1. fe_batch_inverse: handle zero inputs gracefully by substituting ones
during forward accumulation and restoring zeros in output. Prevents
undefined behavior when callers pass zero-valued field elements.
Added test_batch_inverse_zero_safe covering mixed, all-zero, and
single-zero cases. (CT paths in ct_point.cpp unchanged — documented
preconditions only.)
2. 4-stream WNAF (ESP32/STM32): fixed phi(G) sign — use k2_neg directly
instead of k1_neg XOR k2_neg. G tables are precomputed without any
sign baked in, unlike P tables where k1_neg is absorbed into P_base.
Re-enabled the previously disabled code path.
3. OpenMP: added conditional OpenMP support for fe_h_based_inversion_batched.
find_package(OpenMP QUIET) in CMakeLists.txt with ESP32/WASM exclusion.
Static libgomp.a resolution for ARM64 cross-compilation.
4. MuSig2 key aggregation: validate ALL pubkeys upfront before computing
anything. Previously, invalid pubkeys were silently skipped via continue,
enabling potential rogue key attacks. Now returns empty ctx (Q=infinity)
if any pubkey is invalid.
Tested on x86_64 (25/25), ARM64 RK3588 (25/25), RISC-V VisionFive2 (25/25).
No benchmark regressions detected.
2f3051282c