,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x22,0x25,0x49,0x81,0x77,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x22,0x24,0x25,0x00,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4d,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x22,0x22,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x04,0xde,0xad,0xbe,0xef,
+  0x30,0x25,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x81,
+  0x30,0x4b,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x22,0x26,0xaa,0x02,0xaa,0xbb,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x49,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x22,0x80,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,
+  0x30,0x49,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x22,0x80,0x03,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,
+  0x30,0x25,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x05,0x00,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x00,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x01,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x03,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x04,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0xff,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x25,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x00,
+  0x30,0x49,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x22,0x24,0x02,0x01,0x6f,0x02,0x1f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6d,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0x3a,
+  0x30,0x44,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x1f,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,
+  0x30,0x44,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x1f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x82,0x10,0x48,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x82,0x10,0x21,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+  0x30,0x46,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x21,0xff,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x26,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x09,0x01,0x80,
+  0x30,0x26,0x02,0x21,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x01,0x00,
+  0x30,0x45,0x02,0x21,0x01,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x83,0xb9,0x0d,0xea,0xbc,0xa4,0xb0,0x5c,0x45,0x74,0xe4,0x9b,0x58,0x99,0xb9,0x64,0xa6,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x44,0x02,0x20,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x86,0x43,0xb0,0x30,0xef,0x46,0x1f,0x1b,0xcd,0xf5,0x3f,0xde,0x3e,0xf9,0x4c,0xe2,0x24,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x46,0x02,0x22,0x01,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x84,0x3f,0xad,0x3b,0xf4,0x85,0x3e,0x07,0xf7,0xc9,0x87,0x70,0xc9,0x9b,0xff,0xc4,0x64,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0xff,0x7e,0xc1,0x08,0x63,0x31,0x05,0x65,0xa9,0x08,0x45,0x7f,0xa0,0xf1,0xb8,0x7a,0x7b,0x01,0xa0,0xf2,0x2a,0x0a,0x98,0x43,0xf6,0x4a,0xed,0xc3,0x34,0x36,0x7c,0xdc,0x9b,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x44,0x02,0x20,0x7e,0xc1,0x08,0x63,0x31,0x05,0x65,0xa9,0x08,0x45,0x7f,0xa0,0xf1,0xb8,0x7a,0x79,0xbc,0x4f,0xcf,0x10,0xb9,0xe0,0xe4,0x32,0x0a,0xc0,0x21,0xc1,0x06,0xb3,0x1d,0xdc,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0xfe,0x7e,0xc1,0x08,0x63,0x31,0x05,0x65,0xa9,0x08,0x45,0x7f,0xa0,0xf1,0xb8,0x7a,0x7c,0x46,0xf2,0x15,0x43,0x5b,0x4f,0xa3,0xba,0x8b,0x1b,0x64,0xa7,0x66,0x46,0x9b,0x5a,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x01,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4d,0x02,0x29,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x81,0x3e,0xf7,0x9c,0xce,0xfa,0x9a,0x56,0xf7,0xba,0x80,0x5f,0x0e,0x47,0x85,0x84,0xfe,0x5f,0x0d,0xd5,0xf5,0x67,0xbc,0x09,0xb5,0x12,0x3c,0xcb,0xc9,0x83,0x23,0x65,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x01,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x7f,0xc1,0xe1,0x97,0xd8,0xae,0xbe,0x20,0x3c,0x96,0xc8,0x72,0x32,0x27,0x21,0x72,0xfb,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0xff,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x82,0x4c,0x83,0xde,0x0b,0x50,0x2c,0xdf,0xc5,0x17,0x23,0xb5,0x18,0x86,0xb4,0xf0,0x79,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x46,0x02,0x22,0x01,0x00,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9a,0x3b,0xb6,0x0f,0xa1,0xa1,0x48,0x15,0xbb,0xc0,0xa9,0x54,0xa0,0x75,0x8d,0x2c,0x72,0xba,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x44,0x02,0x20,0x90,0x0e,0x75,0xad,0x23,0x3f,0xcc,0x90,0x85,0x09,0xdb,0xff,0x59,0x22,0x64,0x7e,0xf8,0xcd,0x45,0x0e,0x00,0x8a,0x7f,0xff,0x29,0x09,0xec,0x5a,0xa9,0x14,0xce,0x46,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0xfe,0x90,0x0e,0x75,0xad,0x23,0x3f,0xcc,0x90,0x85,0x09,0xdb,0xff,0x59,0x22,0x64,0x80,0x3e,0x1e,0x68,0x27,0x51,0x41,0xdf,0xc3,0x69,0x37,0x8d,0xcd,0xd8,0xde,0x8d,0x05,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0x01,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x45,0x02,0x21,0xff,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x4d,0x02,0x29,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,0x02,0x20,0x6f,0xf1,0x8a,0x52,0xdc,0xc0,0x33,0x6f,0x7a,0xf6,0x24,0x00,0xa6,0xdd,0x9b,0x81,0x07,0x32,0xba,0xf1,0xff,0x75,0x80,0x00,0xd6,0xf6,0x13,0xa5,0x56,0xeb,0x31,0xba,
+  0x30,0x06,0x02,0x01,0x00,0x02,0x01,0x00,
+  0x30,0x06,0x02,0x01,0x00,0x02,0x01,0x01,
+  0x30,0x06,0x02,0x01,0x00,0x02,0x01,0xff,
+  0x30,0x26,0x02,0x01,0x00,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,
+  0x30,0x26,0x02,0x01,0x00,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,
+  0x30,0x26,0x02,0x01,0x00,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,
+  0x30,0x26,0x02,0x01,0x00,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,
+  0x30,0x26,0x02,0x01,0x00,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,
+  0x30,0x06,0x02,0x01,0x01,0x02,0x01,0x00,
+  0x30,0x06,0x02,0x01,0x01,0x02,0x01,0x01,
+  0x30,0x06,0x02,0x01,0x01,0x02,0x01,0xff,
+  0x30,0x26,0x02,0x01,0x01,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,
+  0x30,0x26,0x02,0x01,0x01,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,
+  0x30,0x26,0x02,0x01,0x01,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,
+  0x30,0x26,0x02,0x01,0x01,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,
+  0x30,0x26,0x02,0x01,0x01,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,
+  0x30,0x06,0x02,0x01,0xff,0x02,0x01,0x00,
+  0x30,0x06,0x02,0x01,0xff,0x02,0x01,0x01,
+  0x30,0x06,0x02,0x01,0xff,0x02,0x01,0xff,
+  0x30,0x26,0x02,0x01,0xff,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,
+  0x30,0x26,0x02,0x01,0xff,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,
+  0x30,0x26,0x02,0x01,0xff,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,
+  0x30,0x26,0x02,0x01,0xff,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,
+  0x30,0x26,0x02,0x01,0xff,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x02,0x01,0x00,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x02,0x01,0x01,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x02,0x01,0xff,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,0x02,0x01,0x00,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,0x02,0x01,0x01,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,0x02,0x01,0xff,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,0x02,0x01,0x00,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,0x02,0x01,0x01,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,0x02,0x01,0xff,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x02,0x01,0x00,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x02,0x01,0x01,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x02,0x01,0xff,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,0x02,0x01,0x00,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,0x02,0x01,0x01,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,0x02,0x01,0xff,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x40,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x42,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,
+  0x30,0x46,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x30,
+  0x30,0x08,0x02,0x01,0x00,0x09,0x03,0x80,0xfe,0x01,
+  0x30,0x06,0x02,0x01,0x00,0x09,0x01,0x42,
+  0x30,0x06,0x02,0x01,0x00,0x01,0x01,0x01,
+  0x30,0x06,0x02,0x01,0x00,0x01,0x01,0x00,
+  0x30,0x05,0x02,0x01,0x00,0x05,0x00,
+  0x30,0x05,0x02,0x01,0x00,0x0c,0x00,
+  0x30,0x06,0x02,0x01,0x00,0x0c,0x01,0x30,
+  0x30,0x05,0x02,0x01,0x00,0x30,0x00,
+  0x30,0x08,0x02,0x01,0x00,0x30,0x03,0x02,0x01,0x00,
+  0x30,0x08,0x02,0x01,0x01,0x09,0x03,0x80,0xfe,0x01,
+  0x30,0x06,0x02,0x01,0x01,0x09,0x01,0x42,
+  0x30,0x06,0x02,0x01,0x01,0x01,0x01,0x01,
+  0x30,0x06,0x02,0x01,0x01,0x01,0x01,0x00,
+  0x30,0x05,0x02,0x01,0x01,0x05,0x00,
+  0x30,0x05,0x02,0x01,0x01,0x0c,0x00,
+  0x30,0x06,0x02,0x01,0x01,0x0c,0x01,0x30,
+  0x30,0x05,0x02,0x01,0x01,0x30,0x00,
+  0x30,0x08,0x02,0x01,0x01,0x30,0x03,0x02,0x01,0x00,
+  0x30,0x08,0x02,0x01,0xff,0x09,0x03,0x80,0xfe,0x01,
+  0x30,0x06,0x02,0x01,0xff,0x09,0x01,0x42,
+  0x30,0x06,0x02,0x01,0xff,0x01,0x01,0x01,
+  0x30,0x06,0x02,0x01,0xff,0x01,0x01,0x00,
+  0x30,0x05,0x02,0x01,0xff,0x05,0x00,
+  0x30,0x05,0x02,0x01,0xff,0x0c,0x00,
+  0x30,0x06,0x02,0x01,0xff,0x0c,0x01,0x30,
+  0x30,0x05,0x02,0x01,0xff,0x30,0x00,
+  0x30,0x08,0x02,0x01,0xff,0x30,0x03,0x02,0x01,0x00,
+  0x30,0x28,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x09,0x03,0x80,0xfe,0x01,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x09,0x01,0x42,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x01,0x01,0x01,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x01,0x01,0x00,
+  0x30,0x25,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x05,0x00,
+  0x30,0x25,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x0c,0x00,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x0c,0x01,0x30,
+  0x30,0x25,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x30,0x00,
+  0x30,0x28,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x41,0x30,0x03,0x02,0x01,0x00,
+  0x30,0x28,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x09,0x03,0x80,0xfe,0x01,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x09,0x01,0x42,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x01,0x01,0x01,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x01,0x01,0x00,
+  0x30,0x25,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x05,0x00,
+  0x30,0x25,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x0c,0x00,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x0c,0x01,0x30,
+  0x30,0x25,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x30,0x00,
+  0x30,0x28,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2f,0x30,0x03,0x02,0x01,0x00,
+  0x30,0x0a,0x09,0x03,0x80,0xfe,0x01,0x09,0x03,0x80,0xfe,0x01,
+  0x30,0x06,0x09,0x01,0x42,0x09,0x01,0x42,
+  0x30,0x06,0x01,0x01,0x01,0x01,0x01,0x01,
+  0x30,0x06,0x01,0x01,0x00,0x01,0x01,0x00,
+  0x30,0x04,0x05,0x00,0x05,0x00,
+  0x30,0x04,0x0c,0x00,0x0c,0x00,
+  0x30,0x06,0x0c,0x01,0x30,0x0c,0x01,0x30,
+  0x30,0x04,0x30,0x00,0x30,0x00,
+  0x30,0x0a,0x30,0x03,0x02,0x01,0x00,0x30,0x03,0x02,0x01,0x00,
+  0x30,0x08,0x09,0x03,0x80,0xfe,0x01,0x02,0x01,0x00,
+  0x30,0x06,0x09,0x01,0x42,0x02,0x01,0x00,
+  0x30,0x06,0x01,0x01,0x01,0x02,0x01,0x00,
+  0x30,0x06,0x01,0x01,0x00,0x02,0x01,0x00,
+  0x30,0x05,0x05,0x00,0x02,0x01,0x00,
+  0x30,0x05,0x0c,0x00,0x02,0x01,0x00,
+  0x30,0x06,0x0c,0x01,0x30,0x02,0x01,0x00,
+  0x30,0x05,0x30,0x00,0x02,0x01,0x00,
+  0x30,0x08,0x30,0x03,0x02,0x01,0x00,0x02,0x01,0x00,
+  0x30,0x45,0x02,0x21,0x00,0xdd,0x1b,0x7d,0x09,0xa7,0xbd,0x82,0x18,0x96,0x10,0x34,0xa3,0x9a,0x87,0xfe,0xcf,0x53,0x14,0xf0,0x0c,0x4d,0x25,0xeb,0x58,0xa0,0x7a,0xc8,0x5e,0x85,0xea,0xb5,0x16,0x02,0x20,0x35,0x13,0x8c,0x40,0x1e,0xf8,0xd3,0x49,0x3d,0x65,0xc9,0x00,0x2f,0xe6,0x2b,0x43,0xae,0xe5,0x68,0x73,0x1b,0x74,0x45,0x48,0x35,0x89,0x96,0xd9,0xcc,0x42,0x7e,0x06,
+  0x30,0x45,0x02,0x21,0x00,0x95,0xc2,0x92,0x67,0xd9,0x72,0xa0,0x43,0xd9,0x55,0x22,0x45,0x46,0x22,0x2b,0xba,0x34,0x3f,0xc1,0xd4,0xdb,0x0f,0xec,0x26,0x2a,0x33,0xac,0x61,0x30,0x56,0x96,0xae,0x02,0x20,0x6e,0xdf,0xe9,0x67,0x13,0xae,0xd5,0x6f,0x8a,0x28,0xa6,0x65,0x3f,0x57,0xe0,0xb8,0x29,0x71,0x2e,0x5e,0xdd,0xc6,0x7f,0x34,0x68,0x2b,0x24,0xf0,0x67,0x6b,0x26,0x40,
+  0x30,0x44,0x02,0x20,0x28,0xf9,0x4a,0x89,0x4e,0x92,0x02,0x46,0x99,0xe3,0x45,0xfe,0x66,0x97,0x1e,0x3e,0xdc,0xd0,0x50,0x02,0x33,0x86,0x13,0x5a,0xb3,0x93,0x9d,0x55,0x08,0x98,0xfb,0x25,0x02,0x20,0x32,0x96,0x3e,0x5b,0xd4,0x1f,0xa5,0x91,0x1e,0xd8,0xf3,0x7d,0xeb,0x86,0xda,0xe0,0xa7,0x62,0xbb,0x61,0x21,0xc8,0x94,0x61,0x50,0x83,0xc5,0xd9,0x5e,0xa0,0x1d,0xb3,
+  0x30,0x45,0x02,0x21,0x00,0xbe,0x26,0xb1,0x8f,0x95,0x49,0xf8,0x9f,0x41,0x1a,0x9b,0x52,0x53,0x6b,0x15,0xaa,0x27,0x0b,0x84,0x54,0x8d,0x0e,0x85,0x9a,0x19,0x52,0xa2,0x7a,0xf1,0xa7,0x7a,0xc6,0x02,0x20,0x70,0xc1,0xd4,0xfa,0x9c,0xd0,0x3c,0xc8,0xea,0xa8,0xd5,0x06,0xed,0xb9,0x7e,0xed,0x7b,0x83,0x58,0xb4,0x53,0xc8,0x8a,0xef,0xbb,0x88,0x0a,0x3f,0x0e,0x8d,0x47,0x2f,
+  0x30,0x45,0x02,0x21,0x00,0xb1,0xa4,0xb1,0x47,0x8e,0x65,0xcc,0x3e,0xaf,0xdf,0x22,0x5d,0x12,0x98,0xb4,0x3f,0x2d,0xa1,0x9e,0x4b,0xcf,0xf7,0xea,0xcc,0x0a,0x2e,0x98,0xcd,0x4b,0x74,0xb1,0x14,0x02,0x20,0x17,0x9a,0xa3,0x1e,0x30,0x4c,0xc1,0x42,0xcf,0x50,0x73,0x17,0x17,0x51,0xb2,0x8f,0x3f,0x5e,0x0f,0xa8,0x8c,0x99,0x4e,0x7c,0x55,0xf1,0xbc,0x07,0xb8,0xd5,0x6c,0x16,
+  0x30,0x44,0x02,0x20,0x32,0x53,0x32,0x02,0x12,0x61,0xf1,0xbd,0x18,0xf2,0x71,0x2a,0xa1,0xe2,0x25,0x2d,0xa2,0x37,0x96,0xda,0x8a,0x4b,0x1f,0xf6,0xea,0x18,0xca,0xfe,0xc7,0xe1,0x71,0xf2,0x02,0x20,0x40,0xb4,0xf5,0xe2,0x87,0xee,0x61,0xfc,0x3c,0x80,0x41,0x86,0x98,0x23,0x60,0x89,0x1e,0xaa,0x35,0xc7,0x5f,0x05,0xa4,0x3e,0xcd,0x48,0xb3,0x5d,0x98,0x4a,0x66,0x48,
+  0x30,0x45,0x02,0x21,0x00,0xa2,0x3a,0xd1,0x8d,0x8f,0xc6,0x6d,0x81,0xaf,0x09,0x03,0x89,0x0c,0xbd,0x45,0x3a,0x55,0x4c,0xb0,0x4c,0xdc,0x1a,0x8c,0xa7,0xf7,0xf7,0x8e,0x53,0x67,0xed,0x88,0xa0,0x02,0x20,0x23,0xe3,0xeb,0x2c,0xe1,0xc0,0x4e,0xa7,0x48,0xc3,0x89,0xbd,0x97,0x37,0x4a,0xa9,0x41,0x3b,0x92,0x68,0x85,0x1c,0x04,0xdc,0xd9,0xf8,0x8e,0x78,0x81,0x3f,0xee,0x56,
+  0x30,0x44,0x02,0x20,0x2b,0xde,0xa4,0x1c,0xda,0x63,0xa2,0xd1,0x4b,0xf4,0x73,0x53,0xbd,0x20,0x88,0x0a,0x69,0x09,0x01,0xde,0x7c,0xd6,0xe3,0xcc,0x6d,0x8e,0xd5,0xba,0x0c,0xdb,0x10,0x91,0x02,0x20,0x3c,0xea,0x66,0xbc,0xcf,0xc9,0xf9,0xbf,0x8c,0x7c,0xa4,0xe1,0xc1,0x45,0x7c,0xc9,0x14,0x5e,0x13,0xe9,0x36,0xd9,0x0b,0x3d,0x9c,0x77,0x86,0xb8,0xb2,0x6c,0xf4,0xc7,
+  0x30,0x45,0x02,0x21,0x00,0xd7,0xcd,0x76,0xec,0x01,0xc1,0xb1,0x07,0x9e,0xba,0x9e,0x2a,0xa2,0xa3,0x97,0x24,0x3c,0x47,0x58,0xc9,0x8a,0x1b,0xa0,0xb7,0x40,0x4a,0x34,0x0b,0x9b,0x00,0xce,0xd6,0x02,0x20,0x35,0x75,0x00,0x1e,0x19,0xd9,0x22,0xe6,0xde,0x8b,0x3d,0x6c,0x84,0xea,0x43,0xb5,0xc3,0x33,0x81,0x06,0xcf,0x29,0x99,0x01,0x34,0xe7,0x66,0x9a,0x82,0x6f,0x78,0xe6,
+  0x30,0x45,0x02,0x21,0x00,0xa8,0x72,0xc7,0x44,0xd9,0x36,0xdb,0x21,0xa1,0x0c,0x36,0x1d,0xd5,0xc9,0x06,0x33,0x55,0xf8,0x49,0x02,0x21,0x96,0x52,0xf6,0xfc,0x56,0xdc,0x95,0xa7,0x13,0x9d,0x96,0x02,0x20,0x40,0x0d,0xf7,0x57,0x5d,0x97,0x56,0x21,0x0e,0x9c,0xcc,0x77,0x16,0x2c,0x6b,0x59,0x3c,0x77,0x46,0xcf,0xb4,0x8a,0xc2,0x63,0xc4,0x27,0x50,0xb4,0x21,0xef,0x4b,0xb9,
+  0x30,0x45,0x02,0x21,0x00,0x9f,0xa9,0xaf,0xe0,0x77,0x52,0xda,0x10,0xb3,0x6d,0x3a,0xfc,0xd0,0xfe,0x44,0xbf,0xc4,0x02,0x44,0xd7,0x52,0x03,0x59,0x9c,0xf8,0xf5,0x04,0x7f,0xa3,0x45,0x38,0x54,0x02,0x20,0x50,0xe0,0xa7,0xc0,0x13,0xbf,0xbf,0x51,0x81,0x97,0x36,0x97,0x2d,0x44,0xb4,0xb5,0x6b,0xc2,0xa2,0xb2,0xc1,0x80,0xdf,0x6e,0xc6,0x72,0xdf,0x17,0x14,0x10,0xd7,0x7a,
+  0x30,0x45,0x02,0x21,0x00,0x88,0x56,0x40,0x38,0x4d,0x0d,0x91,0x0e,0xfb,0x17,0x7b,0x46,0xbe,0x6c,0x3d,0xc5,0xca,0xc8,0x1f,0x0b,0x88,0xc3,0x19,0x0b,0xb6,0xb5,0xf9,0x9c,0x26,0x41,0xf2,0x05,0x02,0x20,0x73,0x8e,0xd9,0xbf,0xf1,0x16,0x30,0x6d,0x9c,0xaa,0x0f,0x8f,0xc6,0x08,0xbe,0x24,0x3e,0x0b,0x56,0x77,0x79,0xd8,0xda,0xb0,0x3e,0x8e,0x19,0xd5,0x53,0xf1,0xdc,0x8e,
+  0x30,0x44,0x02,0x20,0x2d,0x05,0x1f,0x91,0xc5,0xa9,0xd4,0x40,0xc5,0x67,0x69,0x85,0x71,0x04,0x83,0xbc,0x4f,0x1a,0x6c,0x61,0x1b,0x10,0xc9,0x5a,0x2f,0xf0,0x36,0x3d,0x90,0xc2,0xa4,0x58,0x02,0x20,0x6d,0xdf,0x94,0xe6,0xfb,0xa5,0xbe,0x58,0x68,0x33,0xd0,0xc5,0x3c,0xf2,0x16,0xad,0x39,0x48,0xf3,0x79,0x53,0xc2,0x6c,0x1c,0xf4,0x96,0x8e,0x9a,0x9e,0x82,0x43,0xdc,
+  0x30,0x45,0x02,0x21,0x00,0xf3,0xac,0x25,0x23,0x96,0x74,0x82,0xf5,0x3d,0x50,0x85,0x22,0x71,0x2d,0x58,0x3f,0x43,0x79,0xcd,0x82,0x41,0x01,0xff,0x63,0x5e,0xa0,0x93,0x51,0x17,0xba,0xa5,0x4f,0x02,0x20,0x27,0xf1,0x08,0x12,0x22,0x73,0x97,0xe0,0x2c,0xea,0x96,0xfb,0x0e,0x68,0x07,0x61,0x63,0x6d,0xab,0x2b,0x08,0x0d,0x1f,0xc5,0xd1,0x16,0x85,0xcb,0xe8,0x50,0x0c,0xfe,
+  0x30,0x45,0x02,0x21,0x00,0x96,0x44,0x7c,0xf6,0x8c,0x3a,0xb7,0x26,0x6e,0xd7,0x44,0x7d,0xe3,0xac,0x52,0xfe,0xd7,0xcc,0x08,0xcb,0xdf,0xea,0x39,0x1c,0x18,0xa9,0xb8,0xab,0x37,0x0b,0xc9,0x13,0x02,0x20,0x0f,0x5e,0x78,0x74,0xd3,0xac,0x0e,0x91,0x8f,0x01,0xc8,0x85,0xa1,0x63,0x91,0x77,0xc9,0x23,0xf8,0x66,0x0d,0x1c,0xeb,0xa1,0xca,0x1f,0x30,0x1b,0xc6,0x75,0xcd,0xbc,
+  0x30,0x44,0x02,0x20,0x53,0x0a,0x08,0x32,0xb6,0x91,0xda,0x0b,0x56,0x19,0xa0,0xb1,0x1d,0xe6,0x87,0x7f,0x3c,0x09,0x71,0xba,0xaa,0x68,0xed,0x12,0x27,0x58,0xc2,0x9c,0xaa,0xf4,0x6b,0x72,0x02,0x20,0x6c,0x89,0xe4,0x4f,0x5e,0xb3,0x30,0x60,0xea,0x4b,0x46,0x31,0x8c,0x39,0x13,0x8e,0xae,0xde,0xc7,0x2d,0xe4,0x2b,0xa5,0x76,0x57,0x9a,0x6a,0x46,0x90,0xe3,0x39,0xf3,
+  0x30,0x45,0x02,0x21,0x00,0x9c,0x54,0xc2,0x55,0x00,0xbd,0xe0,0xb9,0x2d,0x72,0xd6,0xec,0x48,0x3d,0xc2,0x48,0x2f,0x36,0x54,0x29,0x4c,0xa7,0x4d,0xe7,0x96,0xb6,0x81,0x25,0x5e,0xd5,0x8a,0x77,0x02,0x20,0x67,0x74,0x53,0xc6,0xb5,0x6f,0x52,0x76,0x31,0xc9,0xf6,0x7b,0x3f,0x3e,0xb6,0x21,0xfd,0x88,0x58,0x2b,0x4a,0xff,0x15,0x6d,0x2f,0x15,0x67,0xd6,0x21,0x1a,0x2a,0x33,
+  0x30,0x45,0x02,0x21,0x00,0xe7,0x90,0x9d,0x41,0x43,0x9e,0x2f,0x6a,0xf2,0x91,0x36,0xc7,0x34,0x8c,0xa2,0x64,0x1a,0x2b,0x07,0x0d,0x5b,0x64,0xf9,0x1e,0xa9,0xda,0x70,0x70,0xc7,0xa2,0x61,0x8b,0x02,0x20,0x42,0xd7,0x82,0xf1,0x32,0xfa,0x1d,0x36,0xc2,0xc8,0x8b,0xa2,0x7c,0x3d,0x67,0x8d,0x80,0x18,0x4a,0x5d,0x1e,0xcc,0xac,0x75,0x01,0xf0,0xb4,0x7e,0x3d,0x20,0x50,0x08,
+  0x30,0x44,0x02,0x20,0x59,0x24,0x87,0x32,0x09,0x59,0x31,0x35,0xa4,0xc3,0xda,0x7b,0xb3,0x81,0x22,0x7f,0x8a,0x4b,0x6a,0xa9,0xf3,0x4f,0xe5,0xbb,0x7f,0x8f,0xbc,0x13,0x1a,0x03,0x9f,0xfe,0x02,0x20,0x1f,0x1b,0xb1,0x1b,0x44,0x1c,0x8f,0xea,0xa4,0x0f,0x44,0x21,0x3d,0x9a,0x40,0x5e,0xd7,0x92,0xd5,0x9f,0xb4,0x9d,0x5b,0xcd,0xd9,0xa4,0x28,0x5a,0xe5,0x69,0x30,0x22,
+  0x30,0x45,0x02,0x21,0x00,0xee,0xb6,0x92,0xc9,0xb2,0x62,0x96,0x9b,0x23,0x1c,0x38,0xb5,0xa7,0xf6,0x06,0x49,0xe0,0xc8,0x75,0xcd,0x64,0xdf,0x88,0xf3,0x3a,0xa5,0x71,0xfa,0x3d,0x29,0xab,0x0e,0x02,0x20,0x21,0x8b,0x3a,0x1e,0xb0,0x63,0x79,0xc2,0xc1,0x8c,0xf5,0x1b,0x06,0x43,0x07,0x86,0xd1,0xc6,0x4c,0xd2,0xd2,0x4c,0x9b,0x23,0x2b,0x23,0xe5,0xba,0xc7,0x98,0x9a,0xcd,
+  0x30,0x45,0x02,0x21,0x00,0xa4,0x00,0x34,0x17,0x7f,0x36,0x09,0x1c,0x2b,0x65,0x36,0x84,0xa0,0xe3,0xeb,0x5d,0x4b,0xff,0x18,0xe4,0xd0,0x9f,0x66,0x4c,0x28,0x00,0xe7,0xca,0xfd,0xa1,0xda,0xf8,0x02,0x20,0x3a,0x3e,0xc2,0x98,0x53,0x70,0x4e,0x52,0x03,0x1c,0x58,0x92,0x7a,0x80,0x0a,0x96,0x83,0x53,0xad,0xc3,0xd9,0x73,0xbe,0xba,0x91,0x72,0xcb,0xbe,0xab,0x4d,0xd1,0x49,
+  0x30,0x45,0x02,0x21,0x00,0xb5,0xd7,0x95,0xcc,0x75,0xce,0xa5,0xc4,0x34,0xfa,0x41,0x85,0x18,0x0c,0xd6,0xbd,0x21,0x22,0x3f,0x3d,0x5a,0x86,0xda,0x66,0x70,0xd7,0x1d,0x95,0x68,0x0d,0xad,0xbf,0x02,0x20,0x54,0xe4,0xd8,0x81,0x0a,0x00,0x1e,0xcb,0xb9,0xf7,0xca,0x1c,0x2e,0xbf,0xdb,0x9d,0x00,0x9e,0x90,0x31,0xa4,0x31,0xac,0xa3,0xc2,0x0a,0xb4,0xe0,0xd1,0x37,0x4e,0xc1,
+  0x30,0x44,0x02,0x20,0x07,0xdc,0x24,0x78,0xd4,0x3c,0x12,0x32,0xa4,0x59,0x56,0x08,0xc6,0x44,0x26,0xc3,0x55,0x10,0x05,0x1a,0x63,0x1a,0xe6,0xa5,0xa6,0xeb,0x11,0x61,0xe5,0x7e,0x42,0xe1,0x02,0x20,0x4a,0x59,0xea,0x0f,0xdb,0x72,0xd1,0x21,0x65,0xce,0xa3,0xbf,0x1c,0xa8,0x6b,0xa9,0x75,0x17,0xbd,0x18,0x8d,0xb3,0xdb,0xd2,0x1a,0x5a,0x15,0x78,0x50,0x02,0x19,0x84,
+  0x30,0x45,0x02,0x21,0x00,0xdd,0xd2,0x0c,0x4a,0x05,0x59,0x6c,0xa8,0x68,0xb5,0x58,0x83,0x9f,0xce,0x9f,0x65,0x11,0xdd,0xd8,0x3d,0x1c,0xcb,0x53,0xf8,0x2e,0x52,0x69,0xd5,0x59,0xa0,0x15,0x52,0x02,0x20,0x5b,0x91,0x73,0x47,0x29,0xd9,0x30,0x93,0xff,0x22,0x12,0x3c,0x4a,0x25,0x81,0x9d,0x7f,0xeb,0x66,0xa2,0x50,0x66,0x3f,0xc7,0x80,0xcb,0x66,0xfc,0x7b,0x6e,0x6d,0x17,
+  0x30,0x45,0x02,0x21,0x00,0x9c,0xde,0x6e,0x0e,0xde,0x0a,0x00,0x3f,0x02,0xfd,0xa0,0xa0,0x1b,0x59,0xfa,0xcf,0xe5,0xde,0xc0,0x63,0x31,0x8f,0x27,0x9c,0xe2,0xde,0x7a,0x9b,0x10,0x62,0xf7,0xb7,0x02,0x20,0x28,0x86,0xa5,0xb8,0xc6,0x79,0xbd,0xf8,0x22,0x4c,0x66,0xf9,0x08,0xfd,0x62,0x05,0x49,0x2c,0xb7,0x0b,0x00,0x68,0xd4,0x6a,0xe4,0xf3,0x3a,0x41,0x49,0xb1,0x2a,0x52,
+  0x30,0x45,0x02,0x21,0x00,0xc5,0x77,0x10,0x16,0xd0,0xdd,0x63,0x57,0x14,0x3c,0x89,0xf6,0x84,0xcd,0x74,0x04,0x23,0x50,0x25,0x54,0xc0,0xc5,0x9a,0xa8,0xc9,0x95,0x84,0xf1,0xff,0x38,0xf6,0x09,0x02,0x20,0x54,0xb4,0x05,0xf4,0x47,0x75,0x46,0x68,0x6e,0x46,0x4c,0x54,0x63,0xb4,0xfd,0x41,0x90,0x57,0x2e,0x58,0xd0,0xf7,0xe7,0x35,0x7f,0x6e,0x61,0x94,0x7d,0x20,0x71,0x5c,
+  0x30,0x45,0x02,0x21,0x00,0xa2,0x4e,0xbc,0x0e,0xc2,0x24,0xbd,0x67,0xae,0x39,0x7c,0xbe,0x6f,0xa3,0x7b,0x31,0x25,0xad,0xbd,0x34,0x89,0x1a,0xbe,0x2d,0x7c,0x73,0x56,0x92,0x19,0x16,0xdf,0xe6,0x02,0x20,0x34,0xf6,0xeb,0x63,0x74,0x73,0x1b,0xbb,0xaf,0xc4,0x92,0x4f,0xb8,0xb0,0xbd,0xcd,0xda,0x49,0x45,0x6d,0x72,0x4c,0xda,0xe6,0x17,0x8d,0x87,0x01,0x4c,0xb5,0x3d,0x8c,
+  0x30,0x44,0x02,0x20,0x25,0x57,0xd6,0x4a,0x7a,0xee,0x2e,0x09,0x31,0xc0,0x12,0xe4,0xfe,0xa1,0xcd,0x3a,0x2c,0x33,0x4e,0xda,0xe6,0x8c,0xde,0xb7,0x15,0x8c,0xaf,0x21,0xb6,0x8e,0x5a,0x24,0x02,0x20,0x7f,0x06,0xcd,0xbb,0x6a,0x90,0x02,0x3a,0x97,0x38,0x82,0xed,0x97,0xb0,0x80,0xfe,0x6b,0x05,0xaf,0x3e,0xc9,0x3d,0xb6,0xf1,0xa4,0x39,0x9a,0x69,0xed,0xf7,0x67,0x0d,
+  0x30,0x45,0x02,0x21,0x00,0xc4,0xf2,0xec,0xcb,0xb6,0xa2,0x43,0x50,0xc8,0x46,0x64,0x50,0xb9,0xd6,0x1b,0x20,0x7e,0xe3,0x59,0xe0,0x37,0xb3,0xdc,0xed,0xb4,0x2a,0x3f,0x2e,0x6d,0xd6,0xae,0xb5,0x02,0x20,0x32,0x63,0xc6,0xb5,0x9a,0x2f,0x55,0xcd,0xd1,0xc6,0xe1,0x48,0x94,0xd5,0xe5,0x96,0x3b,0x28,0xbc,0x3e,0x24,0x69,0xac,0x9b,0xa1,0x19,0x79,0x91,0xca,0x7f,0xf9,0xc7,
+  0x30,0x45,0x02,0x21,0x00,0xef,0xf0,0x47,0x81,0xc9,0xcb,0xcd,0x16,0x2d,0x0a,0x25,0xa6,0xe2,0xeb,0xcc,0xa4,0x35,0x06,0xc5,0x23,0x38,0x5c,0xb5,0x15,0xd4,0x9e,0xa3,0x8a,0x1b,0x12,0xfc,0xad,0x02,0x20,0x15,0xac,0xd7,0x31,0x94,0xc9,0x1a,0x95,0x47,0x85,0x34,0xf2,0x30,0x15,0xb6,0x72,0xeb,0xed,0x21,0x3e,0x45,0x42,0x4d,0xd2,0xc8,0xe2,0x6a,0xc8,0xb3,0xeb,0x34,0xa5,
+  0x30,0x45,0x02,0x21,0x00,0xf5,0x8b,0x4e,0x31,0x10,0xa6,0x4b,0xf1,0xb5,0xdb,0x97,0x63,0x9e,0xe0,0xe5,0xa9,0xc8,0xdf,0xa4,0x9d,0xc5,0x9b,0x67,0x98,0x91,0xf5,0x20,0xfd,0xf0,0x58,0x4c,0x87,0x02,0x20,0x2c,0xd8,0xfe,0x51,0x88,0x8a,0xee,0x9d,0xb3,0xe0,0x75,0x44,0x0f,0xd4,0xdb,0x73,0xb5,0xc7,0x32,0xfb,0x87,0xb5,0x10,0xe9,0x70,0x93,0xd6,0x64,0x15,0xf6,0x2a,0xf7,
+  0x30,0x45,0x02,0x21,0x00,0xf8,0xab,0xec,0xaa,0x4f,0x0c,0x50,0x2d,0xe4,0xbf,0x59,0x03,0xd4,0x84,0x17,0xf7,0x86,0xbf,0x92,0xe8,0xad,0x72,0xfe,0xc0,0xbd,0x7f,0xcb,0x78,0x00,0xc0,0xbb,0xe3,0x02,0x20,0x4c,0x7f,0x9e,0x23,0x10,0x76,0xa3,0x0b,0x7a,0xe3,0x6b,0x0c,0xeb,0xe6,0x9c,0xce,0xf1,0xcd,0x19,0x4f,0x7c,0xce,0x93,0xa5,0x58,0x8f,0xd6,0x81,0x4f,0x43,0x7c,0x0e,
+  0x30,0x44,0x02,0x20,0x5d,0x5b,0x38,0xbd,0x37,0xad,0x49,0x8b,0x22,0x27,0xa6,0x33,0x26,0x8a,0x8c,0xca,0x87,0x9a,0x5c,0x7c,0x94,0xa4,0xe4,0x16,0xbd,0x0a,0x61,0x4d,0x09,0xe6,0x06,0xd2,0x02,0x20,0x12,0xb8,0xd6,0x64,0xea,0x99,0x91,0x06,0x2e,0xcb,0xb8,0x34,0xe5,0x84,0x00,0xe2,0x5c,0x46,0x00,0x7a,0xf8,0x4f,0x60,0x07,0xd7,0xf1,0x68,0x54,0x43,0x26,0x9a,0xfe,
+  0x30,0x44,0x02,0x20,0x0c,0x1c,0xd9,0xfe,0x40,0x34,0xf0,0x86,0xa2,0xb5,0x2d,0x65,0xb9,0xd3,0x83,0x4d,0x72,0xae,0xbe,0x7f,0x33,0xdf,0xe8,0xf9,0x76,0xda,0x82,0x64,0x81,0x77,0xd8,0xe3,0x02,0x20,0x13,0x10,0x57,0x82,0xe3,0xd0,0xcf,0xe8,0x5c,0x27,0x78,0xde,0xc1,0xa8,0x48,0xb2,0x7a,0xc0,0xae,0x07,0x1a,0xa6,0xda,0x34,0x1a,0x95,0x53,0xa9,0x46,0xb4,0x1e,0x59,
+  0x30,0x45,0x02,0x21,0x00,0xae,0x79,0x35,0xfb,0x96,0xff,0x24,0x6b,0x7b,0x5d,0x56,0x62,0x87,0x0d,0x1b,0xa5,0x87,0xb0,0x3d,0x6e,0x13,0x60,0xba,0xf4,0x79,0x88,0xb5,0xc0,0x2c,0xcc,0x1a,0x5b,0x02,0x20,0x5f,0x00,0xc3,0x23,0x27,0x20,0x83,0x78,0x2d,0x4a,0x59,0xf2,0xdf,0xd6,0x5e,0x49,0xde,0x06,0x93,0x62,0x70,0x16,0x90,0x0e,0xf7,0xe6,0x14,0x28,0x05,0x66,0x64,0xb3,
+  0x30,0x44,0x02,0x20,0x00,0xa1,0x34,0xb5,0xc6,0xcc,0xbc,0xef,0xd4,0xc8,0x82,0xb9,0x45,0xba,0xeb,0x49,0x33,0x44,0x41,0x72,0x79,0x5f,0xa6,0x79,0x6a,0xae,0x14,0x90,0x67,0x54,0x70,0x98,0x02,0x20,0x56,0x6e,0x46,0x10,0x5d,0x24,0xd8,0x90,0x15,0x1e,0x3e,0xea,0x3e,0xbf,0x88,0xf5,0xb9,0x2b,0x3f,0x5e,0xc9,0x3a,0x21,0x77,0x65,0xa6,0xdc,0xbd,0x94,0xf2,0xc5,0x5b,
+  0x30,0x44,0x02,0x20,0x2e,0x47,0x21,0x36,0x3a,0xd3,0x99,0x2c,0x13,0x9e,0x5a,0x1c,0x26,0x39,0x5d,0x2c,0x2d,0x77,0x78,0x24,0xaa,0x24,0xfd,0xe0,0x75,0xe0,0xd7,0x38,0x11,0x71,0x30,0x9d,0x02,0x20,0x74,0x0f,0x7c,0x49,0x44,0x18,0xe1,0x30,0x0d,0xd4,0x51,0x2f,0x78,0x2a,0x58,0x80,0x0b,0xff,0x6a,0x7a,0xbd,0xfd,0xd2,0x0f,0xbb,0xd4,0xf0,0x55,0x15,0xca,0x1a,0x4f,
+  0x30,0x44,0x02,0x20,0x68,0x52,0xe9,0xd3,0xcd,0x9f,0xe3,0x73,0xc2,0xd5,0x04,0x87,0x79,0x67,0xd3,0x65,0xab,0x14,0x56,0x70,0x7b,0x68,0x17,0xa0,0x42,0x86,0x46,0x94,0xe1,0x96,0x0c,0xcf,0x02,0x20,0x06,0x4b,0x27,0xea,0x14,0x2b,0x30,0x88,0x7b,0x84,0xc8,0x6a,0xdc,0xcb,0x2f,0xa3,0x9a,0x69,0x11,0xad,0x21,0xfc,0x7e,0x81,0x9f,0x59,0x3b,0xe5,0x2b,0xc4,0xf3,0xbd,
+  0x30,0x44,0x02,0x20,0x18,0x8a,0x8c,0x56,0x48,0xdc,0x79,0xea,0xce,0x15,0x8c,0xf8,0x86,0xc6,0x2b,0x54,0x68,0xf0,0x5f,0xd9,0x5f,0x03,0xa7,0x63,0x5c,0x5b,0x4c,0x31,0xf0,0x9a,0xf4,0xc5,0x02,0x20,0x36,0x36,0x1a,0x0b,0x57,0x1a,0x00,0xc6,0xcd,0x5e,0x68,0x6c,0xcb,0xfc,0xfa,0x70,0x3c,0x4f,0x97,0xe4,0x89,0x38,0x34,0x6d,0x0c,0x10,0x3f,0xdc,0x76,0xdc,0x58,0x67,
+  0x30,0x45,0x02,0x21,0x00,0xa7,0x4f,0x1f,0xb9,0xa8,0x26,0x3f,0x62,0xfc,0x44,0x16,0xa5,0xb7,0xd5,0x84,0xf4,0x20,0x6f,0x39,0x96,0xbb,0x91,0xf6,0xfc,0x8e,0x73,0xb9,0xe9,0x2b,0xad,0x0e,0x13,0x02,0x20,0x68,0x15,0x03,0x2e,0x8c,0x7d,0x76,0xc3,0xab,0x06,0xa8,0x6f,0x33,0x24,0x9c,0xe9,0x94,0x01,0x48,0xcb,0x36,0xd1,0xf4,0x17,0xc2,0xe9,0x92,0xe8,0x01,0xaf,0xa3,0xfa,
+  0x30,0x44,0x02,0x20,0x07,0x24,0x48,0x65,0xb7,0x2f,0xf3,0x7e,0x62,0xe3,0x14,0x6f,0x0d,0xc1,0x46,0x82,0xba,0xdd,0x71,0x97,0x79,0x91,0x35,0xf0,0xb0,0x0a,0xde,0x76,0x71,0x74,0x2b,0xfe,0x02,0x20,0x0d,0x80,0xc2,0x23,0x8e,0xdb,0x4e,0x4a,0x7a,0x86,0xa8,0xc5,0x7c,0xa9,0xaf,0x17,0x11,0xf4,0x06,0xf7,0xf5,0xda,0x02,0x99,0xaa,0x04,0xe2,0x93,0x2d,0x96,0x07,0x54,
+  0x30,0x45,0x02,0x21,0x00,0xda,0x7f,0xdd,0x05,0xb5,0xba,0xda,0xbd,0x61,0x9d,0x80,0x5c,0x4e,0xe7,0xd9,0xa8,0x4f,0x84,0xdd,0xd5,0xcf,0x9c,0x5b,0xf4,0xd4,0x33,0x81,0x40,0xd6,0x89,0xef,0x08,0x02,0x20,0x28,0xf1,0xcf,0x4f,0xa1,0xc3,0xc5,0x86,0x2c,0xfa,0x14,0x9c,0x00,0x13,0xcf,0x5f,0xe6,0xcf,0x50,0x76,0xca,0xe0,0x00,0x51,0x10,0x63,0xe7,0xde,0x25,0xbb,0x38,0xe5,
+  0x30,0x45,0x02,0x21,0x00,0xd3,0x02,0x7c,0x65,0x6f,0x6d,0x4f,0xdf,0xd8,0xed,0xe2,0x20,0x93,0xe3,0xc3,0x03,0xb0,0x13,0x3c,0x34,0x0d,0x61,0x5e,0x77,0x56,0xf6,0x25,0x3a,0xea,0x92,0x72,0x38,0x02,0x20,0x09,0xae,0xf0,0x60,0xc8,0xe4,0xce,0xf9,0x72,0x97,0x40,0x11,0x55,0x8d,0xf1,0x44,0xfe,0xd2,0x5c,0xa6,0x9a,0xe8,0xd0,0xb2,0xea,0xf1,0xa8,0xfe,0xef,0xbe,0xc4,0x17,
+  0x30,0x44,0x02,0x20,0x0b,0xf6,0xc0,0x18,0x8d,0xc9,0x57,0x1c,0xd0,0xe2,0x1e,0xec,0xac,0x5f,0xbb,0x19,0xd2,0x43,0x49,0x88,0xe9,0xcc,0x10,0x24,0x45,0x93,0xef,0x3a,0x98,0x09,0x9f,0x69,0x02,0x20,0x48,0x64,0xa5,0x62,0x66,0x1f,0x92,0x21,0xec,0x88,0xe3,0xdd,0x0b,0xc2,0xf6,0xe2,0x7a,0xc1,0x28,0xc3,0x0c,0xc1,0xa8,0x0f,0x79,0xec,0x67,0x0a,0x22,0xb0,0x42,0xee,
+  0x30,0x45,0x02,0x21,0x00,0xae,0x45,0x96,0x40,0xd5,0xd1,0x17,0x9b,0xe4,0x7a,0x47,0xfa,0x53,0x8e,0x16,0xd9,0x4d,0xde,0xa5,0x58,0x5e,0x7a,0x24,0x48,0x04,0xa5,0x17,0x42,0xc6,0x86,0x44,0x3a,0x02,0x20,0x6c,0x8e,0x30,0xe5,0x30,0xa6,0x34,0xfa,0xe8,0x0b,0x3c,0xeb,0x06,0x29,0x78,0xb3,0x9e,0xdb,0xe1,0x97,0x77,0xe0,0xa2,0x45,0x53,0xb6,0x88,0x86,0x18,0x1f,0xd8,0x97,
+  0x30,0x44,0x02,0x20,0x1c,0xf3,0x51,0x7b,0xa3,0xbf,0x2a,0xb8,0xb9,0xea,0xd4,0xeb,0xb6,0xe8,0x66,0xcb,0x88,0xa1,0xde,0xac,0xb6,0xa7,0x85,0xd3,0xb6,0x3b,0x48,0x3c,0xa0,0x2a,0xc4,0x95,0x02,0x20,0x24,0x9a,0x79,0x8b,0x73,0x60,0x6f,0x55,0xf5,0xf1,0xc7,0x0d,0xe6,0x7c,0xb1,0xa0,0xcf,0xf9,0x5d,0x7d,0xc5,0x0b,0x3a,0x61,0x7d,0xf8,0x61,0xba,0xd3,0xc6,0xb1,0xc9,
+  0x30,0x45,0x02,0x21,0x00,0xe6,0x9b,0x52,0x38,0x26,0x5e,0xa3,0x5d,0x77,0xe4,0xdd,0x17,0x22,0x88,0xd8,0xce,0xa1,0x98,0x10,0xa1,0x02,0x92,0x61,0x7d,0x59,0x76,0x51,0x9d,0xc5,0x75,0x7c,0xb8,0x02,0x20,0x4b,0x03,0xc5,0xbc,0x47,0xe8,0x26,0xbd,0xb2,0x73,0x28,0xab,0xd3,0x8d,0x30,0x56,0xd7,0x74,0x76,0xb2,0x13,0x0f,0x3d,0xf6,0xec,0x48,0x91,0xaf,0x08,0xba,0x1e,0x29,
+  0x30,0x44,0x02,0x20,0x5f,0x9d,0x7d,0x7c,0x87,0x0d,0x08,0x5f,0xc1,0xd4,0x9f,0xff,0x69,0xe4,0xa2,0x75,0x81,0x28,0x00,0xd2,0xcf,0x89,0x73,0xe7,0x32,0x58,0x66,0xcb,0x40,0xfa,0x2b,0x6f,0x02,0x20,0x6d,0x1f,0x54,0x91,0xd9,0xf7,0x17,0xa5,0x97,0xa1,0x5f,0xd5,0x40,0x40,0x64,0x86,0xd7,0x6a,0x44,0x69,0x7b,0x3f,0x0d,0x9d,0x6d,0xce,0xf6,0x66,0x9f,0x8a,0x0a,0x56,
+  0x30,0x44,0x02,0x20,0x0a,0x7d,0x5b,0x19,0x59,0xf7,0x1d,0xf9,0xf8,0x17,0x14,0x6e,0xe4,0x9b,0xd5,0xc8,0x9b,0x43,0x1e,0x79,0x93,0xe2,0xfd,0xec,0xab,0x68,0x58,0x95,0x7d,0xa6,0x85,0xae,0x02,0x20,0x0f,0x8a,0xad,0x2d,0x25,0x46,0x90,0xbd,0xc1,0x3f,0x34,0xa4,0xfe,0xc4,0x4a,0x02,0xfd,0x74,0x5a,0x42,0x2d,0xf0,0x5c,0xcb,0xb5,0x46,0x35,0xa8,0xb8,0x6b,0x96,0x09,
+  0x30,0x44,0x02,0x20,0x79,0xe8,0x8b,0xf5,0x76,0xb7,0x4b,0xc0,0x7c,0xa1,0x42,0x39,0x5f,0xda,0x28,0xf0,0x3d,0x3d,0x5e,0x64,0x0b,0x0b,0x4f,0xf0,0x75,0x2c,0x6d,0x94,0xcd,0x55,0x34,0x08,0x02,0x20,0x32,0xce,0xa0,0x5b,0xd2,0xd7,0x06,0xc8,0xf6,0x03,0x6a,0x50,0x7e,0x2a,0xb7,0x76,0x60,0x04,0xf0,0x90,0x4e,0x2e,0x5c,0x58,0x62,0x74,0x9c,0x00,0x73,0x24,0x5d,0x6a,
+  0x30,0x45,0x02,0x21,0x00,0x9d,0x54,0xe0,0x37,0xa0,0x02,0x12,0xb3,0x77,0xbc,0x88,0x74,0x79,0x8b,0x8d,0xa0,0x80,0x56,0x4b,0xbd,0xf7,0xe0,0x75,0x91,0xb8,0x61,0x28,0x58,0x09,0xd0,0x14,0x88,0x02,0x20,0x18,0xb4,0xe5,0x57,0x66,0x7a,0x82,0xbd,0x95,0x96,0x5f,0x07,0x06,0xf8,0x1a,0x29,0x24,0x3f,0xbd,0xd8,0x69,0x68,0xa7,0xeb,0xeb,0x43,0x06,0x9d,0xb3,0xb1,0x8c,0x7f,
+  0x30,0x44,0x02,0x20,0x26,0x64,0xf1,0xff,0xa9,0x82,0xfe,0xdb,0xcc,0x7c,0xab,0x1b,0x8b,0xc6,0xe2,0xcb,0x42,0x02,0x18,0xd2,0xa6,0x07,0x7a,0xd0,0x8e,0x59,0x1b,0xa9,0xfe,0xab,0x33,0xbd,0x02,0x20,0x49,0xf5,0xc7,0xcb,0x51,0x5e,0x83,0x87,0x2a,0x3d,0x41,0xb4,0xcd,0xb8,0x5f,0x24,0x2a,0xd9,0xd6,0x1a,0x5b,0xfc,0x01,0xde,0xbf,0xbb,0x52,0xc6,0xc8,0x4b,0xa7,0x28,
+  0x30,0x44,0x02,0x20,0x58,0x27,0x51,0x83,0x44,0x84,0x4f,0xd6,0xa7,0xde,0x73,0xcb,0xb0,0xa6,0xbe,0xfd,0xea,0x7b,0x13,0xd2,0xde,0xe4,0x47,0x53,0x17,0xf0,0xf1,0x8f,0xfc,0x81,0x52,0x4b,0x02,0x20,0x4f,0x5c,0xcb,0x4e,0x0b,0x48,0x8b,0x5a,0x5d,0x76,0x0a,0xac,0xdd,0xb2,0xd7,0x91,0x97,0x0f,0xe4,0x3d,0xa6,0x1e,0xb3,0x0e,0x2e,0x90,0x20,0x8a,0x81,0x7e,0x46,0xdb,
+  0x30,0x45,0x02,0x21,0x00,0x97,0xab,0x19,0xbd,0x13,0x9c,0xac,0x31,0x93,0x25,0x86,0x92,0x18,0xb1,0xbc,0xe1,0x11,0x87,0x5d,0x63,0xfb,0x12,0x09,0x8a,0x04,0xb0,0xcd,0x59,0xb6,0xfd,0xd3,0xa3,0x02,0x20,0x43,0x1d,0x9c,0xea,0x3a,0x24,0x38,0x47,0x30,0x3c,0xeb,0xda,0x56,0x47,0x64,0x31,0xd0,0x34,0x33,0x9f,0x31,0xd7,0x85,0xee,0x88,0x52,0xdb,0x4f,0x04,0x0d,0x49,0x21,
+  0x30,0x44,0x02,0x20,0x52,0xc6,0x83,0x14,0x4e,0x44,0x11,0x9a,0xe2,0x01,0x37,0x49,0xd4,0x96,0x4e,0xf6,0x75,0x09,0x27,0x8f,0x6d,0x38,0xba,0x86,0x9a,0xdc,0xfa,0x69,0x97,0x0e,0x12,0x3d,0x02,0x20,0x34,0x79,0x91,0x01,0x67,0x40,0x8f,0x45,0xbd,0xa4,0x20,0xa6,0x26,0xec,0x9c,0x4e,0xc7,0x11,0xc1,0x27,0x4b,0xe0,0x92,0x19,0x8b,0x41,0x87,0xc0,0x18,0xb5,0x62,0xca,
+  0x30,0x16,0x02,0x11,0x01,0x45,0x51,0x23,0x19,0x50,0xb7,0x5f,0xc4,0x40,0x2d,0xa1,0x72,0x2f,0xc9,0xba,0xeb,0x02,0x01,0x03,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xff,0xff,0xfc,0x2c,0x02,0x01,0x03,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x3f,0x02,0x01,0x03,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x3e,0x9a,0x75,0x82,0x88,0x60,0x89,0xc6,0x2f,0xb8,0x40,0xcf,0x3b,0x83,0x06,0x1c,0xd1,0xcf,0xf3,0xae,0x43,0x41,0x80,0x8b,0xb5,0xbd,0xee,0x61,0x91,0x17,0x41,0x77,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x24,0x23,0x8e,0x70,0xb4,0x31,0xb1,0xa6,0x4e,0xfd,0xf9,0x03,0x26,0x69,0x93,0x9d,0x4b,0x77,0xf2,0x49,0x50,0x3f,0xc6,0x90,0x5f,0xeb,0x75,0x40,0xde,0xa3,0xe6,0xd2,
+  0x30,0x06,0x02,0x01,0x01,0x02,0x01,0x01,
+  0x30,0x06,0x02,0x01,0x01,0x02,0x01,0x02,
+  0x30,0x06,0x02,0x01,0x01,0x02,0x01,0x03,
+  0x30,0x06,0x02,0x01,0x02,0x02,0x01,0x01,
+  0x30,0x06,0x02,0x01,0x02,0x02,0x01,0x02,
+  0x30,0x06,0x02,0x01,0x02,0x02,0x01,0x03,
+  0x30,0x26,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x41,0x43,0x02,0x01,0x03,
+  0x30,0x08,0x02,0x01,0x02,0x02,0x03,0xed,0x29,0x79,
+  0x30,0x26,0x02,0x02,0x01,0x01,0x02,0x20,0x3a,0x74,0xe9,0xd3,0xa7,0x4e,0x9d,0x3a,0x74,0xe9,0xd3,0xa7,0x4e,0x9d,0x3a,0x74,0x9f,0x8a,0xb3,0x73,0x2a,0x0a,0x89,0x60,0x4a,0x09,0xbc,0xe5,0xb2,0x91,0x6d,0xa4,
+  0x30,0x2b,0x02,0x07,0x2d,0x9b,0x4d,0x34,0x79,0x52,0xcc,0x02,0x20,0x03,0x43,0xae,0xfc,0x2f,0x25,0xd9,0x8b,0x88,0x2e,0x86,0xeb,0x9e,0x30,0xd5,0x5a,0x6e,0xb5,0x08,0xb5,0x16,0x51,0x0b,0x34,0x02,0x4a,0xe4,0xb6,0x36,0x23,0x30,0xb3,
+  0x30,0x31,0x02,0x0d,0x10,0x33,0xe6,0x7e,0x37,0xb3,0x2b,0x44,0x55,0x80,0xbf,0x4e,0xfc,0x02,0x20,0x6f,0x90,0x6f,0x90,0x6f,0x90,0x6f,0x90,0x6f,0x90,0x6f,0x90,0x6f,0x90,0x6f,0x8f,0xe1,0xca,0xb5,0xee,0xfd,0xb2,0x14,0x06,0x1d,0xce,0x3b,0x22,0x78,0x9f,0x1d,0x6f,
+  0x30,0x26,0x02,0x02,0x01,0x01,0x02,0x20,0x78,0x32,0x66,0xe9,0x0f,0x43,0xda,0xfe,0x5c,0xd9,0xb3,0xb0,0xbe,0x86,0xde,0x22,0xf9,0xde,0x83,0x67,0x7d,0x0f,0x50,0x71,0x3a,0x46,0x8e,0xc7,0x2f,0xcf,0x5d,0x57,
+  0x30,0x31,0x02,0x0d,0x06,0x25,0x22,0xbb,0xd3,0xec,0xbe,0x7c,0x39,0xe9,0x3e,0x7c,0x26,0x02,0x20,0x78,0x32,0x66,0xe9,0x0f,0x43,0xda,0xfe,0x5c,0xd9,0xb3,0xb0,0xbe,0x86,0xde,0x22,0xf9,0xde,0x83,0x67,0x7d,0x0f,0x50,0x71,0x3a,0x46,0x8e,0xc7,0x2f,0xcf,0x5d,0x57,
+  0x30,0x45,0x02,0x21,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,0xba,0xae,0xdc,0xe6,0xaf,0x48,0xa0,0x3b,0xbf,0xd2,0x5e,0x8c,0xd0,0x36,0x40,0xc1,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc0,
+  0x30,0x16,0x02,0x09,0x00,0x9c,0x44,0xfe,0xbf,0x31,0xc3,0x59,0x4d,0x02,0x09,0x00,0x83,0x9e,0xd2,0x82,0x47,0xc2,0xb0,0x6b,
+  0x30,0x1e,0x02,0x0d,0x09,0xdf,0x8b,0x68,0x24,0x30,0xbe,0xef,0x6f,0x5f,0xd7,0xc7,0xcf,0x02,0x0d,0x0f,0xd0,0xa6,0x2e,0x13,0x77,0x8f,0x42,0x22,0xa0,0xd6,0x1c,0x8a,
+  0x30,0x26,0x02,0x11,0x00,0x8a,0x59,0x8e,0x56,0x3a,0x89,0xf5,0x26,0xc3,0x2e,0xbe,0xc8,0xde,0x26,0x36,0x7a,0x02,0x11,0x00,0x84,0xf6,0x33,0xe2,0x04,0x26,0x30,0xe9,0x9d,0xd0,0xf1,0xe1,0x6f,0x7a,0x04,0xbf,
+  0x30,0x2e,0x02,0x15,0x00,0xaa,0x6e,0xeb,0x58,0x23,0xf7,0xfa,0x31,0xb4,0x66,0xbb,0x47,0x37,0x97,0xf0,0xd0,0x31,0x4c,0x0b,0xdf,0x02,0x15,0x00,0xe2,0x97,0x7c,0x47,0x9e,0x6d,0x25,0x70,0x3c,0xeb,0xbc,0x6b,0xd5,0x61,0x93,0x8c,0xc9,0xd1,0xbf,0xb9,
+  0x30,0x25,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x01,0x01,
+  0x30,0x25,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x01,0x00,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x41,0x9d,0x98,0x1c,0x51,0x5a,0xf8,0xcc,0x82,0x54,0x5a,0xac,0x0c,0x85,0xe9,0xe3,0x08,0xfb,0xb2,0xea,0xb6,0xac,0xd7,0xed,0x49,0x7e,0x0b,0x41,0x45,0xa1,0x8f,0xd9,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x1b,0x21,0x71,0x7a,0xd7,0x1d,0x23,0xbb,0xac,0x60,0xa9,0xad,0x0b,0xaf,0x75,0xb0,0x63,0xc9,0xfd,0xf5,0x2a,0x00,0xeb,0xf9,0x9d,0x02,0x21,0x72,0x91,0x09,0x93,0xc9,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x2f,0x58,0x8f,0x66,0x01,0x8f,0x3d,0xd1,0x4d,0xb3,0xe2,0x8e,0x77,0x99,0x64,0x87,0xe3,0x24,0x86,0xb5,0x21,0xed,0x8e,0x5a,0x20,0xf0,0x65,0x91,0x95,0x17,0x77,0xe9,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x09,0x1a,0x08,0x87,0x0f,0xf4,0xda,0xf9,0x12,0x3b,0x30,0xc2,0x0e,0x8c,0x4f,0xc8,0x50,0x57,0x58,0xdc,0xf4,0x07,0x4f,0xca,0xff,0x21,0x70,0xc9,0xbf,0xcf,0x74,0xf4,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x7c,0x37,0x0d,0xc0,0xce,0x8c,0x59,0xa8,0xb2,0x73,0xcb,0xa4,0x4a,0x7c,0x11,0x91,0xfc,0x31,0x86,0xdc,0x03,0xca,0xb9,0x6b,0x05,0x67,0x31,0x2d,0xf0,0xd0,0xb2,0x50,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x70,0xb5,0x9a,0x7d,0x1e,0xe7,0x7a,0x2f,0x9e,0x04,0x91,0xc2,0xa7,0xcf,0xcd,0x0e,0xd0,0x4d,0xf4,0xa3,0x51,0x92,0xf6,0x13,0x2d,0xcc,0x66,0x8c,0x79,0xa6,0x16,0x0e,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x27,0x36,0xd7,0x6e,0x41,0x22,0x46,0xe0,0x97,0x14,0x8e,0x2b,0xf6,0x29,0x15,0x61,0x4e,0xb7,0xc4,0x28,0x91,0x3a,0x58,0xeb,0x5e,0x9c,0xd4,0x67,0x4a,0x94,0x23,0xde,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x4a,0x1e,0x12,0x83,0x1f,0xbe,0x93,0x62,0x7b,0x02,0xd6,0xe7,0xf2,0x4b,0xcc,0xdd,0x6e,0xf4,0xb2,0xd0,0xf4,0x67,0x39,0xea,0xf3,0xb1,0xea,0xf0,0xca,0x11,0x77,0x70,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x06,0xc7,0x78,0xd4,0xdf,0xff,0x7d,0xee,0x06,0xed,0x88,0xbc,0x4e,0x0e,0xd3,0x4f,0xc5,0x53,0xaa,0xd6,0x7c,0xaf,0x79,0x6f,0x2a,0x1c,0x64,0x87,0xc1,0xb2,0xe8,0x77,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x4d,0xe4,0x59,0xef,0x91,0x59,0xaf,0xa0,0x57,0xfe,0xb3,0xec,0x40,0xfe,0xf0,0x1c,0x45,0xb8,0x09,0xf4,0xab,0x29,0x6e,0xa4,0x8c,0x20,0x6d,0x42,0x49,0xa2,0xb4,0x51,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x74,0x5d,0x29,0x49,0x78,0x00,0x73,0x02,0x03,0x35,0x02,0xe1,0xac,0xc4,0x8b,0x63,0xae,0x65,0x00,0xbe,0x43,0xad,0xbe,0xa1,0xb2,0x58,0xd6,0xb4,0x23,0xdb,0xb4,0x16,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x7b,0x2a,0x78,0x5e,0x38,0x96,0xf5,0x9b,0x2d,0x69,0xda,0x57,0x64,0x8e,0x80,0xad,0x3c,0x13,0x3a,0x75,0x0a,0x28,0x47,0xfd,0x20,0x98,0xcc,0xd9,0x02,0x04,0x2b,0x6c,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x71,0xae,0x94,0xa7,0x2c,0xa8,0x96,0x87,0x5e,0x7a,0xa4,0xa4,0xc3,0xd2,0x9a,0xfd,0xb4,0xb3,0x5b,0x69,0x96,0x27,0x3e,0x63,0xc4,0x7a,0xc5,0x19,0x25,0x6c,0x5e,0xb1,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x0f,0xa5,0x27,0xfa,0x73,0x43,0xc0,0xbc,0x9e,0xc3,0x5a,0x62,0x78,0xbf,0xbf,0xf4,0xd8,0x33,0x01,0xb1,0x54,0xfc,0x4b,0xd1,0x4a,0xee,0x7e,0xb9,0x34,0x45,0xb5,0xf9,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc1,0x02,0x20,0x65,0x39,0xc0,0xad,0xad,0xd0,0x52,0x5f,0xf4,0x26,0x22,0x16,0x4c,0xe9,0x31,0x43,0x48,0xbd,0x08,0x63,0xb4,0xc8,0x0e,0x93,0x6b,0x23,0xca,0x04,0x14,0x26,0x46,0x71,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x5d,0x57,0x6e,0x73,0x57,0xa4,0x50,0x1d,0xdf,0xe9,0x2f,0x46,0x68,0x1b,0x20,0xa0,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc0,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x5d,0x57,0x6e,0x73,0x57,0xa4,0x50,0x1d,0xdf,0xe9,0x2f,0x46,0x68,0x1b,0x20,0xa0,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x5d,0x57,0x6e,0x73,0x57,0xa4,0x50,0x1d,0xdf,0xe9,0x2f,0x46,0x68,0x1b,0x20,0xa0,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x5d,0x57,0x6e,0x73,0x57,0xa4,0x50,0x1d,0xdf,0xe9,0x2f,0x46,0x68,0x1b,0x20,0xa0,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x5d,0x57,0x6e,0x73,0x57,0xa4,0x50,0x1d,0xdf,0xe9,0x2f,0x46,0x68,0x1b,0x20,0xa1,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xb8,0x02,0x20,0x44,0xa5,0xad,0x0b,0xd0,0x63,0x6d,0x9e,0x12,0xbc,0x9e,0x0a,0x6b,0xdd,0x5e,0x1b,0xba,0x77,0xf5,0x23,0x84,0x21,0x93,0xb3,0xb8,0x2e,0x44,0x8e,0x05,0xd5,0xf1,0x1e,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xb8,0x02,0x20,0x44,0xa5,0xad,0x0b,0xd0,0x63,0x6d,0x9e,0x12,0xbc,0x9e,0x0a,0x6b,0xdd,0x5e,0x1b,0xba,0x77,0xf5,0x23,0x84,0x21,0x93,0xb3,0xb8,0x2e,0x44,0x8e,0x05,0xd5,0xf1,0x1e,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xb8,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xb8,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xb8,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xb8,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x16,0xe1,0xe4,0x59,0x45,0x76,0x79,0xdf,0x5b,0x94,0x34,0xae,0x23,0xf4,0x74,0xb3,0xe8,0xd2,0xa7,0x0b,0xd6,0xb5,0xdb,0xe6,0x92,0xba,0x16,0xda,0x01,0xf1,0xfb,0x0a,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x1c,0x94,0x0f,0x31,0x3f,0x92,0x64,0x7b,0xe2,0x57,0xec,0xcd,0x7e,0xd0,0x8b,0x0b,0xae,0xf3,0xf0,0x47,0x8f,0x25,0x87,0x1b,0x53,0x63,0x53,0x02,0xc5,0xf6,0x31,0x4a,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x15,0xd9,0x4a,0x85,0x07,0x7b,0x49,0x3f,0x91,0xcb,0x71,0x01,0xec,0x63,0xe1,0xb0,0x1b,0xe5,0x8b,0x59,0x4e,0x85,0x5f,0x45,0x05,0x0a,0x8c,0x14,0x06,0x2d,0x68,0x9b,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x5b,0x1d,0x27,0xa7,0x69,0x4c,0x14,0x62,0x44,0xa5,0xad,0x0b,0xd0,0x63,0x6d,0x9d,0x9e,0xf3,0xb9,0xfb,0x58,0x38,0x54,0x18,0xd9,0xc9,0x82,0x10,0x50,0x77,0xd1,0xb7,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x2d,0x85,0x89,0x6b,0x3e,0xb9,0xdb,0xb5,0xa5,0x2f,0x42,0xf9,0xc9,0x26,0x1e,0xd3,0xfc,0x46,0x64,0x4e,0xc6,0x5f,0x06,0xad,0xe3,0xfd,0x78,0xf2,0x57,0xe4,0x34,0x32,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x5b,0x0b,0x12,0xd6,0x7d,0x73,0xb7,0x6b,0x4a,0x5e,0x85,0xf3,0x92,0x4c,0x3d,0xa7,0xf8,0x8c,0xc8,0x9d,0x8c,0xbe,0x0d,0x5b,0xc7,0xfa,0xf1,0xe4,0xaf,0xc8,0x68,0x64,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x69,0x4c,0x14,0x62,0x44,0xa5,0xad,0x0b,0xd0,0x63,0x6d,0x9e,0x12,0xbc,0x9e,0x09,0xe6,0x0e,0x68,0xb9,0x0d,0x0b,0x5e,0x6c,0x5d,0xdd,0xd0,0xcb,0x69,0x4d,0x87,0x99,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x3d,0x7f,0x48,0x7c,0x07,0xbf,0xc5,0xf3,0x08,0x46,0x93,0x8a,0x3d,0xce,0xf6,0x96,0x44,0x47,0x07,0xcf,0x96,0x77,0x25,0x4a,0x92,0xb0,0x6c,0x63,0xab,0x86,0x7d,0x22,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x6c,0x76,0x48,0xfc,0x0f,0xbf,0x8a,0x06,0xad,0xb8,0xb8,0x39,0xf9,0x7b,0x4f,0xf7,0xa8,0x00,0xf1,0x1b,0x1e,0x37,0xc5,0x93,0xb2,0x61,0x39,0x45,0x99,0x79,0x2b,0xa4,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x64,0x1c,0x9c,0x5d,0x79,0x0d,0xc0,0x9c,0xdd,0x3d,0xfa,0xbb,0x62,0xcd,0xf4,0x53,0xe6,0x97,0x47,0xa7,0xe3,0xd7,0xaa,0x1a,0x71,0x41,0x89,0xef,0x53,0x17,0x1a,0x99,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x29,0x79,0x8c,0x5c,0x45,0xbd,0xf5,0x8b,0x4a,0x7b,0x2f,0xdc,0x2c,0x46,0xab,0x4a,0xf1,0x21,0x8c,0x7e,0xeb,0x9f,0x0f,0x27,0xa8,0x8f,0x12,0x67,0x67,0x4d,0xe3,0xb0,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x0b,0x70,0xf2,0x2c,0xa2,0xbb,0x3c,0xef,0xad,0xca,0x1a,0x57,0x11,0xfa,0x3a,0x59,0xf4,0x69,0x53,0x85,0xeb,0x5a,0xed,0xf3,0x49,0x5d,0x0b,0x6d,0x00,0xf8,0xfd,0x85,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x16,0xe1,0xe4,0x59,0x45,0x76,0x79,0xdf,0x5b,0x94,0x34,0xae,0x23,0xf4,0x74,0xb3,0xe8,0xd2,0xa7,0x0b,0xd6,0xb5,0xdb,0xe6,0x92,0xba,0x16,0xda,0x01,0xf1,0xfb,0x0a,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x22,0x52,0xd6,0x85,0xe8,0x31,0xb6,0xcf,0x09,0x5e,0x4f,0x05,0x35,0xee,0xaf,0x0d,0xdd,0x3b,0xfa,0x91,0xc2,0x10,0xc9,0xd9,0xdc,0x17,0x22,0x47,0x02,0xea,0xf8,0x8f,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x75,0x13,0x5a,0xbd,0x7c,0x42,0x5b,0x60,0x37,0x1a,0x47,0x7f,0x09,0xce,0x0f,0x27,0x4f,0x64,0xa8,0xc6,0xb0,0x61,0xa0,0x7b,0x5d,0x63,0xe9,0x3c,0x65,0x04,0x6c,0x53,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x2a,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0x3e,0x3a,0x49,0xa2,0x3a,0x6d,0x8a,0xbe,0x95,0x46,0x1f,0x84,0x45,0x67,0x6b,0x17,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x3e,0x88,0x83,0x77,0xac,0x6c,0x71,0xac,0x9d,0xec,0x3f,0xdb,0x9b,0x56,0xc9,0xfe,0xaf,0x0c,0xfa,0xca,0x9f,0x82,0x7f,0xc5,0xeb,0x65,0xfc,0x3e,0xac,0x81,0x12,0x10,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x30,0xbb,0xb7,0x94,0xdb,0x58,0x83,0x63,0xb4,0x06,0x79,0xf6,0xc1,0x82,0xa5,0x0d,0x3c,0xe9,0x67,0x9a,0xcd,0xd3,0xff,0xbe,0x36,0xd7,0x81,0x3d,0xac,0xbd,0xc8,0x18,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x2c,0x37,0xfd,0x99,0x56,0x22,0xc4,0xfb,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xc7,0xce,0xe7,0x45,0x11,0x0c,0xb4,0x5a,0xb5,0x58,0xed,0x7c,0x90,0xc1,0x5a,0x2f,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x7f,0xd9,0x95,0x62,0x2c,0x4f,0xb7,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x5d,0x88,0x3f,0xfa,0xb5,0xb3,0x26,0x52,0xcc,0xdc,0xaa,0x29,0x0f,0xcc,0xb9,0x7d,
+  0x30,0x43,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x1f,0x4c,0xd5,0x3b,0xa7,0x60,0x8f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x9e,0x5c,0xf1,0x43,0xe2,0x53,0x96,0x26,0x19,0x0a,0x3a,0xb0,0x9c,0xce,0x47,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x56,0x22,0xc4,0xfb,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x92,0x8a,0x8f,0x1c,0x7a,0xc7,0xbe,0xc1,0x80,0x8b,0x9f,0x61,0xc0,0x1e,0xc3,0x27,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x44,0x10,0x41,0x04,0x10,0x41,0x04,0x10,0x41,0x04,0x10,0x41,0x04,0x10,0x41,0x03,0xb8,0x78,0x53,0xfd,0x3b,0x7d,0x3f,0x8e,0x17,0x51,0x25,0xb4,0x38,0x2f,0x25,0xed,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x27,0x39,0xce,0x73,0x9c,0xe7,0x39,0xce,0x73,0x9c,0xe7,0x39,0xce,0x73,0x9c,0xe7,0x05,0x56,0x02,0x98,0xd1,0xf2,0xf0,0x8d,0xc4,0x19,0xac,0x27,0x3a,0x5b,0x54,0xd9,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x48,0x88,0x88,0x88,0x88,0x88,0x88,0x88,0x88,0x88,0x88,0x88,0x88,0x88,0x88,0x88,0x31,0xc8,0x3a,0xe8,0x2e,0xbe,0x08,0x98,0x77,0x6b,0x4c,0x69,0xd1,0x1f,0x88,0xde,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x64,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x06,0xdd,0x3a,0x19,0xb8,0xd5,0xfb,0x87,0x52,0x35,0x96,0x3c,0x59,0x3b,0xd2,0xd3,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x6a,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0x3e,0x3a,0x49,0xa2,0x3a,0x6d,0x8a,0xbe,0x95,0x46,0x1f,0x84,0x45,0x67,0x6b,0x15,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x2a,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0x3e,0x3a,0x49,0xa2,0x3a,0x6d,0x8a,0xbe,0x95,0x46,0x1f,0x84,0x45,0x67,0x6b,0x17,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x3f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,
+  0x30,0x44,0x02,0x20,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc,0x02,0x20,0x18,0x5d,0xdb,0xca,0x6d,0xac,0x41,0xb1,0xda,0x03,0x3c,0xfb,0x60,0xc1,0x52,0x86,0x9e,0x74,0xb3,0xcd,0x66,0xe9,0xff,0xdf,0x1b,0x6b,0xc0,0x9e,0xd6,0x5e,0xe4,0x0c,
+  0x30,0x44,0x02,0x20,0x32,0xb0,0xd1,0x0d,0x8d,0x0e,0x04,0xbc,0x8d,0x4d,0x06,0x4d,0x27,0x06,0x99,0xe8,0x7c,0xff,0xc9,0xb4,0x9c,0x5c,0x20,0x73,0x0e,0x1c,0x26,0xf6,0x10,0x5d,0xdc,0xda,0x02,0x20,0x29,0xed,0x3d,0x67,0xb3,0xd5,0x05,0xbe,0x95,0x58,0x0d,0x77,0xd5,0xb7,0x92,0xb4,0x36,0x88,0x11,0x79,0xb2,0xb6,0xb2,0xe0,0x4c,0x5f,0xe5,0x92,0xd3,0x8d,0x82,0xd9,
+  0x30,0x44,0x02,0x20,0x32,0xb0,0xd1,0x0d,0x8d,0x0e,0x04,0xbc,0x8d,0x4d,0x06,0x4d,0x27,0x06,0x99,0xe8,0x7c,0xff,0xc9,0xb4,0x9c,0x5c,0x20,0x73,0x0e,0x1c,0x26,0xf6,0x10,0x5d,0xdc,0xda,0x02,0x20,0x29,0xed,0x3d,0x67,0xb3,0xd5,0x05,0xbe,0x95,0x58,0x0d,0x77,0xd5,0xb7,0x92,0xb4,0x36,0x88,0x11,0x79,0xb2,0xb6,0xb2,0xe0,0x4c,0x5f,0xe5,0x92,0xd3,0x8d,0x82,0xd9,
+  0x30,0x44,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc0,0x02,0x20,0x33,0x33,0x33,0x33,0x33,0x33,0x33,0x33,0x33,0x33,0x33,0x33,0x33,0x33,0x33,0x32,0xf2,0x22,0xf8,0xfa,0xef,0xdb,0x53,0x3f,0x26,0x5d,0x46,0x1c,0x29,0xa4,0x73,0x73,
+  0x30,0x45,0x02,0x21,0x00,0xc6,0x04,0x7f,0x94,0x41,0xed,0x7d,0x6d,0x30,0x45,0x40,0x6e,0x95,0xc0,0x7c,0xd8,0x5c,0x77,0x8e,0x4b,0x8c,0xef,0x3c,0xa7,0xab,0xac,0x09,0xb9,0x5c,0x70,0x9e,0xe5,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc0,
+  0x30,0x45,0x02,0x21,0x00,0xc6,0x04,0x7f,0x94,0x41,0xed,0x7d,0x6d,0x30,0x45,0x40,0x6e,0x95,0xc0,0x7c,0xd8,0x5c,0x77,0x8e,0x4b,0x8c,0xef,0x3c,0xa7,0xab,0xac,0x09,0xb9,0x5c,0x70,0x9e,0xe5,0x02,0x20,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x48,0xc7,0x9f,0xac,0xd4,0x32,0x14,0xc0,0x11,0x12,0x3c,0x1b,0x03,0xa9,0x34,0x12,0xa5,
+  0x30,0x45,0x02,0x21,0x00,0xc6,0x04,0x7f,0x94,0x41,0xed,0x7d,0x6d,0x30,0x45,0x40,0x6e,0x95,0xc0,0x7c,0xd8,0x5c,0x77,0x8e,0x4b,0x8c,0xef,0x3c,0xa7,0xab,0xac,0x09,0xb9,0x5c,0x70,0x9e,0xe5,0x02,0x20,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x65,0xe4,0x45,0xf1,0xf5,0xdf,0xb6,0xa6,0x7e,0x4c,0xba,0x8c,0x38,0x53,0x48,0xe6,0xe7,
+  0x30,0x45,0x02,0x21,0x00,0xc6,0x04,0x7f,0x94,0x41,0xed,0x7d,0x6d,0x30,0x45,0x40,0x6e,0x95,0xc0,0x7c,0xd8,0x5c,0x77,0x8e,0x4b,0x8c,0xef,0x3c,0xa7,0xab,0xac,0x09,0xb9,0x5c,0x70,0x9e,0xe5,0x02,0x20,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x65,0xe4,0x45,0xf1,0xf5,0xdf,0xb6,0xa6,0x7e,0x4c,0xba,0x8c,0x38,0x53,0x48,0xe6,0xe7,
+  0x30,0x45,0x02,0x21,0x00,0xc6,0x04,0x7f,0x94,0x41,0xed,0x7d,0x6d,0x30,0x45,0x40,0x6e,0x95,0xc0,0x7c,0xd8,0x5c,0x77,0x8e,0x4b,0x8c,0xef,0x3c,0xa7,0xab,0xac,0x09,0xb9,0x5c,0x70,0x9e,0xe5,0x02,0x20,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x48,0xc7,0x9f,0xac,0xd4,0x32,0x14,0xc0,0x11,0x12,0x3c,0x1b,0x03,0xa9,0x34,0x12,0xa5,
+  0x30,0x45,0x02,0x21,0x00,0xc6,0x04,0x7f,0x94,0x41,0xed,0x7d,0x6d,0x30,0x45,0x40,0x6e,0x95,0xc0,0x7c,0xd8,0x5c,0x77,0x8e,0x4b,0x8c,0xef,0x3c,0xa7,0xab,0xac,0x09,0xb9,0x5c,0x70,0x9e,0xe5,0x02,0x20,0x0e,0xb1,0x0e,0x5a,0xb9,0x5f,0x2f,0x27,0x53,0x48,0xd8,0x2a,0xd2,0xe4,0xd7,0x94,0x9c,0x81,0x93,0x80,0x0d,0x8c,0x9c,0x75,0xdf,0x58,0xe3,0x43,0xf0,0xeb,0xba,0x7b,
+  0x30,0x44,0x02,0x20,0x79,0xbe,0x66,0x7e,0xf9,0xdc,0xbb,0xac,0x55,0xa0,0x62,0x95,0xce,0x87,0x0b,0x07,0x02,0x9b,0xfc,0xdb,0x2d,0xce,0x28,0xd9,0x59,0xf2,0x81,0x5b,0x16,0xf8,0x17,0x98,0x02,0x20,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x55,0x54,0xe8,0xe4,0xf4,0x4c,0xe5,0x18,0x35,0x69,0x3f,0xf0,0xca,0x2e,0xf0,0x12,0x15,0xc0,
+  0x30,0x44,0x02,0x20,0x79,0xbe,0x66,0x7e,0xf9,0xdc,0xbb,0xac,0x55,0xa0,0x62,0x95,0xce,0x87,0x0b,0x07,0x02,0x9b,0xfc,0xdb,0x2d,0xce,0x28,0xd9,0x59,0xf2,0x81,0x5b,0x16,0xf8,0x17,0x98,0x02,0x20,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x48,0xc7,0x9f,0xac,0xd4,0x32,0x14,0xc0,0x11,0x12,0x3c,0x1b,0x03,0xa9,0x34,0x12,0xa5,
+  0x30,0x44,0x02,0x20,0x79,0xbe,0x66,0x7e,0xf9,0xdc,0xbb,0xac,0x55,0xa0,0x62,0x95,0xce,0x87,0x0b,0x07,0x02,0x9b,0xfc,0xdb,0x2d,0xce,0x28,0xd9,0x59,0xf2,0x81,0x5b,0x16,0xf8,0x17,0x98,0x02,0x20,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x65,0xe4,0x45,0xf1,0xf5,0xdf,0xb6,0xa6,0x7e,0x4c,0xba,0x8c,0x38,0x53,0x48,0xe6,0xe7,
+  0x30,0x44,0x02,0x20,0x79,0xbe,0x66,0x7e,0xf9,0xdc,0xbb,0xac,0x55,0xa0,0x62,0x95,0xce,0x87,0x0b,0x07,0x02,0x9b,0xfc,0xdb,0x2d,0xce,0x28,0xd9,0x59,0xf2,0x81,0x5b,0x16,0xf8,0x17,0x98,0x02,0x20,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x66,0x65,0xe4,0x45,0xf1,0xf5,0xdf,0xb6,0xa6,0x7e,0x4c,0xba,0x8c,0x38,0x53,0x48,0xe6,0xe7,
+  0x30,0x44,0x02,0x20,0x79,0xbe,0x66,0x7e,0xf9,0xdc,0xbb,0xac,0x55,0xa0,0x62,0x95,0xce,0x87,0x0b,0x07,0x02,0x9b,0xfc,0xdb,0x2d,0xce,0x28,0xd9,0x59,0xf2,0x81,0x5b,0x16,0xf8,0x17,0x98,0x02,0x20,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x48,0xc7,0x9f,0xac,0xd4,0x32,0x14,0xc0,0x11,0x12,0x3c,0x1b,0x03,0xa9,0x34,0x12,0xa5,
+  0x30,0x44,0x02,0x20,0x79,0xbe,0x66,0x7e,0xf9,0xdc,0xbb,0xac,0x55,0xa0,0x62,0x95,0xce,0x87,0x0b,0x07,0x02,0x9b,0xfc,0xdb,0x2d,0xce,0x28,0xd9,0x59,0xf2,0x81,0x5b,0x16,0xf8,0x17,0x98,0x02,0x20,0x0e,0xb1,0x0e,0x5a,0xb9,0x5f,0x2f,0x27,0x53,0x48,0xd8,0x2a,0xd2,0xe4,0xd7,0x94,0x9c,0x81,0x93,0x80,0x0d,0x8c,0x9c,0x75,0xdf,0x58,0xe3,0x43,0xf0,0xeb,0xba,0x7b,
+  0x30,0x45,0x02,0x21,0x00,0xbb,0x5a,0x52,0xf4,0x2f,0x9c,0x92,0x61,0xed,0x43,0x61,0xf5,0x94,0x22,0xa1,0xe3,0x00,0x36,0xe7,0xc3,0x2b,0x27,0x0c,0x88,0x07,0xa4,0x19,0xfe,0xca,0x60,0x50,0x23,0x02,0x20,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x63,0xcf,0xd6,0x6a,0x19,0x0a,0x60,0x08,0x89,0x1e,0x0d,0x81,0xd4,0x9a,0x09,0x52,
+  0x30,0x44,0x02,0x20,0x44,0xa5,0xad,0x0b,0xd0,0x63,0x6d,0x9e,0x12,0xbc,0x9e,0x0a,0x6b,0xdd,0x5e,0x1b,0xba,0x77,0xf5,0x23,0x84,0x21,0x93,0xb3,0xb8,0x2e,0x44,0x8e,0x05,0xd5,0xf1,0x1e,0x02,0x20,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x63,0xcf,0xd6,0x6a,0x19,0x0a,0x60,0x08,0x89,0x1e,0x0d,0x81,0xd4,0x9a,0x09,0x52,
+  0x30,0x45,0x02,0x21,0x00,0xbb,0x5a,0x52,0xf4,0x2f,0x9c,0x92,0x61,0xed,0x43,0x61,0xf5,0x94,0x22,0xa1,0xe3,0x00,0x36,0xe7,0xc3,0x2b,0x27,0x0c,0x88,0x07,0xa4,0x19,0xfe,0xca,0x60,0x50,0x23,0x02,0x20,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x63,0xcf,0xd6,0x6a,0x19,0x0a,0x60,0x08,0x89,0x1e,0x0d,0x81,0xd4,0x9a,0x09,0x52,
+  0x30,0x44,0x02,0x20,0x44,0xa5,0xad,0x0b,0xd0,0x63,0x6d,0x9e,0x12,0xbc,0x9e,0x0a,0x6b,0xdd,0x5e,0x1b,0xba,0x77,0xf5,0x23,0x84,0x21,0x93,0xb3,0xb8,0x2e,0x44,0x8e,0x05,0xd5,0xf1,0x1e,0x02,0x20,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x92,0x49,0x24,0x63,0xcf,0xd6,0x6a,0x19,0x0a,0x60,0x08,0x89,0x1e,0x0d,0x81,0xd4,0x9a,0x09,0x52,
+  0x30,0x45,0x02,0x21,0x00,0xf8,0x0a,0xe4,0xf9,0x6c,0xdb,0xc9,0xd8,0x53,0xf8,0x3d,0x47,0xaa,0xe2,0x25,0xbf,0x40,0x7d,0x51,0xc5,0x6b,0x77,0x76,0xcd,0x67,0xd0,0xdc,0x19,0x5d,0x99,0xa9,0xdc,0x02,0x20,0x4c,0xfc,0x1d,0x94,0x1e,0x08,0xcb,0x9a,0xce,0xad,0xde,0x0f,0x4c,0xce,0xad,0x76,0xb3,0x0d,0x33,0x2f,0xc4,0x42,0x11,0x5d,0x50,0xe6,0x73,0xe2,0x86,0x86,0xb7,0x0b,
+  0x30,0x44,0x02,0x20,0x10,0x9c,0xd8,0xae,0x03,0x74,0x35,0x89,0x84,0xa8,0x24,0x9c,0x0a,0x84,0x36,0x28,0xf2,0x83,0x5f,0xfa,0xd1,0xdf,0x1a,0x9a,0x69,0xaa,0x2f,0xe7,0x23,0x55,0x54,0x5c,0x02,0x20,0x53,0x90,0xff,0x25,0x0a,0xc4,0x27,0x4e,0x1c,0xb2,0x5c,0xd6,0xca,0x64,0x91,0xf6,0xb9,0x12,0x81,0xe3,0x2f,0x5b,0x26,0x4d,0x87,0x97,0x7a,0xed,0x4a,0x94,0xe7,0x7b,
+  0x30,0x45,0x02,0x21,0x00,0xd0,0x35,0xee,0x1f,0x17,0xfd,0xb0,0xb2,0x68,0x1b,0x16,0x3e,0x33,0xc3,0x59,0x93,0x26,0x59,0x99,0x0a,0xf7,0x7d,0xca,0x63,0x20,0x12,0xb3,0x0b,0x27,0xa0,0x57,0xb3,0x02,0x20,0x19,0x39,0xd9,0xf3,0xb2,0x85,0x8b,0xc1,0x3e,0x34,0x74,0xcb,0x50,0xe6,0xa8,0x2b,0xe4,0x4f,0xaa,0x71,0x94,0x0f,0x87,0x6c,0x1c,0xba,0x4c,0x3e,0x98,0x92,0x02,0xb6,
+  0x30,0x44,0x02,0x20,0x4f,0x05,0x3f,0x56,0x3a,0xd3,0x4b,0x74,0xfd,0x8c,0x99,0x34,0xce,0x59,0xe7,0x9c,0x2e,0xb8,0xe6,0xec,0xa0,0xfe,0xf5,0xb3,0x23,0xca,0x67,0xd5,0xac,0x7e,0xd2,0x38,0x02,0x20,0x4d,0x4b,0x05,0xda,0xa0,0x71,0x9e,0x77,0x3d,0x86,0x17,0xdc,0xe5,0x63,0x1c,0x5f,0xd6,0xf5,0x9c,0x9b,0xdc,0x74,0x8e,0x4b,0x55,0xc9,0x70,0x04,0x0a,0xf0,0x1b,0xe5,
+  0x30,0x44,0x02,0x20,0x6d,0x6a,0x4f,0x55,0x6c,0xcc,0xe1,0x54,0xe7,0xfb,0x9f,0x19,0xe7,0x6c,0x3d,0xec,0xa1,0x3d,0x59,0xcc,0x2a,0xeb,0x4e,0xca,0xd9,0x68,0xaa,0xb2,0xde,0xd4,0x59,0x65,0x02,0x20,0x53,0xb9,0xfa,0x74,0x80,0x3e,0xde,0x0f,0xc4,0x44,0x1b,0xf6,0x83,0xd5,0x6c,0x56,0x4d,0x3e,0x27,0x4e,0x09,0xcc,0xf4,0x73,0x90,0xba,0xdd,0x14,0x71,0xc0,0x5f,0xb7,
+  0x30,0x44,0x02,0x21,0x00,0xaa,0xd5,0x03,0xde,0x9b,0x9f,0xd6,0x6b,0x94,0x8e,0x9a,0xcf,0x59,0x6f,0x0a,0x0e,0x65,0xe7,0x00,0xb2,0x8b,0x26,0xec,0x56,0xe6,0xe4,0x5e,0x84,0x64,0x89,0xb3,0xc4,0x02,0x1f,0x0d,0xdc,0x3a,0x2f,0x89,0xab,0xb8,0x17,0xbb,0x85,0xc0,0x62,0xce,0x02,0xf8,0x23,0xc6,0x3f,0xc2,0x6b,0x26,0x9e,0x0b,0xc9,0xb8,0x4d,0x81,0xa5,0xaa,0x12,0x3d,
+  0x30,0x45,0x02,0x21,0x00,0x91,0x82,0xce,0xbd,0x3b,0xb8,0xab,0x57,0x2e,0x16,0x71,0x74,0x39,0x72,0x09,0xef,0x4b,0x1d,0x43,0x9a,0xf3,0xb2,0x00,0xcd,0xf0,0x03,0x62,0x00,0x89,0xe4,0x32,0x25,0x02,0x20,0x54,0x47,0x7c,0x98,0x2e,0xa0,0x19,0xd2,0xe1,0x00,0x04,0x97,0xfc,0x25,0xfc,0xee,0x1b,0xcc,0xae,0x55,0xf2,0xac,0x27,0x53,0x0a,0xe5,0x3b,0x29,0xc4,0xb3,0x56,0xa4,
+  0x30,0x44,0x02,0x20,0x38,0x54,0xa3,0x99,0x8a,0xeb,0xdf,0x2d,0xbc,0x28,0xad,0xac,0x41,0x81,0x46,0x2c,0xca,0xc7,0x87,0x39,0x07,0xab,0x7f,0x21,0x2c,0x42,0xdb,0x0e,0x69,0xb5,0x6e,0xd8,0x02,0x20,0x3e,0xd3,0xf6,0xb8,0xa3,0x88,0xd0,0x2f,0x3e,0x4d,0xf9,0xf2,0xae,0x9c,0x1b,0xd2,0xc3,0x91,0x6a,0x68,0x64,0x60,0xdf,0xfc,0xd4,0x29,0x09,0xcd,0x7f,0x82,0x05,0x8e,
+  0x30,0x45,0x02,0x21,0x00,0xe9,0x4d,0xbd,0xc3,0x87,0x95,0xfe,0x5c,0x90,0x4d,0x8f,0x16,0xd9,0x69,0xd3,0xb5,0x87,0xf0,0xa2,0x5d,0x2d,0xe9,0x0b,0x6d,0x8c,0x5c,0x53,0xff,0x88,0x7e,0x36,0x07,0x02,0x20,0x7a,0x94,0x73,0x69,0xc1,0x64,0x97,0x25,0x21,0xbb,0x8a,0xf4,0x06,0x81,0x3b,0x2d,0x9f,0x94,0xd2,0xae,0xaa,0x53,0xd4,0xc2,0x15,0xaa,0xa0,0xa2,0x57,0x8a,0x2c,0x5d,
+  0x30,0x44,0x02,0x20,0x49,0xfc,0x10,0x2a,0x08,0xca,0x47,0xb6,0x0e,0x08,0x58,0xcd,0x02,0x84,0xd2,0x2c,0xdd,0xd7,0x23,0x3f,0x94,0xaa,0xff,0xbb,0x2d,0xb1,0xdd,0x2c,0xf0,0x84,0x25,0xe1,0x02,0x20,0x5b,0x16,0xfc,0xa5,0xa1,0x2c,0xdb,0x39,0x70,0x16,0x97,0xad,0x8e,0x39,0xff,0xd6,0xbd,0xec,0x00,0x24,0x29,0x8a,0xfa,0xa2,0x32,0x6a,0xea,0x09,0x20,0x0b,0x14,0xd6,
+  0x30,0x44,0x02,0x20,0x41,0xef,0xa7,0xd3,0xf0,0x5a,0x00,0x10,0x67,0x5f,0xcb,0x91,0x8a,0x45,0xc6,0x93,0xda,0x4b,0x34,0x8d,0xf2,0x1a,0x59,0xd6,0xf9,0xcd,0x73,0xe0,0xd8,0x31,0xd6,0x7a,0x02,0x20,0x44,0x54,0xad,0xa6,0x93,0xe5,0xe2,0x6b,0x7b,0xd6,0x93,0x23,0x6d,0x34,0x0f,0x80,0x54,0x5c,0x83,0x45,0x77,0xb6,0xf7,0x3d,0x37,0x8c,0x7b,0xcc,0x53,0x42,0x44,0xda,
+  0x30,0x45,0x02,0x21,0x00,0xb6,0x15,0x69,0x8c,0x35,0x8b,0x35,0x92,0x0d,0xd8,0x83,0xec,0xa6,0x25,0xa6,0xc5,0xf7,0x56,0x39,0x70,0xcd,0xfc,0x37,0x8f,0x8f,0xe0,0xce,0xe1,0x70,0x92,0x14,0x4c,0x02,0x20,0x25,0xf4,0x7b,0x32,0x6b,0x5b,0xe1,0xfb,0x61,0x0b,0x88,0x51,0x53,0xea,0x84,0xd4,0x1e,0xb4,0x71,0x6b,0xe6,0x6a,0x99,0x4e,0x87,0x79,0x98,0x9d,0xf1,0xc8,0x63,0xd4,
+  0x30,0x45,0x02,0x21,0x00,0x87,0xcf,0x8c,0x0e,0xb8,0x2d,0x44,0xf6,0x9c,0x60,0xa2,0xff,0x54,0x57,0xd3,0xaa,0xa3,0x22,0xe7,0xec,0x61,0xae,0x5a,0xec,0xfd,0x67,0x8a,0xe1,0xc1,0x93,0x2b,0x0e,0x02,0x20,0x3a,0xdd,0x3b,0x11,0x58,0x15,0x04,0x7d,0x6e,0xb3,0x40,0xa3,0xe0,0x08,0x98,0x9e,0xaa,0x0f,0x87,0x08,0xd1,0x79,0x48,0x14,0x72,0x90,0x94,0xd0,0x8d,0x24,0x60,0xd3,
+  0x30,0x44,0x02,0x20,0x62,0xf4,0x8e,0xf7,0x1a,0xce,0x27,0xbf,0x5a,0x01,0x83,0x4d,0xe1,0xf7,0xe3,0xf9,0x48,0xb9,0xdc,0xe1,0xca,0x1e,0x91,0x1d,0x5e,0x13,0xd3,0xb1,0x04,0x47,0x1d,0x82,0x02,0x20,0x5e,0xa8,0xf3,0x3f,0x0c,0x77,0x89,0x72,0xc4,0x58,0x20,0x80,0xde,0xda,0x9b,0x34,0x18,0x57,0xdd,0x64,0x51,0x4f,0x08,0x49,0xa0,0x5f,0x69,0x64,0xc2,0xe3,0x40,0x22,
+  0x30,0x45,0x02,0x21,0x00,0xf6,0xb0,0xe2,0xf6,0xfe,0x02,0x0c,0xf7,0xc0,0xc2,0x01,0x37,0x43,0x43,0x44,0xed,0x7a,0xdd,0x6c,0x4b,0xe5,0x18,0x61,0xe2,0xd1,0x4c,0xbd,0xa4,0x72,0xa6,0xff,0xb4,0x02,0x20,0x64,0x16,0xc8,0xdd,0x3e,0x5c,0x52,0x82,0xb3,0x06,0xe8,0xdc,0x8f,0xf3,0x4a,0xb6,0x4c,0xc9,0x95,0x49,0x23,0x2d,0x67,0x8d,0x71,0x44,0x02,0xeb,0x6c,0xa7,0xaa,0x0f,
+  0x30,0x45,0x02,0x21,0x00,0xdb,0x09,0xd8,0x46,0x0f,0x05,0xef,0xf2,0x3b,0xc7,0xe4,0x36,0xb6,0x7d,0xa5,0x63,0xfa,0x4b,0x4e,0xdb,0x58,0xac,0x24,0xce,0x20,0x1f,0xa8,0xa3,0x58,0x12,0x50,0x57,0x02,0x20,0x46,0xda,0x11,0x67,0x54,0x60,0x29,0x40,0xc8,0x99,0x9c,0x8d,0x66,0x5f,0x78,0x6c,0x50,0xf5,0x77,0x2c,0x0a,0x3c,0xdb,0xda,0x07,0x5e,0x77,0xea,0xbc,0x64,0xdf,0x16,
+  0x30,0x44,0x02,0x20,0x59,0x2c,0x41,0xe1,0x65,0x17,0xf1,0x2f,0xca,0xbd,0x98,0x26,0x76,0x74,0xf9,0x74,0xb5,0x88,0xe9,0xf3,0x5d,0x35,0x40,0x6c,0x1a,0x7b,0xb2,0xed,0x1d,0x19,0xb7,0xb8,0x02,0x20,0x3e,0x65,0xa0,0x6b,0xd9,0xf8,0x3c,0xaa,0xeb,0x7b,0x00,0xf2,0x36,0x8d,0x7e,0x0d,0xec,0xe6,0xb1,0x22,0x21,0x26,0x9a,0x9b,0x5b,0x76,0x51,0x98,0xf8,0x40,0xa3,0xa1,
+  0x30,0x45,0x02,0x21,0x00,0xbe,0x0d,0x70,0x88,0x7d,0x5e,0x40,0x82,0x1a,0x61,0xb6,0x80,0x47,0xde,0x4e,0xa0,0x3d,0xeb,0xfd,0xf5,0x1c,0xdf,0x4d,0x4b,0x19,0x55,0x58,0xb9,0x59,0xa0,0x32,0xb2,0x02,0x20,0x7d,0x99,0x4b,0x2d,0x8f,0x1d,0xbb,0xeb,0x13,0x53,0x4e,0xb3,0xf6,0xe5,0xdc,0xcd,0x85,0xf5,0xc4,0x13,0x3c,0x27,0xd9,0xe6,0x42,0x71,0xb1,0x82,0x6c,0xe1,0xf6,0x7d,
+  0x30,0x45,0x02,0x21,0x00,0xfa,0xe9,0x2d,0xfc,0xb2,0xee,0x39,0x2d,0x27,0x0a,0xf3,0xa5,0x73,0x9f,0xaa,0x26,0xd4,0xf9,0x7b,0xfd,0x39,0xed,0x3c,0xbe,0xe4,0xd2,0x9e,0x26,0xaf,0x3b,0x20,0x6a,0x02,0x20,0x6c,0x9b,0xa3,0x7f,0x9f,0xaa,0x6a,0x1f,0xd3,0xf6,0x5f,0x23,0xb4,0xe8,0x53,0xd4,0x69,0x2a,0x72,0x74,0x24,0x0a,0x12,0xdb,0x7b,0xa3,0x88,0x48,0x30,0x63,0x0d,0x16,
+  0x30,0x44,0x02,0x20,0x17,0x6a,0x25,0x57,0x56,0x6f,0xfa,0x51,0x8b,0x11,0x22,0x66,0x94,0xeb,0x98,0x02,0xed,0x20,0x98,0xbf,0xe2,0x78,0xe5,0x57,0x0f,0xe1,0xd5,0xd7,0xaf,0x18,0xa9,0x43,0x02,0x20,0x12,0x91,0xdf,0x6a,0x0e,0xd5,0xfc,0x0d,0x15,0x09,0x8e,0x70,0xbc,0xf1,0x3a,0x00,0x92,0x84,0xdf,0xd0,0x68,0x9d,0x3b,0xb4,0xbe,0x6c,0xee,0xb9,0xbe,0x14,0x87,0xc4,
+  0x30,0x44,0x02,0x20,0x60,0xbe,0x20,0xc3,0xdb,0xc1,0x62,0xdd,0x34,0xd2,0x67,0x80,0x62,0x1c,0x10,0x4b,0xbe,0x5d,0xac,0xe6,0x30,0x17,0x1b,0x2d,0xae,0xf0,0xd8,0x26,0x40,0x9e,0xe5,0xc2,0x02,0x20,0x42,0x7f,0x7e,0x4d,0x88,0x9d,0x54,0x91,0x70,0xbd,0xa6,0xa9,0x40,0x9f,0xb1,0xcb,0x8b,0x0e,0x76,0x3d,0x13,0xee,0xa7,0xbd,0x97,0xf6,0x4c,0xf4,0x1d,0xc6,0xe4,0x97,
+  0x30,0x45,0x02,0x21,0x00,0xed,0xf0,0x3c,0xf6,0x3f,0x65,0x88,0x83,0x28,0x9a,0x1a,0x59,0x3d,0x10,0x07,0x89,0x5b,0x9f,0x23,0x6d,0x27,0xc9,0xc1,0xf1,0x31,0x30,0x89,0xaa,0xed,0x6b,0x16,0xae,0x02,0x20,0x1a,0x4d,0xd6,0xfc,0x08,0x14,0xdc,0x52,0x3d,0x1f,0xef,0xa8,0x1c,0x64,0xfb,0xf5,0xe6,0x18,0xe6,0x51,0xe7,0x09,0x6f,0xcc,0xad,0xbb,0x94,0xcd,0x48,0xe5,0xe0,0xcd};
+
+static const wycheproof_ecdsa_testvector testvectors[SECP256K1_ECDSA_WYCHEPROOF_NUMBER_TESTVECTORS] = {
+  /* tcId: 1. Signature malleability */
+  {0, 0, 6, 0, 72, 0 },
+  /* tcId: 2. valid */
+  {0, 0, 6, 72, 71, 1 },
+  /* tcId: 3. length of sequence [r, s] uses long form encoding */
+  {0, 0, 6, 143, 72, 0 },
+  /* tcId: 4. length of sequence [r, s] contains a leading 0 */
+  {0, 0, 6, 215, 73, 0 },
+  /* tcId: 5. length of sequence [r, s] uses 70 instead of 69 */
+  {0, 0, 6, 288, 71, 0 },
+  /* tcId: 6. length of sequence [r, s] uses 68 instead of 69 */
+  {0, 0, 6, 359, 71, 0 },
+  /* tcId: 7. uint32 overflow in length of sequence [r, s] */
+  {0, 0, 6, 430, 76, 0 },
+  /* tcId: 8. uint64 overflow in length of sequence [r, s] */
+  {0, 0, 6, 506, 80, 0 },
+  /* tcId: 9. length of sequence [r, s] = 2**31 - 1 */
+  {0, 0, 6, 586, 75, 0 },
+  /* tcId: 10. length of sequence [r, s] = 2**31 */
+  {0, 0, 6, 661, 75, 0 },
+  /* tcId: 11. length of sequence [r, s] = 2**32 - 1 */
+  {0, 0, 6, 736, 75, 0 },
+  /* tcId: 12. length of sequence [r, s] = 2**40 - 1 */
+  {0, 0, 6, 811, 76, 0 },
+  /* tcId: 13. length of sequence [r, s] = 2**64 - 1 */
+  {0, 0, 6, 887, 79, 0 },
+  /* tcId: 14. incorrect length of sequence [r, s] */
+  {0, 0, 6, 966, 71, 0 },
+  /* tcId: 15. replaced sequence [r, s] by an indefinite length tag without termination */
+  {0, 0, 6, 1037, 71, 0 },
+  /* tcId: 16. removing sequence [r, s] */
+  {0, 0, 6, 1108, 0, 0 },
+  /* tcId: 17. lonely sequence tag */
+  {0, 0, 6, 1108, 1, 0 },
+  /* tcId: 18. appending 0's to sequence [r, s] */
+  {0, 0, 6, 1109, 73, 0 },
+  /* tcId: 19. prepending 0's to sequence [r, s] */
+  {0, 0, 6, 1182, 73, 0 },
+  /* tcId: 20. appending unused 0's to sequence [r, s] */
+  {0, 0, 6, 1255, 73, 0 },
+  /* tcId: 21. appending null value to sequence [r, s] */
+  {0, 0, 6, 1328, 73, 0 },
+  /* tcId: 22. prepending garbage to sequence [r, s] */
+  {0, 0, 6, 1401, 76, 0 },
+  /* tcId: 23. prepending garbage to sequence [r, s] */
+  {0, 0, 6, 1477, 75, 0 },
+  /* tcId: 24. appending garbage to sequence [r, s] */
+  {0, 0, 6, 1552, 79, 0 },
+  /* tcId: 25. including undefined tags */
+  {0, 0, 6, 1631, 79, 0 },
+  /* tcId: 26. including undefined tags */
+  {0, 0, 6, 1710, 79, 0 },
+  /* tcId: 27. including undefined tags */
+  {0, 0, 6, 1789, 79, 0 },
+  /* tcId: 28. truncated length of sequence [r, s] */
+  {0, 0, 6, 1868, 2, 0 },
+  /* tcId: 29. including undefined tags to sequence [r, s] */
+  {0, 0, 6, 1870, 77, 0 },
+  /* tcId: 30. using composition with indefinite length for sequence [r, s] */
+  {0, 0, 6, 1947, 75, 0 },
+  /* tcId: 31. using composition with wrong tag for sequence [r, s] */
+  {0, 0, 6, 2022, 75, 0 },
+  /* tcId: 32. Replacing sequence [r, s] with NULL */
+  {0, 0, 6, 2097, 2, 0 },
+  /* tcId: 33. changing tag value of sequence [r, s] */
+  {0, 0, 6, 2099, 71, 0 },
+  /* tcId: 34. changing tag value of sequence [r, s] */
+  {0, 0, 6, 2170, 71, 0 },
+  /* tcId: 35. changing tag value of sequence [r, s] */
+  {0, 0, 6, 2241, 71, 0 },
+  /* tcId: 36. changing tag value of sequence [r, s] */
+  {0, 0, 6, 2312, 71, 0 },
+  /* tcId: 37. changing tag value of sequence [r, s] */
+  {0, 0, 6, 2383, 71, 0 },
+  /* tcId: 38. dropping value of sequence [r, s] */
+  {0, 0, 6, 2454, 2, 0 },
+  /* tcId: 39. using composition for sequence [r, s] */
+  {0, 0, 6, 2456, 75, 0 },
+  /* tcId: 40. truncated sequence [r, s] */
+  {0, 0, 6, 2531, 70, 0 },
+  /* tcId: 41. truncated sequence [r, s] */
+  {0, 0, 6, 2601, 70, 0 },
+  /* tcId: 42. sequence [r, s] of size 4166 to check for overflows */
+  {0, 0, 6, 2671, 4170, 0 },
+  /* tcId: 43. indefinite length */
+  {0, 0, 6, 6841, 73, 0 },
+  /* tcId: 44. indefinite length with truncated delimiter */
+  {0, 0, 6, 6914, 72, 0 },
+  /* tcId: 45. indefinite length with additional element */
+  {0, 0, 6, 6986, 75, 0 },
+  /* tcId: 46. indefinite length with truncated element */
+  {0, 0, 6, 7061, 77, 0 },
+  /* tcId: 47. indefinite length with garbage */
+  {0, 0, 6, 7138, 77, 0 },
+  /* tcId: 48. indefinite length with nonempty EOC */
+  {0, 0, 6, 7215, 75, 0 },
+  /* tcId: 49. prepend empty sequence */
+  {0, 0, 6, 7290, 73, 0 },
+  /* tcId: 50. append empty sequence */
+  {0, 0, 6, 7363, 73, 0 },
+  /* tcId: 51. append zero */
+  {0, 0, 6, 7436, 74, 0 },
+  /* tcId: 52. append garbage with high tag number */
+  {0, 0, 6, 7510, 74, 0 },
+  /* tcId: 53. append null with explicit tag */
+  {0, 0, 6, 7584, 75, 0 },
+  /* tcId: 54. append null with implicit tag */
+  {0, 0, 6, 7659, 73, 0 },
+  /* tcId: 55. sequence of sequence */
+  {0, 0, 6, 7732, 73, 0 },
+  /* tcId: 56. truncated sequence: removed last 1 elements */
+  {0, 0, 6, 7805, 37, 0 },
+  /* tcId: 57. repeating element in sequence */
+  {0, 0, 6, 7842, 105, 0 },
+  /* tcId: 58. flipped bit 0 in r */
+  {0, 0, 6, 7947, 69, 0 },
+  /* tcId: 59. flipped bit 32 in r */
+  {0, 0, 6, 8016, 69, 0 },
+  /* tcId: 60. flipped bit 48 in r */
+  {0, 0, 6, 8085, 69, 0 },
+  /* tcId: 61. flipped bit 64 in r */
+  {0, 0, 6, 8154, 69, 0 },
+  /* tcId: 62. length of r uses long form encoding */
+  {0, 0, 6, 8223, 72, 0 },
+  /* tcId: 63. length of r contains a leading 0 */
+  {0, 0, 6, 8295, 73, 0 },
+  /* tcId: 64. length of r uses 34 instead of 33 */
+  {0, 0, 6, 8368, 71, 0 },
+  /* tcId: 65. length of r uses 32 instead of 33 */
+  {0, 0, 6, 8439, 71, 0 },
+  /* tcId: 66. uint32 overflow in length of r */
+  {0, 0, 6, 8510, 76, 0 },
+  /* tcId: 67. uint64 overflow in length of r */
+  {0, 0, 6, 8586, 80, 0 },
+  /* tcId: 68. length of r = 2**31 - 1 */
+  {0, 0, 6, 8666, 75, 0 },
+  /* tcId: 69. length of r = 2**31 */
+  {0, 0, 6, 8741, 75, 0 },
+  /* tcId: 70. length of r = 2**32 - 1 */
+  {0, 0, 6, 8816, 75, 0 },
+  /* tcId: 71. length of r = 2**40 - 1 */
+  {0, 0, 6, 8891, 76, 0 },
+  /* tcId: 72. length of r = 2**64 - 1 */
+  {0, 0, 6, 8967, 79, 0 },
+  /* tcId: 73. incorrect length of r */
+  {0, 0, 6, 9046, 71, 0 },
+  /* tcId: 74. replaced r by an indefinite length tag without termination */
+  {0, 0, 6, 9117, 71, 0 },
+  /* tcId: 75. removing r */
+  {0, 0, 6, 9188, 36, 0 },
+  /* tcId: 76. lonely integer tag */
+  {0, 0, 6, 9224, 37, 0 },
+  /* tcId: 77. lonely integer tag */
+  {0, 0, 6, 9261, 38, 0 },
+  /* tcId: 78. appending 0's to r */
+  {0, 0, 6, 9299, 73, 0 },
+  /* tcId: 79. prepending 0's to r */
+  {0, 0, 6, 9372, 73, 0 },
+  /* tcId: 80. appending unused 0's to r */
+  {0, 0, 6, 9445, 73, 0 },
+  /* tcId: 81. appending null value to r */
+  {0, 0, 6, 9518, 73, 0 },
+  /* tcId: 82. prepending garbage to r */
+  {0, 0, 6, 9591, 76, 0 },
+  /* tcId: 83. prepending garbage to r */
+  {0, 0, 6, 9667, 75, 0 },
+  /* tcId: 84. appending garbage to r */
+  {0, 0, 6, 9742, 79, 0 },
+  /* tcId: 85. truncated length of r */
+  {0, 0, 6, 9821, 38, 0 },
+  /* tcId: 86. including undefined tags to r */
+  {0, 0, 6, 9859, 77, 0 },
+  /* tcId: 87. using composition with indefinite length for r */
+  {0, 0, 6, 9936, 75, 0 },
+  /* tcId: 88. using composition with wrong tag for r */
+  {0, 0, 6, 10011, 75, 0 },
+  /* tcId: 89. Replacing r with NULL */
+  {0, 0, 6, 10086, 38, 0 },
+  /* tcId: 90. changing tag value of r */
+  {0, 0, 6, 10124, 71, 0 },
+  /* tcId: 91. changing tag value of r */
+  {0, 0, 6, 10195, 71, 0 },
+  /* tcId: 92. changing tag value of r */
+  {0, 0, 6, 10266, 71, 0 },
+  /* tcId: 93. changing tag value of r */
+  {0, 0, 6, 10337, 71, 0 },
+  /* tcId: 94. changing tag value of r */
+  {0, 0, 6, 10408, 71, 0 },
+  /* tcId: 95. dropping value of r */
+  {0, 0, 6, 10479, 38, 0 },
+  /* tcId: 96. using composition for r */
+  {0, 0, 6, 10517, 75, 0 },
+  /* tcId: 97. modifying first byte of r */
+  {0, 0, 6, 10592, 71, 0 },
+  /* tcId: 98. modifying last byte of r */
+  {0, 0, 6, 10663, 71, 0 },
+  /* tcId: 99. truncated r */
+  {0, 0, 6, 10734, 70, 0 },
+  /* tcId: 100. truncated r */
+  {0, 0, 6, 10804, 70, 0 },
+  /* tcId: 101. r of size 4130 to check for overflows */
+  {0, 0, 6, 10874, 4172, 0 },
+  /* tcId: 102. leading ff in r */
+  {0, 0, 6, 15046, 72, 0 },
+  /* tcId: 103. replaced r by infinity */
+  {0, 0, 6, 15118, 39, 0 },
+  /* tcId: 104. replacing r with zero */
+  {0, 0, 6, 15157, 39, 0 },
+  /* tcId: 105. flipped bit 0 in s */
+  {0, 0, 6, 15196, 69, 0 },
+  /* tcId: 106. flipped bit 32 in s */
+  {0, 0, 6, 15265, 69, 0 },
+  /* tcId: 107. flipped bit 48 in s */
+  {0, 0, 6, 15334, 69, 0 },
+  /* tcId: 108. flipped bit 64 in s */
+  {0, 0, 6, 15403, 69, 0 },
+  /* tcId: 109. length of s uses long form encoding */
+  {0, 0, 6, 15472, 72, 0 },
+  /* tcId: 110. length of s contains a leading 0 */
+  {0, 0, 6, 15544, 73, 0 },
+  /* tcId: 111. length of s uses 33 instead of 32 */
+  {0, 0, 6, 15617, 71, 0 },
+  /* tcId: 112. length of s uses 31 instead of 32 */
+  {0, 0, 6, 15688, 71, 0 },
+  /* tcId: 113. uint32 overflow in length of s */
+  {0, 0, 6, 15759, 76, 0 },
+  /* tcId: 114. uint64 overflow in length of s */
+  {0, 0, 6, 15835, 80, 0 },
+  /* tcId: 115. length of s = 2**31 - 1 */
+  {0, 0, 6, 15915, 75, 0 },
+  /* tcId: 116. length of s = 2**31 */
+  {0, 0, 6, 15990, 75, 0 },
+  /* tcId: 117. length of s = 2**32 - 1 */
+  {0, 0, 6, 16065, 75, 0 },
+  /* tcId: 118. length of s = 2**40 - 1 */
+  {0, 0, 6, 16140, 76, 0 },
+  /* tcId: 119. length of s = 2**64 - 1 */
+  {0, 0, 6, 16216, 79, 0 },
+  /* tcId: 120. incorrect length of s */
+  {0, 0, 6, 16295, 71, 0 },
+  /* tcId: 121. replaced s by an indefinite length tag without termination */
+  {0, 0, 6, 16366, 71, 0 },
+  /* tcId: 122. appending 0's to s */
+  {0, 0, 6, 16437, 73, 0 },
+  /* tcId: 123. prepending 0's to s */
+  {0, 0, 6, 16510, 73, 0 },
+  /* tcId: 124. appending null value to s */
+  {0, 0, 6, 16583, 73, 0 },
+  /* tcId: 125. prepending garbage to s */
+  {0, 0, 6, 16656, 76, 0 },
+  /* tcId: 126. prepending garbage to s */
+  {0, 0, 6, 16732, 75, 0 },
+  /* tcId: 127. appending garbage to s */
+  {0, 0, 6, 16807, 79, 0 },
+  /* tcId: 128. truncated length of s */
+  {0, 0, 6, 16886, 39, 0 },
+  /* tcId: 129. including undefined tags to s */
+  {0, 0, 6, 16925, 77, 0 },
+  /* tcId: 130. using composition with indefinite length for s */
+  {0, 0, 6, 17002, 75, 0 },
+  /* tcId: 131. using composition with wrong tag for s */
+  {0, 0, 6, 17077, 75, 0 },
+  /* tcId: 132. Replacing s with NULL */
+  {0, 0, 6, 17152, 39, 0 },
+  /* tcId: 133. changing tag value of s */
+  {0, 0, 6, 17191, 71, 0 },
+  /* tcId: 134. changing tag value of s */
+  {0, 0, 6, 17262, 71, 0 },
+  /* tcId: 135. changing tag value of s */
+  {0, 0, 6, 17333, 71, 0 },
+  /* tcId: 136. changing tag value of s */
+  {0, 0, 6, 17404, 71, 0 },
+  /* tcId: 137. changing tag value of s */
+  {0, 0, 6, 17475, 71, 0 },
+  /* tcId: 138. dropping value of s */
+  {0, 0, 6, 17546, 39, 0 },
+  /* tcId: 139. using composition for s */
+  {0, 0, 6, 17585, 75, 0 },
+  /* tcId: 140. modifying first byte of s */
+  {0, 0, 6, 17660, 71, 0 },
+  /* tcId: 141. modifying last byte of s */
+  {0, 0, 6, 17731, 71, 0 },
+  /* tcId: 142. truncated s */
+  {0, 0, 6, 17802, 70, 0 },
+  /* tcId: 143. truncated s */
+  {0, 0, 6, 17872, 70, 0 },
+  /* tcId: 144. s of size 4129 to check for overflows */
+  {0, 0, 6, 17942, 4172, 0 },
+  /* tcId: 145. leading ff in s */
+  {0, 0, 6, 22114, 72, 0 },
+  /* tcId: 146. replaced s by infinity */
+  {0, 0, 6, 22186, 40, 0 },
+  /* tcId: 147. replacing s with zero */
+  {0, 0, 6, 22226, 40, 0 },
+  /* tcId: 148. replaced r by r + n */
+  {0, 0, 6, 22266, 71, 0 },
+  /* tcId: 149. replaced r by r - n */
+  {0, 0, 6, 22337, 70, 0 },
+  /* tcId: 150. replaced r by r + 256 * n */
+  {0, 0, 6, 22407, 72, 0 },
+  /* tcId: 151. replaced r by -r */
+  {0, 0, 6, 22479, 71, 0 },
+  /* tcId: 152. replaced r by n - r */
+  {0, 0, 6, 22550, 70, 0 },
+  /* tcId: 153. replaced r by -n - r */
+  {0, 0, 6, 22620, 71, 0 },
+  /* tcId: 154. replaced r by r + 2**256 */
+  {0, 0, 6, 22691, 71, 0 },
+  /* tcId: 155. replaced r by r + 2**320 */
+  {0, 0, 6, 22762, 79, 0 },
+  /* tcId: 156. replaced s by s + n */
+  {0, 0, 6, 22841, 71, 0 },
+  /* tcId: 157. replaced s by s - n */
+  {0, 0, 6, 22912, 71, 0 },
+  /* tcId: 158. replaced s by s + 256 * n */
+  {0, 0, 6, 22983, 72, 0 },
+  /* tcId: 159. replaced s by -s */
+  {0, 0, 6, 23055, 70, 0 },
+  /* tcId: 160. replaced s by -n - s */
+  {0, 0, 6, 23125, 71, 0 },
+  /* tcId: 161. replaced s by s + 2**256 */
+  {0, 0, 6, 23196, 71, 0 },
+  /* tcId: 162. replaced s by s - 2**256 */
+  {0, 0, 6, 23267, 71, 0 },
+  /* tcId: 163. replaced s by s + 2**320 */
+  {0, 0, 6, 23338, 79, 0 },
+  /* tcId: 164. Signature with special case values r=0 and s=0 */
+  {0, 0, 6, 23417, 8, 0 },
+  /* tcId: 165. Signature with special case values r=0 and s=1 */
+  {0, 0, 6, 23425, 8, 0 },
+  /* tcId: 166. Signature with special case values r=0 and s=-1 */
+  {0, 0, 6, 23433, 8, 0 },
+  /* tcId: 167. Signature with special case values r=0 and s=n */
+  {0, 0, 6, 23441, 40, 0 },
+  /* tcId: 168. Signature with special case values r=0 and s=n - 1 */
+  {0, 0, 6, 23481, 40, 0 },
+  /* tcId: 169. Signature with special case values r=0 and s=n + 1 */
+  {0, 0, 6, 23521, 40, 0 },
+  /* tcId: 170. Signature with special case values r=0 and s=p */
+  {0, 0, 6, 23561, 40, 0 },
+  /* tcId: 171. Signature with special case values r=0 and s=p + 1 */
+  {0, 0, 6, 23601, 40, 0 },
+  /* tcId: 172. Signature with special case values r=1 and s=0 */
+  {0, 0, 6, 23641, 8, 0 },
+  /* tcId: 173. Signature with special case values r=1 and s=1 */
+  {0, 0, 6, 23649, 8, 0 },
+  /* tcId: 174. Signature with special case values r=1 and s=-1 */
+  {0, 0, 6, 23657, 8, 0 },
+  /* tcId: 175. Signature with special case values r=1 and s=n */
+  {0, 0, 6, 23665, 40, 0 },
+  /* tcId: 176. Signature with special case values r=1 and s=n - 1 */
+  {0, 0, 6, 23705, 40, 0 },
+  /* tcId: 177. Signature with special case values r=1 and s=n + 1 */
+  {0, 0, 6, 23745, 40, 0 },
+  /* tcId: 178. Signature with special case values r=1 and s=p */
+  {0, 0, 6, 23785, 40, 0 },
+  /* tcId: 179. Signature with special case values r=1 and s=p + 1 */
+  {0, 0, 6, 23825, 40, 0 },
+  /* tcId: 180. Signature with special case values r=-1 and s=0 */
+  {0, 0, 6, 23865, 8, 0 },
+  /* tcId: 181. Signature with special case values r=-1 and s=1 */
+  {0, 0, 6, 23873, 8, 0 },
+  /* tcId: 182. Signature with special case values r=-1 and s=-1 */
+  {0, 0, 6, 23881, 8, 0 },
+  /* tcId: 183. Signature with special case values r=-1 and s=n */
+  {0, 0, 6, 23889, 40, 0 },
+  /* tcId: 184. Signature with special case values r=-1 and s=n - 1 */
+  {0, 0, 6, 23929, 40, 0 },
+  /* tcId: 185. Signature with special case values r=-1 and s=n + 1 */
+  {0, 0, 6, 23969, 40, 0 },
+  /* tcId: 186. Signature with special case values r=-1 and s=p */
+  {0, 0, 6, 24009, 40, 0 },
+  /* tcId: 187. Signature with special case values r=-1 and s=p + 1 */
+  {0, 0, 6, 24049, 40, 0 },
+  /* tcId: 188. Signature with special case values r=n and s=0 */
+  {0, 0, 6, 24089, 40, 0 },
+  /* tcId: 189. Signature with special case values r=n and s=1 */
+  {0, 0, 6, 24129, 40, 0 },
+  /* tcId: 190. Signature with special case values r=n and s=-1 */
+  {0, 0, 6, 24169, 40, 0 },
+  /* tcId: 191. Signature with special case values r=n and s=n */
+  {0, 0, 6, 24209, 72, 0 },
+  /* tcId: 192. Signature with special case values r=n and s=n - 1 */
+  {0, 0, 6, 24281, 72, 0 },
+  /* tcId: 193. Signature with special case values r=n and s=n + 1 */
+  {0, 0, 6, 24353, 72, 0 },
+  /* tcId: 194. Signature with special case values r=n and s=p */
+  {0, 0, 6, 24425, 72, 0 },
+  /* tcId: 195. Signature with special case values r=n and s=p + 1 */
+  {0, 0, 6, 24497, 72, 0 },
+  /* tcId: 196. Signature with special case values r=n - 1 and s=0 */
+  {0, 0, 6, 24569, 40, 0 },
+  /* tcId: 197. Signature with special case values r=n - 1 and s=1 */
+  {0, 0, 6, 24609, 40, 0 },
+  /* tcId: 198. Signature with special case values r=n - 1 and s=-1 */
+  {0, 0, 6, 24649, 40, 0 },
+  /* tcId: 199. Signature with special case values r=n - 1 and s=n */
+  {0, 0, 6, 24689, 72, 0 },
+  /* tcId: 200. Signature with special case values r=n - 1 and s=n - 1 */
+  {0, 0, 6, 24761, 72, 0 },
+  /* tcId: 201. Signature with special case values r=n - 1 and s=n + 1 */
+  {0, 0, 6, 24833, 72, 0 },
+  /* tcId: 202. Signature with special case values r=n - 1 and s=p */
+  {0, 0, 6, 24905, 72, 0 },
+  /* tcId: 203. Signature with special case values r=n - 1 and s=p + 1 */
+  {0, 0, 6, 24977, 72, 0 },
+  /* tcId: 204. Signature with special case values r=n + 1 and s=0 */
+  {0, 0, 6, 25049, 40, 0 },
+  /* tcId: 205. Signature with special case values r=n + 1 and s=1 */
+  {0, 0, 6, 25089, 40, 0 },
+  /* tcId: 206. Signature with special case values r=n + 1 and s=-1 */
+  {0, 0, 6, 25129, 40, 0 },
+  /* tcId: 207. Signature with special case values r=n + 1 and s=n */
+  {0, 0, 6, 25169, 72, 0 },
+  /* tcId: 208. Signature with special case values r=n + 1 and s=n - 1 */
+  {0, 0, 6, 25241, 72, 0 },
+  /* tcId: 209. Signature with special case values r=n + 1 and s=n + 1 */
+  {0, 0, 6, 25313, 72, 0 },
+  /* tcId: 210. Signature with special case values r=n + 1 and s=p */
+  {0, 0, 6, 25385, 72, 0 },
+  /* tcId: 211. Signature with special case values r=n + 1 and s=p + 1 */
+  {0, 0, 6, 25457, 72, 0 },
+  /* tcId: 212. Signature with special case values r=p and s=0 */
+  {0, 0, 6, 25529, 40, 0 },
+  /* tcId: 213. Signature with special case values r=p and s=1 */
+  {0, 0, 6, 25569, 40, 0 },
+  /* tcId: 214. Signature with special case values r=p and s=-1 */
+  {0, 0, 6, 25609, 40, 0 },
+  /* tcId: 215. Signature with special case values r=p and s=n */
+  {0, 0, 6, 25649, 72, 0 },
+  /* tcId: 216. Signature with special case values r=p and s=n - 1 */
+  {0, 0, 6, 25721, 72, 0 },
+  /* tcId: 217. Signature with special case values r=p and s=n + 1 */
+  {0, 0, 6, 25793, 72, 0 },
+  /* tcId: 218. Signature with special case values r=p and s=p */
+  {0, 0, 6, 25865, 72, 0 },
+  /* tcId: 219. Signature with special case values r=p and s=p + 1 */
+  {0, 0, 6, 25937, 72, 0 },
+  /* tcId: 220. Signature with special case values r=p + 1 and s=0 */
+  {0, 0, 6, 26009, 40, 0 },
+  /* tcId: 221. Signature with special case values r=p + 1 and s=1 */
+  {0, 0, 6, 26049, 40, 0 },
+  /* tcId: 222. Signature with special case values r=p + 1 and s=-1 */
+  {0, 0, 6, 26089, 40, 0 },
+  /* tcId: 223. Signature with special case values r=p + 1 and s=n */
+  {0, 0, 6, 26129, 72, 0 },
+  /* tcId: 224. Signature with special case values r=p + 1 and s=n - 1 */
+  {0, 0, 6, 26201, 72, 0 },
+  /* tcId: 225. Signature with special case values r=p + 1 and s=n + 1 */
+  {0, 0, 6, 26273, 72, 0 },
+  /* tcId: 226. Signature with special case values r=p + 1 and s=p */
+  {0, 0, 6, 26345, 72, 0 },
+  /* tcId: 227. Signature with special case values r=p + 1 and s=p + 1 */
+  {0, 0, 6, 26417, 72, 0 },
+  /* tcId: 228. Signature encoding contains incorrect types: r=0, s=0.25 */
+  {0, 0, 6, 26489, 10, 0 },
+  /* tcId: 229. Signature encoding contains incorrect types: r=0, s=nan */
+  {0, 0, 6, 26499, 8, 0 },
+  /* tcId: 230. Signature encoding contains incorrect types: r=0, s=True */
+  {0, 0, 6, 26507, 8, 0 },
+  /* tcId: 231. Signature encoding contains incorrect types: r=0, s=False */
+  {0, 0, 6, 26515, 8, 0 },
+  /* tcId: 232. Signature encoding contains incorrect types: r=0, s=Null */
+  {0, 0, 6, 26523, 7, 0 },
+  /* tcId: 233. Signature encoding contains incorrect types: r=0, s=empyt UTF-8 string */
+  {0, 0, 6, 26530, 7, 0 },
+  /* tcId: 234. Signature encoding contains incorrect types: r=0, s="0" */
+  {0, 0, 6, 26537, 8, 0 },
+  /* tcId: 235. Signature encoding contains incorrect types: r=0, s=empty list */
+  {0, 0, 6, 26545, 7, 0 },
+  /* tcId: 236. Signature encoding contains incorrect types: r=0, s=list containing 0 */
+  {0, 0, 6, 26552, 10, 0 },
+  /* tcId: 237. Signature encoding contains incorrect types: r=1, s=0.25 */
+  {0, 0, 6, 26562, 10, 0 },
+  /* tcId: 238. Signature encoding contains incorrect types: r=1, s=nan */
+  {0, 0, 6, 26572, 8, 0 },
+  /* tcId: 239. Signature encoding contains incorrect types: r=1, s=True */
+  {0, 0, 6, 26580, 8, 0 },
+  /* tcId: 240. Signature encoding contains incorrect types: r=1, s=False */
+  {0, 0, 6, 26588, 8, 0 },
+  /* tcId: 241. Signature encoding contains incorrect types: r=1, s=Null */
+  {0, 0, 6, 26596, 7, 0 },
+  /* tcId: 242. Signature encoding contains incorrect types: r=1, s=empyt UTF-8 string */
+  {0, 0, 6, 26603, 7, 0 },
+  /* tcId: 243. Signature encoding contains incorrect types: r=1, s="0" */
+  {0, 0, 6, 26610, 8, 0 },
+  /* tcId: 244. Signature encoding contains incorrect types: r=1, s=empty list */
+  {0, 0, 6, 26618, 7, 0 },
+  /* tcId: 245. Signature encoding contains incorrect types: r=1, s=list containing 0 */
+  {0, 0, 6, 26625, 10, 0 },
+  /* tcId: 246. Signature encoding contains incorrect types: r=-1, s=0.25 */
+  {0, 0, 6, 26635, 10, 0 },
+  /* tcId: 247. Signature encoding contains incorrect types: r=-1, s=nan */
+  {0, 0, 6, 26645, 8, 0 },
+  /* tcId: 248. Signature encoding contains incorrect types: r=-1, s=True */
+  {0, 0, 6, 26653, 8, 0 },
+  /* tcId: 249. Signature encoding contains incorrect types: r=-1, s=False */
+  {0, 0, 6, 26661, 8, 0 },
+  /* tcId: 250. Signature encoding contains incorrect types: r=-1, s=Null */
+  {0, 0, 6, 26669, 7, 0 },
+  /* tcId: 251. Signature encoding contains incorrect types: r=-1, s=empyt UTF-8 string */
+  {0, 0, 6, 26676, 7, 0 },
+  /* tcId: 252. Signature encoding contains incorrect types: r=-1, s="0" */
+  {0, 0, 6, 26683, 8, 0 },
+  /* tcId: 253. Signature encoding contains incorrect types: r=-1, s=empty list */
+  {0, 0, 6, 26691, 7, 0 },
+  /* tcId: 254. Signature encoding contains incorrect types: r=-1, s=list containing 0 */
+  {0, 0, 6, 26698, 10, 0 },
+  /* tcId: 255. Signature encoding contains incorrect types: r=n, s=0.25 */
+  {0, 0, 6, 26708, 42, 0 },
+  /* tcId: 256. Signature encoding contains incorrect types: r=n, s=nan */
+  {0, 0, 6, 26750, 40, 0 },
+  /* tcId: 257. Signature encoding contains incorrect types: r=n, s=True */
+  {0, 0, 6, 26790, 40, 0 },
+  /* tcId: 258. Signature encoding contains incorrect types: r=n, s=False */
+  {0, 0, 6, 26830, 40, 0 },
+  /* tcId: 259. Signature encoding contains incorrect types: r=n, s=Null */
+  {0, 0, 6, 26870, 39, 0 },
+  /* tcId: 260. Signature encoding contains incorrect types: r=n, s=empyt UTF-8 string */
+  {0, 0, 6, 26909, 39, 0 },
+  /* tcId: 261. Signature encoding contains incorrect types: r=n, s="0" */
+  {0, 0, 6, 26948, 40, 0 },
+  /* tcId: 262. Signature encoding contains incorrect types: r=n, s=empty list */
+  {0, 0, 6, 26988, 39, 0 },
+  /* tcId: 263. Signature encoding contains incorrect types: r=n, s=list containing 0 */
+  {0, 0, 6, 27027, 42, 0 },
+  /* tcId: 264. Signature encoding contains incorrect types: r=p, s=0.25 */
+  {0, 0, 6, 27069, 42, 0 },
+  /* tcId: 265. Signature encoding contains incorrect types: r=p, s=nan */
+  {0, 0, 6, 27111, 40, 0 },
+  /* tcId: 266. Signature encoding contains incorrect types: r=p, s=True */
+  {0, 0, 6, 27151, 40, 0 },
+  /* tcId: 267. Signature encoding contains incorrect types: r=p, s=False */
+  {0, 0, 6, 27191, 40, 0 },
+  /* tcId: 268. Signature encoding contains incorrect types: r=p, s=Null */
+  {0, 0, 6, 27231, 39, 0 },
+  /* tcId: 269. Signature encoding contains incorrect types: r=p, s=empyt UTF-8 string */
+  {0, 0, 6, 27270, 39, 0 },
+  /* tcId: 270. Signature encoding contains incorrect types: r=p, s="0" */
+  {0, 0, 6, 27309, 40, 0 },
+  /* tcId: 271. Signature encoding contains incorrect types: r=p, s=empty list */
+  {0, 0, 6, 27349, 39, 0 },
+  /* tcId: 272. Signature encoding contains incorrect types: r=p, s=list containing 0 */
+  {0, 0, 6, 27388, 42, 0 },
+  /* tcId: 273. Signature encoding contains incorrect types: r=0.25, s=0.25 */
+  {0, 0, 6, 27430, 12, 0 },
+  /* tcId: 274. Signature encoding contains incorrect types: r=nan, s=nan */
+  {0, 0, 6, 27442, 8, 0 },
+  /* tcId: 275. Signature encoding contains incorrect types: r=True, s=True */
+  {0, 0, 6, 27450, 8, 0 },
+  /* tcId: 276. Signature encoding contains incorrect types: r=False, s=False */
+  {0, 0, 6, 27458, 8, 0 },
+  /* tcId: 277. Signature encoding contains incorrect types: r=Null, s=Null */
+  {0, 0, 6, 27466, 6, 0 },
+  /* tcId: 278. Signature encoding contains incorrect types: r=empyt UTF-8 string, s=empyt UTF-8 string */
+  {0, 0, 6, 27472, 6, 0 },
+  /* tcId: 279. Signature encoding contains incorrect types: r="0", s="0" */
+  {0, 0, 6, 27478, 8, 0 },
+  /* tcId: 280. Signature encoding contains incorrect types: r=empty list, s=empty list */
+  {0, 0, 6, 27486, 6, 0 },
+  /* tcId: 281. Signature encoding contains incorrect types: r=list containing 0, s=list containing 0 */
+  {0, 0, 6, 27492, 12, 0 },
+  /* tcId: 282. Signature encoding contains incorrect types: r=0.25, s=0 */
+  {0, 0, 6, 27504, 10, 0 },
+  /* tcId: 283. Signature encoding contains incorrect types: r=nan, s=0 */
+  {0, 0, 6, 27514, 8, 0 },
+  /* tcId: 284. Signature encoding contains incorrect types: r=True, s=0 */
+  {0, 0, 6, 27522, 8, 0 },
+  /* tcId: 285. Signature encoding contains incorrect types: r=False, s=0 */
+  {0, 0, 6, 27530, 8, 0 },
+  /* tcId: 286. Signature encoding contains incorrect types: r=Null, s=0 */
+  {0, 0, 6, 27538, 7, 0 },
+  /* tcId: 287. Signature encoding contains incorrect types: r=empyt UTF-8 string, s=0 */
+  {0, 0, 6, 27545, 7, 0 },
+  /* tcId: 288. Signature encoding contains incorrect types: r="0", s=0 */
+  {0, 0, 6, 27552, 8, 0 },
+  /* tcId: 289. Signature encoding contains incorrect types: r=empty list, s=0 */
+  {0, 0, 6, 27560, 7, 0 },
+  /* tcId: 290. Signature encoding contains incorrect types: r=list containing 0, s=0 */
+  {0, 0, 6, 27567, 10, 0 },
+  /* tcId: 291. Edge case for Shamir multiplication */
+  {0, 6, 5, 27577, 71, 1 },
+  /* tcId: 292. special case hash */
+  {0, 11, 9, 27648, 71, 1 },
+  /* tcId: 293. special case hash */
+  {0, 20, 10, 27719, 70, 1 },
+  /* tcId: 294. special case hash */
+  {0, 30, 11, 27789, 71, 1 },
+  /* tcId: 295. special case hash */
+  {0, 41, 10, 27860, 71, 1 },
+  /* tcId: 296. special case hash */
+  {0, 51, 10, 27931, 70, 1 },
+  /* tcId: 297. special case hash */
+  {0, 61, 10, 28001, 71, 1 },
+  /* tcId: 298. special case hash */
+  {0, 71, 9, 28072, 70, 1 },
+  /* tcId: 299. special case hash */
+  {0, 80, 10, 28142, 71, 1 },
+  /* tcId: 300. special case hash */
+  {0, 90, 10, 28213, 71, 1 },
+  /* tcId: 301. special case hash */
+  {0, 100, 10, 28284, 71, 1 },
+  /* tcId: 302. special case hash */
+  {0, 110, 10, 28355, 71, 1 },
+  /* tcId: 303. special case hash */
+  {0, 120, 11, 28426, 70, 1 },
+  /* tcId: 304. special case hash */
+  {0, 131, 10, 28496, 71, 1 },
+  /* tcId: 305. special case hash */
+  {0, 141, 10, 28567, 71, 1 },
+  /* tcId: 306. special case hash */
+  {0, 151, 10, 28638, 70, 1 },
+  /* tcId: 307. special case hash */
+  {0, 161, 10, 28708, 71, 1 },
+  /* tcId: 308. special case hash */
+  {0, 171, 10, 28779, 71, 1 },
+  /* tcId: 309. special case hash */
+  {0, 181, 10, 28850, 70, 1 },
+  /* tcId: 310. special case hash */
+  {0, 191, 10, 28920, 71, 1 },
+  /* tcId: 311. special case hash */
+  {0, 201, 10, 28991, 71, 1 },
+  /* tcId: 312. special case hash */
+  {0, 211, 10, 29062, 71, 1 },
+  /* tcId: 313. special case hash */
+  {0, 221, 10, 29133, 70, 1 },
+  /* tcId: 314. special case hash */
+  {0, 231, 10, 29203, 71, 1 },
+  /* tcId: 315. special case hash */
+  {0, 241, 10, 29274, 71, 1 },
+  /* tcId: 316. special case hash */
+  {0, 251, 10, 29345, 71, 1 },
+  /* tcId: 317. special case hash */
+  {0, 261, 11, 29416, 71, 1 },
+  /* tcId: 318. special case hash */
+  {0, 272, 11, 29487, 70, 1 },
+  /* tcId: 319. special case hash */
+  {0, 283, 9, 29557, 71, 1 },
+  /* tcId: 320. special case hash */
+  {0, 292, 9, 29628, 71, 1 },
+  /* tcId: 321. special case hash */
+  {0, 301, 10, 29699, 71, 1 },
+  /* tcId: 322. special case hash */
+  {0, 311, 10, 29770, 71, 1 },
+  /* tcId: 323. special case hash */
+  {0, 321, 10, 29841, 70, 1 },
+  /* tcId: 324. special case hash */
+  {0, 331, 10, 29911, 70, 1 },
+  /* tcId: 325. special case hash */
+  {0, 341, 10, 29981, 71, 1 },
+  /* tcId: 326. special case hash */
+  {0, 351, 9, 30052, 70, 1 },
+  /* tcId: 327. special case hash */
+  {0, 360, 10, 30122, 70, 1 },
+  /* tcId: 328. special case hash */
+  {0, 370, 10, 30192, 70, 1 },
+  /* tcId: 329. special case hash */
+  {0, 380, 10, 30262, 70, 1 },
+  /* tcId: 330. special case hash */
+  {0, 390, 9, 30332, 71, 1 },
+  /* tcId: 331. special case hash */
+  {0, 399, 11, 30403, 70, 1 },
+  /* tcId: 332. special case hash */
+  {0, 410, 9, 30473, 71, 1 },
+  /* tcId: 333. special case hash */
+  {0, 419, 9, 30544, 71, 1 },
+  /* tcId: 334. special case hash */
+  {0, 428, 11, 30615, 70, 1 },
+  /* tcId: 335. special case hash */
+  {0, 439, 8, 30685, 71, 1 },
+  /* tcId: 336. special case hash */
+  {0, 447, 10, 30756, 70, 1 },
+  /* tcId: 337. special case hash */
+  {0, 457, 10, 30826, 71, 1 },
+  /* tcId: 338. special case hash */
+  {0, 467, 10, 30897, 70, 1 },
+  /* tcId: 339. special case hash */
+  {0, 477, 10, 30967, 70, 1 },
+  /* tcId: 340. special case hash */
+  {0, 487, 10, 31037, 70, 1 },
+  /* tcId: 341. special case hash */
+  {0, 497, 10, 31107, 71, 1 },
+  /* tcId: 342. special case hash */
+  {0, 507, 10, 31178, 70, 1 },
+  /* tcId: 343. special case hash */
+  {0, 517, 10, 31248, 70, 1 },
+  /* tcId: 344. special case hash */
+  {0, 527, 10, 31318, 71, 1 },
+  /* tcId: 345. special case hash */
+  {0, 537, 9, 31389, 70, 1 },
+  /* tcId: 346. k*G has a large x-coordinate */
+  {65, 0, 6, 31459, 24, 1 },
+  /* tcId: 347. r too large */
+  {65, 0, 6, 31483, 40, 0 },
+  /* tcId: 348. r,s are large */
+  {130, 0, 6, 31523, 40, 1 },
+  /* tcId: 349. r and s^-1 have a large Hamming weight */
+  {195, 0, 6, 31563, 70, 1 },
+  /* tcId: 350. r and s^-1 have a large Hamming weight */
+  {260, 0, 6, 31633, 70, 1 },
+  /* tcId: 351. small r and s */
+  {325, 0, 6, 31703, 8, 1 },
+  /* tcId: 352. small r and s */
+  {390, 0, 6, 31711, 8, 1 },
+  /* tcId: 353. small r and s */
+  {455, 0, 6, 31719, 8, 1 },
+  /* tcId: 354. small r and s */
+  {520, 0, 6, 31727, 8, 1 },
+  /* tcId: 355. small r and s */
+  {585, 0, 6, 31735, 8, 1 },
+  /* tcId: 356. small r and s */
+  {650, 0, 6, 31743, 8, 1 },
+  /* tcId: 357. r is larger than n */
+  {650, 0, 6, 31751, 40, 0 },
+  /* tcId: 358. s is larger than n */
+  {715, 0, 6, 31791, 10, 0 },
+  /* tcId: 359. small r and s^-1 */
+  {780, 0, 6, 31801, 40, 1 },
+  /* tcId: 360. smallish r and s^-1 */
+  {845, 0, 6, 31841, 45, 1 },
+  /* tcId: 361. 100-bit r and small s^-1 */
+  {910, 0, 6, 31886, 51, 1 },
+  /* tcId: 362. small r and 100 bit s^-1 */
+  {975, 0, 6, 31937, 40, 1 },
+  /* tcId: 363. 100-bit r and s^-1 */
+  {1040, 0, 6, 31977, 51, 1 },
+  /* tcId: 364. r and s^-1 are close to n */
+  {1105, 0, 6, 32028, 71, 1 },
+  /* tcId: 365. r and s are 64-bit integer */
+  {1170, 0, 6, 32099, 24, 1 },
+  /* tcId: 366. r and s are 100-bit integer */
+  {1235, 0, 6, 32123, 32, 1 },
+  /* tcId: 367. r and s are 128-bit integer */
+  {1300, 0, 6, 32155, 40, 1 },
+  /* tcId: 368. r and s are 160-bit integer */
+  {1365, 0, 6, 32195, 48, 1 },
+  /* tcId: 369. s == 1 */
+  {1430, 0, 6, 32243, 39, 1 },
+  /* tcId: 370. s == 0 */
+  {1430, 0, 6, 32282, 39, 0 },
+  /* tcId: 371. edge case modular inverse */
+  {1495, 0, 6, 32321, 70, 1 },
+  /* tcId: 372. edge case modular inverse */
+  {1560, 0, 6, 32391, 70, 1 },
+  /* tcId: 373. edge case modular inverse */
+  {1625, 0, 6, 32461, 70, 1 },
+  /* tcId: 374. edge case modular inverse */
+  {1690, 0, 6, 32531, 70, 1 },
+  /* tcId: 375. edge case modular inverse */
+  {1755, 0, 6, 32601, 70, 1 },
+  /* tcId: 376. edge case modular inverse */
+  {1820, 0, 6, 32671, 70, 1 },
+  /* tcId: 377. edge case modular inverse */
+  {1885, 0, 6, 32741, 70, 1 },
+  /* tcId: 378. edge case modular inverse */
+  {1950, 0, 6, 32811, 70, 1 },
+  /* tcId: 379. edge case modular inverse */
+  {2015, 0, 6, 32881, 70, 1 },
+  /* tcId: 380. edge case modular inverse */
+  {2080, 0, 6, 32951, 70, 1 },
+  /* tcId: 381. edge case modular inverse */
+  {2145, 0, 6, 33021, 70, 1 },
+  /* tcId: 382. edge case modular inverse */
+  {2210, 0, 6, 33091, 70, 1 },
+  /* tcId: 383. edge case modular inverse */
+  {2275, 0, 6, 33161, 70, 1 },
+  /* tcId: 384. edge case modular inverse */
+  {2340, 0, 6, 33231, 70, 1 },
+  /* tcId: 385. edge case modular inverse */
+  {2405, 0, 6, 33301, 70, 1 },
+  /* tcId: 386. point at infinity during verify */
+  {2470, 0, 6, 33371, 70, 0 },
+  /* tcId: 387. edge case for signature malleability */
+  {2535, 0, 6, 33441, 70, 1 },
+  /* tcId: 388. edge case for signature malleability */
+  {2600, 0, 6, 33511, 70, 0 },
+  /* tcId: 389. u1 == 1 */
+  {2665, 0, 6, 33581, 70, 1 },
+  /* tcId: 390. u1 == n - 1 */
+  {2730, 0, 6, 33651, 70, 1 },
+  /* tcId: 391. u2 == 1 */
+  {2795, 0, 6, 33721, 70, 1 },
+  /* tcId: 392. u2 == n - 1 */
+  {2860, 0, 6, 33791, 70, 1 },
+  /* tcId: 393. edge case for u1 */
+  {2925, 0, 6, 33861, 70, 1 },
+  /* tcId: 394. edge case for u1 */
+  {2990, 0, 6, 33931, 70, 1 },
+  /* tcId: 395. edge case for u1 */
+  {3055, 0, 6, 34001, 70, 1 },
+  /* tcId: 396. edge case for u1 */
+  {3120, 0, 6, 34071, 70, 1 },
+  /* tcId: 397. edge case for u1 */
+  {3185, 0, 6, 34141, 70, 1 },
+  /* tcId: 398. edge case for u1 */
+  {3250, 0, 6, 34211, 70, 1 },
+  /* tcId: 399. edge case for u1 */
+  {3315, 0, 6, 34281, 70, 1 },
+  /* tcId: 400. edge case for u1 */
+  {3380, 0, 6, 34351, 70, 1 },
+  /* tcId: 401. edge case for u1 */
+  {3445, 0, 6, 34421, 70, 1 },
+  /* tcId: 402. edge case for u1 */
+  {3510, 0, 6, 34491, 70, 1 },
+  /* tcId: 403. edge case for u1 */
+  {3575, 0, 6, 34561, 70, 1 },
+  /* tcId: 404. edge case for u1 */
+  {3640, 0, 6, 34631, 70, 1 },
+  /* tcId: 405. edge case for u1 */
+  {3705, 0, 6, 34701, 70, 1 },
+  /* tcId: 406. edge case for u1 */
+  {3770, 0, 6, 34771, 70, 1 },
+  /* tcId: 407. edge case for u1 */
+  {3835, 0, 6, 34841, 70, 1 },
+  /* tcId: 408. edge case for u2 */
+  {3900, 0, 6, 34911, 70, 1 },
+  /* tcId: 409. edge case for u2 */
+  {3965, 0, 6, 34981, 70, 1 },
+  /* tcId: 410. edge case for u2 */
+  {4030, 0, 6, 35051, 70, 1 },
+  /* tcId: 411. edge case for u2 */
+  {4095, 0, 6, 35121, 70, 1 },
+  /* tcId: 412. edge case for u2 */
+  {4160, 0, 6, 35191, 70, 1 },
+  /* tcId: 413. edge case for u2 */
+  {4225, 0, 6, 35261, 69, 1 },
+  /* tcId: 414. edge case for u2 */
+  {4290, 0, 6, 35330, 70, 1 },
+  /* tcId: 415. edge case for u2 */
+  {4355, 0, 6, 35400, 70, 1 },
+  /* tcId: 416. edge case for u2 */
+  {4420, 0, 6, 35470, 70, 1 },
+  /* tcId: 417. edge case for u2 */
+  {4485, 0, 6, 35540, 70, 1 },
+  /* tcId: 418. edge case for u2 */
+  {4550, 0, 6, 35610, 70, 1 },
+  /* tcId: 419. edge case for u2 */
+  {4615, 0, 6, 35680, 70, 1 },
+  /* tcId: 420. edge case for u2 */
+  {4680, 0, 6, 35750, 70, 1 },
+  /* tcId: 421. edge case for u2 */
+  {4745, 0, 6, 35820, 70, 1 },
+  /* tcId: 422. edge case for u2 */
+  {4810, 0, 6, 35890, 70, 1 },
+  /* tcId: 423. point duplication during verification */
+  {4875, 0, 6, 35960, 70, 1 },
+  /* tcId: 424. duplication bug */
+  {4940, 0, 6, 36030, 70, 0 },
+  /* tcId: 425. comparison with point at infinity  */
+  {5005, 0, 6, 36100, 70, 0 },
+  /* tcId: 426. extreme value for k and edgecase s */
+  {5070, 0, 6, 36170, 71, 1 },
+  /* tcId: 427. extreme value for k and s^-1 */
+  {5135, 0, 6, 36241, 71, 1 },
+  /* tcId: 428. extreme value for k and s^-1 */
+  {5200, 0, 6, 36312, 71, 1 },
+  /* tcId: 429. extreme value for k and s^-1 */
+  {5265, 0, 6, 36383, 71, 1 },
+  /* tcId: 430. extreme value for k and s^-1 */
+  {5330, 0, 6, 36454, 71, 1 },
+  /* tcId: 431. extreme value for k */
+  {5395, 0, 6, 36525, 71, 1 },
+  /* tcId: 432. extreme value for k and edgecase s */
+  {5460, 0, 6, 36596, 70, 1 },
+  /* tcId: 433. extreme value for k and s^-1 */
+  {5525, 0, 6, 36666, 70, 1 },
+  /* tcId: 434. extreme value for k and s^-1 */
+  {5590, 0, 6, 36736, 70, 1 },
+  /* tcId: 435. extreme value for k and s^-1 */
+  {5655, 0, 6, 36806, 70, 1 },
+  /* tcId: 436. extreme value for k and s^-1 */
+  {5720, 0, 6, 36876, 70, 1 },
+  /* tcId: 437. extreme value for k */
+  {5785, 0, 6, 36946, 70, 1 },
+  /* tcId: 438. public key shares x-coordinate with generator */
+  {5850, 0, 6, 37016, 71, 0 },
+  /* tcId: 439. public key shares x-coordinate with generator */
+  {5850, 0, 6, 37087, 70, 0 },
+  /* tcId: 440. public key shares x-coordinate with generator */
+  {5915, 0, 6, 37157, 71, 0 },
+  /* tcId: 441. public key shares x-coordinate with generator */
+  {5915, 0, 6, 37228, 70, 0 },
+  /* tcId: 442. pseudorandom signature */
+  {5980, 546, 0, 37298, 71, 1 },
+  /* tcId: 443. pseudorandom signature */
+  {5980, 546, 3, 37369, 70, 1 },
+  /* tcId: 444. pseudorandom signature */
+  {5980, 0, 6, 37439, 71, 1 },
+  /* tcId: 445. pseudorandom signature */
+  {5980, 549, 20, 37510, 70, 1 },
+  /* tcId: 446. y-coordinate of the public key is small */
+  {6045, 569, 7, 37580, 70, 1 },
+  /* tcId: 447. y-coordinate of the public key is small */
+  {6045, 569, 7, 37650, 70, 1 },
+  /* tcId: 448. y-coordinate of the public key is small */
+  {6045, 569, 7, 37720, 71, 1 },
+  /* tcId: 449. y-coordinate of the public key is large */
+  {6110, 569, 7, 37791, 70, 1 },
+  /* tcId: 450. y-coordinate of the public key is large */
+  {6110, 569, 7, 37861, 71, 1 },
+  /* tcId: 451. y-coordinate of the public key is large */
+  {6110, 569, 7, 37932, 70, 1 },
+  /* tcId: 452. x-coordinate of the public key is small */
+  {6175, 569, 7, 38002, 70, 1 },
+  /* tcId: 453. x-coordinate of the public key is small */
+  {6175, 569, 7, 38072, 71, 1 },
+  /* tcId: 454. x-coordinate of the public key is small */
+  {6175, 569, 7, 38143, 71, 1 },
+  /* tcId: 455. x-coordinate of the public key has many trailing 1's */
+  {6240, 569, 7, 38214, 70, 1 },
+  /* tcId: 456. x-coordinate of the public key has many trailing 1's */
+  {6240, 569, 7, 38284, 71, 1 },
+  /* tcId: 457. x-coordinate of the public key has many trailing 1's */
+  {6240, 569, 7, 38355, 71, 1 },
+  /* tcId: 458. y-coordinate of the public key has many trailing 1's */
+  {6305, 569, 7, 38426, 70, 1 },
+  /* tcId: 459. y-coordinate of the public key has many trailing 1's */
+  {6305, 569, 7, 38496, 71, 1 },
+  /* tcId: 460. y-coordinate of the public key has many trailing 1's */
+  {6305, 569, 7, 38567, 71, 1 },
+  /* tcId: 461. x-coordinate of the public key has many trailing 0's */
+  {6370, 569, 7, 38638, 70, 1 },
+  /* tcId: 462. x-coordinate of the public key has many trailing 0's */
+  {6370, 569, 7, 38708, 70, 1 },
+  /* tcId: 463. x-coordinate of the public key has many trailing 0's */
+  {6370, 569, 7, 38778, 71, 1 },
+
+};
diff --git a/secp256k1-sys/depend/secp256k1/src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.json b/secp256k1-sys/depend/secp256k1/src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.json
new file mode 100644
index 000000000..9c9074799
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/src/wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.json
@@ -0,0 +1,6360 @@
+{
+  "algorithm" : "ECDSA",
+  "schema" : "ecdsa_bitcoin_verify_schema.json",
+  "generatorVersion" : "0.9rc5",
+  "numberOfTests" : 463,
+  "header" : [
+    "Test vectors of type EcdsaBitcoinVerify are meant for the verification",
+    "of a ECDSA variant used for bitcoin, that add signature non-malleability."
+  ],
+  "notes" : {
+    "ArithmeticError" : {
+      "bugType" : "EDGE_CASE",
+      "description" : "Some implementations of ECDSA have arithmetic errors that occur when intermediate results have extreme values. This test vector has been constructed to test such occurences.",
+      "cves" : [
+        "CVE-2017-18146"
+      ]
+    },
+    "BerEncodedSignature" : {
+      "bugType" : "BER_ENCODING",
+      "description" : "ECDSA signatures are usually DER encoded. This signature contains valid values for r and s, but it uses alternative BER encoding.",
+      "effect" : "Accepting alternative BER encodings may be benign in some cases, or be an issue if protocol requires signature malleability.",
+      "cves" : [
+        "CVE-2020-14966",
+        "CVE-2020-13822",
+        "CVE-2019-14859",
+        "CVE-2016-1000342"
+      ]
+    },
+    "EdgeCasePublicKey" : {
+      "bugType" : "EDGE_CASE",
+      "description" : "The test vector uses a special case public key. "
+    },
+    "EdgeCaseShamirMultiplication" : {
+      "bugType" : "EDGE_CASE",
+      "description" : "Shamir proposed a fast method for computing the sum of two scalar multiplications efficiently. This test vector has been constructed so that an intermediate result is the point at infinity if Shamir's method is used."
+    },
+    "IntegerOverflow" : {
+      "bugType" : "CAN_OF_WORMS",
+      "description" : "The test vector contains an r and s that has been modified, so that the original value is restored if the implementation ignores the most significant bits.",
+      "effect" : "Without further analysis it is unclear if the modification can be used to forge signatures."
+    },
+    "InvalidEncoding" : {
+      "bugType" : "CAN_OF_WORMS",
+      "description" : "ECDSA signatures are encoded using ASN.1. This test vector contains an incorrectly encoded signature. The test vector itself was generated from a valid signature by modifying its encoding.",
+      "effect" : "Without further analysis it is unclear if the modification can be used to forge signatures."
+    },
+    "InvalidSignature" : {
+      "bugType" : "AUTH_BYPASS",
+      "description" : "The signature contains special case values such as r=0 and s=0. Buggy implementations may accept such values, if the implementation does not check boundaries and computes s^(-1) == 0.",
+      "effect" : "Accepting such signatures can have the effect that an adversary can forge signatures without even knowning the message to sign.",
+      "cves" : [
+        "CVE-2022-21449",
+        "CVE-2021-43572",
+        "CVE-2022-24884"
+      ]
+    },
+    "InvalidTypesInSignature" : {
+      "bugType" : "AUTH_BYPASS",
+      "description" : "The signature contains invalid types. Dynamic typed languages sometime coerce such values of different types into integers. If an implementation is careless and has additional bugs, such as not checking integer boundaries then it may be possible that such signatures are accepted.",
+      "effect" : "Accepting such signatures can have the effect that an adversary can forge signatures without even knowning the message to sign.",
+      "cves" : [
+        "CVE-2022-21449"
+      ]
+    },
+    "ModifiedInteger" : {
+      "bugType" : "CAN_OF_WORMS",
+      "description" : "The test vector contains an r and s that has been modified. The goal is to check for arithmetic errors.",
+      "effect" : "Without further analysis it is unclear if the modification can be used to forge signatures."
+    },
+    "ModifiedSignature" : {
+      "bugType" : "CAN_OF_WORMS",
+      "description" : "The test vector contains an invalid signature that was generated from a valid signature by modifying it.",
+      "effect" : "Without further analysis it is unclear if the modification can be used to forge signatures."
+    },
+    "ModularInverse" : {
+      "bugType" : "EDGE_CASE",
+      "description" : "The test vectors contains a signature where computing the modular inverse of s hits an edge case.",
+      "effect" : "While the signature in this test vector is constructed and similar cases are unlikely to occur, it is important to determine if the underlying arithmetic error can be used to forge signatures.",
+      "cves" : [
+        "CVE-2019-0865"
+      ]
+    },
+    "PointDuplication" : {
+      "bugType" : "EDGE_CASE",
+      "description" : "Some implementations of ECDSA do not handle duplication and points at infinity correctly. This is a test vector that has been specially crafted to check for such an omission.",
+      "cves" : [
+        "2020-12607",
+        "CVE-2015-2730"
+      ]
+    },
+    "RangeCheck" : {
+      "bugType" : "CAN_OF_WORMS",
+      "description" : "The test vector contains an r and s that has been modified. By adding or subtracting the order of the group (or other values) the test vector checks whether signature verification verifies the range of r and s.",
+      "effect" : "Without further analysis it is unclear if the modification can be used to forge signatures."
+    },
+    "SignatureMalleabilityBitcoin" : {
+      "bugType" : "SIGNATURE_MALLEABILITY",
+      "description" : "\"BitCoins\"-curves are curves where signature malleability can be a serious issue. An implementation should only accept a signature s where s < n/2. If an implementation is not meant for uses cases that require signature malleability then this implemenation should be tested with another set of test vectors.",
+      "effect" : "In bitcoin exchanges, it may be used to make a double deposits or double withdrawals",
+      "links" : [
+        "https://en.bitcoin.it/wiki/Transaction_malleability",
+        "https://en.bitcoinwiki.org/wiki/Transaction_Malleability"
+      ]
+    },
+    "SmallRandS" : {
+      "bugType" : "EDGE_CASE",
+      "description" : "The test vectors contains a signature where both r and s are small integers. Some libraries cannot verify such signatures.",
+      "effect" : "While the signature in this test vector is constructed and similar cases are unlikely to occur, it is important to determine if the underlying arithmetic error can be used to forge signatures.",
+      "cves" : [
+        "2020-13895"
+      ]
+    },
+    "SpecialCaseHash" : {
+      "bugType" : "EDGE_CASE",
+      "description" : "The test vector contains a signature where the hash of the message is a special case, e.g., contains a long run of 0 or 1 bits."
+    },
+    "ValidSignature" : {
+      "bugType" : "BASIC",
+      "description" : "The test vector contains a valid signature that was generated pseudorandomly. Such signatures should not fail to verify unless some of the parameters (e.g. curve or hash function) are not supported."
+    }
+  },
+  "testGroups" : [
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04b838ff44e5bc177bf21189d0766082fc9d843226887fc9760371100b7ee20a6ff0c9d75bfba7b31a6bca1974496eeb56de357071955d83c4b1badaa0b21832e9",
+        "wx" : "00b838ff44e5bc177bf21189d0766082fc9d843226887fc9760371100b7ee20a6f",
+        "wy" : "00f0c9d75bfba7b31a6bca1974496eeb56de357071955d83c4b1badaa0b21832e9"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004b838ff44e5bc177bf21189d0766082fc9d843226887fc9760371100b7ee20a6ff0c9d75bfba7b31a6bca1974496eeb56de357071955d83c4b1badaa0b21832e9",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEuDj/ROW8F3vyEYnQdmCC/J2EMiaIf8l2\nA3EQC37iCm/wyddb+6ezGmvKGXRJbutW3jVwcZVdg8Sxutqgshgy6Q==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 1,
+          "comment" : "Signature malleability",
+          "flags" : [
+            "SignatureMalleabilityBitcoin"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365022100900e75ad233fcc908509dbff5922647db37c21f4afd3203ae8dc4ae7794b0f87",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 2,
+          "comment" : "valid",
+          "flags" : [
+            "ValidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 3,
+          "comment" : "length of sequence [r, s] uses long form encoding",
+          "flags" : [
+            "BerEncodedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "308145022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 4,
+          "comment" : "length of sequence [r, s] contains a leading 0",
+          "flags" : [
+            "BerEncodedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30820045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 5,
+          "comment" : "length of sequence [r, s] uses 70 instead of 69",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 6,
+          "comment" : "length of sequence [r, s] uses 68 instead of 69",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 7,
+          "comment" : "uint32 overflow in length of sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30850100000045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 8,
+          "comment" : "uint64 overflow in length of sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3089010000000000000045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 9,
+          "comment" : "length of sequence [r, s] = 2**31 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30847fffffff022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 10,
+          "comment" : "length of sequence [r, s] = 2**31",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "308480000000022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 11,
+          "comment" : "length of sequence [r, s] = 2**32 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3084ffffffff022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 12,
+          "comment" : "length of sequence [r, s] = 2**40 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3085ffffffffff022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 13,
+          "comment" : "length of sequence [r, s] = 2**64 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3088ffffffffffffffff022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 14,
+          "comment" : "incorrect length of sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30ff022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 15,
+          "comment" : "replaced sequence [r, s] by an indefinite length tag without termination",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3080022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 16,
+          "comment" : "removing sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 17,
+          "comment" : "lonely sequence tag",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 18,
+          "comment" : "appending 0's to sequence [r, s]",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 19,
+          "comment" : "prepending 0's to sequence [r, s]",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30470000022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 20,
+          "comment" : "appending unused 0's to sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 21,
+          "comment" : "appending null value to sequence [r, s]",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 22,
+          "comment" : "prepending garbage to sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304a4981773045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 23,
+          "comment" : "prepending garbage to sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304925003045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 24,
+          "comment" : "appending garbage to sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30473045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0004deadbeef",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 25,
+          "comment" : "including undefined tags",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304daa00bb00cd003045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 26,
+          "comment" : "including undefined tags",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304d2229aa00bb00cd00022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 27,
+          "comment" : "including undefined tags",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304d022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323652228aa00bb00cd0002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 28,
+          "comment" : "truncated length of sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3081",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 29,
+          "comment" : "including undefined tags to sequence [r, s]",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304baa02aabb3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 30,
+          "comment" : "using composition with indefinite length for sequence [r, s]",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30803045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 31,
+          "comment" : "using composition with wrong tag for sequence [r, s]",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30803145022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 32,
+          "comment" : "Replacing sequence [r, s] with NULL",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "0500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 33,
+          "comment" : "changing tag value of sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "2e45022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 34,
+          "comment" : "changing tag value of sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "2f45022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 35,
+          "comment" : "changing tag value of sequence [r, s]",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3145022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 36,
+          "comment" : "changing tag value of sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3245022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 37,
+          "comment" : "changing tag value of sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "ff45022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 38,
+          "comment" : "dropping value of sequence [r, s]",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 39,
+          "comment" : "using composition for sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304930010230442100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 40,
+          "comment" : "truncated sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 41,
+          "comment" : "truncated sequence [r, s]",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30442100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 42,
+          "comment" : "sequence [r, s] of size 4166 to check for overflows",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30821046022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 43,
+          "comment" : "indefinite length",
+          "flags" : [
+            "BerEncodedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3080022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 44,
+          "comment" : "indefinite length with truncated delimiter",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3080022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba00",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 45,
+          "comment" : "indefinite length with additional element",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3080022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba05000000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 46,
+          "comment" : "indefinite length with truncated element",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3080022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba060811220000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 47,
+          "comment" : "indefinite length with garbage",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3080022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000fe02beef",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 48,
+          "comment" : "indefinite length with nonempty EOC",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3080022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0002beef",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 49,
+          "comment" : "prepend empty sequence",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30473000022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 50,
+          "comment" : "append empty sequence",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba3000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 51,
+          "comment" : "append zero",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3048022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 52,
+          "comment" : "append garbage with high tag number",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3048022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31babf7f00",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 53,
+          "comment" : "append null with explicit tag",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3049022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31baa0020500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 54,
+          "comment" : "append null with implicit tag",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31baa000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 55,
+          "comment" : "sequence of sequence",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30473045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 56,
+          "comment" : "truncated sequence: removed last 1 elements",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3023022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 57,
+          "comment" : "repeating element in sequence",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3067022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 58,
+          "comment" : "flipped bit 0 in r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304300813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236402206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 59,
+          "comment" : "flipped bit 32 in r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304300813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccac983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 60,
+          "comment" : "flipped bit 48 in r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304300813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5133ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 61,
+          "comment" : "flipped bit 64 in r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304300813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc08b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 62,
+          "comment" : "length of r uses long form encoding",
+          "flags" : [
+            "BerEncodedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304602812100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 63,
+          "comment" : "length of r contains a leading 0",
+          "flags" : [
+            "BerEncodedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30470282002100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 64,
+          "comment" : "length of r uses 34 instead of 33",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022200813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 65,
+          "comment" : "length of r uses 32 instead of 33",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022000813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 66,
+          "comment" : "uint32 overflow in length of r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304a0285010000002100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 67,
+          "comment" : "uint64 overflow in length of r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304e028901000000000000002100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 68,
+          "comment" : "length of r = 2**31 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304902847fffffff00813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 69,
+          "comment" : "length of r = 2**31",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304902848000000000813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 70,
+          "comment" : "length of r = 2**32 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30490284ffffffff00813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 71,
+          "comment" : "length of r = 2**40 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304a0285ffffffffff00813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 72,
+          "comment" : "length of r = 2**64 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304d0288ffffffffffffffff00813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 73,
+          "comment" : "incorrect length of r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304502ff00813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 74,
+          "comment" : "replaced r by an indefinite length tag without termination",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045028000813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 75,
+          "comment" : "removing r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "302202206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 76,
+          "comment" : "lonely integer tag",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30230202206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 77,
+          "comment" : "lonely integer tag",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3024022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 78,
+          "comment" : "appending 0's to r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022300813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365000002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 79,
+          "comment" : "prepending 0's to r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30470223000000813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 80,
+          "comment" : "appending unused 0's to r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365000002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 81,
+          "comment" : "appending null value to r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022300813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365050002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 82,
+          "comment" : "prepending garbage to r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304a2226498177022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 83,
+          "comment" : "prepending garbage to r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304922252500022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 84,
+          "comment" : "appending garbage to r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304d2223022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650004deadbeef02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 85,
+          "comment" : "truncated length of r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3024028102206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 86,
+          "comment" : "including undefined tags to r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304b2227aa02aabb022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 87,
+          "comment" : "using composition with indefinite length for r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30492280022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365000002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 88,
+          "comment" : "using composition with wrong tag for r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30492280032100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365000002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 89,
+          "comment" : "Replacing r with NULL",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3024050002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 90,
+          "comment" : "changing tag value of r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045002100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 91,
+          "comment" : "changing tag value of r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045012100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 92,
+          "comment" : "changing tag value of r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045032100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 93,
+          "comment" : "changing tag value of r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045042100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 94,
+          "comment" : "changing tag value of r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045ff2100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 95,
+          "comment" : "dropping value of r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3024020002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 96,
+          "comment" : "using composition for r",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304922250201000220813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 97,
+          "comment" : "modifying first byte of r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022102813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 98,
+          "comment" : "modifying last byte of r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323e502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 99,
+          "comment" : "truncated r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022000813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832302206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 100,
+          "comment" : "truncated r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30440220813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 101,
+          "comment" : "r of size 4130 to check for overflows",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "308210480282102200813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 102,
+          "comment" : "leading ff in r",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30460222ff00813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 103,
+          "comment" : "replaced r by infinity",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "302509018002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 104,
+          "comment" : "replacing r with zero",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "302502010002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 105,
+          "comment" : "flipped bit 0 in s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3043022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323656ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31bb",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 106,
+          "comment" : "flipped bit 32 in s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3043022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323656ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a456eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 107,
+          "comment" : "flipped bit 48 in s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3043022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323656ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f713a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 108,
+          "comment" : "flipped bit 64 in s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3043022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323656ff18a52dcc0336f7af62400a6dd9b810732baf1ff758001d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 109,
+          "comment" : "length of s uses long form encoding",
+          "flags" : [
+            "BerEncodedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650281206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 110,
+          "comment" : "length of s contains a leading 0",
+          "flags" : [
+            "BerEncodedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365028200206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 111,
+          "comment" : "length of s uses 33 instead of 32",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502216ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 112,
+          "comment" : "length of s uses 31 instead of 32",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365021f6ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 113,
+          "comment" : "uint32 overflow in length of s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304a022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365028501000000206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 114,
+          "comment" : "uint64 overflow in length of s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304e022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502890100000000000000206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 115,
+          "comment" : "length of s = 2**31 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3049022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502847fffffff6ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 116,
+          "comment" : "length of s = 2**31",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3049022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650284800000006ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 117,
+          "comment" : "length of s = 2**32 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3049022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650284ffffffff6ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 118,
+          "comment" : "length of s = 2**40 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304a022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650285ffffffffff6ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 119,
+          "comment" : "length of s = 2**64 - 1",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304d022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650288ffffffffffffffff6ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 120,
+          "comment" : "incorrect length of s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502ff6ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 121,
+          "comment" : "replaced s by an indefinite length tag without termination",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502806ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 122,
+          "comment" : "appending 0's to s",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502226ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 123,
+          "comment" : "prepending 0's to s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365022200006ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 124,
+          "comment" : "appending null value to s",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3047022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502226ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 125,
+          "comment" : "prepending garbage to s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304a022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365222549817702206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 126,
+          "comment" : "prepending garbage to s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3049022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323652224250002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 127,
+          "comment" : "appending garbage to s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304d022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365222202206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0004deadbeef",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 128,
+          "comment" : "truncated length of s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650281",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 129,
+          "comment" : "including undefined tags to s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304b022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323652226aa02aabb02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 130,
+          "comment" : "using composition with indefinite length for s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3049022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365228002206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 131,
+          "comment" : "using composition with wrong tag for s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3049022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365228003206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 132,
+          "comment" : "Replacing s with NULL",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 133,
+          "comment" : "changing tag value of s",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236500206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 134,
+          "comment" : "changing tag value of s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236501206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 135,
+          "comment" : "changing tag value of s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236503206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 136,
+          "comment" : "changing tag value of s",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236504206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 137,
+          "comment" : "changing tag value of s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365ff206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 138,
+          "comment" : "dropping value of s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650200",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 139,
+          "comment" : "using composition for s",
+          "flags" : [
+            "InvalidEncoding"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3049022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365222402016f021ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 140,
+          "comment" : "modifying first byte of s",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206df18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 141,
+          "comment" : "modifying last byte of s",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb313a",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 142,
+          "comment" : "truncated s",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365021f6ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 143,
+          "comment" : "truncated s",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365021ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 144,
+          "comment" : "s of size 4129 to check for overflows",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30821048022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365028210216ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 145,
+          "comment" : "leading ff in s",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc98323650221ff6ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 146,
+          "comment" : "replaced s by infinity",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365090180",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 147,
+          "comment" : "replacing s with zero",
+          "flags" : [
+            "ModifiedSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc9832365020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 148,
+          "comment" : "replaced r by r + n",
+          "flags" : [
+            "RangeCheck"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022101813ef79ccefa9a56f7ba805f0e478583b90deabca4b05c4574e49b5899b964a602206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 149,
+          "comment" : "replaced r by r - n",
+          "flags" : [
+            "RangeCheck"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30440220813ef79ccefa9a56f7ba805f0e47858643b030ef461f1bcdf53fde3ef94ce22402206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 150,
+          "comment" : "replaced r by r + 256 * n",
+          "flags" : [
+            "RangeCheck"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304602220100813ef79ccefa9a56f7ba805f0e47843fad3bf4853e07f7c98770c99bffc4646502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 151,
+          "comment" : "replaced r by -r",
+          "flags" : [
+            "ModifiedInteger"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30450221ff7ec10863310565a908457fa0f1b87a7b01a0f22a0a9843f64aedc334367cdc9b02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 152,
+          "comment" : "replaced r by n - r",
+          "flags" : [
+            "ModifiedInteger"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ec10863310565a908457fa0f1b87a79bc4fcf10b9e0e4320ac021c106b31ddc02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 153,
+          "comment" : "replaced r by -n - r",
+          "flags" : [
+            "ModifiedInteger"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30450221fe7ec10863310565a908457fa0f1b87a7c46f215435b4fa3ba8b1b64a766469b5a02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 154,
+          "comment" : "replaced r by r + 2**256",
+          "flags" : [
+            "IntegerOverflow"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022101813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 155,
+          "comment" : "replaced r by r + 2**320",
+          "flags" : [
+            "IntegerOverflow"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304d0229010000000000000000813ef79ccefa9a56f7ba805f0e478584fe5f0dd5f567bc09b5123ccbc983236502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 156,
+          "comment" : "replaced s by s + n",
+          "flags" : [
+            "RangeCheck"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30450221016ff18a52dcc0336f7af62400a6dd9b7fc1e197d8aebe203c96c87232272172fb02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 157,
+          "comment" : "replaced s by s - n",
+          "flags" : [
+            "RangeCheck"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30450221ff6ff18a52dcc0336f7af62400a6dd9b824c83de0b502cdfc51723b51886b4f07902206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 158,
+          "comment" : "replaced s by s + 256 * n",
+          "flags" : [
+            "RangeCheck"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022201006ff18a52dcc0336f7af62400a6dd9a3bb60fa1a14815bbc0a954a0758d2c72ba02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 159,
+          "comment" : "replaced s by -s",
+          "flags" : [
+            "ModifiedInteger"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30440220900e75ad233fcc908509dbff5922647ef8cd450e008a7fff2909ec5aa914ce4602206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 160,
+          "comment" : "replaced s by -n - s",
+          "flags" : [
+            "ModifiedInteger"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30450221fe900e75ad233fcc908509dbff592264803e1e68275141dfc369378dcdd8de8d0502206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 161,
+          "comment" : "replaced s by s + 2**256",
+          "flags" : [
+            "IntegerOverflow"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30450221016ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 162,
+          "comment" : "replaced s by s - 2**256",
+          "flags" : [
+            "IntegerOverflow"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30450221ff6ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 163,
+          "comment" : "replaced s by s + 2**320",
+          "flags" : [
+            "IntegerOverflow"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304d02290100000000000000006ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba02206ff18a52dcc0336f7af62400a6dd9b810732baf1ff758000d6f613a556eb31ba",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 164,
+          "comment" : "Signature with special case values r=0 and s=0",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020100020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 165,
+          "comment" : "Signature with special case values r=0 and s=1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020100020101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 166,
+          "comment" : "Signature with special case values r=0 and s=-1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201000201ff",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 167,
+          "comment" : "Signature with special case values r=0 and s=n",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020100022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 168,
+          "comment" : "Signature with special case values r=0 and s=n - 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020100022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 169,
+          "comment" : "Signature with special case values r=0 and s=n + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020100022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 170,
+          "comment" : "Signature with special case values r=0 and s=p",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020100022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 171,
+          "comment" : "Signature with special case values r=0 and s=p + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020100022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 172,
+          "comment" : "Signature with special case values r=1 and s=0",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020101020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 173,
+          "comment" : "Signature with special case values r=1 and s=1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020101020101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 174,
+          "comment" : "Signature with special case values r=1 and s=-1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201010201ff",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 175,
+          "comment" : "Signature with special case values r=1 and s=n",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020101022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 176,
+          "comment" : "Signature with special case values r=1 and s=n - 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020101022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 177,
+          "comment" : "Signature with special case values r=1 and s=n + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020101022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 178,
+          "comment" : "Signature with special case values r=1 and s=p",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020101022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 179,
+          "comment" : "Signature with special case values r=1 and s=p + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020101022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 180,
+          "comment" : "Signature with special case values r=-1 and s=0",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201ff020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 181,
+          "comment" : "Signature with special case values r=-1 and s=1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201ff020101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 182,
+          "comment" : "Signature with special case values r=-1 and s=-1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201ff0201ff",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 183,
+          "comment" : "Signature with special case values r=-1 and s=n",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30260201ff022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 184,
+          "comment" : "Signature with special case values r=-1 and s=n - 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30260201ff022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 185,
+          "comment" : "Signature with special case values r=-1 and s=n + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30260201ff022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 186,
+          "comment" : "Signature with special case values r=-1 and s=p",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30260201ff022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 187,
+          "comment" : "Signature with special case values r=-1 and s=p + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30260201ff022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 188,
+          "comment" : "Signature with special case values r=n and s=0",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 189,
+          "comment" : "Signature with special case values r=n and s=1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141020101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 190,
+          "comment" : "Signature with special case values r=n and s=-1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641410201ff",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 191,
+          "comment" : "Signature with special case values r=n and s=n",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 192,
+          "comment" : "Signature with special case values r=n and s=n - 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 193,
+          "comment" : "Signature with special case values r=n and s=n + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 194,
+          "comment" : "Signature with special case values r=n and s=p",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 195,
+          "comment" : "Signature with special case values r=n and s=p + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 196,
+          "comment" : "Signature with special case values r=n - 1 and s=0",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 197,
+          "comment" : "Signature with special case values r=n - 1 and s=1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140020101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 198,
+          "comment" : "Signature with special case values r=n - 1 and s=-1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641400201ff",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 199,
+          "comment" : "Signature with special case values r=n - 1 and s=n",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 200,
+          "comment" : "Signature with special case values r=n - 1 and s=n - 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 201,
+          "comment" : "Signature with special case values r=n - 1 and s=n + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 202,
+          "comment" : "Signature with special case values r=n - 1 and s=p",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 203,
+          "comment" : "Signature with special case values r=n - 1 and s=p + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 204,
+          "comment" : "Signature with special case values r=n + 1 and s=0",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 205,
+          "comment" : "Signature with special case values r=n + 1 and s=1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142020101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 206,
+          "comment" : "Signature with special case values r=n + 1 and s=-1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641420201ff",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 207,
+          "comment" : "Signature with special case values r=n + 1 and s=n",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 208,
+          "comment" : "Signature with special case values r=n + 1 and s=n - 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 209,
+          "comment" : "Signature with special case values r=n + 1 and s=n + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 210,
+          "comment" : "Signature with special case values r=n + 1 and s=p",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 211,
+          "comment" : "Signature with special case values r=n + 1 and s=p + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 212,
+          "comment" : "Signature with special case values r=p and s=0",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 213,
+          "comment" : "Signature with special case values r=p and s=1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f020101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 214,
+          "comment" : "Signature with special case values r=p and s=-1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f0201ff",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 215,
+          "comment" : "Signature with special case values r=p and s=n",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 216,
+          "comment" : "Signature with special case values r=p and s=n - 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 217,
+          "comment" : "Signature with special case values r=p and s=n + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 218,
+          "comment" : "Signature with special case values r=p and s=p",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 219,
+          "comment" : "Signature with special case values r=p and s=p + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 220,
+          "comment" : "Signature with special case values r=p + 1 and s=0",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 221,
+          "comment" : "Signature with special case values r=p + 1 and s=1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30020101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 222,
+          "comment" : "Signature with special case values r=p + 1 and s=-1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc300201ff",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 223,
+          "comment" : "Signature with special case values r=p + 1 and s=n",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 224,
+          "comment" : "Signature with special case values r=p + 1 and s=n - 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 225,
+          "comment" : "Signature with special case values r=p + 1 and s=n + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 226,
+          "comment" : "Signature with special case values r=p + 1 and s=p",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 227,
+          "comment" : "Signature with special case values r=p + 1 and s=p + 1",
+          "flags" : [
+            "InvalidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3046022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc30",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 228,
+          "comment" : "Signature encoding contains incorrect types: r=0, s=0.25",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3008020100090380fe01",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 229,
+          "comment" : "Signature encoding contains incorrect types: r=0, s=nan",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020100090142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 230,
+          "comment" : "Signature encoding contains incorrect types: r=0, s=True",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020100010101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 231,
+          "comment" : "Signature encoding contains incorrect types: r=0, s=False",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020100010100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 232,
+          "comment" : "Signature encoding contains incorrect types: r=0, s=Null",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050201000500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 233,
+          "comment" : "Signature encoding contains incorrect types: r=0, s=empyt UTF-8 string",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050201000c00",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 234,
+          "comment" : "Signature encoding contains incorrect types: r=0, s=\"0\"",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201000c0130",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 235,
+          "comment" : "Signature encoding contains incorrect types: r=0, s=empty list",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050201003000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 236,
+          "comment" : "Signature encoding contains incorrect types: r=0, s=list containing 0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30080201003003020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 237,
+          "comment" : "Signature encoding contains incorrect types: r=1, s=0.25",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3008020101090380fe01",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 238,
+          "comment" : "Signature encoding contains incorrect types: r=1, s=nan",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020101090142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 239,
+          "comment" : "Signature encoding contains incorrect types: r=1, s=True",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020101010101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 240,
+          "comment" : "Signature encoding contains incorrect types: r=1, s=False",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020101010100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 241,
+          "comment" : "Signature encoding contains incorrect types: r=1, s=Null",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050201010500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 242,
+          "comment" : "Signature encoding contains incorrect types: r=1, s=empyt UTF-8 string",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050201010c00",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 243,
+          "comment" : "Signature encoding contains incorrect types: r=1, s=\"0\"",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201010c0130",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 244,
+          "comment" : "Signature encoding contains incorrect types: r=1, s=empty list",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050201013000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 245,
+          "comment" : "Signature encoding contains incorrect types: r=1, s=list containing 0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30080201013003020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 246,
+          "comment" : "Signature encoding contains incorrect types: r=-1, s=0.25",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30080201ff090380fe01",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 247,
+          "comment" : "Signature encoding contains incorrect types: r=-1, s=nan",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201ff090142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 248,
+          "comment" : "Signature encoding contains incorrect types: r=-1, s=True",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201ff010101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 249,
+          "comment" : "Signature encoding contains incorrect types: r=-1, s=False",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201ff010100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 250,
+          "comment" : "Signature encoding contains incorrect types: r=-1, s=Null",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050201ff0500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 251,
+          "comment" : "Signature encoding contains incorrect types: r=-1, s=empyt UTF-8 string",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050201ff0c00",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 252,
+          "comment" : "Signature encoding contains incorrect types: r=-1, s=\"0\"",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060201ff0c0130",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 253,
+          "comment" : "Signature encoding contains incorrect types: r=-1, s=empty list",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050201ff3000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 254,
+          "comment" : "Signature encoding contains incorrect types: r=-1, s=list containing 0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30080201ff3003020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 255,
+          "comment" : "Signature encoding contains incorrect types: r=n, s=0.25",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3028022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141090380fe01",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 256,
+          "comment" : "Signature encoding contains incorrect types: r=n, s=nan",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141090142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 257,
+          "comment" : "Signature encoding contains incorrect types: r=n, s=True",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141010101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 258,
+          "comment" : "Signature encoding contains incorrect types: r=n, s=False",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141010100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 259,
+          "comment" : "Signature encoding contains incorrect types: r=n, s=Null",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641410500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 260,
+          "comment" : "Signature encoding contains incorrect types: r=n, s=empyt UTF-8 string",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641410c00",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 261,
+          "comment" : "Signature encoding contains incorrect types: r=n, s=\"0\"",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641410c0130",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 262,
+          "comment" : "Signature encoding contains incorrect types: r=n, s=empty list",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641413000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 263,
+          "comment" : "Signature encoding contains incorrect types: r=n, s=list containing 0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3028022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641413003020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 264,
+          "comment" : "Signature encoding contains incorrect types: r=p, s=0.25",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3028022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f090380fe01",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 265,
+          "comment" : "Signature encoding contains incorrect types: r=p, s=nan",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f090142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 266,
+          "comment" : "Signature encoding contains incorrect types: r=p, s=True",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f010101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 267,
+          "comment" : "Signature encoding contains incorrect types: r=p, s=False",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f010100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 268,
+          "comment" : "Signature encoding contains incorrect types: r=p, s=Null",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f0500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 269,
+          "comment" : "Signature encoding contains incorrect types: r=p, s=empyt UTF-8 string",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f0c00",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 270,
+          "comment" : "Signature encoding contains incorrect types: r=p, s=\"0\"",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f0c0130",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 271,
+          "comment" : "Signature encoding contains incorrect types: r=p, s=empty list",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f3000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 272,
+          "comment" : "Signature encoding contains incorrect types: r=p, s=list containing 0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3028022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f3003020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 273,
+          "comment" : "Signature encoding contains incorrect types: r=0.25, s=0.25",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "300a090380fe01090380fe01",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 274,
+          "comment" : "Signature encoding contains incorrect types: r=nan, s=nan",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006090142090142",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 275,
+          "comment" : "Signature encoding contains incorrect types: r=True, s=True",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006010101010101",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 276,
+          "comment" : "Signature encoding contains incorrect types: r=False, s=False",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006010100010100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 277,
+          "comment" : "Signature encoding contains incorrect types: r=Null, s=Null",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "300405000500",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 278,
+          "comment" : "Signature encoding contains incorrect types: r=empyt UTF-8 string, s=empyt UTF-8 string",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30040c000c00",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 279,
+          "comment" : "Signature encoding contains incorrect types: r=\"0\", s=\"0\"",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060c01300c0130",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 280,
+          "comment" : "Signature encoding contains incorrect types: r=empty list, s=empty list",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "300430003000",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 281,
+          "comment" : "Signature encoding contains incorrect types: r=list containing 0, s=list containing 0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "300a30030201003003020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 282,
+          "comment" : "Signature encoding contains incorrect types: r=0.25, s=0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3008090380fe01020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 283,
+          "comment" : "Signature encoding contains incorrect types: r=nan, s=0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006090142020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 284,
+          "comment" : "Signature encoding contains incorrect types: r=True, s=0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006010101020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 285,
+          "comment" : "Signature encoding contains incorrect types: r=False, s=0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006010100020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 286,
+          "comment" : "Signature encoding contains incorrect types: r=Null, s=0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050500020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 287,
+          "comment" : "Signature encoding contains incorrect types: r=empyt UTF-8 string, s=0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30050c00020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 288,
+          "comment" : "Signature encoding contains incorrect types: r=\"0\", s=0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30060c0130020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 289,
+          "comment" : "Signature encoding contains incorrect types: r=empty list, s=0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30053000020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 290,
+          "comment" : "Signature encoding contains incorrect types: r=list containing 0, s=0",
+          "flags" : [
+            "InvalidTypesInSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30083003020100020100",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 291,
+          "comment" : "Edge case for Shamir multiplication",
+          "flags" : [
+            "EdgeCaseShamirMultiplication"
+          ],
+          "msg" : "3235353835",
+          "sig" : "3045022100dd1b7d09a7bd8218961034a39a87fecf5314f00c4d25eb58a07ac85e85eab516022035138c401ef8d3493d65c9002fe62b43aee568731b744548358996d9cc427e06",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 292,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "343236343739373234",
+          "sig" : "304502210095c29267d972a043d955224546222bba343fc1d4db0fec262a33ac61305696ae02206edfe96713aed56f8a28a6653f57e0b829712e5eddc67f34682b24f0676b2640",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 293,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "37313338363834383931",
+          "sig" : "3044022028f94a894e92024699e345fe66971e3edcd050023386135ab3939d550898fb25022032963e5bd41fa5911ed8f37deb86dae0a762bb6121c894615083c5d95ea01db3",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 294,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "3130333539333331363638",
+          "sig" : "3045022100be26b18f9549f89f411a9b52536b15aa270b84548d0e859a1952a27af1a77ac6022070c1d4fa9cd03cc8eaa8d506edb97eed7b8358b453c88aefbb880a3f0e8d472f",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 295,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "33393439343031323135",
+          "sig" : "3045022100b1a4b1478e65cc3eafdf225d1298b43f2da19e4bcff7eacc0a2e98cd4b74b1140220179aa31e304cc142cf5073171751b28f3f5e0fa88c994e7c55f1bc07b8d56c16",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 296,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31333434323933303739",
+          "sig" : "30440220325332021261f1bd18f2712aa1e2252da23796da8a4b1ff6ea18cafec7e171f2022040b4f5e287ee61fc3c804186982360891eaa35c75f05a43ecd48b35d984a6648",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 297,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "33373036323131373132",
+          "sig" : "3045022100a23ad18d8fc66d81af0903890cbd453a554cb04cdc1a8ca7f7f78e5367ed88a0022023e3eb2ce1c04ea748c389bd97374aa9413b9268851c04dcd9f88e78813fee56",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 298,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "333433363838373132",
+          "sig" : "304402202bdea41cda63a2d14bf47353bd20880a690901de7cd6e3cc6d8ed5ba0cdb109102203cea66bccfc9f9bf8c7ca4e1c1457cc9145e13e936d90b3d9c7786b8b26cf4c7",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 299,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31333531353330333730",
+          "sig" : "3045022100d7cd76ec01c1b1079eba9e2aa2a397243c4758c98a1ba0b7404a340b9b00ced602203575001e19d922e6de8b3d6c84ea43b5c3338106cf29990134e7669a826f78e6",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 300,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "36353533323033313236",
+          "sig" : "3045022100a872c744d936db21a10c361dd5c9063355f84902219652f6fc56dc95a7139d960220400df7575d9756210e9ccc77162c6b593c7746cfb48ac263c42750b421ef4bb9",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 301,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31353634333436363033",
+          "sig" : "30450221009fa9afe07752da10b36d3afcd0fe44bfc40244d75203599cf8f5047fa3453854022050e0a7c013bfbf51819736972d44b4b56bc2a2b2c180df6ec672df171410d77a",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 302,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "34343239353339313137",
+          "sig" : "3045022100885640384d0d910efb177b46be6c3dc5cac81f0b88c3190bb6b5f99c2641f2050220738ed9bff116306d9caa0f8fc608be243e0b567779d8dab03e8e19d553f1dc8e",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 303,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "3130393533323631333531",
+          "sig" : "304402202d051f91c5a9d440c5676985710483bc4f1a6c611b10c95a2ff0363d90c2a45802206ddf94e6fba5be586833d0c53cf216ad3948f37953c26c1cf4968e9a9e8243dc",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 304,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "35393837333530303431",
+          "sig" : "3045022100f3ac2523967482f53d508522712d583f4379cd824101ff635ea0935117baa54f022027f10812227397e02cea96fb0e680761636dab2b080d1fc5d11685cbe8500cfe",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 305,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "33343633303036383738",
+          "sig" : "304502210096447cf68c3ab7266ed7447de3ac52fed7cc08cbdfea391c18a9b8ab370bc91302200f5e7874d3ac0e918f01c885a1639177c923f8660d1ceba1ca1f301bc675cdbc",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 306,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "39383137333230323837",
+          "sig" : "30440220530a0832b691da0b5619a0b11de6877f3c0971baaa68ed122758c29caaf46b7202206c89e44f5eb33060ea4b46318c39138eaedec72de42ba576579a6a4690e339f3",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 307,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "33323232303431303436",
+          "sig" : "30450221009c54c25500bde0b92d72d6ec483dc2482f3654294ca74de796b681255ed58a770220677453c6b56f527631c9f67b3f3eb621fd88582b4aff156d2f1567d6211a2a33",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 308,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "36363636333037313034",
+          "sig" : "3045022100e7909d41439e2f6af29136c7348ca2641a2b070d5b64f91ea9da7070c7a2618b022042d782f132fa1d36c2c88ba27c3d678d80184a5d1eccac7501f0b47e3d205008",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 309,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31303335393531383938",
+          "sig" : "304402205924873209593135a4c3da7bb381227f8a4b6aa9f34fe5bb7f8fbc131a039ffe02201f1bb11b441c8feaa40f44213d9a405ed792d59fb49d5bcdd9a4285ae5693022",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 310,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31383436353937313935",
+          "sig" : "3045022100eeb692c9b262969b231c38b5a7f60649e0c875cd64df88f33aa571fa3d29ab0e0220218b3a1eb06379c2c18cf51b06430786d1c64cd2d24c9b232b23e5bac7989acd",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 311,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "33313336303436313839",
+          "sig" : "3045022100a40034177f36091c2b653684a0e3eb5d4bff18e4d09f664c2800e7cafda1daf802203a3ec29853704e52031c58927a800a968353adc3d973beba9172cbbeab4dd149",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 312,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "32363633373834323534",
+          "sig" : "3045022100b5d795cc75cea5c434fa4185180cd6bd21223f3d5a86da6670d71d95680dadbf022054e4d8810a001ecbb9f7ca1c2ebfdb9d009e9031a431aca3c20ab4e0d1374ec1",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 313,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31363532313030353234",
+          "sig" : "3044022007dc2478d43c1232a4595608c64426c35510051a631ae6a5a6eb1161e57e42e102204a59ea0fdb72d12165cea3bf1ca86ba97517bd188db3dbd21a5a157850021984",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 314,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "35373438303831363936",
+          "sig" : "3045022100ddd20c4a05596ca868b558839fce9f6511ddd83d1ccb53f82e5269d559a0155202205b91734729d93093ff22123c4a25819d7feb66a250663fc780cb66fc7b6e6d17",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 315,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "36333433393133343638",
+          "sig" : "30450221009cde6e0ede0a003f02fda0a01b59facfe5dec063318f279ce2de7a9b1062f7b702202886a5b8c679bdf8224c66f908fd6205492cb70b0068d46ae4f33a4149b12a52",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 316,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31353431313033353938",
+          "sig" : "3045022100c5771016d0dd6357143c89f684cd740423502554c0c59aa8c99584f1ff38f609022054b405f4477546686e464c5463b4fd4190572e58d0f7e7357f6e61947d20715c",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 317,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "3130343738353830313238",
+          "sig" : "3045022100a24ebc0ec224bd67ae397cbe6fa37b3125adbd34891abe2d7c7356921916dfe6022034f6eb6374731bbbafc4924fb8b0bdcdda49456d724cdae6178d87014cb53d8c",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 318,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "3130353336323835353638",
+          "sig" : "304402202557d64a7aee2e0931c012e4fea1cd3a2c334edae68cdeb7158caf21b68e5a2402207f06cdbb6a90023a973882ed97b080fe6b05af3ec93db6f1a4399a69edf7670d",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 319,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "393533393034313035",
+          "sig" : "3045022100c4f2eccbb6a24350c8466450b9d61b207ee359e037b3dcedb42a3f2e6dd6aeb502203263c6b59a2f55cdd1c6e14894d5e5963b28bc3e2469ac9ba1197991ca7ff9c7",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 320,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "393738383438303339",
+          "sig" : "3045022100eff04781c9cbcd162d0a25a6e2ebcca43506c523385cb515d49ea38a1b12fcad022015acd73194c91a95478534f23015b672ebed213e45424dd2c8e26ac8b3eb34a5",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 321,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "33363130363732343432",
+          "sig" : "3045022100f58b4e3110a64bf1b5db97639ee0e5a9c8dfa49dc59b679891f520fdf0584c8702202cd8fe51888aee9db3e075440fd4db73b5c732fb87b510e97093d66415f62af7",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 322,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31303534323430373035",
+          "sig" : "3045022100f8abecaa4f0c502de4bf5903d48417f786bf92e8ad72fec0bd7fcb7800c0bbe302204c7f9e231076a30b7ae36b0cebe69ccef1cd194f7cce93a5588fd6814f437c0e",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 323,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "35313734343438313937",
+          "sig" : "304402205d5b38bd37ad498b2227a633268a8cca879a5c7c94a4e416bd0a614d09e606d2022012b8d664ea9991062ecbb834e58400e25c46007af84f6007d7f1685443269afe",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 324,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31393637353631323531",
+          "sig" : "304402200c1cd9fe4034f086a2b52d65b9d3834d72aebe7f33dfe8f976da82648177d8e3022013105782e3d0cfe85c2778dec1a848b27ac0ae071aa6da341a9553a946b41e59",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 325,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "33343437323533333433",
+          "sig" : "3045022100ae7935fb96ff246b7b5d5662870d1ba587b03d6e1360baf47988b5c02ccc1a5b02205f00c323272083782d4a59f2dfd65e49de0693627016900ef7e61428056664b3",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 326,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "333638323634333138",
+          "sig" : "3044022000a134b5c6ccbcefd4c882b945baeb4933444172795fa6796aae1490675470980220566e46105d24d890151e3eea3ebf88f5b92b3f5ec93a217765a6dcbd94f2c55b",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 327,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "33323631313938363038",
+          "sig" : "304402202e4721363ad3992c139e5a1c26395d2c2d777824aa24fde075e0d7381171309d0220740f7c494418e1300dd4512f782a58800bff6a7abdfdd20fbbd4f05515ca1a4f",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 328,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "39363738373831303934",
+          "sig" : "304402206852e9d3cd9fe373c2d504877967d365ab1456707b6817a042864694e1960ccf0220064b27ea142b30887b84c86adccb2fa39a6911ad21fc7e819f593be52bc4f3bd",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 329,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "34393538383233383233",
+          "sig" : "30440220188a8c5648dc79eace158cf886c62b5468f05fd95f03a7635c5b4c31f09af4c5022036361a0b571a00c6cd5e686ccbfcfa703c4f97e48938346d0c103fdc76dc5867",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 330,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "383234363337383337",
+          "sig" : "3045022100a74f1fb9a8263f62fc4416a5b7d584f4206f3996bb91f6fc8e73b9e92bad0e1302206815032e8c7d76c3ab06a86f33249ce9940148cb36d1f417c2e992e801afa3fa",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 331,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "3131303230383333373736",
+          "sig" : "3044022007244865b72ff37e62e3146f0dc14682badd7197799135f0b00ade7671742bfe02200d80c2238edb4e4a7a86a8c57ca9af1711f406f7f5da0299aa04e2932d960754",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 332,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "313333383731363438",
+          "sig" : "3045022100da7fdd05b5badabd619d805c4ee7d9a84f84ddd5cf9c5bf4d4338140d689ef08022028f1cf4fa1c3c5862cfa149c0013cf5fe6cf5076cae000511063e7de25bb38e5",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 333,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "333232313434313632",
+          "sig" : "3045022100d3027c656f6d4fdfd8ede22093e3c303b0133c340d615e7756f6253aea927238022009aef060c8e4cef972974011558df144fed25ca69ae8d0b2eaf1a8feefbec417",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 334,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "3130363836363535353436",
+          "sig" : "304402200bf6c0188dc9571cd0e21eecac5fbb19d2434988e9cc10244593ef3a98099f6902204864a562661f9221ec88e3dd0bc2f6e27ac128c30cc1a80f79ec670a22b042ee",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 335,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "3632313535323436",
+          "sig" : "3045022100ae459640d5d1179be47a47fa538e16d94ddea5585e7a244804a51742c686443a02206c8e30e530a634fae80b3ceb062978b39edbe19777e0a24553b68886181fd897",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 336,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "37303330383138373734",
+          "sig" : "304402201cf3517ba3bf2ab8b9ead4ebb6e866cb88a1deacb6a785d3b63b483ca02ac4950220249a798b73606f55f5f1c70de67cb1a0cff95d7dc50b3a617df861bad3c6b1c9",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 337,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "35393234353233373434",
+          "sig" : "3045022100e69b5238265ea35d77e4dd172288d8cea19810a10292617d5976519dc5757cb802204b03c5bc47e826bdb27328abd38d3056d77476b2130f3df6ec4891af08ba1e29",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 338,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31343935353836363231",
+          "sig" : "304402205f9d7d7c870d085fc1d49fff69e4a275812800d2cf8973e7325866cb40fa2b6f02206d1f5491d9f717a597a15fd540406486d76a44697b3f0d9d6dcef6669f8a0a56",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 339,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "34303035333134343036",
+          "sig" : "304402200a7d5b1959f71df9f817146ee49bd5c89b431e7993e2fdecab6858957da685ae02200f8aad2d254690bdc13f34a4fec44a02fd745a422df05ccbb54635a8b86b9609",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 340,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "33303936343537353132",
+          "sig" : "3044022079e88bf576b74bc07ca142395fda28f03d3d5e640b0b4ff0752c6d94cd553408022032cea05bd2d706c8f6036a507e2ab7766004f0904e2e5c5862749c0073245d6a",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 341,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "32373834303235363230",
+          "sig" : "30450221009d54e037a00212b377bc8874798b8da080564bbdf7e07591b861285809d01488022018b4e557667a82bd95965f0706f81a29243fbdd86968a7ebeb43069db3b18c7f",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 342,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "32363138373837343138",
+          "sig" : "304402202664f1ffa982fedbcc7cab1b8bc6e2cb420218d2a6077ad08e591ba9feab33bd022049f5c7cb515e83872a3d41b4cdb85f242ad9d61a5bfc01debfbb52c6c84ba728",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 343,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "31363432363235323632",
+          "sig" : "304402205827518344844fd6a7de73cbb0a6befdea7b13d2dee4475317f0f18ffc81524b02204f5ccb4e0b488b5a5d760aacddb2d791970fe43da61eb30e2e90208a817e46db",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 344,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "36383234313839343336",
+          "sig" : "304502210097ab19bd139cac319325869218b1bce111875d63fb12098a04b0cd59b6fdd3a30220431d9cea3a243847303cebda56476431d034339f31d785ee8852db4f040d4921",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 345,
+          "comment" : "special case hash",
+          "flags" : [
+            "SpecialCaseHash"
+          ],
+          "msg" : "343834323435343235",
+          "sig" : "3044022052c683144e44119ae2013749d4964ef67509278f6d38ba869adcfa69970e123d02203479910167408f45bda420a626ec9c4ec711c1274be092198b4187c018b562ca",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0407310f90a9eae149a08402f54194a0f7b4ac427bf8d9bd6c7681071dc47dc36226a6d37ac46d61fd600c0bf1bff87689ed117dda6b0e59318ae010a197a26ca0",
+        "wx" : "07310f90a9eae149a08402f54194a0f7b4ac427bf8d9bd6c7681071dc47dc362",
+        "wy" : "26a6d37ac46d61fd600c0bf1bff87689ed117dda6b0e59318ae010a197a26ca0"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000407310f90a9eae149a08402f54194a0f7b4ac427bf8d9bd6c7681071dc47dc36226a6d37ac46d61fd600c0bf1bff87689ed117dda6b0e59318ae010a197a26ca0",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEBzEPkKnq4UmghAL1QZSg97SsQnv42b1s\ndoEHHcR9w2ImptN6xG1h/WAMC/G/+HaJ7RF92msOWTGK4BChl6JsoA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 346,
+          "comment" : "k*G has a large x-coordinate",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30160211014551231950b75fc4402da1722fc9baeb020103",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 347,
+          "comment" : "r too large",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2c020103",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04bc97e7585eecad48e16683bc4091708e1a930c683fc47001d4b383594f2c4e22705989cf69daeadd4e4e4b8151ed888dfec20fb01728d89d56b3f38f2ae9c8c5",
+        "wx" : "00bc97e7585eecad48e16683bc4091708e1a930c683fc47001d4b383594f2c4e22",
+        "wy" : "705989cf69daeadd4e4e4b8151ed888dfec20fb01728d89d56b3f38f2ae9c8c5"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004bc97e7585eecad48e16683bc4091708e1a930c683fc47001d4b383594f2c4e22705989cf69daeadd4e4e4b8151ed888dfec20fb01728d89d56b3f38f2ae9c8c5",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEvJfnWF7srUjhZoO8QJFwjhqTDGg/xHAB\n1LODWU8sTiJwWYnPadrq3U5OS4FR7YiN/sIPsBco2J1Ws/OPKunIxQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 348,
+          "comment" : "r,s are large",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd036413f020103",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0444ad339afbc21e9abf7b602a5ca535ea378135b6d10d81310bdd8293d1df3252b63ff7d0774770f8fe1d1722fa83acd02f434e4fc110a0cc8f6dddd37d56c463",
+        "wx" : "44ad339afbc21e9abf7b602a5ca535ea378135b6d10d81310bdd8293d1df3252",
+        "wy" : "00b63ff7d0774770f8fe1d1722fa83acd02f434e4fc110a0cc8f6dddd37d56c463"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000444ad339afbc21e9abf7b602a5ca535ea378135b6d10d81310bdd8293d1df3252b63ff7d0774770f8fe1d1722fa83acd02f434e4fc110a0cc8f6dddd37d56c463",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAERK0zmvvCHpq/e2AqXKU16jeBNbbRDYEx\nC92Ck9HfMlK2P/fQd0dw+P4dFyL6g6zQL0NOT8EQoMyPbd3TfVbEYw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 349,
+          "comment" : "r and s^-1 have a large Hamming weight",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02203e9a7582886089c62fb840cf3b83061cd1cff3ae4341808bb5bdee6191174177",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "041260c2122c9e244e1af5151bede0c3ae23b54d7c596881d3eebad21f37dd878c5c9a0c1a9ade76737a8811bd6a7f9287c978ee396aa89c11e47229d2ccb552f0",
+        "wx" : "1260c2122c9e244e1af5151bede0c3ae23b54d7c596881d3eebad21f37dd878c",
+        "wy" : "5c9a0c1a9ade76737a8811bd6a7f9287c978ee396aa89c11e47229d2ccb552f0"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200041260c2122c9e244e1af5151bede0c3ae23b54d7c596881d3eebad21f37dd878c5c9a0c1a9ade76737a8811bd6a7f9287c978ee396aa89c11e47229d2ccb552f0",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEEmDCEiyeJE4a9RUb7eDDriO1TXxZaIHT\n7rrSHzfdh4xcmgwamt52c3qIEb1qf5KHyXjuOWqonBHkcinSzLVS8A==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 350,
+          "comment" : "r and s^-1 have a large Hamming weight",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc022024238e70b431b1a64efdf9032669939d4b77f249503fc6905feb7540dea3e6d2",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "041877045be25d34a1d0600f9d5c00d0645a2a54379b6ceefad2e6bf5c2a3352ce821a532cc1751ee1d36d41c3d6ab4e9b143e44ec46d73478ea6a79a5c0e54159",
+        "wx" : "1877045be25d34a1d0600f9d5c00d0645a2a54379b6ceefad2e6bf5c2a3352ce",
+        "wy" : "00821a532cc1751ee1d36d41c3d6ab4e9b143e44ec46d73478ea6a79a5c0e54159"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200041877045be25d34a1d0600f9d5c00d0645a2a54379b6ceefad2e6bf5c2a3352ce821a532cc1751ee1d36d41c3d6ab4e9b143e44ec46d73478ea6a79a5c0e54159",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEGHcEW+JdNKHQYA+dXADQZFoqVDebbO76\n0ua/XCozUs6CGlMswXUe4dNtQcPWq06bFD5E7EbXNHjqanmlwOVBWQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 351,
+          "comment" : "small r and s",
+          "flags" : [
+            "SmallRandS",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020101020101",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04455439fcc3d2deeceddeaece60e7bd17304f36ebb602adf5a22e0b8f1db46a50aec38fb2baf221e9a8d1887c7bf6222dd1834634e77263315af6d23609d04f77",
+        "wx" : "455439fcc3d2deeceddeaece60e7bd17304f36ebb602adf5a22e0b8f1db46a50",
+        "wy" : "00aec38fb2baf221e9a8d1887c7bf6222dd1834634e77263315af6d23609d04f77"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004455439fcc3d2deeceddeaece60e7bd17304f36ebb602adf5a22e0b8f1db46a50aec38fb2baf221e9a8d1887c7bf6222dd1834634e77263315af6d23609d04f77",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAERVQ5/MPS3uzt3q7OYOe9FzBPNuu2Aq31\noi4Ljx20alCuw4+yuvIh6ajRiHx79iIt0YNGNOdyYzFa9tI2CdBPdw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 352,
+          "comment" : "small r and s",
+          "flags" : [
+            "SmallRandS",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020101020102",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "042e1f466b024c0c3ace2437de09127fed04b706f94b19a21bb1c2acf35cece7180449ae3523d72534e964972cfd3b38af0bddd9619e5af223e4d1a40f34cf9f1d",
+        "wx" : "2e1f466b024c0c3ace2437de09127fed04b706f94b19a21bb1c2acf35cece718",
+        "wy" : "0449ae3523d72534e964972cfd3b38af0bddd9619e5af223e4d1a40f34cf9f1d"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200042e1f466b024c0c3ace2437de09127fed04b706f94b19a21bb1c2acf35cece7180449ae3523d72534e964972cfd3b38af0bddd9619e5af223e4d1a40f34cf9f1d",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAELh9GawJMDDrOJDfeCRJ/7QS3BvlLGaIb\nscKs81zs5xgESa41I9clNOlklyz9OzivC93ZYZ5a8iPk0aQPNM+fHQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 353,
+          "comment" : "small r and s",
+          "flags" : [
+            "SmallRandS",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020101020103",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "048e7abdbbd18de7452374c1879a1c3b01d13261e7d4571c3b47a1c76c55a2337326ed897cd517a4f5349db809780f6d2f2b9f6299d8b5a89077f1119a718fd7b3",
+        "wx" : "008e7abdbbd18de7452374c1879a1c3b01d13261e7d4571c3b47a1c76c55a23373",
+        "wy" : "26ed897cd517a4f5349db809780f6d2f2b9f6299d8b5a89077f1119a718fd7b3"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200048e7abdbbd18de7452374c1879a1c3b01d13261e7d4571c3b47a1c76c55a2337326ed897cd517a4f5349db809780f6d2f2b9f6299d8b5a89077f1119a718fd7b3",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEjnq9u9GN50UjdMGHmhw7AdEyYefUVxw7\nR6HHbFWiM3Mm7Yl81Rek9TSduAl4D20vK59imdi1qJB38RGacY/Xsw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 354,
+          "comment" : "small r and s",
+          "flags" : [
+            "SmallRandS",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020102020101",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "047b333d4340d3d718dd3e6aff7de7bbf8b72bfd616c8420056052842376b9af1942117c5afeac755d6f376fc6329a7d76051b87123a4a5d0bc4a539380f03de7b",
+        "wx" : "7b333d4340d3d718dd3e6aff7de7bbf8b72bfd616c8420056052842376b9af19",
+        "wy" : "42117c5afeac755d6f376fc6329a7d76051b87123a4a5d0bc4a539380f03de7b"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200047b333d4340d3d718dd3e6aff7de7bbf8b72bfd616c8420056052842376b9af1942117c5afeac755d6f376fc6329a7d76051b87123a4a5d0bc4a539380f03de7b",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEezM9Q0DT1xjdPmr/fee7+Lcr/WFshCAF\nYFKEI3a5rxlCEXxa/qx1XW83b8Yymn12BRuHEjpKXQvEpTk4DwPeew==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 355,
+          "comment" : "small r and s",
+          "flags" : [
+            "SmallRandS",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020102020102",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04d30ca4a0ddb6616c851d30ced682c40f83c62758a1f2759988d6763a88f1c0e503a80d5415650d41239784e8e2fb1235e9fe991d112ebb81186cbf0da2de3aff",
+        "wx" : "00d30ca4a0ddb6616c851d30ced682c40f83c62758a1f2759988d6763a88f1c0e5",
+        "wy" : "03a80d5415650d41239784e8e2fb1235e9fe991d112ebb81186cbf0da2de3aff"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004d30ca4a0ddb6616c851d30ced682c40f83c62758a1f2759988d6763a88f1c0e503a80d5415650d41239784e8e2fb1235e9fe991d112ebb81186cbf0da2de3aff",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE0wykoN22YWyFHTDO1oLED4PGJ1ih8nWZ\niNZ2OojxwOUDqA1UFWUNQSOXhOji+xI16f6ZHREuu4EYbL8Not46/w==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 356,
+          "comment" : "small r and s",
+          "flags" : [
+            "SmallRandS",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3006020102020103",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 357,
+          "comment" : "r is larger than n",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364143020103",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0448969b39991297b332a652d3ee6e01e909b39904e71fa2354a7830c7750baf24b4012d1b830d199ccb1fc972b32bfded55f09cd62d257e5e844e27e57a1594ec",
+        "wx" : "48969b39991297b332a652d3ee6e01e909b39904e71fa2354a7830c7750baf24",
+        "wy" : "00b4012d1b830d199ccb1fc972b32bfded55f09cd62d257e5e844e27e57a1594ec"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000448969b39991297b332a652d3ee6e01e909b39904e71fa2354a7830c7750baf24b4012d1b830d199ccb1fc972b32bfded55f09cd62d257e5e844e27e57a1594ec",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAESJabOZkSl7MyplLT7m4B6QmzmQTnH6I1\nSngwx3ULryS0AS0bgw0ZnMsfyXKzK/3tVfCc1i0lfl6ETiflehWU7A==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 358,
+          "comment" : "s is larger than n",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30080201020203ed2979",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0402ef4d6d6cfd5a94f1d7784226e3e2a6c0a436c55839619f38fb4472b5f9ee777eb4acd4eebda5cd72875ffd2a2f26229c2dc6b46500919a432c86739f3ae866",
+        "wx" : "02ef4d6d6cfd5a94f1d7784226e3e2a6c0a436c55839619f38fb4472b5f9ee77",
+        "wy" : "7eb4acd4eebda5cd72875ffd2a2f26229c2dc6b46500919a432c86739f3ae866"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000402ef4d6d6cfd5a94f1d7784226e3e2a6c0a436c55839619f38fb4472b5f9ee777eb4acd4eebda5cd72875ffd2a2f26229c2dc6b46500919a432c86739f3ae866",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEAu9NbWz9WpTx13hCJuPipsCkNsVYOWGf\nOPtEcrX57nd+tKzU7r2lzXKHX/0qLyYinC3GtGUAkZpDLIZznzroZg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 359,
+          "comment" : "small r and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30260202010102203a74e9d3a74e9d3a74e9d3a74e9d3a749f8ab3732a0a89604a09bce5b2916da4",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04464f4ff715729cae5072ca3bd801d3195b67aec65e9b01aad20a2943dcbcb584b1afd29d31a39a11d570aa1597439b3b2d1971bf2f1abf15432d0207b10d1d08",
+        "wx" : "464f4ff715729cae5072ca3bd801d3195b67aec65e9b01aad20a2943dcbcb584",
+        "wy" : "00b1afd29d31a39a11d570aa1597439b3b2d1971bf2f1abf15432d0207b10d1d08"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004464f4ff715729cae5072ca3bd801d3195b67aec65e9b01aad20a2943dcbcb584b1afd29d31a39a11d570aa1597439b3b2d1971bf2f1abf15432d0207b10d1d08",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAERk9P9xVynK5Qcso72AHTGVtnrsZemwGq\n0gopQ9y8tYSxr9KdMaOaEdVwqhWXQ5s7LRlxvy8avxVDLQIHsQ0dCA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 360,
+          "comment" : "smallish r and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "302b02072d9b4d347952cc02200343aefc2f25d98b882e86eb9e30d55a6eb508b516510b34024ae4b6362330b3",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04157f8fddf373eb5f49cfcf10d8b853cf91cbcd7d665c3522ba7dd738ddb79a4cdeadf1a5c448ea3c9f4191a8999abfcc757ac6d64567ef072c47fec613443b8f",
+        "wx" : "157f8fddf373eb5f49cfcf10d8b853cf91cbcd7d665c3522ba7dd738ddb79a4c",
+        "wy" : "00deadf1a5c448ea3c9f4191a8999abfcc757ac6d64567ef072c47fec613443b8f"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004157f8fddf373eb5f49cfcf10d8b853cf91cbcd7d665c3522ba7dd738ddb79a4cdeadf1a5c448ea3c9f4191a8999abfcc757ac6d64567ef072c47fec613443b8f",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEFX+P3fNz619Jz88Q2LhTz5HLzX1mXDUi\nun3XON23mkzerfGlxEjqPJ9BkaiZmr/MdXrG1kVn7wcsR/7GE0Q7jw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 361,
+          "comment" : "100-bit r and small s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3031020d1033e67e37b32b445580bf4efc02206f906f906f906f906f906f906f906f8fe1cab5eefdb214061dce3b22789f1d6f",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "040934a537466c07430e2c48feb990bb19fb78cecc9cee424ea4d130291aa237f0d4f92d23b462804b5b68c52558c01c9996dbf727fccabbeedb9621a400535afa",
+        "wx" : "0934a537466c07430e2c48feb990bb19fb78cecc9cee424ea4d130291aa237f0",
+        "wy" : "00d4f92d23b462804b5b68c52558c01c9996dbf727fccabbeedb9621a400535afa"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200040934a537466c07430e2c48feb990bb19fb78cecc9cee424ea4d130291aa237f0d4f92d23b462804b5b68c52558c01c9996dbf727fccabbeedb9621a400535afa",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAECTSlN0ZsB0MOLEj+uZC7Gft4zsyc7kJO\npNEwKRqiN/DU+S0jtGKAS1toxSVYwByZltv3J/zKu+7bliGkAFNa+g==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 362,
+          "comment" : "small r and 100 bit s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3026020201010220783266e90f43dafe5cd9b3b0be86de22f9de83677d0f50713a468ec72fcf5d57",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04d6ef20be66c893f741a9bf90d9b74675d1c2a31296397acb3ef174fd0b300c654a0c95478ca00399162d7f0f2dc89efdc2b28a30fbabe285857295a4b0c4e265",
+        "wx" : "00d6ef20be66c893f741a9bf90d9b74675d1c2a31296397acb3ef174fd0b300c65",
+        "wy" : "4a0c95478ca00399162d7f0f2dc89efdc2b28a30fbabe285857295a4b0c4e265"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004d6ef20be66c893f741a9bf90d9b74675d1c2a31296397acb3ef174fd0b300c654a0c95478ca00399162d7f0f2dc89efdc2b28a30fbabe285857295a4b0c4e265",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE1u8gvmbIk/dBqb+Q2bdGddHCoxKWOXrL\nPvF0/QswDGVKDJVHjKADmRYtfw8tyJ79wrKKMPur4oWFcpWksMTiZQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 363,
+          "comment" : "100-bit r and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3031020d062522bbd3ecbe7c39e93e7c260220783266e90f43dafe5cd9b3b0be86de22f9de83677d0f50713a468ec72fcf5d57",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04b7291d1404e0c0c07dab9372189f4bd58d2ceaa8d15ede544d9514545ba9ee0629c9a63d5e308769cc30ec276a410e6464a27eeafd9e599db10f053a4fe4a829",
+        "wx" : "00b7291d1404e0c0c07dab9372189f4bd58d2ceaa8d15ede544d9514545ba9ee06",
+        "wy" : "29c9a63d5e308769cc30ec276a410e6464a27eeafd9e599db10f053a4fe4a829"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004b7291d1404e0c0c07dab9372189f4bd58d2ceaa8d15ede544d9514545ba9ee0629c9a63d5e308769cc30ec276a410e6464a27eeafd9e599db10f053a4fe4a829",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEtykdFATgwMB9q5NyGJ9L1Y0s6qjRXt5U\nTZUUVFup7gYpyaY9XjCHacww7CdqQQ5kZKJ+6v2eWZ2xDwU6T+SoKQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 364,
+          "comment" : "r and s^-1 are close to n",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03640c1022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c0",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "046e28303305d642ccb923b722ea86b2a0bc8e3735ecb26e849b19c9f76b2fdbb8186e80d64d8cab164f5238f5318461bf89d4d96ee6544c816c7566947774e0f6",
+        "wx" : "6e28303305d642ccb923b722ea86b2a0bc8e3735ecb26e849b19c9f76b2fdbb8",
+        "wy" : "186e80d64d8cab164f5238f5318461bf89d4d96ee6544c816c7566947774e0f6"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200046e28303305d642ccb923b722ea86b2a0bc8e3735ecb26e849b19c9f76b2fdbb8186e80d64d8cab164f5238f5318461bf89d4d96ee6544c816c7566947774e0f6",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEbigwMwXWQsy5I7ci6oayoLyONzXssm6E\nmxnJ92sv27gYboDWTYyrFk9SOPUxhGG/idTZbuZUTIFsdWaUd3Tg9g==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 365,
+          "comment" : "r and s are 64-bit integer",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30160209009c44febf31c3594d020900839ed28247c2b06b",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04375bda93f6af92fb5f8f4b1b5f0534e3bafab34cb7ad9fb9d0b722e4a5c302a9a00b9f387a5a396097aa2162fc5bbcf4a5263372f681c94da51e9799120990fd",
+        "wx" : "375bda93f6af92fb5f8f4b1b5f0534e3bafab34cb7ad9fb9d0b722e4a5c302a9",
+        "wy" : "00a00b9f387a5a396097aa2162fc5bbcf4a5263372f681c94da51e9799120990fd"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004375bda93f6af92fb5f8f4b1b5f0534e3bafab34cb7ad9fb9d0b722e4a5c302a9a00b9f387a5a396097aa2162fc5bbcf4a5263372f681c94da51e9799120990fd",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEN1vak/avkvtfj0sbXwU047r6s0y3rZ+5\n0Lci5KXDAqmgC584elo5YJeqIWL8W7z0pSYzcvaByU2lHpeZEgmQ/Q==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 366,
+          "comment" : "r and s are 100-bit integer",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "301e020d09df8b682430beef6f5fd7c7cf020d0fd0a62e13778f4222a0d61c8a",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04d75b68216babe03ae257e94b4e3bf1c52f44e3df266d1524ff8c5ea69da73197da4bff9ed1c53f44917a67d7b978598e89df359e3d5913eaea24f3ae259abc44",
+        "wx" : "00d75b68216babe03ae257e94b4e3bf1c52f44e3df266d1524ff8c5ea69da73197",
+        "wy" : "00da4bff9ed1c53f44917a67d7b978598e89df359e3d5913eaea24f3ae259abc44"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004d75b68216babe03ae257e94b4e3bf1c52f44e3df266d1524ff8c5ea69da73197da4bff9ed1c53f44917a67d7b978598e89df359e3d5913eaea24f3ae259abc44",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE11toIWur4DriV+lLTjvxxS9E498mbRUk\n/4xepp2nMZfaS/+e0cU/RJF6Z9e5eFmOid81nj1ZE+rqJPOuJZq8RA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 367,
+          "comment" : "r and s are 128-bit integer",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "30260211008a598e563a89f526c32ebec8de26367a02110084f633e2042630e99dd0f1e16f7a04bf",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0478bcda140aed23d430cb23c3dc0d01f423db134ee94a3a8cb483f2deac2ac653118114f6f33045d4e9ed9107085007bfbddf8f58fe7a1a2445d66a990045476e",
+        "wx" : "78bcda140aed23d430cb23c3dc0d01f423db134ee94a3a8cb483f2deac2ac653",
+        "wy" : "118114f6f33045d4e9ed9107085007bfbddf8f58fe7a1a2445d66a990045476e"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000478bcda140aed23d430cb23c3dc0d01f423db134ee94a3a8cb483f2deac2ac653118114f6f33045d4e9ed9107085007bfbddf8f58fe7a1a2445d66a990045476e",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEeLzaFArtI9QwyyPD3A0B9CPbE07pSjqM\ntIPy3qwqxlMRgRT28zBF1OntkQcIUAe/vd+PWP56GiRF1mqZAEVHbg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 368,
+          "comment" : "r and s are 160-bit integer",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "302e021500aa6eeb5823f7fa31b466bb473797f0d0314c0bdf021500e2977c479e6d25703cebbc6bd561938cc9d1bfb9",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04bb79f61857f743bfa1b6e7111ce4094377256969e4e15159123d9548acc3be6c1f9d9f8860dcffd3eb36dd6c31ff2e7226c2009c4c94d8d7d2b5686bf7abd677",
+        "wx" : "00bb79f61857f743bfa1b6e7111ce4094377256969e4e15159123d9548acc3be6c",
+        "wy" : "1f9d9f8860dcffd3eb36dd6c31ff2e7226c2009c4c94d8d7d2b5686bf7abd677"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004bb79f61857f743bfa1b6e7111ce4094377256969e4e15159123d9548acc3be6c1f9d9f8860dcffd3eb36dd6c31ff2e7226c2009c4c94d8d7d2b5686bf7abd677",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEu3n2GFf3Q7+htucRHOQJQ3claWnk4VFZ\nEj2VSKzDvmwfnZ+IYNz/0+s23Wwx/y5yJsIAnEyU2NfStWhr96vWdw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 369,
+          "comment" : "s == 1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c1020101",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 370,
+          "comment" : "s == 0",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3025022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c1020100",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0493591827d9e6713b4e9faea62c72b28dfefa68e0c05160b5d6aae88fd2e36c36073f5545ad5af410af26afff68654cf72d45e493489311203247347a890f4518",
+        "wx" : "0093591827d9e6713b4e9faea62c72b28dfefa68e0c05160b5d6aae88fd2e36c36",
+        "wy" : "073f5545ad5af410af26afff68654cf72d45e493489311203247347a890f4518"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000493591827d9e6713b4e9faea62c72b28dfefa68e0c05160b5d6aae88fd2e36c36073f5545ad5af410af26afff68654cf72d45e493489311203247347a890f4518",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEk1kYJ9nmcTtOn66mLHKyjf76aODAUWC1\n1qroj9LjbDYHP1VFrVr0EK8mr/9oZUz3LUXkk0iTESAyRzR6iQ9FGA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 371,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c10220419d981c515af8cc82545aac0c85e9e308fbb2eab6acd7ed497e0b4145a18fd9",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0431ed3081aefe001eb6402069ee2ccc1862937b85995144dba9503943587bf0dada01b8cc4df34f5ab3b1a359615208946e5ee35f98ee775b8ccecd86ccc1650f",
+        "wx" : "31ed3081aefe001eb6402069ee2ccc1862937b85995144dba9503943587bf0da",
+        "wy" : "00da01b8cc4df34f5ab3b1a359615208946e5ee35f98ee775b8ccecd86ccc1650f"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000431ed3081aefe001eb6402069ee2ccc1862937b85995144dba9503943587bf0dada01b8cc4df34f5ab3b1a359615208946e5ee35f98ee775b8ccecd86ccc1650f",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEMe0wga7+AB62QCBp7izMGGKTe4WZUUTb\nqVA5Q1h78NraAbjMTfNPWrOxo1lhUgiUbl7jX5jud1uMzs2GzMFlDw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 372,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c102201b21717ad71d23bbac60a9ad0baf75b063c9fdf52a00ebf99d022172910993c9",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "047dff66fa98509ff3e2e51045f4390523dccda43a3bc2885e58c248090990eea854c76c2b9adeb6bb571823e07fd7c65c8639cf9d905260064c8e7675ce6d98b4",
+        "wx" : "7dff66fa98509ff3e2e51045f4390523dccda43a3bc2885e58c248090990eea8",
+        "wy" : "54c76c2b9adeb6bb571823e07fd7c65c8639cf9d905260064c8e7675ce6d98b4"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200047dff66fa98509ff3e2e51045f4390523dccda43a3bc2885e58c248090990eea854c76c2b9adeb6bb571823e07fd7c65c8639cf9d905260064c8e7675ce6d98b4",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEff9m+phQn/Pi5RBF9DkFI9zNpDo7wohe\nWMJICQmQ7qhUx2wrmt62u1cYI+B/18ZchjnPnZBSYAZMjnZ1zm2YtA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 373,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c102202f588f66018f3dd14db3e28e77996487e32486b521ed8e5a20f06591951777e9",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "044280509aab64edfc0b4a2967e4cbce849cb544e4a77313c8e6ece579fbd7420a2e89fe5cc1927d554e6a3bb14033ea7c922cd75cba2c7415fdab52f20b1860f1",
+        "wx" : "4280509aab64edfc0b4a2967e4cbce849cb544e4a77313c8e6ece579fbd7420a",
+        "wy" : "2e89fe5cc1927d554e6a3bb14033ea7c922cd75cba2c7415fdab52f20b1860f1"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200044280509aab64edfc0b4a2967e4cbce849cb544e4a77313c8e6ece579fbd7420a2e89fe5cc1927d554e6a3bb14033ea7c922cd75cba2c7415fdab52f20b1860f1",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEQoBQmqtk7fwLSiln5MvOhJy1ROSncxPI\n5uzlefvXQgouif5cwZJ9VU5qO7FAM+p8kizXXLosdBX9q1LyCxhg8Q==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 374,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c10220091a08870ff4daf9123b30c20e8c4fc8505758dcf4074fcaff2170c9bfcf74f4",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "044f8df145194e3c4fc3eea26d43ce75b402d6b17472ddcbb254b8a79b0bf3d9cb2aa20d82844cb266344e71ca78f2ad27a75a09e5bc0fa57e4efd9d465a0888db",
+        "wx" : "4f8df145194e3c4fc3eea26d43ce75b402d6b17472ddcbb254b8a79b0bf3d9cb",
+        "wy" : "2aa20d82844cb266344e71ca78f2ad27a75a09e5bc0fa57e4efd9d465a0888db"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200044f8df145194e3c4fc3eea26d43ce75b402d6b17472ddcbb254b8a79b0bf3d9cb2aa20d82844cb266344e71ca78f2ad27a75a09e5bc0fa57e4efd9d465a0888db",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAET43xRRlOPE/D7qJtQ851tALWsXRy3cuy\nVLinmwvz2csqog2ChEyyZjROccp48q0np1oJ5bwPpX5O/Z1GWgiI2w==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 375,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c102207c370dc0ce8c59a8b273cba44a7c1191fc3186dc03cab96b0567312df0d0b250",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "049598a57dd67ec3e16b587a338aa3a10a3a3913b41a3af32e3ed3ff01358c6b14122819edf8074bbc521f7d4cdce82fef7a516706affba1d93d9dea9ccae1a207",
+        "wx" : "009598a57dd67ec3e16b587a338aa3a10a3a3913b41a3af32e3ed3ff01358c6b14",
+        "wy" : "122819edf8074bbc521f7d4cdce82fef7a516706affba1d93d9dea9ccae1a207"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200049598a57dd67ec3e16b587a338aa3a10a3a3913b41a3af32e3ed3ff01358c6b14122819edf8074bbc521f7d4cdce82fef7a516706affba1d93d9dea9ccae1a207",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAElZilfdZ+w+FrWHoziqOhCjo5E7QaOvMu\nPtP/ATWMaxQSKBnt+AdLvFIffUzc6C/velFnBq/7odk9neqcyuGiBw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 376,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c1022070b59a7d1ee77a2f9e0491c2a7cfcd0ed04df4a35192f6132dcc668c79a6160e",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "049171fec3ca20806bc084f12f0760911b60990bd80e5b2a71ca03a048b20f837e634fd17863761b2958d2be4e149f8d3d7abbdc18be03f451ab6c17fa0a1f8330",
+        "wx" : "009171fec3ca20806bc084f12f0760911b60990bd80e5b2a71ca03a048b20f837e",
+        "wy" : "634fd17863761b2958d2be4e149f8d3d7abbdc18be03f451ab6c17fa0a1f8330"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200049171fec3ca20806bc084f12f0760911b60990bd80e5b2a71ca03a048b20f837e634fd17863761b2958d2be4e149f8d3d7abbdc18be03f451ab6c17fa0a1f8330",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEkXH+w8oggGvAhPEvB2CRG2CZC9gOWypx\nygOgSLIPg35jT9F4Y3YbKVjSvk4Un409ervcGL4D9FGrbBf6Ch+DMA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 377,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c102202736d76e412246e097148e2bf62915614eb7c428913a58eb5e9cd4674a9423de",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04777c8930b6e1d271100fe68ce93f163fa37612c5fff67f4a62fc3bafaf3d17a9ed73d86f60a51b5ed91353a3b054edc0aa92c9ebcbd0b75d188fdc882791d68d",
+        "wx" : "777c8930b6e1d271100fe68ce93f163fa37612c5fff67f4a62fc3bafaf3d17a9",
+        "wy" : "00ed73d86f60a51b5ed91353a3b054edc0aa92c9ebcbd0b75d188fdc882791d68d"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004777c8930b6e1d271100fe68ce93f163fa37612c5fff67f4a62fc3bafaf3d17a9ed73d86f60a51b5ed91353a3b054edc0aa92c9ebcbd0b75d188fdc882791d68d",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEd3yJMLbh0nEQD+aM6T8WP6N2EsX/9n9K\nYvw7r689F6ntc9hvYKUbXtkTU6OwVO3AqpLJ68vQt10Yj9yIJ5HWjQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 378,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c102204a1e12831fbe93627b02d6e7f24bccdd6ef4b2d0f46739eaf3b1eaf0ca117770",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04eabc248f626e0a63e1eb81c43d461a39a1dba881eb6ee2152b07c32d71bcf4700603caa8b9d33db13af44c6efbec8a198ed6124ac9eb17eaafd2824a545ec000",
+        "wx" : "00eabc248f626e0a63e1eb81c43d461a39a1dba881eb6ee2152b07c32d71bcf470",
+        "wy" : "0603caa8b9d33db13af44c6efbec8a198ed6124ac9eb17eaafd2824a545ec000"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004eabc248f626e0a63e1eb81c43d461a39a1dba881eb6ee2152b07c32d71bcf4700603caa8b9d33db13af44c6efbec8a198ed6124ac9eb17eaafd2824a545ec000",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE6rwkj2JuCmPh64HEPUYaOaHbqIHrbuIV\nKwfDLXG89HAGA8qoudM9sTr0TG777IoZjtYSSsnrF+qv0oJKVF7AAA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 379,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c1022006c778d4dfff7dee06ed88bc4e0ed34fc553aad67caf796f2a1c6487c1b2e877",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "049f7a13ada158a55f9ddf1a45f044f073d9b80030efdcfc9f9f58418fbceaf001f8ada0175090f80d47227d6713b6740f9a0091d88a837d0a1cd77b58a8f28d73",
+        "wx" : "009f7a13ada158a55f9ddf1a45f044f073d9b80030efdcfc9f9f58418fbceaf001",
+        "wy" : "00f8ada0175090f80d47227d6713b6740f9a0091d88a837d0a1cd77b58a8f28d73"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200049f7a13ada158a55f9ddf1a45f044f073d9b80030efdcfc9f9f58418fbceaf001f8ada0175090f80d47227d6713b6740f9a0091d88a837d0a1cd77b58a8f28d73",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEn3oTraFYpV+d3xpF8ETwc9m4ADDv3Pyf\nn1hBj7zq8AH4raAXUJD4DUcifWcTtnQPmgCR2IqDfQoc13tYqPKNcw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 380,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c102204de459ef9159afa057feb3ec40fef01c45b809f4ab296ea48c206d4249a2b451",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0411c4f3e461cd019b5c06ea0cea4c4090c3cc3e3c5d9f3c6d65b436826da9b4dbbbeb7a77e4cbfda207097c43423705f72c80476da3dac40a483b0ab0f2ead1cb",
+        "wx" : "11c4f3e461cd019b5c06ea0cea4c4090c3cc3e3c5d9f3c6d65b436826da9b4db",
+        "wy" : "00bbeb7a77e4cbfda207097c43423705f72c80476da3dac40a483b0ab0f2ead1cb"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000411c4f3e461cd019b5c06ea0cea4c4090c3cc3e3c5d9f3c6d65b436826da9b4dbbbeb7a77e4cbfda207097c43423705f72c80476da3dac40a483b0ab0f2ead1cb",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEEcTz5GHNAZtcBuoM6kxAkMPMPjxdnzxt\nZbQ2gm2ptNu763p35Mv9ogcJfENCNwX3LIBHbaPaxApIOwqw8urRyw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 381,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c10220745d294978007302033502e1acc48b63ae6500be43adbea1b258d6b423dbb416",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04e2e18682d53123aa01a6c5d00b0c623d671b462ea80bddd65227fd5105988aa4161907b3fd25044a949ea41c8e2ea8459dc6f1654856b8b61b31543bb1b45bdb",
+        "wx" : "00e2e18682d53123aa01a6c5d00b0c623d671b462ea80bddd65227fd5105988aa4",
+        "wy" : "161907b3fd25044a949ea41c8e2ea8459dc6f1654856b8b61b31543bb1b45bdb"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004e2e18682d53123aa01a6c5d00b0c623d671b462ea80bddd65227fd5105988aa4161907b3fd25044a949ea41c8e2ea8459dc6f1654856b8b61b31543bb1b45bdb",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE4uGGgtUxI6oBpsXQCwxiPWcbRi6oC93W\nUif9UQWYiqQWGQez/SUESpSepByOLqhFncbxZUhWuLYbMVQ7sbRb2w==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 382,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c102207b2a785e3896f59b2d69da57648e80ad3c133a750a2847fd2098ccd902042b6c",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0490f8d4ca73de08a6564aaf005247b6f0ffe978504dce52605f46b7c3e56197dafadbe528eb70d9ee7ea0e70702db54f721514c7b8604ac2cb214f1decb7e383d",
+        "wx" : "0090f8d4ca73de08a6564aaf005247b6f0ffe978504dce52605f46b7c3e56197da",
+        "wy" : "00fadbe528eb70d9ee7ea0e70702db54f721514c7b8604ac2cb214f1decb7e383d"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000490f8d4ca73de08a6564aaf005247b6f0ffe978504dce52605f46b7c3e56197dafadbe528eb70d9ee7ea0e70702db54f721514c7b8604ac2cb214f1decb7e383d",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEkPjUynPeCKZWSq8AUke28P/peFBNzlJg\nX0a3w+Vhl9r62+Uo63DZ7n6g5wcC21T3IVFMe4YErCyyFPHey344PQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 383,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c1022071ae94a72ca896875e7aa4a4c3d29afdb4b35b6996273e63c47ac519256c5eb1",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04824c195c73cffdf038d101bce1687b5c3b6146f395c885976f7753b2376b948e3cdefa6fc347d13e4dcbc63a0b03a165180cd2be1431a0cf74ce1ea25082d2bc",
+        "wx" : "00824c195c73cffdf038d101bce1687b5c3b6146f395c885976f7753b2376b948e",
+        "wy" : "3cdefa6fc347d13e4dcbc63a0b03a165180cd2be1431a0cf74ce1ea25082d2bc"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004824c195c73cffdf038d101bce1687b5c3b6146f395c885976f7753b2376b948e3cdefa6fc347d13e4dcbc63a0b03a165180cd2be1431a0cf74ce1ea25082d2bc",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEgkwZXHPP/fA40QG84Wh7XDthRvOVyIWX\nb3dTsjdrlI483vpvw0fRPk3LxjoLA6FlGAzSvhQxoM90zh6iUILSvA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 384,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c102200fa527fa7343c0bc9ec35a6278bfbff4d83301b154fc4bd14aee7eb93445b5f9",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "042788a52f078eb3f202c4fa73e0d3386faf3df6be856003636f599922d4f5268f30b4f207c919bbdf5e67a8be4265a8174754b3aba8f16e575b77ff4d5a7eb64f",
+        "wx" : "2788a52f078eb3f202c4fa73e0d3386faf3df6be856003636f599922d4f5268f",
+        "wy" : "30b4f207c919bbdf5e67a8be4265a8174754b3aba8f16e575b77ff4d5a7eb64f"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200042788a52f078eb3f202c4fa73e0d3386faf3df6be856003636f599922d4f5268f30b4f207c919bbdf5e67a8be4265a8174754b3aba8f16e575b77ff4d5a7eb64f",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEJ4ilLweOs/ICxPpz4NM4b6899r6FYANj\nb1mZItT1Jo8wtPIHyRm7315nqL5CZagXR1Szq6jxbldbd/9NWn62Tw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 385,
+          "comment" : "edge case modular inverse",
+          "flags" : [
+            "ModularInverse",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c102206539c0adadd0525ff42622164ce9314348bd0863b4c80e936b23ca0414264671",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04d533b789a4af890fa7a82a1fae58c404f9a62a50b49adafab349c513b415087401b4171b803e76b34a9861e10f7bc289a066fd01bd29f84c987a10a5fb18c2d4",
+        "wx" : "00d533b789a4af890fa7a82a1fae58c404f9a62a50b49adafab349c513b4150874",
+        "wy" : "01b4171b803e76b34a9861e10f7bc289a066fd01bd29f84c987a10a5fb18c2d4"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004d533b789a4af890fa7a82a1fae58c404f9a62a50b49adafab349c513b415087401b4171b803e76b34a9861e10f7bc289a066fd01bd29f84c987a10a5fb18c2d4",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE1TO3iaSviQ+nqCofrljEBPmmKlC0mtr6\ns0nFE7QVCHQBtBcbgD52s0qYYeEPe8KJoGb9Ab0p+EyYehCl+xjC1A==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 386,
+          "comment" : "point at infinity during verify",
+          "flags" : [
+            "PointDuplication",
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c0",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "043a3150798c8af69d1e6e981f3a45402ba1d732f4be8330c5164f49e10ec555b4221bd842bc5e4d97eff37165f60e3998a424d72a450cf95ea477c78287d0343a",
+        "wx" : "3a3150798c8af69d1e6e981f3a45402ba1d732f4be8330c5164f49e10ec555b4",
+        "wy" : "221bd842bc5e4d97eff37165f60e3998a424d72a450cf95ea477c78287d0343a"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200043a3150798c8af69d1e6e981f3a45402ba1d732f4be8330c5164f49e10ec555b4221bd842bc5e4d97eff37165f60e3998a424d72a450cf95ea477c78287d0343a",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEOjFQeYyK9p0ebpgfOkVAK6HXMvS+gzDF\nFk9J4Q7FVbQiG9hCvF5Nl+/zcWX2DjmYpCTXKkUM+V6kd8eCh9A0Og==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 387,
+          "comment" : "edge case for signature malleability",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a002207fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "043b37df5fb347c69a0f17d85c0c7ca83736883a825e13143d0fcfc8101e851e800de3c090b6ca21ba543517330c04b12f948c6badf14a63abffdf4ef8c7537026",
+        "wx" : "3b37df5fb347c69a0f17d85c0c7ca83736883a825e13143d0fcfc8101e851e80",
+        "wy" : "0de3c090b6ca21ba543517330c04b12f948c6badf14a63abffdf4ef8c7537026"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200043b37df5fb347c69a0f17d85c0c7ca83736883a825e13143d0fcfc8101e851e800de3c090b6ca21ba543517330c04b12f948c6badf14a63abffdf4ef8c7537026",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEOzffX7NHxpoPF9hcDHyoNzaIOoJeExQ9\nD8/IEB6FHoAN48CQtsohulQ1FzMMBLEvlIxrrfFKY6v/3074x1NwJg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 388,
+          "comment" : "edge case for signature malleability",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a002207fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a1",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04feb5163b0ece30ff3e03c7d55c4380fa2fa81ee2c0354942ff6f08c99d0cd82ce87de05ee1bda089d3e4e248fa0f721102acfffdf50e654be281433999df897e",
+        "wx" : "00feb5163b0ece30ff3e03c7d55c4380fa2fa81ee2c0354942ff6f08c99d0cd82c",
+        "wy" : "00e87de05ee1bda089d3e4e248fa0f721102acfffdf50e654be281433999df897e"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004feb5163b0ece30ff3e03c7d55c4380fa2fa81ee2c0354942ff6f08c99d0cd82ce87de05ee1bda089d3e4e248fa0f721102acfffdf50e654be281433999df897e",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE/rUWOw7OMP8+A8fVXEOA+i+oHuLANUlC\n/28IyZ0M2CzofeBe4b2gidPk4kj6D3IRAqz//fUOZUvigUM5md+Jfg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 389,
+          "comment" : "u1 == 1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215b8022044a5ad0bd0636d9e12bc9e0a6bdd5e1bba77f523842193b3b82e448e05d5f11e",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04238ced001cf22b8853e02edc89cbeca5050ba7e042a7a77f9382cd414922897640683d3094643840f295890aa4c18aa39b41d77dd0fb3bb2700e4f9ec284ffc2",
+        "wx" : "238ced001cf22b8853e02edc89cbeca5050ba7e042a7a77f9382cd4149228976",
+        "wy" : "40683d3094643840f295890aa4c18aa39b41d77dd0fb3bb2700e4f9ec284ffc2"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004238ced001cf22b8853e02edc89cbeca5050ba7e042a7a77f9382cd414922897640683d3094643840f295890aa4c18aa39b41d77dd0fb3bb2700e4f9ec284ffc2",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEI4ztABzyK4hT4C7cicvspQULp+BCp6d/\nk4LNQUkiiXZAaD0wlGQ4QPKViQqkwYqjm0HXfdD7O7JwDk+ewoT/wg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 390,
+          "comment" : "u1 == n - 1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215b8022044a5ad0bd0636d9e12bc9e0a6bdd5e1bba77f523842193b3b82e448e05d5f11e",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04961cf64817c06c0e51b3c2736c922fde18bd8c4906fcd7f5ef66c4678508f35ed2c5d18168cfbe70f2f123bd7419232bb92dd69113e2941061889481c5a027bf",
+        "wx" : "00961cf64817c06c0e51b3c2736c922fde18bd8c4906fcd7f5ef66c4678508f35e",
+        "wy" : "00d2c5d18168cfbe70f2f123bd7419232bb92dd69113e2941061889481c5a027bf"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004961cf64817c06c0e51b3c2736c922fde18bd8c4906fcd7f5ef66c4678508f35ed2c5d18168cfbe70f2f123bd7419232bb92dd69113e2941061889481c5a027bf",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAElhz2SBfAbA5Rs8JzbJIv3hi9jEkG/Nf1\n72bEZ4UI817SxdGBaM++cPLxI710GSMruS3WkRPilBBhiJSBxaAnvw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 391,
+          "comment" : "u2 == 1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215b8022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215b8",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0413681eae168cd4ea7cf2e2a45d052742d10a9f64e796867dbdcb829fe0b1028816528760d177376c09df79de39557c329cc1753517acffe8fa2ec298026b8384",
+        "wx" : "13681eae168cd4ea7cf2e2a45d052742d10a9f64e796867dbdcb829fe0b10288",
+        "wy" : "16528760d177376c09df79de39557c329cc1753517acffe8fa2ec298026b8384"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000413681eae168cd4ea7cf2e2a45d052742d10a9f64e796867dbdcb829fe0b1028816528760d177376c09df79de39557c329cc1753517acffe8fa2ec298026b8384",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEE2gerhaM1Op88uKkXQUnQtEKn2TnloZ9\nvcuCn+CxAogWUodg0Xc3bAnfed45VXwynMF1NRes/+j6LsKYAmuDhA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 392,
+          "comment" : "u2 == n - 1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215b8022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215b8",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "045aa7abfdb6b4086d543325e5d79c6e95ce42f866d2bb84909633a04bb1aa31c291c80088794905e1da33336d874e2f91ccf45cc59185bede5dd6f3f7acaae18b",
+        "wx" : "5aa7abfdb6b4086d543325e5d79c6e95ce42f866d2bb84909633a04bb1aa31c2",
+        "wy" : "0091c80088794905e1da33336d874e2f91ccf45cc59185bede5dd6f3f7acaae18b"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200045aa7abfdb6b4086d543325e5d79c6e95ce42f866d2bb84909633a04bb1aa31c291c80088794905e1da33336d874e2f91ccf45cc59185bede5dd6f3f7acaae18b",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEWqer/ba0CG1UMyXl15xulc5C+GbSu4SQ\nljOgS7GqMcKRyACIeUkF4dozM22HTi+RzPRcxZGFvt5d1vP3rKrhiw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 393,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc022016e1e459457679df5b9434ae23f474b3e8d2a70bd6b5dbe692ba16da01f1fb0a",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0400277791b305a45b2b39590b2f05d3392a6c8182cef4eb540120e0f5c206c3e464108233fb0b8c3ac892d79ef8e0fbf92ed133addb4554270132584dc52eef41",
+        "wx" : "277791b305a45b2b39590b2f05d3392a6c8182cef4eb540120e0f5c206c3e4",
+        "wy" : "64108233fb0b8c3ac892d79ef8e0fbf92ed133addb4554270132584dc52eef41"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000400277791b305a45b2b39590b2f05d3392a6c8182cef4eb540120e0f5c206c3e464108233fb0b8c3ac892d79ef8e0fbf92ed133addb4554270132584dc52eef41",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEACd3kbMFpFsrOVkLLwXTOSpsgYLO9OtU\nASDg9cIGw+RkEIIz+wuMOsiS15744Pv5LtEzrdtFVCcBMlhNxS7vQQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 394,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02201c940f313f92647be257eccd7ed08b0baef3f0478f25871b53635302c5f6314a",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "046efa092b68de9460f0bcc919005a5f6e80e19de98968be3cd2c770a9949bfb1ac75e6e5087d6550d5f9beb1e79e5029307bc255235e2d5dc99241ac3ab886c49",
+        "wx" : "6efa092b68de9460f0bcc919005a5f6e80e19de98968be3cd2c770a9949bfb1a",
+        "wy" : "00c75e6e5087d6550d5f9beb1e79e5029307bc255235e2d5dc99241ac3ab886c49"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200046efa092b68de9460f0bcc919005a5f6e80e19de98968be3cd2c770a9949bfb1ac75e6e5087d6550d5f9beb1e79e5029307bc255235e2d5dc99241ac3ab886c49",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEbvoJK2jelGDwvMkZAFpfboDhnemJaL48\n0sdwqZSb+xrHXm5Qh9ZVDV+b6x555QKTB7wlUjXi1dyZJBrDq4hsSQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 395,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc022015d94a85077b493f91cb7101ec63e1b01be58b594e855f45050a8c14062d689b",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0472d4a19c4f9d2cf5848ea40445b70d4696b5f02d632c0c654cc7d7eeb0c6d058e8c4cd9943e459174c7ac01fa742198e47e6c19a6bdb0c4f6c237831c1b3f942",
+        "wx" : "72d4a19c4f9d2cf5848ea40445b70d4696b5f02d632c0c654cc7d7eeb0c6d058",
+        "wy" : "00e8c4cd9943e459174c7ac01fa742198e47e6c19a6bdb0c4f6c237831c1b3f942"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000472d4a19c4f9d2cf5848ea40445b70d4696b5f02d632c0c654cc7d7eeb0c6d058e8c4cd9943e459174c7ac01fa742198e47e6c19a6bdb0c4f6c237831c1b3f942",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEctShnE+dLPWEjqQERbcNRpa18C1jLAxl\nTMfX7rDG0FjoxM2ZQ+RZF0x6wB+nQhmOR+bBmmvbDE9sI3gxwbP5Qg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 396,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02205b1d27a7694c146244a5ad0bd0636d9d9ef3b9fb58385418d9c982105077d1b7",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "042a8ea2f50dcced0c217575bdfa7cd47d1c6f100041ec0e35512794c1be7e740258f8c17122ed303fda7143eb58bede70295b653266013b0b0ebd3f053137f6ec",
+        "wx" : "2a8ea2f50dcced0c217575bdfa7cd47d1c6f100041ec0e35512794c1be7e7402",
+        "wy" : "58f8c17122ed303fda7143eb58bede70295b653266013b0b0ebd3f053137f6ec"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200042a8ea2f50dcced0c217575bdfa7cd47d1c6f100041ec0e35512794c1be7e740258f8c17122ed303fda7143eb58bede70295b653266013b0b0ebd3f053137f6ec",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEKo6i9Q3M7QwhdXW9+nzUfRxvEABB7A41\nUSeUwb5+dAJY+MFxIu0wP9pxQ+tYvt5wKVtlMmYBOwsOvT8FMTf27A==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 397,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02202d85896b3eb9dbb5a52f42f9c9261ed3fc46644ec65f06ade3fd78f257e43432",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0488de689ce9af1e94be6a2089c8a8b1253ffdbb6c8e9c86249ba220001a4ad3b80c4998e54842f413b9edb1825acbb6335e81e4d184b2b01c8bebdc85d1f28946",
+        "wx" : "0088de689ce9af1e94be6a2089c8a8b1253ffdbb6c8e9c86249ba220001a4ad3b8",
+        "wy" : "0c4998e54842f413b9edb1825acbb6335e81e4d184b2b01c8bebdc85d1f28946"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000488de689ce9af1e94be6a2089c8a8b1253ffdbb6c8e9c86249ba220001a4ad3b80c4998e54842f413b9edb1825acbb6335e81e4d184b2b01c8bebdc85d1f28946",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEiN5onOmvHpS+aiCJyKixJT/9u2yOnIYk\nm6IgABpK07gMSZjlSEL0E7ntsYJay7YzXoHk0YSysByL69yF0fKJRg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 398,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02205b0b12d67d73b76b4a5e85f3924c3da7f88cc89d8cbe0d5bc7faf1e4afc86864",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04fea2d31f70f90d5fb3e00e186ac42ab3c1615cee714e0b4e1131b3d4d8225bf7b037a18df2ac15343f30f74067ddf29e817d5f77f8dce05714da59c094f0cda9",
+        "wx" : "00fea2d31f70f90d5fb3e00e186ac42ab3c1615cee714e0b4e1131b3d4d8225bf7",
+        "wy" : "00b037a18df2ac15343f30f74067ddf29e817d5f77f8dce05714da59c094f0cda9"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004fea2d31f70f90d5fb3e00e186ac42ab3c1615cee714e0b4e1131b3d4d8225bf7b037a18df2ac15343f30f74067ddf29e817d5f77f8dce05714da59c094f0cda9",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE/qLTH3D5DV+z4A4YasQqs8FhXO5xTgtO\nETGz1NgiW/ewN6GN8qwVND8w90Bn3fKegX1fd/jc4FcU2lnAlPDNqQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 399,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc0220694c146244a5ad0bd0636d9e12bc9e09e60e68b90d0b5e6c5dddd0cb694d8799",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "047258911e3d423349166479dbe0b8341af7fbd03d0a7e10edccb36b6ceea5a3db17ac2b8992791128fa3b96dc2fbd4ca3bfa782ef2832fc6656943db18e7346b0",
+        "wx" : "7258911e3d423349166479dbe0b8341af7fbd03d0a7e10edccb36b6ceea5a3db",
+        "wy" : "17ac2b8992791128fa3b96dc2fbd4ca3bfa782ef2832fc6656943db18e7346b0"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200047258911e3d423349166479dbe0b8341af7fbd03d0a7e10edccb36b6ceea5a3db17ac2b8992791128fa3b96dc2fbd4ca3bfa782ef2832fc6656943db18e7346b0",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEcliRHj1CM0kWZHnb4Lg0Gvf70D0KfhDt\nzLNrbO6lo9sXrCuJknkRKPo7ltwvvUyjv6eC7ygy/GZWlD2xjnNGsA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 400,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02203d7f487c07bfc5f30846938a3dcef696444707cf9677254a92b06c63ab867d22",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "044f28461dea64474d6bb34d1499c97d37b9e95633df1ceeeaacd45016c98b3914c8818810b8cc06ddb40e8a1261c528faa589455d5a6df93b77bc5e0e493c7470",
+        "wx" : "4f28461dea64474d6bb34d1499c97d37b9e95633df1ceeeaacd45016c98b3914",
+        "wy" : "00c8818810b8cc06ddb40e8a1261c528faa589455d5a6df93b77bc5e0e493c7470"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200044f28461dea64474d6bb34d1499c97d37b9e95633df1ceeeaacd45016c98b3914c8818810b8cc06ddb40e8a1261c528faa589455d5a6df93b77bc5e0e493c7470",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAETyhGHepkR01rs00Umcl9N7npVjPfHO7q\nrNRQFsmLORTIgYgQuMwG3bQOihJhxSj6pYlFXVpt+Tt3vF4OSTx0cA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 401,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02206c7648fc0fbf8a06adb8b839f97b4ff7a800f11b1e37c593b261394599792ba4",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0474f2a814fb5d8eca91a69b5e60712732b3937de32829be974ed7b68c5c2f5d66eff0f07c56f987a657f42196205f588c0f1d96fd8a63a5f238b48f478788fe3b",
+        "wx" : "74f2a814fb5d8eca91a69b5e60712732b3937de32829be974ed7b68c5c2f5d66",
+        "wy" : "00eff0f07c56f987a657f42196205f588c0f1d96fd8a63a5f238b48f478788fe3b"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000474f2a814fb5d8eca91a69b5e60712732b3937de32829be974ed7b68c5c2f5d66eff0f07c56f987a657f42196205f588c0f1d96fd8a63a5f238b48f478788fe3b",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEdPKoFPtdjsqRppteYHEnMrOTfeMoKb6X\nTte2jFwvXWbv8PB8VvmHplf0IZYgX1iMDx2W/YpjpfI4tI9Hh4j+Ow==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 402,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc0220641c9c5d790dc09cdd3dfabb62cdf453e69747a7e3d7aa1a714189ef53171a99",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04195b51a7cc4a21b8274a70a90de779814c3c8ca358328208c09a29f336b82d6ab2416b7c92fffdc29c3b1282dd2a77a4d04df7f7452047393d849989c5cee9ad",
+        "wx" : "195b51a7cc4a21b8274a70a90de779814c3c8ca358328208c09a29f336b82d6a",
+        "wy" : "00b2416b7c92fffdc29c3b1282dd2a77a4d04df7f7452047393d849989c5cee9ad"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004195b51a7cc4a21b8274a70a90de779814c3c8ca358328208c09a29f336b82d6ab2416b7c92fffdc29c3b1282dd2a77a4d04df7f7452047393d849989c5cee9ad",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEGVtRp8xKIbgnSnCpDed5gUw8jKNYMoII\nwJop8za4LWqyQWt8kv/9wpw7EoLdKnek0E3390UgRzk9hJmJxc7prQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 403,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc022029798c5c45bdf58b4a7b2fdc2c46ab4af1218c7eeb9f0f27a88f1267674de3b0",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04622fc74732034bec2ddf3bc16d34b3d1f7a327dd2a8c19bab4bb4fe3a24b58aa736b2f2fae76f4dfaecc9096333b01328d51eb3fda9c9227e90d0b449983c4f0",
+        "wx" : "622fc74732034bec2ddf3bc16d34b3d1f7a327dd2a8c19bab4bb4fe3a24b58aa",
+        "wy" : "736b2f2fae76f4dfaecc9096333b01328d51eb3fda9c9227e90d0b449983c4f0"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004622fc74732034bec2ddf3bc16d34b3d1f7a327dd2a8c19bab4bb4fe3a24b58aa736b2f2fae76f4dfaecc9096333b01328d51eb3fda9c9227e90d0b449983c4f0",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEYi/HRzIDS+wt3zvBbTSz0fejJ90qjBm6\ntLtP46JLWKpzay8vrnb0367MkJYzOwEyjVHrP9qckifpDQtEmYPE8A==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 404,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02200b70f22ca2bb3cefadca1a5711fa3a59f4695385eb5aedf3495d0b6d00f8fd85",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "041f7f85caf2d7550e7af9b65023ebb4dce3450311692309db269969b834b611c70827f45b78020ecbbaf484fdd5bfaae6870f1184c21581baf6ef82bd7b530f93",
+        "wx" : "1f7f85caf2d7550e7af9b65023ebb4dce3450311692309db269969b834b611c7",
+        "wy" : "0827f45b78020ecbbaf484fdd5bfaae6870f1184c21581baf6ef82bd7b530f93"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200041f7f85caf2d7550e7af9b65023ebb4dce3450311692309db269969b834b611c70827f45b78020ecbbaf484fdd5bfaae6870f1184c21581baf6ef82bd7b530f93",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEH3+FyvLXVQ56+bZQI+u03ONFAxFpIwnb\nJplpuDS2EccIJ/RbeAIOy7r0hP3Vv6rmhw8RhMIVgbr274K9e1MPkw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 405,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc022016e1e459457679df5b9434ae23f474b3e8d2a70bd6b5dbe692ba16da01f1fb0a",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0449c197dc80ad1da47a4342b93893e8e1fb0bb94fc33a83e783c00b24c781377aefc20da92bac762951f72474becc734d4cc22ba81b895e282fdac4df7af0f37d",
+        "wx" : "49c197dc80ad1da47a4342b93893e8e1fb0bb94fc33a83e783c00b24c781377a",
+        "wy" : "00efc20da92bac762951f72474becc734d4cc22ba81b895e282fdac4df7af0f37d"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000449c197dc80ad1da47a4342b93893e8e1fb0bb94fc33a83e783c00b24c781377aefc20da92bac762951f72474becc734d4cc22ba81b895e282fdac4df7af0f37d",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEScGX3ICtHaR6Q0K5OJPo4fsLuU/DOoPn\ng8ALJMeBN3rvwg2pK6x2KVH3JHS+zHNNTMIrqBuJXigv2sTfevDzfQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 406,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02202252d685e831b6cf095e4f0535eeaf0ddd3bfa91c210c9d9dc17224702eaf88f",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04d8cb68517b616a56400aa3868635e54b6f699598a2f6167757654980baf6acbe7ec8cf449c849aa03461a30efada41453c57c6e6fbc93bbc6fa49ada6dc0555c",
+        "wx" : "00d8cb68517b616a56400aa3868635e54b6f699598a2f6167757654980baf6acbe",
+        "wy" : "7ec8cf449c849aa03461a30efada41453c57c6e6fbc93bbc6fa49ada6dc0555c"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004d8cb68517b616a56400aa3868635e54b6f699598a2f6167757654980baf6acbe7ec8cf449c849aa03461a30efada41453c57c6e6fbc93bbc6fa49ada6dc0555c",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE2MtoUXthalZACqOGhjXlS29plZii9hZ3\nV2VJgLr2rL5+yM9EnISaoDRhow762kFFPFfG5vvJO7xvpJrabcBVXA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 407,
+          "comment" : "edge case for u1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc022075135abd7c425b60371a477f09ce0f274f64a8c6b061a07b5d63e93c65046c53",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04030713fb63f2aa6fe2cadf1b20efc259c77445dafa87dac398b84065ca347df3b227818de1a39b589cb071d83e5317cccdc2338e51e312fe31d8dc34a4801750",
+        "wx" : "030713fb63f2aa6fe2cadf1b20efc259c77445dafa87dac398b84065ca347df3",
+        "wy" : "00b227818de1a39b589cb071d83e5317cccdc2338e51e312fe31d8dc34a4801750"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004030713fb63f2aa6fe2cadf1b20efc259c77445dafa87dac398b84065ca347df3b227818de1a39b589cb071d83e5317cccdc2338e51e312fe31d8dc34a4801750",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEAwcT+2Pyqm/iyt8bIO/CWcd0Rdr6h9rD\nmLhAZco0ffOyJ4GN4aObWJywcdg+UxfMzcIzjlHjEv4x2Nw0pIAXUA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 408,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02202aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3e3a49a23a6d8abe95461f8445676b17",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04babb3677b0955802d8e929a41355640eaf1ea1353f8a771331c4946e3480afa7252f196c87ed3d2a59d3b1b559137fed0013fecefc19fb5a92682b9bca51b950",
+        "wx" : "00babb3677b0955802d8e929a41355640eaf1ea1353f8a771331c4946e3480afa7",
+        "wy" : "252f196c87ed3d2a59d3b1b559137fed0013fecefc19fb5a92682b9bca51b950"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004babb3677b0955802d8e929a41355640eaf1ea1353f8a771331c4946e3480afa7252f196c87ed3d2a59d3b1b559137fed0013fecefc19fb5a92682b9bca51b950",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEurs2d7CVWALY6SmkE1VkDq8eoTU/incT\nMcSUbjSAr6clLxlsh+09KlnTsbVZE3/tABP+zvwZ+1qSaCubylG5UA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 409,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02203e888377ac6c71ac9dec3fdb9b56c9feaf0cfaca9f827fc5eb65fc3eac811210",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "041aab2018793471111a8a0e9b143fde02fc95920796d3a63de329b424396fba60bbe4130705174792441b318d3aa31dfe8577821e9b446ec573d272e036c4ebe9",
+        "wx" : "1aab2018793471111a8a0e9b143fde02fc95920796d3a63de329b424396fba60",
+        "wy" : "00bbe4130705174792441b318d3aa31dfe8577821e9b446ec573d272e036c4ebe9"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200041aab2018793471111a8a0e9b143fde02fc95920796d3a63de329b424396fba60bbe4130705174792441b318d3aa31dfe8577821e9b446ec573d272e036c4ebe9",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEGqsgGHk0cREaig6bFD/eAvyVkgeW06Y9\n4ym0JDlvumC75BMHBRdHkkQbMY06ox3+hXeCHptEbsVz0nLgNsTr6Q==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 410,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc022030bbb794db588363b40679f6c182a50d3ce9679acdd3ffbe36d7813dacbdc818",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "048cb0b909499c83ea806cd885b1dd467a0119f06a88a0276eb0cfda274535a8ff47b5428833bc3f2c8bf9d9041158cf33718a69961cd01729bc0011d1e586ab75",
+        "wx" : "008cb0b909499c83ea806cd885b1dd467a0119f06a88a0276eb0cfda274535a8ff",
+        "wy" : "47b5428833bc3f2c8bf9d9041158cf33718a69961cd01729bc0011d1e586ab75"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200048cb0b909499c83ea806cd885b1dd467a0119f06a88a0276eb0cfda274535a8ff47b5428833bc3f2c8bf9d9041158cf33718a69961cd01729bc0011d1e586ab75",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEjLC5CUmcg+qAbNiFsd1GegEZ8GqIoCdu\nsM/aJ0U1qP9HtUKIM7w/LIv52QQRWM8zcYpplhzQFym8ABHR5YardQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 411,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02202c37fd995622c4fb7fffffffffffffffc7cee745110cb45ab558ed7c90c15a2f",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "048f03cf1a42272bb1532723093f72e6feeac85e1700e9fbe9a6a2dd642d74bf5d3b89a7189dad8cf75fc22f6f158aa27f9c2ca00daca785be3358f2bda3862ca0",
+        "wx" : "008f03cf1a42272bb1532723093f72e6feeac85e1700e9fbe9a6a2dd642d74bf5d",
+        "wy" : "3b89a7189dad8cf75fc22f6f158aa27f9c2ca00daca785be3358f2bda3862ca0"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200048f03cf1a42272bb1532723093f72e6feeac85e1700e9fbe9a6a2dd642d74bf5d3b89a7189dad8cf75fc22f6f158aa27f9c2ca00daca785be3358f2bda3862ca0",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEjwPPGkInK7FTJyMJP3Lm/urIXhcA6fvp\npqLdZC10v107iacYna2M91/CL28ViqJ/nCygDaynhb4zWPK9o4YsoA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 412,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02207fd995622c4fb7ffffffffffffffffff5d883ffab5b32652ccdcaa290fccb97d",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0444de3b9c7a57a8c9e820952753421e7d987bb3d79f71f013805c897e018f8acea2460758c8f98d3fdce121a943659e372c326fff2e5fc2ae7fa3f79daae13c12",
+        "wx" : "44de3b9c7a57a8c9e820952753421e7d987bb3d79f71f013805c897e018f8ace",
+        "wy" : "00a2460758c8f98d3fdce121a943659e372c326fff2e5fc2ae7fa3f79daae13c12"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000444de3b9c7a57a8c9e820952753421e7d987bb3d79f71f013805c897e018f8acea2460758c8f98d3fdce121a943659e372c326fff2e5fc2ae7fa3f79daae13c12",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAERN47nHpXqMnoIJUnU0IefZh7s9efcfAT\ngFyJfgGPis6iRgdYyPmNP9zhIalDZZ43LDJv/y5fwq5/o/edquE8Eg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 413,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304302207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc021f4cd53ba7608fffffffffffffffffffff9e5cf143e2539626190a3ab09cce47",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "046fb8b2b48e33031268ad6a517484dc8839ea90f6669ea0c7ac3233e2ac31394a0ac8bbe7f73c2ff4df9978727ac1dfc2fd58647d20f31f99105316b64671f204",
+        "wx" : "6fb8b2b48e33031268ad6a517484dc8839ea90f6669ea0c7ac3233e2ac31394a",
+        "wy" : "0ac8bbe7f73c2ff4df9978727ac1dfc2fd58647d20f31f99105316b64671f204"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200046fb8b2b48e33031268ad6a517484dc8839ea90f6669ea0c7ac3233e2ac31394a0ac8bbe7f73c2ff4df9978727ac1dfc2fd58647d20f31f99105316b64671f204",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEb7iytI4zAxJorWpRdITciDnqkPZmnqDH\nrDIz4qwxOUoKyLvn9zwv9N+ZeHJ6wd/C/VhkfSDzH5kQUxa2RnHyBA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 414,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02205622c4fb7fffffffffffffffffffffff928a8f1c7ac7bec1808b9f61c01ec327",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04bea71122a048693e905ff602b3cf9dd18af69b9fc9d8431d2b1dd26b942c95e6f43c7b8b95eb62082c12db9dbda7fe38e45cbe4a4886907fb81bdb0c5ea9246c",
+        "wx" : "00bea71122a048693e905ff602b3cf9dd18af69b9fc9d8431d2b1dd26b942c95e6",
+        "wy" : "00f43c7b8b95eb62082c12db9dbda7fe38e45cbe4a4886907fb81bdb0c5ea9246c"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004bea71122a048693e905ff602b3cf9dd18af69b9fc9d8431d2b1dd26b942c95e6f43c7b8b95eb62082c12db9dbda7fe38e45cbe4a4886907fb81bdb0c5ea9246c",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEvqcRIqBIaT6QX/YCs8+d0Yr2m5/J2EMd\nKx3Sa5Qsleb0PHuLletiCCwS2529p/445Fy+SkiGkH+4G9sMXqkkbA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 415,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc022044104104104104104104104104104103b87853fd3b7d3f8e175125b4382f25ed",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04da918c731ba06a20cb94ef33b778e981a404a305f1941fe33666b45b03353156e2bb2694f575b45183be78e5c9b5210bf3bf488fd4c8294516d89572ca4f5391",
+        "wx" : "00da918c731ba06a20cb94ef33b778e981a404a305f1941fe33666b45b03353156",
+        "wy" : "00e2bb2694f575b45183be78e5c9b5210bf3bf488fd4c8294516d89572ca4f5391"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004da918c731ba06a20cb94ef33b778e981a404a305f1941fe33666b45b03353156e2bb2694f575b45183be78e5c9b5210bf3bf488fd4c8294516d89572ca4f5391",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE2pGMcxugaiDLlO8zt3jpgaQEowXxlB/j\nNma0WwM1MVbiuyaU9XW0UYO+eOXJtSEL879Ij9TIKUUW2JVyyk9TkQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 416,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02202739ce739ce739ce739ce739ce739ce705560298d1f2f08dc419ac273a5b54d9",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "043007e92c3937dade7964dfa35b0eff031f7eb02aed0a0314411106cdeb70fe3d5a7546fc0552997b20e3d6f413e75e2cb66e116322697114b79bac734bfc4dc5",
+        "wx" : "3007e92c3937dade7964dfa35b0eff031f7eb02aed0a0314411106cdeb70fe3d",
+        "wy" : "5a7546fc0552997b20e3d6f413e75e2cb66e116322697114b79bac734bfc4dc5"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200043007e92c3937dade7964dfa35b0eff031f7eb02aed0a0314411106cdeb70fe3d5a7546fc0552997b20e3d6f413e75e2cb66e116322697114b79bac734bfc4dc5",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEMAfpLDk32t55ZN+jWw7/Ax9+sCrtCgMU\nQREGzetw/j1adUb8BVKZeyDj1vQT514stm4RYyJpcRS3m6xzS/xNxQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 417,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02204888888888888888888888888888888831c83ae82ebe0898776b4c69d11f88de",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0460e734ef5624d3cbf0ddd375011bd663d6d6aebc644eb599fdf98dbdcd18ce9bd2d90b3ac31f139af832cccf6ccbbb2c6ea11fa97370dc9906da474d7d8a7567",
+        "wx" : "60e734ef5624d3cbf0ddd375011bd663d6d6aebc644eb599fdf98dbdcd18ce9b",
+        "wy" : "00d2d90b3ac31f139af832cccf6ccbbb2c6ea11fa97370dc9906da474d7d8a7567"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000460e734ef5624d3cbf0ddd375011bd663d6d6aebc644eb599fdf98dbdcd18ce9bd2d90b3ac31f139af832cccf6ccbbb2c6ea11fa97370dc9906da474d7d8a7567",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEYOc071Yk08vw3dN1ARvWY9bWrrxkTrWZ\n/fmNvc0YzpvS2Qs6wx8TmvgyzM9sy7ssbqEfqXNw3JkG2kdNfYp1Zw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 418,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02206492492492492492492492492492492406dd3a19b8d5fb875235963c593bd2d3",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0485a900e97858f693c0b7dfa261e380dad6ea046d1f65ddeeedd5f7d8af0ba33769744d15add4f6c0bc3b0da2aec93b34cb8c65f9340ddf74e7b0009eeeccce3c",
+        "wx" : "0085a900e97858f693c0b7dfa261e380dad6ea046d1f65ddeeedd5f7d8af0ba337",
+        "wy" : "69744d15add4f6c0bc3b0da2aec93b34cb8c65f9340ddf74e7b0009eeeccce3c"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000485a900e97858f693c0b7dfa261e380dad6ea046d1f65ddeeedd5f7d8af0ba33769744d15add4f6c0bc3b0da2aec93b34cb8c65f9340ddf74e7b0009eeeccce3c",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEhakA6XhY9pPAt9+iYeOA2tbqBG0fZd3u\n7dX32K8LozdpdE0VrdT2wLw7DaKuyTs0y4xl+TQN33TnsACe7szOPA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 419,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02206aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3e3a49a23a6d8abe95461f8445676b15",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0438066f75d88efc4c93de36f49e037b234cc18b1de5608750a62cab0345401046a3e84bed8cfcb819ef4d550444f2ce4b651766b69e2e2901f88836ff90034fed",
+        "wx" : "38066f75d88efc4c93de36f49e037b234cc18b1de5608750a62cab0345401046",
+        "wy" : "00a3e84bed8cfcb819ef4d550444f2ce4b651766b69e2e2901f88836ff90034fed"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000438066f75d88efc4c93de36f49e037b234cc18b1de5608750a62cab0345401046a3e84bed8cfcb819ef4d550444f2ce4b651766b69e2e2901f88836ff90034fed",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEOAZvddiO/EyT3jb0ngN7I0zBix3lYIdQ\npiyrA0VAEEaj6EvtjPy4Ge9NVQRE8s5LZRdmtp4uKQH4iDb/kANP7Q==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 420,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02202aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3e3a49a23a6d8abe95461f8445676b17",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0498f68177dc95c1b4cbfa5245488ca523a7d5629470d035d621a443c72f39aabfa33d29546fa1c648f2c7d5ccf70cf1ce4ab79b5db1ac059dbecd068dbdff1b89",
+        "wx" : "0098f68177dc95c1b4cbfa5245488ca523a7d5629470d035d621a443c72f39aabf",
+        "wy" : "00a33d29546fa1c648f2c7d5ccf70cf1ce4ab79b5db1ac059dbecd068dbdff1b89"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000498f68177dc95c1b4cbfa5245488ca523a7d5629470d035d621a443c72f39aabfa33d29546fa1c648f2c7d5ccf70cf1ce4ab79b5db1ac059dbecd068dbdff1b89",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEmPaBd9yVwbTL+lJFSIylI6fVYpRw0DXW\nIaRDxy85qr+jPSlUb6HGSPLH1cz3DPHOSrebXbGsBZ2+zQaNvf8biQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 421,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc02203ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "045c2bbfa23c9b9ad07f038aa89b4930bf267d9401e4255de9e8da0a5078ec8277e3e882a31d5e6a379e0793983ccded39b95c4353ab2ff01ea5369ba47b0c3191",
+        "wx" : "5c2bbfa23c9b9ad07f038aa89b4930bf267d9401e4255de9e8da0a5078ec8277",
+        "wy" : "00e3e882a31d5e6a379e0793983ccded39b95c4353ab2ff01ea5369ba47b0c3191"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200045c2bbfa23c9b9ad07f038aa89b4930bf267d9401e4255de9e8da0a5078ec8277e3e882a31d5e6a379e0793983ccded39b95c4353ab2ff01ea5369ba47b0c3191",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEXCu/ojybmtB/A4qom0kwvyZ9lAHkJV3p\n6NoKUHjsgnfj6IKjHV5qN54Hk5g8ze05uVxDU6sv8B6lNpukewwxkQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 422,
+          "comment" : "edge case for u2",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "304402207ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc0220185ddbca6dac41b1da033cfb60c152869e74b3cd66e9ffdf1b6bc09ed65ee40c",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "042ea7133432339c69d27f9b267281bd2ddd5f19d6338d400a05cd3647b157a3853547808298448edb5e701ade84cd5fb1ac9567ba5e8fb68a6b933ec4b5cc84cc",
+        "wx" : "2ea7133432339c69d27f9b267281bd2ddd5f19d6338d400a05cd3647b157a385",
+        "wy" : "3547808298448edb5e701ade84cd5fb1ac9567ba5e8fb68a6b933ec4b5cc84cc"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200042ea7133432339c69d27f9b267281bd2ddd5f19d6338d400a05cd3647b157a3853547808298448edb5e701ade84cd5fb1ac9567ba5e8fb68a6b933ec4b5cc84cc",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAELqcTNDIznGnSf5smcoG9Ld1fGdYzjUAK\nBc02R7FXo4U1R4CCmESO215wGt6EzV+xrJVnul6Ptoprkz7EtcyEzA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 423,
+          "comment" : "point duplication during verification",
+          "flags" : [
+            "PointDuplication"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022032b0d10d8d0e04bc8d4d064d270699e87cffc9b49c5c20730e1c26f6105ddcda022029ed3d67b3d505be95580d77d5b792b436881179b2b6b2e04c5fe592d38d82d9",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "042ea7133432339c69d27f9b267281bd2ddd5f19d6338d400a05cd3647b157a385cab87f7d67bb7124a18fe5217b32a04e536a9845a1704975946cc13a4a337763",
+        "wx" : "2ea7133432339c69d27f9b267281bd2ddd5f19d6338d400a05cd3647b157a385",
+        "wy" : "00cab87f7d67bb7124a18fe5217b32a04e536a9845a1704975946cc13a4a337763"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200042ea7133432339c69d27f9b267281bd2ddd5f19d6338d400a05cd3647b157a385cab87f7d67bb7124a18fe5217b32a04e536a9845a1704975946cc13a4a337763",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAELqcTNDIznGnSf5smcoG9Ld1fGdYzjUAK\nBc02R7FXo4XKuH99Z7txJKGP5SF7MqBOU2qYRaFwSXWUbME6SjN3Yw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 424,
+          "comment" : "duplication bug",
+          "flags" : [
+            "PointDuplication"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022032b0d10d8d0e04bc8d4d064d270699e87cffc9b49c5c20730e1c26f6105ddcda022029ed3d67b3d505be95580d77d5b792b436881179b2b6b2e04c5fe592d38d82d9",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "048aa2c64fa9c6437563abfbcbd00b2048d48c18c152a2a6f49036de7647ebe82e1ce64387995c68a060fa3bc0399b05cc06eec7d598f75041a4917e692b7f51ff",
+        "wx" : "008aa2c64fa9c6437563abfbcbd00b2048d48c18c152a2a6f49036de7647ebe82e",
+        "wy" : "1ce64387995c68a060fa3bc0399b05cc06eec7d598f75041a4917e692b7f51ff"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200048aa2c64fa9c6437563abfbcbd00b2048d48c18c152a2a6f49036de7647ebe82e1ce64387995c68a060fa3bc0399b05cc06eec7d598f75041a4917e692b7f51ff",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEiqLGT6nGQ3Vjq/vL0AsgSNSMGMFSoqb0\nkDbedkfr6C4c5kOHmVxooGD6O8A5mwXMBu7H1Zj3UEGkkX5pK39R/w==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 425,
+          "comment" : "comparison with point at infinity ",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c0022033333333333333333333333333333332f222f8faefdb533f265d461c29a47373",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04391427ff7ee78013c14aec7d96a8a062209298a783835e94fd6549d502fff71fdd6624ec343ad9fcf4d9872181e59f842f9ba4cccae09a6c0972fb6ac6b4c6bd",
+        "wx" : "391427ff7ee78013c14aec7d96a8a062209298a783835e94fd6549d502fff71f",
+        "wy" : "00dd6624ec343ad9fcf4d9872181e59f842f9ba4cccae09a6c0972fb6ac6b4c6bd"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004391427ff7ee78013c14aec7d96a8a062209298a783835e94fd6549d502fff71fdd6624ec343ad9fcf4d9872181e59f842f9ba4cccae09a6c0972fb6ac6b4c6bd",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEORQn/37ngBPBSux9lqigYiCSmKeDg16U\n/WVJ1QL/9x/dZiTsNDrZ/PTZhyGB5Z+EL5ukzMrgmmwJcvtqxrTGvQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 426,
+          "comment" : "extreme value for k and edgecase s",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c0",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04e762b8a219b4f180219cc7a9059245e4961bd191c03899789c7a34b89e8c138ec1533ef0419bb7376e0bfde9319d10a06968791d9ea0eed9c1ce6345aed9759e",
+        "wx" : "00e762b8a219b4f180219cc7a9059245e4961bd191c03899789c7a34b89e8c138e",
+        "wy" : "00c1533ef0419bb7376e0bfde9319d10a06968791d9ea0eed9c1ce6345aed9759e"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004e762b8a219b4f180219cc7a9059245e4961bd191c03899789c7a34b89e8c138ec1533ef0419bb7376e0bfde9319d10a06968791d9ea0eed9c1ce6345aed9759e",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE52K4ohm08YAhnMepBZJF5JYb0ZHAOJl4\nnHo0uJ6ME47BUz7wQZu3N24L/ekxnRCgaWh5HZ6g7tnBzmNFrtl1ng==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 427,
+          "comment" : "extreme value for k and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5022049249249249249249249249249249248c79facd43214c011123c1b03a93412a5",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "049aedb0d281db164e130000c5697fae0f305ef848be6fffb43ac593fbb950e952fa6f633359bdcd82b56b0b9f965b037789d46b9a8141b791b2aefa713f96c175",
+        "wx" : "009aedb0d281db164e130000c5697fae0f305ef848be6fffb43ac593fbb950e952",
+        "wy" : "00fa6f633359bdcd82b56b0b9f965b037789d46b9a8141b791b2aefa713f96c175"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200049aedb0d281db164e130000c5697fae0f305ef848be6fffb43ac593fbb950e952fa6f633359bdcd82b56b0b9f965b037789d46b9a8141b791b2aefa713f96c175",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEmu2w0oHbFk4TAADFaX+uDzBe+Ei+b/+0\nOsWT+7lQ6VL6b2MzWb3NgrVrC5+WWwN3idRrmoFBt5GyrvpxP5bBdQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 428,
+          "comment" : "extreme value for k and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5022066666666666666666666666666666665e445f1f5dfb6a67e4cba8c385348e6e7",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "048ad445db62816260e4e687fd1884e48b9fc0636d031547d63315e792e19bfaee1de64f99d5f1cd8b6ec9cb0f787a654ae86993ba3db1008ef43cff0684cb22bd",
+        "wx" : "008ad445db62816260e4e687fd1884e48b9fc0636d031547d63315e792e19bfaee",
+        "wy" : "1de64f99d5f1cd8b6ec9cb0f787a654ae86993ba3db1008ef43cff0684cb22bd"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200048ad445db62816260e4e687fd1884e48b9fc0636d031547d63315e792e19bfaee1de64f99d5f1cd8b6ec9cb0f787a654ae86993ba3db1008ef43cff0684cb22bd",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEitRF22KBYmDk5of9GITki5/AY20DFUfW\nMxXnkuGb+u4d5k+Z1fHNi27Jyw94emVK6GmTuj2xAI70PP8GhMsivQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 429,
+          "comment" : "extreme value for k and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5022066666666666666666666666666666665e445f1f5dfb6a67e4cba8c385348e6e7",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "041f5799c95be89063b24f26e40cb928c1a868a76fb0094607e8043db409c91c32e75724e813a4191e3a839007f08e2e897388b06d4a00de6de60e536d91fab566",
+        "wx" : "1f5799c95be89063b24f26e40cb928c1a868a76fb0094607e8043db409c91c32",
+        "wy" : "00e75724e813a4191e3a839007f08e2e897388b06d4a00de6de60e536d91fab566"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200041f5799c95be89063b24f26e40cb928c1a868a76fb0094607e8043db409c91c32e75724e813a4191e3a839007f08e2e897388b06d4a00de6de60e536d91fab566",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEH1eZyVvokGOyTybkDLkowahop2+wCUYH\n6AQ9tAnJHDLnVyToE6QZHjqDkAfwji6Jc4iwbUoA3m3mDlNtkfq1Zg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 430,
+          "comment" : "extreme value for k and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5022049249249249249249249249249249248c79facd43214c011123c1b03a93412a5",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04a3331a4e1b4223ec2c027edd482c928a14ed358d93f1d4217d39abf69fcb5ccc28d684d2aaabcd6383775caa6239de26d4c6937bb603ecb4196082f4cffd509d",
+        "wx" : "00a3331a4e1b4223ec2c027edd482c928a14ed358d93f1d4217d39abf69fcb5ccc",
+        "wy" : "28d684d2aaabcd6383775caa6239de26d4c6937bb603ecb4196082f4cffd509d"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004a3331a4e1b4223ec2c027edd482c928a14ed358d93f1d4217d39abf69fcb5ccc28d684d2aaabcd6383775caa6239de26d4c6937bb603ecb4196082f4cffd509d",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEozMaThtCI+wsAn7dSCySihTtNY2T8dQh\nfTmr9p/LXMwo1oTSqqvNY4N3XKpiOd4m1MaTe7YD7LQZYIL0z/1QnQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 431,
+          "comment" : "extreme value for k",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee502200eb10e5ab95f2f275348d82ad2e4d7949c8193800d8c9c75df58e343f0ebba7b",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "043f3952199774c7cf39b38b66cb1042a6260d8680803845e4d433adba3bb248185ea495b68cbc7ed4173ee63c9042dc502625c7eb7e21fb02ca9a9114e0a3a18d",
+        "wx" : "3f3952199774c7cf39b38b66cb1042a6260d8680803845e4d433adba3bb24818",
+        "wy" : "5ea495b68cbc7ed4173ee63c9042dc502625c7eb7e21fb02ca9a9114e0a3a18d"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200043f3952199774c7cf39b38b66cb1042a6260d8680803845e4d433adba3bb248185ea495b68cbc7ed4173ee63c9042dc502625c7eb7e21fb02ca9a9114e0a3a18d",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEPzlSGZd0x885s4tmyxBCpiYNhoCAOEXk\n1DOtujuySBhepJW2jLx+1Bc+5jyQQtxQJiXH634h+wLKmpEU4KOhjQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 432,
+          "comment" : "extreme value for k and edgecase s",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022079be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798022055555555555555555555555555555554e8e4f44ce51835693ff0ca2ef01215c0",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04cdfb8c0f422e144e137c2412c86c171f5fe3fa3f5bbb544e9076288f3ced786e054fd0721b77c11c79beacb3c94211b0a19bda08652efeaf92513a3b0a163698",
+        "wx" : "00cdfb8c0f422e144e137c2412c86c171f5fe3fa3f5bbb544e9076288f3ced786e",
+        "wy" : "054fd0721b77c11c79beacb3c94211b0a19bda08652efeaf92513a3b0a163698"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004cdfb8c0f422e144e137c2412c86c171f5fe3fa3f5bbb544e9076288f3ced786e054fd0721b77c11c79beacb3c94211b0a19bda08652efeaf92513a3b0a163698",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEzfuMD0IuFE4TfCQSyGwXH1/j+j9bu1RO\nkHYojzzteG4FT9ByG3fBHHm+rLPJQhGwoZvaCGUu/q+SUTo7ChY2mA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 433,
+          "comment" : "extreme value for k and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022079be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798022049249249249249249249249249249248c79facd43214c011123c1b03a93412a5",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0473598a6a1c68278fa6bfd0ce4064e68235bc1c0f6b20a928108be336730f87e3cbae612519b5032ecc85aed811271a95fe7939d5d3460140ba318f4d14aba31d",
+        "wx" : "73598a6a1c68278fa6bfd0ce4064e68235bc1c0f6b20a928108be336730f87e3",
+        "wy" : "00cbae612519b5032ecc85aed811271a95fe7939d5d3460140ba318f4d14aba31d"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000473598a6a1c68278fa6bfd0ce4064e68235bc1c0f6b20a928108be336730f87e3cbae612519b5032ecc85aed811271a95fe7939d5d3460140ba318f4d14aba31d",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEc1mKahxoJ4+mv9DOQGTmgjW8HA9rIKko\nEIvjNnMPh+PLrmElGbUDLsyFrtgRJxqV/nk51dNGAUC6MY9NFKujHQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 434,
+          "comment" : "extreme value for k and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022079be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798022066666666666666666666666666666665e445f1f5dfb6a67e4cba8c385348e6e7",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0458debd9a7ee2c9d59132478a5440ae4d5d7ed437308369f92ea86c82183f10a16773e76f5edbf4da0e4f1bdffac0f57257e1dfa465842931309a24245fda6a5d",
+        "wx" : "58debd9a7ee2c9d59132478a5440ae4d5d7ed437308369f92ea86c82183f10a1",
+        "wy" : "6773e76f5edbf4da0e4f1bdffac0f57257e1dfa465842931309a24245fda6a5d"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000458debd9a7ee2c9d59132478a5440ae4d5d7ed437308369f92ea86c82183f10a16773e76f5edbf4da0e4f1bdffac0f57257e1dfa465842931309a24245fda6a5d",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEWN69mn7iydWRMkeKVECuTV1+1Dcwg2n5\nLqhsghg/EKFnc+dvXtv02g5PG9/6wPVyV+HfpGWEKTEwmiQkX9pqXQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 435,
+          "comment" : "extreme value for k and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022079be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798022066666666666666666666666666666665e445f1f5dfb6a67e4cba8c385348e6e7",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "048b904de47967340c5f8c3572a720924ef7578637feab1949acb241a5a6ac3f5b950904496f9824b1d63f3313bae21b89fae89afdfc811b5ece03fd5aa301864f",
+        "wx" : "008b904de47967340c5f8c3572a720924ef7578637feab1949acb241a5a6ac3f5b",
+        "wy" : "00950904496f9824b1d63f3313bae21b89fae89afdfc811b5ece03fd5aa301864f"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200048b904de47967340c5f8c3572a720924ef7578637feab1949acb241a5a6ac3f5b950904496f9824b1d63f3313bae21b89fae89afdfc811b5ece03fd5aa301864f",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEi5BN5HlnNAxfjDVypyCSTvdXhjf+qxlJ\nrLJBpaasP1uVCQRJb5gksdY/MxO64huJ+uia/fyBG17OA/1aowGGTw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 436,
+          "comment" : "extreme value for k and s^-1",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022079be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798022049249249249249249249249249249248c79facd43214c011123c1b03a93412a5",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04f4892b6d525c771e035f2a252708f3784e48238604b4f94dc56eaa1e546d941a346b1aa0bce68b1c50e5b52f509fb5522e5c25e028bc8f863402edb7bcad8b1b",
+        "wx" : "00f4892b6d525c771e035f2a252708f3784e48238604b4f94dc56eaa1e546d941a",
+        "wy" : "346b1aa0bce68b1c50e5b52f509fb5522e5c25e028bc8f863402edb7bcad8b1b"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004f4892b6d525c771e035f2a252708f3784e48238604b4f94dc56eaa1e546d941a346b1aa0bce68b1c50e5b52f509fb5522e5c25e028bc8f863402edb7bcad8b1b",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE9IkrbVJcdx4DXyolJwjzeE5II4YEtPlN\nxW6qHlRtlBo0axqgvOaLHFDltS9Qn7VSLlwl4Ci8j4Y0Au23vK2LGw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 437,
+          "comment" : "extreme value for k",
+          "flags" : [
+            "ArithmeticError"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022079be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f8179802200eb10e5ab95f2f275348d82ad2e4d7949c8193800d8c9c75df58e343f0ebba7b",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8",
+        "wx" : "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798",
+        "wy" : "483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEeb5mfvncu6xVoGKVzocLBwKb/NstzijZ\nWfKBWxb4F5hIOtp3JqPEZV2k+/wOEQio/Re0SKaFVBmcR9CP+xDUuA==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 438,
+          "comment" : "public key shares x-coordinate with generator",
+          "flags" : [
+            "PointDuplication"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca60502302202492492492492492492492492492492463cfd66a190a6008891e0d81d49a0952",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 439,
+          "comment" : "public key shares x-coordinate with generator",
+          "flags" : [
+            "PointDuplication"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022044a5ad0bd0636d9e12bc9e0a6bdd5e1bba77f523842193b3b82e448e05d5f11e02202492492492492492492492492492492463cfd66a190a6008891e0d81d49a0952",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798b7c52588d95c3b9aa25b0403f1eef75702e84bb7597aabe663b82f6f04ef2777",
+        "wx" : "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798",
+        "wy" : "00b7c52588d95c3b9aa25b0403f1eef75702e84bb7597aabe663b82f6f04ef2777"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798b7c52588d95c3b9aa25b0403f1eef75702e84bb7597aabe663b82f6f04ef2777",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEeb5mfvncu6xVoGKVzocLBwKb/NstzijZ\nWfKBWxb4F5i3xSWI2Vw7mqJbBAPx7vdXAuhLt1l6q+ZjuC9vBO8ndw==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 440,
+          "comment" : "public key shares x-coordinate with generator",
+          "flags" : [
+            "PointDuplication"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca60502302202492492492492492492492492492492463cfd66a190a6008891e0d81d49a0952",
+          "result" : "invalid"
+        },
+        {
+          "tcId" : 441,
+          "comment" : "public key shares x-coordinate with generator",
+          "flags" : [
+            "PointDuplication"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3044022044a5ad0bd0636d9e12bc9e0a6bdd5e1bba77f523842193b3b82e448e05d5f11e02202492492492492492492492492492492463cfd66a190a6008891e0d81d49a0952",
+          "result" : "invalid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04782c8ed17e3b2a783b5464f33b09652a71c678e05ec51e84e2bcfc663a3de963af9acb4280b8c7f7c42f4ef9aba6245ec1ec1712fd38a0fa96418d8cd6aa6152",
+        "wx" : "782c8ed17e3b2a783b5464f33b09652a71c678e05ec51e84e2bcfc663a3de963",
+        "wy" : "00af9acb4280b8c7f7c42f4ef9aba6245ec1ec1712fd38a0fa96418d8cd6aa6152"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004782c8ed17e3b2a783b5464f33b09652a71c678e05ec51e84e2bcfc663a3de963af9acb4280b8c7f7c42f4ef9aba6245ec1ec1712fd38a0fa96418d8cd6aa6152",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEeCyO0X47Kng7VGTzOwllKnHGeOBexR6E\n4rz8Zjo96WOvmstCgLjH98QvTvmrpiRewewXEv04oPqWQY2M1qphUg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 442,
+          "comment" : "pseudorandom signature",
+          "flags" : [
+            "ValidSignature"
+          ],
+          "msg" : "",
+          "sig" : "3045022100f80ae4f96cdbc9d853f83d47aae225bf407d51c56b7776cd67d0dc195d99a9dc02204cfc1d941e08cb9aceadde0f4ccead76b30d332fc442115d50e673e28686b70b",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 443,
+          "comment" : "pseudorandom signature",
+          "flags" : [
+            "ValidSignature"
+          ],
+          "msg" : "4d7367",
+          "sig" : "30440220109cd8ae0374358984a8249c0a843628f2835ffad1df1a9a69aa2fe72355545c02205390ff250ac4274e1cb25cd6ca6491f6b91281e32f5b264d87977aed4a94e77b",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 444,
+          "comment" : "pseudorandom signature",
+          "flags" : [
+            "ValidSignature"
+          ],
+          "msg" : "313233343030",
+          "sig" : "3045022100d035ee1f17fdb0b2681b163e33c359932659990af77dca632012b30b27a057b302201939d9f3b2858bc13e3474cb50e6a82be44faa71940f876c1cba4c3e989202b6",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 445,
+          "comment" : "pseudorandom signature",
+          "flags" : [
+            "ValidSignature"
+          ],
+          "msg" : "0000000000000000000000000000000000000000",
+          "sig" : "304402204f053f563ad34b74fd8c9934ce59e79c2eb8e6eca0fef5b323ca67d5ac7ed23802204d4b05daa0719e773d8617dce5631c5fd6f59c9bdc748e4b55c970040af01be5",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "046e823555452914099182c6b2c1d6f0b5d28d50ccd005af2ce1bba541aa40caff00000001060492d5a5673e0f25d8d50fb7e58c49d86d46d4216955e0aa3d40e1",
+        "wx" : "6e823555452914099182c6b2c1d6f0b5d28d50ccd005af2ce1bba541aa40caff",
+        "wy" : "01060492d5a5673e0f25d8d50fb7e58c49d86d46d4216955e0aa3d40e1"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200046e823555452914099182c6b2c1d6f0b5d28d50ccd005af2ce1bba541aa40caff00000001060492d5a5673e0f25d8d50fb7e58c49d86d46d4216955e0aa3d40e1",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEboI1VUUpFAmRgsaywdbwtdKNUMzQBa8s\n4bulQapAyv8AAAABBgSS1aVnPg8l2NUPt+WMSdhtRtQhaVXgqj1A4Q==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 446,
+          "comment" : "y-coordinate of the public key is small",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "304402206d6a4f556ccce154e7fb9f19e76c3deca13d59cc2aeb4ecad968aab2ded45965022053b9fa74803ede0fc4441bf683d56c564d3e274e09ccf47390badd1471c05fb7",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 447,
+          "comment" : "y-coordinate of the public key is small",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3044022100aad503de9b9fd66b948e9acf596f0a0e65e700b28b26ec56e6e45e846489b3c4021f0ddc3a2f89abb817bb85c062ce02f823c63fc26b269e0bc9b84d81a5aa123d",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 448,
+          "comment" : "y-coordinate of the public key is small",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "30450221009182cebd3bb8ab572e167174397209ef4b1d439af3b200cdf003620089e43225022054477c982ea019d2e1000497fc25fcee1bccae55f2ac27530ae53b29c4b356a4",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "046e823555452914099182c6b2c1d6f0b5d28d50ccd005af2ce1bba541aa40cafffffffffef9fb6d2a5a98c1f0da272af0481a73b62792b92bde96aa1e55c2bb4e",
+        "wx" : "6e823555452914099182c6b2c1d6f0b5d28d50ccd005af2ce1bba541aa40caff",
+        "wy" : "00fffffffef9fb6d2a5a98c1f0da272af0481a73b62792b92bde96aa1e55c2bb4e"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200046e823555452914099182c6b2c1d6f0b5d28d50ccd005af2ce1bba541aa40cafffffffffef9fb6d2a5a98c1f0da272af0481a73b62792b92bde96aa1e55c2bb4e",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEboI1VUUpFAmRgsaywdbwtdKNUMzQBa8s\n4bulQapAyv/////++fttKlqYwfDaJyrwSBpztieSuSvelqoeVcK7Tg==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 449,
+          "comment" : "y-coordinate of the public key is large",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "304402203854a3998aebdf2dbc28adac4181462ccac7873907ab7f212c42db0e69b56ed802203ed3f6b8a388d02f3e4df9f2ae9c1bd2c3916a686460dffcd42909cd7f82058e",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 450,
+          "comment" : "y-coordinate of the public key is large",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3045022100e94dbdc38795fe5c904d8f16d969d3b587f0a25d2de90b6d8c5c53ff887e360702207a947369c164972521bb8af406813b2d9f94d2aeaa53d4c215aaa0a2578a2c5d",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 451,
+          "comment" : "y-coordinate of the public key is large",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3044022049fc102a08ca47b60e0858cd0284d22cddd7233f94aaffbb2db1dd2cf08425e102205b16fca5a12cdb39701697ad8e39ffd6bdec0024298afaa2326aea09200b14d6",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04000000013fd22248d64d95f73c29b48ab48631850be503fd00f8468b5f0f70e0f6ee7aa43bc2c6fd25b1d8269241cbdd9dbb0dac96dc96231f430705f838717d",
+        "wx" : "013fd22248d64d95f73c29b48ab48631850be503fd00f8468b5f0f70e0",
+        "wy" : "00f6ee7aa43bc2c6fd25b1d8269241cbdd9dbb0dac96dc96231f430705f838717d"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004000000013fd22248d64d95f73c29b48ab48631850be503fd00f8468b5f0f70e0f6ee7aa43bc2c6fd25b1d8269241cbdd9dbb0dac96dc96231f430705f838717d",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEAAAAAT/SIkjWTZX3PCm0irSGMYUL5QP9\nAPhGi18PcOD27nqkO8LG/SWx2CaSQcvdnbsNrJbcliMfQwcF+DhxfQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 452,
+          "comment" : "x-coordinate of the public key is small",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3044022041efa7d3f05a0010675fcb918a45c693da4b348df21a59d6f9cd73e0d831d67a02204454ada693e5e26b7bd693236d340f80545c834577b6f73d378c7bcc534244da",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 453,
+          "comment" : "x-coordinate of the public key is small",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3045022100b615698c358b35920dd883eca625a6c5f7563970cdfc378f8fe0cee17092144c022025f47b326b5be1fb610b885153ea84d41eb4716be66a994e8779989df1c863d4",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 454,
+          "comment" : "x-coordinate of the public key is small",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "304502210087cf8c0eb82d44f69c60a2ff5457d3aaa322e7ec61ae5aecfd678ae1c1932b0e02203add3b115815047d6eb340a3e008989eaa0f8708d1794814729094d08d2460d3",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "0425afd689acabaed67c1f296de59406f8c550f57146a0b4ec2c97876dfffffffffa46a76e520322dfbc491ec4f0cc197420fc4ea5883d8f6dd53c354bc4f67c35",
+        "wx" : "25afd689acabaed67c1f296de59406f8c550f57146a0b4ec2c97876dffffffff",
+        "wy" : "00fa46a76e520322dfbc491ec4f0cc197420fc4ea5883d8f6dd53c354bc4f67c35"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a0342000425afd689acabaed67c1f296de59406f8c550f57146a0b4ec2c97876dfffffffffa46a76e520322dfbc491ec4f0cc197420fc4ea5883d8f6dd53c354bc4f67c35",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEJa/WiayrrtZ8Hylt5ZQG+MVQ9XFGoLTs\nLJeHbf/////6RqduUgMi37xJHsTwzBl0IPxOpYg9j23VPDVLxPZ8NQ==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 455,
+          "comment" : "x-coordinate of the public key has many trailing 1's",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3044022062f48ef71ace27bf5a01834de1f7e3f948b9dce1ca1e911d5e13d3b104471d8202205ea8f33f0c778972c4582080deda9b341857dd64514f0849a05f6964c2e34022",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 456,
+          "comment" : "x-coordinate of the public key has many trailing 1's",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3045022100f6b0e2f6fe020cf7c0c20137434344ed7add6c4be51861e2d14cbda472a6ffb402206416c8dd3e5c5282b306e8dc8ff34ab64cc99549232d678d714402eb6ca7aa0f",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 457,
+          "comment" : "x-coordinate of the public key has many trailing 1's",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3045022100db09d8460f05eff23bc7e436b67da563fa4b4edb58ac24ce201fa8a358125057022046da116754602940c8999c8d665f786c50f5772c0a3cdbda075e77eabc64df16",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "04d12e6c66b67734c3c84d2601cf5d35dc097e27637f0aca4a4fdb74b6aadd3bb93f5bdff88bd5736df898e699006ed750f11cf07c5866cd7ad70c7121ffffffff",
+        "wx" : "00d12e6c66b67734c3c84d2601cf5d35dc097e27637f0aca4a4fdb74b6aadd3bb9",
+        "wy" : "3f5bdff88bd5736df898e699006ed750f11cf07c5866cd7ad70c7121ffffffff"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a03420004d12e6c66b67734c3c84d2601cf5d35dc097e27637f0aca4a4fdb74b6aadd3bb93f5bdff88bd5736df898e699006ed750f11cf07c5866cd7ad70c7121ffffffff",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAE0S5sZrZ3NMPITSYBz1013Al+J2N/CspK\nT9t0tqrdO7k/W9/4i9VzbfiY5pkAbtdQ8RzwfFhmzXrXDHEh/////w==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 458,
+          "comment" : "y-coordinate of the public key has many trailing 1's",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "30440220592c41e16517f12fcabd98267674f974b588e9f35d35406c1a7bb2ed1d19b7b802203e65a06bd9f83caaeb7b00f2368d7e0dece6b12221269a9b5b765198f840a3a1",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 459,
+          "comment" : "y-coordinate of the public key has many trailing 1's",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3045022100be0d70887d5e40821a61b68047de4ea03debfdf51cdf4d4b195558b959a032b202207d994b2d8f1dbbeb13534eb3f6e5dccd85f5c4133c27d9e64271b1826ce1f67d",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 460,
+          "comment" : "y-coordinate of the public key has many trailing 1's",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3045022100fae92dfcb2ee392d270af3a5739faa26d4f97bfd39ed3cbee4d29e26af3b206a02206c9ba37f9faa6a1fd3f65f23b4e853d4692a7274240a12db7ba3884830630d16",
+          "result" : "valid"
+        }
+      ]
+    },
+    {
+      "type" : "EcdsaBitcoinVerify",
+      "publicKey" : {
+        "type" : "EcPublicKey",
+        "curve" : "secp256k1",
+        "keySize" : 256,
+        "uncompressed" : "046d4a7f60d4774a4f0aa8bbdedb953c7eea7909407e3164755664bc2800000000e659d34e4df38d9e8c9eaadfba36612c769195be86c77aac3f36e78b538680fb",
+        "wx" : "6d4a7f60d4774a4f0aa8bbdedb953c7eea7909407e3164755664bc2800000000",
+        "wy" : "00e659d34e4df38d9e8c9eaadfba36612c769195be86c77aac3f36e78b538680fb"
+      },
+      "publicKeyDer" : "3056301006072a8648ce3d020106052b8104000a034200046d4a7f60d4774a4f0aa8bbdedb953c7eea7909407e3164755664bc2800000000e659d34e4df38d9e8c9eaadfba36612c769195be86c77aac3f36e78b538680fb",
+      "publicKeyPem" : "-----BEGIN PUBLIC KEY-----\nMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEbUp/YNR3Sk8KqLve25U8fup5CUB+MWR1\nVmS8KAAAAADmWdNOTfONnoyeqt+6NmEsdpGVvobHeqw/NueLU4aA+w==\n-----END PUBLIC KEY-----\n",
+      "sha" : "SHA-256",
+      "tests" : [
+        {
+          "tcId" : 461,
+          "comment" : "x-coordinate of the public key has many trailing 0's",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "30440220176a2557566ffa518b11226694eb9802ed2098bfe278e5570fe1d5d7af18a94302201291df6a0ed5fc0d15098e70bcf13a009284dfd0689d3bb4be6ceeb9be1487c4",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 462,
+          "comment" : "x-coordinate of the public key has many trailing 0's",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3044022060be20c3dbc162dd34d26780621c104bbe5dace630171b2daef0d826409ee5c20220427f7e4d889d549170bda6a9409fb1cb8b0e763d13eea7bd97f64cf41dc6e497",
+          "result" : "valid"
+        },
+        {
+          "tcId" : 463,
+          "comment" : "x-coordinate of the public key has many trailing 0's",
+          "flags" : [
+            "EdgeCasePublicKey"
+          ],
+          "msg" : "4d657373616765",
+          "sig" : "3045022100edf03cf63f658883289a1a593d1007895b9f236d27c9c1f1313089aaed6b16ae02201a4dd6fc0814dc523d1fefa81c64fbf5e618e651e7096fccadbb94cd48e5e0cd",
+          "result" : "valid"
+        }
+      ]
+    }
+  ]
+}
diff --git a/secp256k1-sys/depend/secp256k1/tools/tests_wycheproof_generate.py b/secp256k1-sys/depend/secp256k1/tools/tests_wycheproof_generate.py
new file mode 100755
index 000000000..b26dfa89d
--- /dev/null
+++ b/secp256k1-sys/depend/secp256k1/tools/tests_wycheproof_generate.py
@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+# Copyright (c) 2023 Random "Randy" Lattice and Sean Andersen
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://www.opensource.org/licenses/mit-license.php.
+'''
+Generate a C file with ECDSA testvectors from the Wycheproof project.
+'''
+
+import json
+import sys
+
+filename_input = sys.argv[1]
+
+with open(filename_input) as f:
+    doc = json.load(f)
+
+num_groups = len(doc['testGroups'])
+
+def to_c_array(x):
+    if x == "":
+        return ""
+    s = ',0x'.join(a+b for a,b in zip(x[::2], x[1::2]))
+    return "0x" + s
+
+
+num_vectors = 0
+offset_msg_running, offset_pk_running, offset_sig = 0, 0, 0
+out = ""
+messages = ""
+signatures = ""
+public_keys = ""
+cache_msgs = {}
+cache_public_keys = {}
+
+for i in range(num_groups):
+    group = doc['testGroups'][i]
+    num_tests = len(group['tests'])
+    public_key = group['publicKey']
+    for j in range(num_tests):
+        test_vector = group['tests'][j]
+        # // 2 to convert hex to byte length
+        sig_size = len(test_vector['sig']) // 2
+        msg_size = len(test_vector['msg']) // 2
+
+        if test_vector['result'] == "invalid":
+            expected_verify = 0
+        elif test_vector['result'] == "valid":
+            expected_verify = 1
+        else:
+            raise ValueError("invalid result field")
+
+        if num_vectors != 0 and sig_size != 0:
+            signatures += ",\n  "
+
+        new_msg = False
+        msg = to_c_array(test_vector['msg'])
+        msg_offset = offset_msg_running
+        # check for repeated msg
+        if msg not in cache_msgs:
+            if num_vectors != 0 and msg_size != 0:
+                messages += ",\n  "
+            cache_msgs[msg] = offset_msg_running
+            messages += msg
+            new_msg = True
+        else:
+            msg_offset = cache_msgs[msg]
+
+        new_pk = False
+        pk = to_c_array(public_key['uncompressed'])
+        pk_offset = offset_pk_running
+        # check for repeated pk
+        if pk not in cache_public_keys:
+            if num_vectors != 0:
+                public_keys += ",\n  "
+            cache_public_keys[pk] = offset_pk_running
+            public_keys += pk
+            new_pk = True
+        else:
+            pk_offset = cache_public_keys[pk]
+
+        signatures += to_c_array(test_vector['sig'])
+
+        out += "  /" + "* tcId: " + str(test_vector['tcId']) + ". " + test_vector['comment'] + " *" + "/\n"
+        out += f"  {{{pk_offset}, {msg_offset}, {msg_size}, {offset_sig}, {sig_size}, {expected_verify} }},\n"
+        if new_msg:
+            offset_msg_running += msg_size
+        if new_pk:
+            offset_pk_running += 65
+        offset_sig += sig_size
+        num_vectors += 1
+
+struct_definition = """
+typedef struct {
+    size_t pk_offset;
+    size_t msg_offset;
+    size_t msg_len;
+    size_t sig_offset;
+    size_t sig_len;
+    int expected_verify;
+} wycheproof_ecdsa_testvector;
+"""
+
+
+print("/* Note: this file was autogenerated using tests_wycheproof_generate.py. Do not edit. */")
+print(f"#define SECP256K1_ECDSA_WYCHEPROOF_NUMBER_TESTVECTORS ({num_vectors})")
+
+print(struct_definition)
+
+print("static const unsigned char wycheproof_ecdsa_messages[]    = { " + messages + "};\n")
+print("static const unsigned char wycheproof_ecdsa_public_keys[] = { " + public_keys + "};\n")
+print("static const unsigned char wycheproof_ecdsa_signatures[]  = { " + signatures + "};\n")
+
+print("static const wycheproof_ecdsa_testvector testvectors[SECP256K1_ECDSA_WYCHEPROOF_NUMBER_TESTVECTORS] = {")
+print(out)
+print("};")
diff --git a/secp256k1-sys/depend/util.h.patch b/secp256k1-sys/depend/util.h.patch
index 92731c741..59b23e0df 100644
--- a/secp256k1-sys/depend/util.h.patch
+++ b/secp256k1-sys/depend/util.h.patch
@@ -1,17 +1,6 @@
-71,86d70
-< static SECP256K1_INLINE void *checked_malloc(const secp256k1_callback* cb, size_t size) {
-<     void *ret = malloc(size);
-<     if (ret == NULL) {
-<         secp256k1_callback_call(cb, "Out of memory");
-<     }
-<     return ret;
-< }
-< 
-< static SECP256K1_INLINE void *checked_realloc(const secp256k1_callback* cb, void *ptr, size_t size) {
-<     void *ret = realloc(ptr, size);
-<     if (ret == NULL) {
-<         secp256k1_callback_call(cb, "Out of memory");
-<     }
-<     return ret;
-< }
+10c10,12
 < 
+---
+> extern int secp256k1_ecdsa_signature_parse_compact(
+>         const secp256k1_context *ctx,
+>         secp256k1_ecdsa_signature *sig, const unsigned char *input64);
diff --git a/secp256k1-sys/src/lib.rs b/secp256k1-sys/src/lib.rs
index d7ea4da98..7aa2834a4 100644
--- a/secp256k1-sys/src/lib.rs
+++ b/secp256k1-sys/src/lib.rs
@@ -519,83 +519,83 @@ impl core::hash::Hash for Keypair {
 
 extern "C" {
     /// Default ECDH hash function
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdh_hash_function_default")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdh_hash_function_default")]
     pub static secp256k1_ecdh_hash_function_default: EcdhHashFn;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_nonce_function_rfc6979")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_nonce_function_rfc6979")]
     pub static secp256k1_nonce_function_rfc6979: NonceFn;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_nonce_function_default")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_nonce_function_default")]
     pub static secp256k1_nonce_function_default: NonceFn;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_nonce_function_bip340")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_nonce_function_bip340")]
     pub static secp256k1_nonce_function_bip340: SchnorrNonceFn;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_context_no_precomp")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_context_no_precomp")]
     pub static secp256k1_context_no_precomp: *const Context;
 
     // Contexts
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_context_preallocated_destroy")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_context_preallocated_destroy")]
     pub fn secp256k1_context_preallocated_destroy(cx: NonNull<Context>);
 
     // Signatures
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_signature_parse_der")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_signature_parse_der")]
     pub fn secp256k1_ecdsa_signature_parse_der(cx: *const Context, sig: *mut Signature,
                                                input: *const c_uchar, in_len: size_t)
                                                -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_signature_parse_compact")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_signature_parse_compact")]
     pub fn secp256k1_ecdsa_signature_parse_compact(cx: *const Context, sig: *mut Signature,
                                                    input64: *const c_uchar)
                                                    -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_signature_parse_der_lax")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_signature_parse_der_lax")]
     pub fn ecdsa_signature_parse_der_lax(cx: *const Context, sig: *mut Signature,
                                          input: *const c_uchar, in_len: size_t)
                                          -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_signature_serialize_der")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_signature_serialize_der")]
     pub fn secp256k1_ecdsa_signature_serialize_der(cx: *const Context, output: *mut c_uchar,
                                                    out_len: *mut size_t, sig: *const Signature)
                                                    -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_signature_serialize_compact")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_signature_serialize_compact")]
     pub fn secp256k1_ecdsa_signature_serialize_compact(cx: *const Context, output64: *mut c_uchar,
                                                        sig: *const Signature)
                                                        -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_signature_normalize")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_signature_normalize")]
     pub fn secp256k1_ecdsa_signature_normalize(cx: *const Context, out_sig: *mut Signature,
                                                in_sig: *const Signature)
                                                -> c_int;
 
     // Secret Keys
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_seckey_verify")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_seckey_verify")]
     pub fn secp256k1_ec_seckey_verify(cx: *const Context,
                                       sk: *const c_uchar) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_seckey_negate")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_seckey_negate")]
     pub fn secp256k1_ec_seckey_negate(cx: *const Context,
                                       sk: *mut c_uchar) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_seckey_tweak_add")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_seckey_tweak_add")]
     pub fn secp256k1_ec_seckey_tweak_add(cx: *const Context,
                                         sk: *mut c_uchar,
                                         tweak: *const c_uchar)
                                         -> c_int;
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_seckey_tweak_mul")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_seckey_tweak_mul")]
     pub fn secp256k1_ec_seckey_tweak_mul(cx: *const Context,
                                         sk: *mut c_uchar,
                                         tweak: *const c_uchar)
                                         -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_keypair_sec")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_keypair_sec")]
     pub fn secp256k1_keypair_sec(cx: *const Context,
                                  output_seckey: *mut c_uchar,
                                  keypair: *const Keypair)
                                  -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_keypair_pub")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_keypair_pub")]
     pub fn secp256k1_keypair_pub(cx: *const Context,
                                  output_pubkey: *mut PublicKey,
                                  keypair: *const Keypair)
@@ -605,71 +605,71 @@ extern "C" {
 #[cfg(not(secp256k1_fuzz))]
 extern "C" {
     // Contexts
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_context_preallocated_size")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_context_preallocated_size")]
     pub fn secp256k1_context_preallocated_size(flags: c_uint) -> size_t;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_context_preallocated_create")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_context_preallocated_create")]
     pub fn secp256k1_context_preallocated_create(prealloc: NonNull<c_void>, flags: c_uint) -> NonNull<Context>;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_context_preallocated_clone_size")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_context_preallocated_clone_size")]
     pub fn secp256k1_context_preallocated_clone_size(cx: *const Context) -> size_t;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_context_preallocated_clone")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_context_preallocated_clone")]
     pub fn secp256k1_context_preallocated_clone(cx: *const Context, prealloc: NonNull<c_void>) -> NonNull<Context>;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_context_randomize")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_context_randomize")]
     pub fn secp256k1_context_randomize(cx: NonNull<Context>,
                                        seed32: *const c_uchar)
                                        -> c_int;
     // Pubkeys
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_pubkey_parse")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_pubkey_parse")]
     pub fn secp256k1_ec_pubkey_parse(cx: *const Context, pk: *mut PublicKey,
                                      input: *const c_uchar, in_len: size_t)
                                      -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_pubkey_serialize")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_pubkey_serialize")]
     pub fn secp256k1_ec_pubkey_serialize(cx: *const Context, output: *mut c_uchar,
                                          out_len: *mut size_t, pk: *const PublicKey,
                                          compressed: c_uint)
                                          -> c_int;
 
     // EC
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_pubkey_create")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_pubkey_create")]
     pub fn secp256k1_ec_pubkey_create(cx: *const Context, pk: *mut PublicKey,
                                       sk: *const c_uchar) -> c_int;
 
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_pubkey_negate")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_pubkey_negate")]
     pub fn secp256k1_ec_pubkey_negate(cx: *const Context,
                                       pk: *mut PublicKey) -> c_int;
 
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_pubkey_cmp")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_pubkey_cmp")]
     pub fn secp256k1_ec_pubkey_cmp(cx: *const Context,
                                    pubkey1: *const PublicKey,
                                    pubkey2: *const PublicKey)
                                    -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_pubkey_tweak_add")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_pubkey_tweak_add")]
     pub fn secp256k1_ec_pubkey_tweak_add(cx: *const Context,
                                          pk: *mut PublicKey,
                                          tweak: *const c_uchar)
                                          -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_pubkey_tweak_mul")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_pubkey_tweak_mul")]
     pub fn secp256k1_ec_pubkey_tweak_mul(cx: *const Context,
                                          pk: *mut PublicKey,
                                          tweak: *const c_uchar)
                                          -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ec_pubkey_combine")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ec_pubkey_combine")]
     pub fn secp256k1_ec_pubkey_combine(cx: *const Context,
                                        out: *mut PublicKey,
                                        ins: *const *const PublicKey,
                                        n: c_int)
                                        -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdh")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdh")]
     pub fn secp256k1_ecdh(
         cx: *const Context,
         output: *mut c_uchar,
@@ -680,14 +680,14 @@ extern "C" {
     ) -> c_int;
 
     // ECDSA
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_verify")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_verify")]
     pub fn secp256k1_ecdsa_verify(cx: *const Context,
                                   sig: *const Signature,
                                   msg32: *const c_uchar,
                                   pk: *const PublicKey)
                                   -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_sign")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_sign")]
     pub fn secp256k1_ecdsa_sign(cx: *const Context,
                                 sig: *mut Signature,
                                 msg32: *const c_uchar,
@@ -697,7 +697,7 @@ extern "C" {
                                 -> c_int;
 
     // Schnorr Signatures
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_schnorrsig_sign")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_schnorrsig_sign")]
     pub fn secp256k1_schnorrsig_sign(
         cx: *const Context,
         sig: *mut c_uchar,
@@ -707,7 +707,7 @@ extern "C" {
     ) -> c_int;
 
     // Schnorr Signatures with extra parameters (see [`SchnorrSigExtraParams`])
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_schnorrsig_sign_custom")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_schnorrsig_sign_custom")]
     pub fn secp256k1_schnorrsig_sign_custom(
         cx: *const Context,
         sig: *mut c_uchar,
@@ -717,7 +717,7 @@ extern "C" {
         extra_params: *const SchnorrSigExtraParams,
     ) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_schnorrsig_verify")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_schnorrsig_verify")]
     pub fn secp256k1_schnorrsig_verify(
         cx: *const Context,
         sig64: *const c_uchar,
@@ -727,28 +727,28 @@ extern "C" {
     ) -> c_int;
 
     // Extra keys
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_keypair_create")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_keypair_create")]
     pub fn secp256k1_keypair_create(
         cx: *const Context,
         keypair: *mut Keypair,
         seckey: *const c_uchar,
     ) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_xonly_pubkey_parse")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_xonly_pubkey_parse")]
     pub fn secp256k1_xonly_pubkey_parse(
         cx: *const Context,
         pubkey: *mut XOnlyPublicKey,
         input32: *const c_uchar,
     ) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_xonly_pubkey_serialize")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_xonly_pubkey_serialize")]
     pub fn secp256k1_xonly_pubkey_serialize(
         cx: *const Context,
         output32: *mut c_uchar,
         pubkey: *const XOnlyPublicKey,
     ) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_xonly_pubkey_from_pubkey")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_xonly_pubkey_from_pubkey")]
     pub fn secp256k1_xonly_pubkey_from_pubkey(
         cx: *const Context,
         xonly_pubkey: *mut XOnlyPublicKey,
@@ -756,14 +756,14 @@ extern "C" {
         pubkey: *const PublicKey,
     ) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_xonly_pubkey_cmp")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_xonly_pubkey_cmp")]
     pub fn secp256k1_xonly_pubkey_cmp(
         cx: *const Context,
         pubkey1: *const XOnlyPublicKey,
         pubkey2: *const XOnlyPublicKey
     ) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add")]
     pub fn secp256k1_xonly_pubkey_tweak_add(
         cx: *const Context,
         output_pubkey: *mut PublicKey,
@@ -771,7 +771,7 @@ extern "C" {
         tweak32: *const c_uchar,
     ) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_keypair_xonly_pub")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_keypair_xonly_pub")]
     pub fn secp256k1_keypair_xonly_pub(
         cx: *const Context,
         pubkey: *mut XOnlyPublicKey,
@@ -779,14 +779,14 @@ extern "C" {
         keypair: *const Keypair
     ) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_keypair_xonly_tweak_add")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_keypair_xonly_tweak_add")]
     pub fn secp256k1_keypair_xonly_tweak_add(
         cx: *const Context,
         keypair: *mut Keypair,
         tweak32: *const c_uchar,
     ) -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_xonly_pubkey_tweak_add_check")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_xonly_pubkey_tweak_add_check")]
     pub fn secp256k1_xonly_pubkey_tweak_add_check(
         cx: *const Context,
         tweaked_pubkey32: *const c_uchar,
@@ -813,7 +813,7 @@ extern "C" {
 /// The newly created secp256k1 raw context.
 #[cfg(all(feature = "alloc", not(rust_secp_no_symbol_renaming)))]
 pub unsafe fn secp256k1_context_create(flags: c_uint) -> NonNull<Context> {
-    rustsecp256k1_v0_8_1_context_create(flags)
+    rustsecp256k1_v0_9_0_context_create(flags)
 }
 
 /// A reimplementation of the C function `secp256k1_context_create` in rust.
@@ -822,7 +822,7 @@ pub unsafe fn secp256k1_context_create(flags: c_uint) -> NonNull<Context> {
 #[no_mangle]
 #[allow(clippy::missing_safety_doc)] // Documented above.
 #[cfg(all(feature = "alloc", not(rust_secp_no_symbol_renaming)))]
-pub unsafe extern "C" fn rustsecp256k1_v0_8_1_context_create(flags: c_uint) -> NonNull<Context> {
+pub unsafe extern "C" fn rustsecp256k1_v0_9_0_context_create(flags: c_uint) -> NonNull<Context> {
     use core::mem;
     use crate::alloc::alloc;
     assert!(ALIGN_TO >= mem::align_of::<usize>());
@@ -855,13 +855,13 @@ pub unsafe extern "C" fn rustsecp256k1_v0_8_1_context_create(flags: c_uint) -> N
 ///  `ctx` must be a valid pointer to a block of memory created using [`secp256k1_context_create`].
 #[cfg(all(feature = "alloc", not(rust_secp_no_symbol_renaming)))]
 pub unsafe fn secp256k1_context_destroy(ctx: NonNull<Context>) {
-    rustsecp256k1_v0_8_1_context_destroy(ctx)
+    rustsecp256k1_v0_9_0_context_destroy(ctx)
 }
 
 #[no_mangle]
 #[allow(clippy::missing_safety_doc)] // Documented above.
 #[cfg(all(feature = "alloc", not(rust_secp_no_symbol_renaming)))]
-pub unsafe extern "C" fn rustsecp256k1_v0_8_1_context_destroy(mut ctx: NonNull<Context>) {
+pub unsafe extern "C" fn rustsecp256k1_v0_9_0_context_destroy(mut ctx: NonNull<Context>) {
     use crate::alloc::alloc;
     secp256k1_context_preallocated_destroy(ctx);
     let ctx: *mut Context = ctx.as_mut();
@@ -897,7 +897,7 @@ pub unsafe extern "C" fn rustsecp256k1_v0_8_1_context_destroy(mut ctx: NonNull<C
 /// For exact safety constraints see [`std::slice::from_raw_parts`] and [`std::str::from_utf8_unchecked`].
 #[no_mangle]
 #[cfg(not(rust_secp_no_symbol_renaming))]
-pub unsafe extern "C" fn rustsecp256k1_v0_8_1_default_illegal_callback_fn(message: *const c_char, _data: *mut c_void) {
+pub unsafe extern "C" fn rustsecp256k1_v0_9_0_default_illegal_callback_fn(message: *const c_char, _data: *mut c_void) {
     use core::str;
     let msg_slice = slice::from_raw_parts(message as *const u8, strlen(message));
     let msg = str::from_utf8_unchecked(msg_slice);
@@ -925,7 +925,7 @@ pub unsafe extern "C" fn rustsecp256k1_v0_8_1_default_illegal_callback_fn(messag
 /// For exact safety constraints see [`std::slice::from_raw_parts`] and [`std::str::from_utf8_unchecked`].
 #[no_mangle]
 #[cfg(not(rust_secp_no_symbol_renaming))]
-pub unsafe extern "C" fn rustsecp256k1_v0_8_1_default_error_callback_fn(message: *const c_char, _data: *mut c_void) {
+pub unsafe extern "C" fn rustsecp256k1_v0_9_0_default_error_callback_fn(message: *const c_char, _data: *mut c_void) {
     use core::str;
     let msg_slice = slice::from_raw_parts(message as *const u8, strlen(message));
     let msg = str::from_utf8_unchecked(msg_slice);
@@ -987,9 +987,9 @@ mod fuzz_dummy {
     #[cfg(rust_secp_no_symbol_renaming)] compile_error!("We do not support fuzzing with rust_secp_no_symbol_renaming");
 
     extern "C" {
-        fn rustsecp256k1_v0_8_1_context_preallocated_size(flags: c_uint) -> size_t;
-        fn rustsecp256k1_v0_8_1_context_preallocated_create(prealloc: NonNull<c_void>, flags: c_uint) -> NonNull<Context>;
-        fn rustsecp256k1_v0_8_1_context_preallocated_clone(cx: *const Context, prealloc: NonNull<c_void>) -> NonNull<Context>;
+        fn rustsecp256k1_v0_9_0_context_preallocated_size(flags: c_uint) -> size_t;
+        fn rustsecp256k1_v0_9_0_context_preallocated_create(prealloc: NonNull<c_void>, flags: c_uint) -> NonNull<Context>;
+        fn rustsecp256k1_v0_9_0_context_preallocated_clone(cx: *const Context, prealloc: NonNull<c_void>) -> NonNull<Context>;
     }
 
     #[cfg(feature = "lowmemory")]
@@ -998,7 +998,7 @@ mod fuzz_dummy {
     const CTX_SIZE: usize = 1024 * (1024 + 128);
     // Contexts
     pub unsafe fn secp256k1_context_preallocated_size(flags: c_uint) -> size_t {
-        assert!(rustsecp256k1_v0_8_1_context_preallocated_size(flags) + std::mem::size_of::<c_uint>() <= CTX_SIZE);
+        assert!(rustsecp256k1_v0_9_0_context_preallocated_size(flags) + std::mem::size_of::<c_uint>() <= CTX_SIZE);
         CTX_SIZE
     }
 
@@ -1018,8 +1018,8 @@ mod fuzz_dummy {
             if have_ctx == HAVE_CONTEXT_NONE {
                 have_ctx = HAVE_PREALLOCATED_CONTEXT.swap(HAVE_CONTEXT_WORKING, Ordering::AcqRel);
                 if have_ctx == HAVE_CONTEXT_NONE {
-                    assert!(rustsecp256k1_v0_8_1_context_preallocated_size(SECP256K1_START_SIGN | SECP256K1_START_VERIFY) + std::mem::size_of::<c_uint>() <= CTX_SIZE);
-                    assert_eq!(rustsecp256k1_v0_8_1_context_preallocated_create(
+                    assert!(rustsecp256k1_v0_9_0_context_preallocated_size(SECP256K1_START_SIGN | SECP256K1_START_VERIFY) + std::mem::size_of::<c_uint>() <= CTX_SIZE);
+                    assert_eq!(rustsecp256k1_v0_9_0_context_preallocated_create(
                             NonNull::new_unchecked(PREALLOCATED_CONTEXT[..].as_mut_ptr() as *mut c_void),
                             SECP256K1_START_SIGN | SECP256K1_START_VERIFY),
                         NonNull::new_unchecked(PREALLOCATED_CONTEXT[..].as_mut_ptr() as *mut Context));
@@ -1048,7 +1048,7 @@ mod fuzz_dummy {
         let new_ptr = (prealloc.as_ptr() as *mut u8).add(CTX_SIZE).sub(std::mem::size_of::<c_uint>());
         let flags = (orig_ptr as *mut c_uint).read();
         (new_ptr as *mut c_uint).write(flags);
-        rustsecp256k1_v0_8_1_context_preallocated_clone(cx, prealloc)
+        rustsecp256k1_v0_9_0_context_preallocated_clone(cx, prealloc)
     }
 
     pub unsafe fn secp256k1_context_randomize(cx: NonNull<Context>,
diff --git a/secp256k1-sys/src/recovery.rs b/secp256k1-sys/src/recovery.rs
index 85db59e18..fb1d70de2 100644
--- a/secp256k1-sys/src/recovery.rs
+++ b/secp256k1-sys/src/recovery.rs
@@ -100,17 +100,17 @@ impl core::hash::Hash for RecoverableSignature {
 }
 
 extern "C" {
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_parse_compact")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_parse_compact")]
     pub fn secp256k1_ecdsa_recoverable_signature_parse_compact(cx: *const Context, sig: *mut RecoverableSignature,
                                                                input64: *const c_uchar, recid: c_int)
                                                                -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_serialize_compact")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_serialize_compact")]
     pub fn secp256k1_ecdsa_recoverable_signature_serialize_compact(cx: *const Context, output64: *mut c_uchar,
                                                                    recid: *mut c_int, sig: *const RecoverableSignature)
                                                                    -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_recoverable_signature_convert")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_recoverable_signature_convert")]
     pub fn secp256k1_ecdsa_recoverable_signature_convert(cx: *const Context, sig: *mut Signature,
                                                          input: *const RecoverableSignature)
                                                          -> c_int;
@@ -118,7 +118,7 @@ extern "C" {
 
 #[cfg(not(secp256k1_fuzz))]
 extern "C" {
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_sign_recoverable")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_sign_recoverable")]
     pub fn secp256k1_ecdsa_sign_recoverable(cx: *const Context,
                                             sig: *mut RecoverableSignature,
                                             msg32: *const c_uchar,
@@ -127,7 +127,7 @@ extern "C" {
                                             noncedata: *const c_void)
                                             -> c_int;
 
-    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_8_1_ecdsa_recover")]
+    #[cfg_attr(not(rust_secp_no_symbol_renaming), link_name = "rustsecp256k1_v0_9_0_ecdsa_recover")]
     pub fn secp256k1_ecdsa_recover(cx: *const Context,
                                    pk: *mut PublicKey,
                                    sig: *const RecoverableSignature,
diff --git a/secp256k1-sys/vendor-libsecp.sh b/secp256k1-sys/vendor-libsecp.sh
index 1c84c8c27..ed437fc07 100755
--- a/secp256k1-sys/vendor-libsecp.sh
+++ b/secp256k1-sys/vendor-libsecp.sh
@@ -99,6 +99,9 @@ patch "$DIR/src/secp256k1.c" "./secp256k1.c.patch"
 patch "$DIR/src/scratch_impl.h" "./scratch_impl.h.patch"
 patch "$DIR/src/util.h" "./util.h.patch"
 
+# Fix a linking error while cross-compiling to windowns with mingw
+patch "$DIR/contrib/lax_der_parsing.c" "./lax_der_parsing.c.patch"
+
 # Prefix all methods with rustsecp and a version prefix
 find "$DIR" \
     -not -path '*/\.*' \