Update secp256k1 subtree to latest master

20 files changed, 596 insertions, 494 deletions

diff --git a/src/secp256k1/.cirrus.yml b/src/secp256k1/.cirrus.yml
index 6e77403bf5..4bd15511a4 100644
--- a/src/secp256k1/.cirrus.yml
+++ b/src/secp256k1/.cirrus.yml
@@ -10,8 +10,8 @@ env:
   MAKEFLAGS: -j4
   BUILD: check
   ### secp256k1 config
-  ECMULTWINDOW: auto
-  ECMULTGENKB: auto
+  ECMULTWINDOW: 15
+  ECMULTGENKB: 22
   ASM: no
   WIDEMUL: auto
   WITH_VALGRIND: yes
diff --git a/src/secp256k1/.github/workflows/ci.yml b/src/secp256k1/.github/workflows/ci.yml
index d246682044..ade94e1eec 100644
--- a/src/secp256k1/.github/workflows/ci.yml
+++ b/src/secp256k1/.github/workflows/ci.yml
@@ -21,8 +21,8 @@ env:
   MAKEFLAGS: '-j4'
   BUILD: 'check'
   ### secp256k1 config
-  ECMULTWINDOW: 'auto'
-  ECMULTGENKB: 'auto'
+  ECMULTWINDOW: 15
+  ECMULTGENKB: 22
   ASM: 'no'
   WIDEMUL: 'auto'
   WITH_VALGRIND: 'yes'
@@ -485,18 +485,24 @@ jobs:
       matrix:
         configuration:
           - env_vars:
+              CTIMETESTS: 'yes'
               CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -g'
           - env_vars:
               ECMULTGENKB: 2
               ECMULTWINDOW: 2
+              CTIMETESTS: 'yes'
               CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -g -O3'
+          - env_vars:
+              # -fsanitize-memory-param-retval is clang's default, but our build system disables it
+              # when ctime_tests when enabled.
+              CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -fsanitize-memory-param-retval -g'
+              CTIMETESTS: 'no'
 
     env:
       ECDH: 'yes'
       RECOVERY: 'yes'
       SCHNORRSIG: 'yes'
       ELLSWIFT: 'yes'
-      CTIMETESTS: 'yes'
       CC: 'clang'
       SECP256K1_TEST_ITERS: 32
       ASM: 'no'
@@ -585,10 +591,10 @@ jobs:
         run: env
         if: ${{ always() }}
 
-  macos-native:
-    name: "x86_64: macOS Monterey"
+  x86_64-macos-native:
+    name: "x86_64: macOS Monterey, Valgrind"
     # See: https://github.com/actions/runner-images#available-images.
-    runs-on: macos-12 # Use M1 once available https://github.com/github/roadmap/issues/528
+    runs-on: macos-12
 
     env:
       CC: 'clang'
@@ -644,6 +650,62 @@ jobs:
         run: env
         if: ${{ always() }}
 
+  arm64-macos-native:
+    name: "ARM64: macOS Sonoma"
+    # See: https://github.com/actions/runner-images#available-images.
+    runs-on: macos-14
+
+    env:
+      CC: 'clang'
+      HOMEBREW_NO_AUTO_UPDATE: 1
+      HOMEBREW_NO_INSTALL_CLEANUP: 1
+      WITH_VALGRIND: 'no'
+      CTIMETESTS: 'no'
+
+    strategy:
+      fail-fast: false
+      matrix:
+        env_vars:
+          - { WIDEMUL: 'int64',  RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
+          - { WIDEMUL: 'int128_struct', ECMULTGENPRECISION: 2, ECMULTWINDOW: 4 }
+          - { WIDEMUL: 'int128',                  ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes' }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CC: 'gcc' }
+          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CPPFLAGS: '-DVERIFY' }
+          - BUILD: 'distcheck'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Homebrew packages
+        run: |
+          brew install automake libtool gcc
+          ln -s $(brew --prefix gcc)/bin/gcc-?? /usr/local/bin/gcc
+
+      - name: CI script
+        env: ${{ matrix.env_vars }}
+        run: ./ci/ci.sh
+
+      - run: cat tests.log || true
+        if: ${{ always() }}
+      - run: cat noverify_tests.log || true
+        if: ${{ always() }}
+      - run: cat exhaustive_tests.log || true
+        if: ${{ always() }}
+      - run: cat ctime_tests.log || true
+        if: ${{ always() }}
+      - run: cat bench.log || true
+        if: ${{ always() }}
+      - run: cat config.log || true
+        if: ${{ always() }}
+      - run: cat test_env.log || true
+        if: ${{ always() }}
+      - name: CI env
+        run: env
+        if: ${{ always() }}
+
   win64-native:
     name: ${{ matrix.configuration.job_name }}
     # See: https://github.com/actions/runner-images#available-images.
diff --git a/src/secp256k1/CMakeLists.txt b/src/secp256k1/CMakeLists.txt
index 88994d828a..7e3465a75b 100644
--- a/src/secp256k1/CMakeLists.txt
+++ b/src/secp256k1/CMakeLists.txt
@@ -18,15 +18,14 @@ project(libsecp256k1
 )
 
 if(CMAKE_VERSION VERSION_LESS 3.21)
-  get_directory_property(parent_directory PARENT_DIRECTORY)
-  if(parent_directory)
-    set(PROJECT_IS_TOP_LEVEL OFF CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
-    set(${PROJECT_NAME}_IS_TOP_LEVEL OFF CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+  # Emulates CMake 3.21+ behavior.
+  if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
+    set(PROJECT_IS_TOP_LEVEL ON)
+    set(${PROJECT_NAME}_IS_TOP_LEVEL ON)
   else()
-    set(PROJECT_IS_TOP_LEVEL ON CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
-    set(${PROJECT_NAME}_IS_TOP_LEVEL ON CACHE INTERNAL "Emulates CMake 3.21+ behavior.")
+    set(PROJECT_IS_TOP_LEVEL OFF)
+    set(${PROJECT_NAME}_IS_TOP_LEVEL OFF)
   endif()
-  unset(parent_directory)
 endif()
 
 # The library version is based on libtool versioning of the ABI. The set of
@@ -92,21 +91,15 @@ if(SECP256K1_USE_EXTERNAL_DEFAULT_CALLBACKS)
   add_compile_definitions(USE_EXTERNAL_DEFAULT_CALLBACKS=1)
 endif()
 
-set(SECP256K1_ECMULT_WINDOW_SIZE "AUTO" CACHE STRING "Window size for ecmult precomputation for verification, specified as integer in range [2..24]. \"AUTO\" is a reasonable setting for desktop machines (currently 15). [default=AUTO]")
-set_property(CACHE SECP256K1_ECMULT_WINDOW_SIZE PROPERTY STRINGS "AUTO" 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24)
+set(SECP256K1_ECMULT_WINDOW_SIZE 15 CACHE STRING "Window size for ecmult precomputation for verification, specified as integer in range [2..24]. The default value is a reasonable setting for desktop machines (currently 15). [default=15]")
+set_property(CACHE SECP256K1_ECMULT_WINDOW_SIZE PROPERTY STRINGS 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24)
 include(CheckStringOptionValue)
 check_string_option_value(SECP256K1_ECMULT_WINDOW_SIZE)
-if(SECP256K1_ECMULT_WINDOW_SIZE STREQUAL "AUTO")
-  set(SECP256K1_ECMULT_WINDOW_SIZE 15)
-endif()
 add_compile_definitions(ECMULT_WINDOW_SIZE=${SECP256K1_ECMULT_WINDOW_SIZE})
 
-set(SECP256K1_ECMULT_GEN_KB "AUTO" CACHE STRING "The size of the precomputed table for signing in multiples of 1024 bytes (on typical platforms). Larger values result in possibly better signing or key generation performance at the cost of a larger table. Valid choices are 2, 22, 86. \"AUTO\" is a reasonable setting for desktop machines (currently 22). [default=AUTO]")
-set_property(CACHE SECP256K1_ECMULT_GEN_KB PROPERTY STRINGS "AUTO" 2 22 86)
+set(SECP256K1_ECMULT_GEN_KB 22 CACHE STRING "The size of the precomputed table for signing in multiples of 1024 bytes (on typical platforms). Larger values result in possibly better signing or key generation performance at the cost of a larger table. Valid choices are 2, 22, 86. The default value is a reasonable setting for desktop machines (currently 22). [default=22]")
+set_property(CACHE SECP256K1_ECMULT_GEN_KB PROPERTY STRINGS 2 22 86)
 check_string_option_value(SECP256K1_ECMULT_GEN_KB)
-if(SECP256K1_ECMULT_GEN_KB STREQUAL "AUTO")
-  set(SECP256K1_ECMULT_GEN_KB 22)
-endif()
 if(SECP256K1_ECMULT_GEN_KB EQUAL 2)
   add_compile_definitions(COMB_BLOCKS=2)
   add_compile_definitions(COMB_TEETH=5)
@@ -214,23 +207,25 @@ mark_as_advanced(
   CMAKE_SHARED_LINKER_FLAGS_COVERAGE
 )
 
-get_property(is_multi_config GLOBAL PROPERTY GENERATOR_IS_MULTI_CONFIG)
-set(default_build_type "RelWithDebInfo")
-if(is_multi_config)
-  set(CMAKE_CONFIGURATION_TYPES "${default_build_type}" "Release" "Debug" "MinSizeRel" "Coverage" CACHE STRING
-    "Supported configuration types."
-    FORCE
-  )
-else()
-  set_property(CACHE CMAKE_BUILD_TYPE PROPERTY
-    STRINGS "${default_build_type}" "Release" "Debug" "MinSizeRel" "Coverage"
-  )
-  if(NOT CMAKE_BUILD_TYPE)
-    message(STATUS "Setting build type to \"${default_build_type}\" as none was specified")
-    set(CMAKE_BUILD_TYPE "${default_build_type}" CACHE STRING
-      "Choose the type of build."
+if(PROJECT_IS_TOP_LEVEL)
+  get_property(is_multi_config GLOBAL PROPERTY GENERATOR_IS_MULTI_CONFIG)
+  set(default_build_type "RelWithDebInfo")
+  if(is_multi_config)
+    set(CMAKE_CONFIGURATION_TYPES "${default_build_type}" "Release" "Debug" "MinSizeRel" "Coverage" CACHE STRING
+      "Supported configuration types."
       FORCE
     )
+  else()
+    set_property(CACHE CMAKE_BUILD_TYPE PROPERTY
+      STRINGS "${default_build_type}" "Release" "Debug" "MinSizeRel" "Coverage"
+    )
+    if(NOT CMAKE_BUILD_TYPE)
+      message(STATUS "Setting build type to \"${default_build_type}\" as none was specified")
+      set(CMAKE_BUILD_TYPE "${default_build_type}" CACHE STRING
+        "Choose the type of build."
+        FORCE
+      )
+    endif()
   endif()
 endif()
 
@@ -263,10 +258,17 @@ endif()
 
 set(CMAKE_C_VISIBILITY_PRESET hidden)
 
-# Ask CTest to create a "check" target (e.g., make check) as alias for the "test" target.
-# CTEST_TEST_TARGET_ALIAS is not documented but supposed to be user-facing.
-# See: https://gitlab.kitware.com/cmake/cmake/-/commit/816c9d1aa1f2b42d40c81a991b68c96eb12b6d2
-set(CTEST_TEST_TARGET_ALIAS check)
+set(print_msan_notice)
+if(SECP256K1_BUILD_CTIME_TESTS)
+  include(CheckMemorySanitizer)
+  check_memory_sanitizer(msan_enabled)
+  if(msan_enabled)
+    try_append_c_flags(-fno-sanitize-memory-param-retval)
+    set(print_msan_notice YES)
+  endif()
+  unset(msan_enabled)
+endif()
+
 include(CTest)
 # We do not use CTest's BUILD_TESTING because a single toggle for all tests is too coarse for our needs.
 mark_as_advanced(BUILD_TESTING)
@@ -274,14 +276,16 @@ if(SECP256K1_BUILD_BENCHMARK OR SECP256K1_BUILD_TESTS OR SECP256K1_BUILD_EXHAUST
   enable_testing()
 endif()
 
-set(SECP256K1_LATE_CFLAGS "" CACHE STRING "Compiler flags that are added to the command line after all other flags added by the build system.")
-include(AllTargetsCompileOptions)
+set(SECP256K1_APPEND_CFLAGS "" CACHE STRING "Compiler flags that are appended to the command line after all other flags added by the build system. This variable is intended for debugging and special builds.")
+if(SECP256K1_APPEND_CFLAGS)
+  # Appending to this low-level rule variable is the only way to
+  # guarantee that the flags appear at the end of the command line.
+  string(APPEND CMAKE_C_COMPILE_OBJECT " ${SECP256K1_APPEND_CFLAGS}")
+endif()
 
 add_subdirectory(src)
-all_targets_compile_options(src "${SECP256K1_LATE_CFLAGS}")
 if(SECP256K1_BUILD_EXAMPLES)
   add_subdirectory(examples)
-  all_targets_compile_options(examples "${SECP256K1_LATE_CFLAGS}")
 endif()
 
 message("\n")
@@ -332,7 +336,7 @@ message("Valgrind .............................. ${SECP256K1_VALGRIND}")
 get_directory_property(definitions COMPILE_DEFINITIONS)
 string(REPLACE ";" " " definitions "${definitions}")
 message("Preprocessor defined macros ........... ${definitions}")
-message("C compiler ............................ ${CMAKE_C_COMPILER}")
+message("C compiler ............................ ${CMAKE_C_COMPILER_ID} ${CMAKE_C_COMPILER_VERSION}, ${CMAKE_C_COMPILER}")
 message("CFLAGS ................................ ${CMAKE_C_FLAGS}")
 get_directory_property(compile_options COMPILE_OPTIONS)
 string(REPLACE ";" " " compile_options "${compile_options}")
@@ -355,10 +359,17 @@ else()
   message(" - LDFLAGS for executables ............ ${CMAKE_EXE_LINKER_FLAGS_DEBUG}")
   message(" - LDFLAGS for shared libraries ....... ${CMAKE_SHARED_LINKER_FLAGS_DEBUG}")
 endif()
-if(SECP256K1_LATE_CFLAGS)
-  message("SECP256K1_LATE_CFLAGS ................. ${SECP256K1_LATE_CFLAGS}")
+if(SECP256K1_APPEND_CFLAGS)
+  message("SECP256K1_APPEND_CFLAGS ............... ${SECP256K1_APPEND_CFLAGS}")
+endif()
+message("")
+if(print_msan_notice)
+  message(
+    "Note:\n"
+    "  MemorySanitizer detected, tried to add -fno-sanitize-memory-param-retval to compile options\n"
+    "  to avoid false positives in ctime_tests. Pass -DSECP256K1_BUILD_CTIME_TESTS=OFF to avoid this.\n"
+  )
 endif()
-message("\n")
 if(SECP256K1_EXPERIMENTAL)
   message(
     "  ******\n"
diff --git a/src/secp256k1/README.md b/src/secp256k1/README.md
index 6e88eb4ecb..e8d4123ab9 100644
--- a/src/secp256k1/README.md
+++ b/src/secp256k1/README.md
@@ -20,6 +20,7 @@ Features:
 * Optional module for public key recovery.
 * Optional module for ECDH key exchange.
 * Optional module for Schnorr signatures according to [BIP-340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
+* Optional module for ElligatorSwift key exchange according to [BIP-324](https://github.com/bitcoin/bips/blob/master/bip-0324.mediawiki).
 
 Implementation details
 ----------------------
diff --git a/src/secp256k1/build-aux/m4/bitcoin_secp.m4 b/src/secp256k1/build-aux/m4/bitcoin_secp.m4
index 11adef4f22..048267fa6e 100644
--- a/src/secp256k1/build-aux/m4/bitcoin_secp.m4
+++ b/src/secp256k1/build-aux/m4/bitcoin_secp.m4
@@ -45,6 +45,22 @@ fi
 AC_MSG_RESULT($has_valgrind)
 ])
 
+AC_DEFUN([SECP_MSAN_CHECK], [
+AC_MSG_CHECKING(whether MemorySanitizer is enabled)
+AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+  #if defined(__has_feature)
+  #  if __has_feature(memory_sanitizer)
+       /* MemorySanitizer is enabled. */
+  #  elif
+  #    error "MemorySanitizer is disabled."
+  #  endif
+  #else
+  #  error "__has_feature is not defined."
+  #endif
+  ]])], [msan_enabled=yes], [msan_enabled=no])
+AC_MSG_RESULT([$msan_enabled])
+])
+
 dnl SECP_TRY_APPEND_CFLAGS(flags, VAR)
 dnl Append flags to VAR if CC accepts them.
 AC_DEFUN([SECP_TRY_APPEND_CFLAGS], [
diff --git a/src/secp256k1/cmake/AllTargetsCompileOptions.cmake b/src/secp256k1/cmake/AllTargetsCompileOptions.cmake
deleted file mode 100644
index 6e420e0fde..0000000000
--- a/src/secp256k1/cmake/AllTargetsCompileOptions.cmake
+++ /dev/null
@@ -1,12 +0,0 @@
-# Add compile options to all targets added in the subdirectory.
-function(all_targets_compile_options dir options)
-  get_directory_property(targets DIRECTORY ${dir} BUILDSYSTEM_TARGETS)
-  separate_arguments(options)
-  set(compiled_target_types STATIC_LIBRARY SHARED_LIBRARY OBJECT_LIBRARY EXECUTABLE)
-  foreach(target ${targets})
-    get_target_property(type ${target} TYPE)
-    if(type IN_LIST compiled_target_types)
-      target_compile_options(${target} PRIVATE ${options})
-    endif()
-  endforeach()
-endfunction()
diff --git a/src/secp256k1/cmake/CheckMemorySanitizer.cmake b/src/secp256k1/cmake/CheckMemorySanitizer.cmake
new file mode 100644
index 0000000000..d9ef681e65
--- /dev/null
+++ b/src/secp256k1/cmake/CheckMemorySanitizer.cmake
@@ -0,0 +1,18 @@
+include_guard(GLOBAL)
+include(CheckCSourceCompiles)
+
+function(check_memory_sanitizer output)
+  set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY)
+  check_c_source_compiles("
+    #if defined(__has_feature)
+    #  if __has_feature(memory_sanitizer)
+         /* MemorySanitizer is enabled. */
+    #  elif
+    #    error \"MemorySanitizer is disabled.\"
+    #  endif
+    #else
+    #  error \"__has_feature is not defined.\"
+    #endif
+  " HAVE_MSAN)
+  set(${output} ${HAVE_MSAN} PARENT_SCOPE)
+endfunction()
diff --git a/src/secp256k1/configure.ac b/src/secp256k1/configure.ac
index 8b62e1dbfd..adae189787 100644
--- a/src/secp256k1/configure.ac
+++ b/src/secp256k1/configure.ac
@@ -203,22 +203,22 @@ AC_ARG_WITH([test-override-wide-multiply], [] ,[set_widemul=$withval], [set_wide
 AC_ARG_WITH([asm], [AS_HELP_STRING([--with-asm=x86_64|arm32|no|auto],
 [assembly to use (experimental: arm32) [default=auto]])],[req_asm=$withval], [req_asm=auto])
 
-AC_ARG_WITH([ecmult-window], [AS_HELP_STRING([--with-ecmult-window=SIZE|auto],
+AC_ARG_WITH([ecmult-window], [AS_HELP_STRING([--with-ecmult-window=SIZE],
 [window size for ecmult precomputation for verification, specified as integer in range [2..24].]
 [Larger values result in possibly better performance at the cost of an exponentially larger precomputed table.]
 [The table will store 2^(SIZE-1) * 64 bytes of data but can be larger in memory due to platform-specific padding and alignment.]
 [A window size larger than 15 will require you delete the prebuilt precomputed_ecmult.c file so that it can be rebuilt.]
 [For very large window sizes, use "make -j 1" to reduce memory use during compilation.]
-["auto" is a reasonable setting for desktop machines (currently 15). [default=auto]]
+[The default value is a reasonable setting for desktop machines (currently 15). [default=15]]
 )],
-[req_ecmult_window=$withval], [req_ecmult_window=auto])
+[set_ecmult_window=$withval], [set_ecmult_window=15])
 
-AC_ARG_WITH([ecmult-gen-kb], [AS_HELP_STRING([--with-ecmult-gen-kb=2|22|86|auto],
+AC_ARG_WITH([ecmult-gen-kb], [AS_HELP_STRING([--with-ecmult-gen-kb=2|22|86],
 [The size of the precomputed table for signing in multiples of 1024 bytes (on typical platforms).]
 [Larger values result in possibly better signing/keygeneration performance at the cost of a larger table.]
-["auto" is a reasonable setting for desktop machines (currently 22). [default=auto]]
+[The default value is a reasonable setting for desktop machines (currently 22). [default=22]]
 )],
-[req_ecmult_gen_kb=$withval], [req_ecmult_gen_kb=auto])
+[set_ecmult_gen_kb=$withval], [set_ecmult_gen_kb=22])
 
 AC_ARG_WITH([valgrind], [AS_HELP_STRING([--with-valgrind=yes|no|auto],
 [Build with extra checks for running inside Valgrind [default=auto]]
@@ -247,6 +247,20 @@ if test x"$enable_ctime_tests" = x"auto"; then
     enable_ctime_tests=$enable_valgrind
 fi
 
+print_msan_notice=no
+if test x"$enable_ctime_tests" = x"yes"; then
+  SECP_MSAN_CHECK
+  # MSan on Clang >=16 reports unitialized memory in function parameters and return values, even if
+  # the uninitalized variable is never actually "used". This is called "eager" checking, and it's
+  # sounds like good idea for normal use of MSan. However, it yields many false positives in the
+  # ctime_tests because many return values depend on secret (i.e., "uninitialized") values, and
+  # we're only interested in detecting branches (which count as "uses") on secret data.
+  if test x"$msan_enabled" = x"yes"; then
+    SECP_TRY_APPEND_CFLAGS([-fno-sanitize-memory-param-retval], SECP_CFLAGS)
+    print_msan_notice=yes
+  fi
+fi
+
 if test x"$enable_coverage" = x"yes"; then
     SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DCOVERAGE=1"
     SECP_CFLAGS="-O0 --coverage $SECP_CFLAGS"
@@ -335,14 +349,7 @@ auto)
   ;;
 esac
 
-# Set ecmult window size
-if test x"$req_ecmult_window" = x"auto"; then
-  set_ecmult_window=15
-else
-  set_ecmult_window=$req_ecmult_window
-fi
-
-error_window_size=['window size for ecmult precomputation not an integer in range [2..24] or "auto"']
+error_window_size=['window size for ecmult precomputation not an integer in range [2..24]']
 case $set_ecmult_window in
 ''|*[[!0-9]]*)
   # no valid integer
@@ -357,13 +364,6 @@ case $set_ecmult_window in
   ;;
 esac
 
-# Set ecmult gen kb
-if test x"$req_ecmult_gen_kb" = x"auto"; then
-  set_ecmult_gen_kb=22
-else
-  set_ecmult_gen_kb=$req_ecmult_gen_kb
-fi
-
 case $set_ecmult_gen_kb in
 2)
   SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DCOMB_BLOCKS=2 -DCOMB_TEETH=5"
@@ -375,7 +375,7 @@ case $set_ecmult_gen_kb in
   SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DCOMB_BLOCKS=43 -DCOMB_TEETH=6"
   ;;
 *)
-  AC_MSG_ERROR(['ecmult gen table size not 2, 22, 86 or "auto"'])
+  AC_MSG_ERROR(['ecmult gen table size not 2, 22 or 86'])
   ;;
 esac
 
@@ -426,12 +426,7 @@ fi
 ### Check for --enable-experimental if necessary
 ###
 
-if test x"$enable_experimental" = x"yes"; then
-  AC_MSG_NOTICE([******])
-  AC_MSG_NOTICE([WARNING: experimental build])
-  AC_MSG_NOTICE([Experimental features do not have stable APIs or properties, and may not be safe for production use.])
-  AC_MSG_NOTICE([******])
-else
+if test x"$enable_experimental" = x"no"; then
   if test x"$set_asm" = x"arm32"; then
     AC_MSG_ERROR([ARM32 assembly is experimental. Use --enable-experimental to allow.])
   fi
@@ -492,3 +487,17 @@ echo "  CPPFLAGS                = $CPPFLAGS"
 echo "  SECP_CFLAGS             = $SECP_CFLAGS"
 echo "  CFLAGS                  = $CFLAGS"
 echo "  LDFLAGS                 = $LDFLAGS"
+
+if test x"$print_msan_notice" = x"yes"; then
+  echo
+  echo "Note:"
+  echo "  MemorySanitizer detected, tried to add -fno-sanitize-memory-param-retval to SECP_CFLAGS"
+  echo "  to avoid false positives in ctime_tests. Pass --disable-ctime-tests to avoid this."
+fi
+
+if test x"$enable_experimental" = x"yes"; then
+  echo
+  echo "WARNING: Experimental build"
+  echo "  Experimental features do not have stable APIs or properties, and may not be safe for"
+  echo "  production use."
+fi
diff --git a/src/secp256k1/src/modules/ecdh/tests_impl.h b/src/secp256k1/src/modules/ecdh/tests_impl.h
index 6be96eacbe..3c3acdaf8c 100644
--- a/src/secp256k1/src/modules/ecdh/tests_impl.h
+++ b/src/secp256k1/src/modules/ecdh/tests_impl.h
@@ -56,7 +56,7 @@ static void test_ecdh_generator_basepoint(void) {
         size_t point_ser_len = sizeof(point_ser);
         secp256k1_scalar s;
 
-        random_scalar_order(&s);
+        testutil_random_scalar_order(&s);
         secp256k1_scalar_get_b32(s_b32, &s);
 
         CHECK(secp256k1_ec_pubkey_create(CTX, &point[0], s_one) == 1);
@@ -95,7 +95,7 @@ static void test_bad_scalar(void) {
     secp256k1_pubkey point;
 
     /* Create random point */
-    random_scalar_order(&rand);
+    testutil_random_scalar_order(&rand);
     secp256k1_scalar_get_b32(s_rand, &rand);
     CHECK(secp256k1_ec_pubkey_create(CTX, &point, s_rand) == 1);
 
@@ -127,7 +127,7 @@ static void test_result_basepoint(void) {
     CHECK(secp256k1_ecdh(CTX, out_base, &point, s_one, NULL, NULL) == 1);
 
     for (i = 0; i < 2 * COUNT; i++) {
-        random_scalar_order(&rand);
+        testutil_random_scalar_order(&rand);
         secp256k1_scalar_get_b32(s, &rand);
         secp256k1_scalar_inverse(&rand, &rand);
         secp256k1_scalar_get_b32(s_inv, &rand);
diff --git a/src/secp256k1/src/modules/ellswift/tests_impl.h b/src/secp256k1/src/modules/ellswift/tests_impl.h
index f96e3a1268..ed5658f34c 100644
--- a/src/secp256k1/src/modules/ellswift/tests_impl.h
+++ b/src/secp256k1/src/modules/ellswift/tests_impl.h
@@ -229,9 +229,9 @@ void run_ellswift_tests(void) {
         secp256k1_ge g, g2;
         secp256k1_pubkey pubkey, pubkey2;
         /* Generate random public key and random randomizer. */
-        random_group_element_test(&g);
+        testutil_random_ge_test(&g);
         secp256k1_pubkey_save(&pubkey, &g);
-        secp256k1_testrand256(rnd32);
+        testrand256(rnd32);
         /* Convert the public key to ElligatorSwift and back. */
         secp256k1_ellswift_encode(CTX, ell64, &pubkey, rnd32);
         secp256k1_ellswift_decode(CTX, &pubkey2, ell64);
@@ -249,8 +249,8 @@ void run_ellswift_tests(void) {
         unsigned char ell64[64];
         int ret;
         /* Generate random secret key and random randomizer. */
-        if (i & 1) secp256k1_testrand256_test(auxrnd32);
-        random_scalar_order_test(&sec);
+        if (i & 1) testrand256_test(auxrnd32);
+        testutil_random_scalar_order_test(&sec);
         secp256k1_scalar_get_b32(sec32, &sec);
         /* Construct ElligatorSwift-encoded public keys for that key. */
         ret = secp256k1_ellswift_create(CTX, ell64, sec32, (i & 1) ? auxrnd32 : NULL);
@@ -271,11 +271,11 @@ void run_ellswift_tests(void) {
         secp256k1_pubkey pub;
         int ret;
         /* Generate random secret key. */
-        random_scalar_order_test(&sec);
+        testutil_random_scalar_order_test(&sec);
         secp256k1_scalar_get_b32(sec32, &sec);
         /* Generate random ElligatorSwift encoding for the remote key and decode it. */
-        secp256k1_testrand256_test(ell64);
-        secp256k1_testrand256_test(ell64 + 32);
+        testrand256_test(ell64);
+        testrand256_test(ell64 + 32);
         secp256k1_ellswift_decode(CTX, &pub, ell64);
         secp256k1_pubkey_load(CTX, &dec, &pub);
         secp256k1_gej_set_ge(&decj, &dec);
@@ -313,18 +313,18 @@ void run_ellswift_tests(void) {
             data = NULL;
         } else {
             hash_function = secp256k1_ellswift_xdh_hash_function_prefix;
-            secp256k1_testrand256_test(prefix64);
-            secp256k1_testrand256_test(prefix64 + 32);
+            testrand256_test(prefix64);
+            testrand256_test(prefix64 + 32);
             data = prefix64;
         }
 
         /* Generate random secret keys and random randomizers. */
-        secp256k1_testrand256_test(auxrnd32a);
-        secp256k1_testrand256_test(auxrnd32b);
-        random_scalar_order_test(&seca);
+        testrand256_test(auxrnd32a);
+        testrand256_test(auxrnd32b);
+        testutil_random_scalar_order_test(&seca);
         /* Draw secb uniformly at random to make sure that the secret keys
          * differ */
-        random_scalar_order(&secb);
+        testutil_random_scalar_order(&secb);
         secp256k1_scalar_get_b32(sec32a, &seca);
         secp256k1_scalar_get_b32(sec32b, &secb);
 
@@ -349,13 +349,13 @@ void run_ellswift_tests(void) {
         /* Verify that the shared secret doesn't match if other side's public key is incorrect. */
         /* For A (using a bad public key for B): */
         memcpy(ell64b_bad, ell64b, sizeof(ell64a_bad));
-        secp256k1_testrand_flip(ell64b_bad, sizeof(ell64b_bad));
+        testrand_flip(ell64b_bad, sizeof(ell64b_bad));
         ret = secp256k1_ellswift_xdh(CTX, share32_bad, ell64a, ell64b_bad, sec32a, 0, hash_function, data);
         CHECK(ret); /* Mismatching encodings don't get detected by secp256k1_ellswift_xdh. */
         CHECK(secp256k1_memcmp_var(share32_bad, share32a, 32) != 0);
         /* For B (using a bad public key for A): */
         memcpy(ell64a_bad, ell64a, sizeof(ell64a_bad));
-        secp256k1_testrand_flip(ell64a_bad, sizeof(ell64a_bad));
+        testrand_flip(ell64a_bad, sizeof(ell64a_bad));
         ret = secp256k1_ellswift_xdh(CTX, share32_bad, ell64a_bad, ell64b, sec32b, 1, hash_function, data);
         CHECK(ret);
         CHECK(secp256k1_memcmp_var(share32_bad, share32b, 32) != 0);
@@ -363,12 +363,12 @@ void run_ellswift_tests(void) {
         /* Verify that the shared secret doesn't match if the private key is incorrect. */
         /* For A: */
         memcpy(sec32a_bad, sec32a, sizeof(sec32a_bad));
-        secp256k1_testrand_flip(sec32a_bad, sizeof(sec32a_bad));
+        testrand_flip(sec32a_bad, sizeof(sec32a_bad));
         ret = secp256k1_ellswift_xdh(CTX, share32_bad, ell64a, ell64b, sec32a_bad, 0, hash_function, data);
         CHECK(!ret || secp256k1_memcmp_var(share32_bad, share32a, 32) != 0);
         /* For B: */
         memcpy(sec32b_bad, sec32b, sizeof(sec32b_bad));
-        secp256k1_testrand_flip(sec32b_bad, sizeof(sec32b_bad));
+        testrand_flip(sec32b_bad, sizeof(sec32b_bad));
         ret = secp256k1_ellswift_xdh(CTX, share32_bad, ell64a, ell64b, sec32b_bad, 1, hash_function, data);
         CHECK(!ret || secp256k1_memcmp_var(share32_bad, share32b, 32) != 0);
 
@@ -376,7 +376,7 @@ void run_ellswift_tests(void) {
             /* Verify that the shared secret doesn't match when a different encoding of the same public key is used. */
             /* For A (changing B's public key): */
             memcpy(auxrnd32b_bad, auxrnd32b, sizeof(auxrnd32b_bad));
-            secp256k1_testrand_flip(auxrnd32b_bad, sizeof(auxrnd32b_bad));
+            testrand_flip(auxrnd32b_bad, sizeof(auxrnd32b_bad));
             ret = secp256k1_ellswift_create(CTX, ell64b_bad, sec32b, auxrnd32b_bad);
             CHECK(ret);
             ret = secp256k1_ellswift_xdh(CTX, share32_bad, ell64a, ell64b_bad, sec32a, 0, hash_function, data);
@@ -384,7 +384,7 @@ void run_ellswift_tests(void) {
             CHECK(secp256k1_memcmp_var(share32_bad, share32a, 32) != 0);
             /* For B (changing A's public key): */
             memcpy(auxrnd32a_bad, auxrnd32a, sizeof(auxrnd32a_bad));
-            secp256k1_testrand_flip(auxrnd32a_bad, sizeof(auxrnd32a_bad));
+            testrand_flip(auxrnd32a_bad, sizeof(auxrnd32a_bad));
             ret = secp256k1_ellswift_create(CTX, ell64a_bad, sec32a, auxrnd32a_bad);
             CHECK(ret);
             ret = secp256k1_ellswift_xdh(CTX, share32_bad, ell64a_bad, ell64b, sec32b, 1, hash_function, data);
diff --git a/src/secp256k1/src/modules/extrakeys/tests_impl.h b/src/secp256k1/src/modules/extrakeys/tests_impl.h
index 45521d1742..ab4ef4a74b 100644
--- a/src/secp256k1/src/modules/extrakeys/tests_impl.h
+++ b/src/secp256k1/src/modules/extrakeys/tests_impl.h
@@ -23,9 +23,9 @@ static void test_xonly_pubkey(void) {
     int pk_parity;
     int i;
 
-    secp256k1_testrand256(sk);
+    testrand256(sk);
     memset(ones32, 0xFF, 32);
-    secp256k1_testrand256(xy_sk);
+    testrand256(xy_sk);
     CHECK(secp256k1_ec_pubkey_create(CTX, &pk, sk) == 1);
     CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 1);
 
@@ -95,7 +95,7 @@ static void test_xonly_pubkey(void) {
      * the curve) then xonly_pubkey_parse should fail as well. */
     for (i = 0; i < COUNT; i++) {
         unsigned char rand33[33];
-        secp256k1_testrand256(&rand33[1]);
+        testrand256(&rand33[1]);
         rand33[0] = SECP256K1_TAG_PUBKEY_EVEN;
         if (!secp256k1_ec_pubkey_parse(CTX, &pk, rand33, 33)) {
             memset(&xonly_pk, 1, sizeof(xonly_pk));
@@ -152,8 +152,8 @@ static void test_xonly_pubkey_tweak(void) {
     int i;
 
     memset(overflows, 0xff, sizeof(overflows));
-    secp256k1_testrand256(tweak);
-    secp256k1_testrand256(sk);
+    testrand256(tweak);
+    testrand256(sk);
     CHECK(secp256k1_ec_pubkey_create(CTX, &internal_pk, sk) == 1);
     CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
 
@@ -190,7 +190,7 @@ static void test_xonly_pubkey_tweak(void) {
 
     /* Invalid pk with a valid tweak */
     memset(&internal_xonly_pk, 0, sizeof(internal_xonly_pk));
-    secp256k1_testrand256(tweak);
+    testrand256(tweak);
     CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak));
     CHECK(secp256k1_memcmp_var(&output_pk, zeros64, sizeof(output_pk))  == 0);
 }
@@ -209,8 +209,8 @@ static void test_xonly_pubkey_tweak_check(void) {
     unsigned char tweak[32];
 
     memset(overflows, 0xff, sizeof(overflows));
-    secp256k1_testrand256(tweak);
-    secp256k1_testrand256(sk);
+    testrand256(tweak);
+    testrand256(sk);
     CHECK(secp256k1_ec_pubkey_create(CTX, &internal_pk, sk) == 1);
     CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
 
@@ -256,7 +256,7 @@ static void test_xonly_pubkey_tweak_recursive(void) {
     unsigned char tweak[N_PUBKEYS - 1][32];
     int i;
 
-    secp256k1_testrand256(sk);
+    testrand256(sk);
     CHECK(secp256k1_ec_pubkey_create(CTX, &pk[0], sk) == 1);
     /* Add tweaks */
     for (i = 0; i < N_PUBKEYS - 1; i++) {
@@ -292,7 +292,7 @@ static void test_keypair(void) {
     memset(overflows, 0xFF, sizeof(overflows));
 
     /* Test keypair_create */
-    secp256k1_testrand256(sk);
+    testrand256(sk);
     CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
     CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) != 0);
     CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
@@ -311,7 +311,7 @@ static void test_keypair(void) {
     CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
 
     /* Test keypair_pub */
-    secp256k1_testrand256(sk);
+    testrand256(sk);
     CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
     CHECK(secp256k1_keypair_pub(CTX, &pk, &keypair) == 1);
     CHECK_ILLEGAL(CTX, secp256k1_keypair_pub(CTX, NULL, &keypair));
@@ -330,7 +330,7 @@ static void test_keypair(void) {
     CHECK(secp256k1_memcmp_var(&pk, &pk_tmp, sizeof(pk)) == 0);
 
     /** Test keypair_xonly_pub **/
-    secp256k1_testrand256(sk);
+    testrand256(sk);
     CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
     CHECK(secp256k1_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, &keypair) == 1);
     CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_pub(CTX, NULL, &pk_parity, &keypair));
@@ -353,7 +353,7 @@ static void test_keypair(void) {
     CHECK(pk_parity == pk_parity_tmp);
 
     /* Test keypair_seckey */
-    secp256k1_testrand256(sk);
+    testrand256(sk);
     CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
     CHECK(secp256k1_keypair_sec(CTX, sk_tmp, &keypair) == 1);
     CHECK_ILLEGAL(CTX, secp256k1_keypair_sec(CTX, NULL, &keypair));
@@ -381,8 +381,8 @@ static void test_keypair_add(void) {
     int i;
 
     CHECK(sizeof(zeros96) == sizeof(keypair));
-    secp256k1_testrand256(sk);
-    secp256k1_testrand256(tweak);
+    testrand256(sk);
+    testrand256(tweak);
     memset(overflows, 0xFF, 32);
     CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
 
@@ -407,7 +407,7 @@ static void test_keypair_add(void) {
     for (i = 0; i < COUNT; i++) {
         secp256k1_scalar scalar_tweak;
         secp256k1_keypair keypair_tmp;
-        secp256k1_testrand256(sk);
+        testrand256(sk);
         CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
         memcpy(&keypair_tmp, &keypair, sizeof(keypair));
         /* Because sk may be negated before adding, we need to try with tweak =
@@ -423,7 +423,7 @@ static void test_keypair_add(void) {
 
     /* Invalid keypair with a valid tweak */
     memset(&keypair, 0, sizeof(keypair));
-    secp256k1_testrand256(tweak);
+    testrand256(tweak);
     CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak));
     CHECK(secp256k1_memcmp_var(&keypair, zeros96, sizeof(keypair))  == 0);
     /* Only seckey part of keypair invalid */
@@ -446,7 +446,7 @@ static void test_keypair_add(void) {
         unsigned char sk32[32];
         int pk_parity;
 
-        secp256k1_testrand256(tweak);
+        testrand256(tweak);
         CHECK(secp256k1_keypair_xonly_pub(CTX, &internal_pk, NULL, &keypair) == 1);
         CHECK(secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
         CHECK(secp256k1_keypair_xonly_pub(CTX, &output_pk, &pk_parity, &keypair) == 1);
diff --git a/src/secp256k1/src/modules/recovery/tests_impl.h b/src/secp256k1/src/modules/recovery/tests_impl.h
index 728ccfed8d..7a28a3ce65 100644
--- a/src/secp256k1/src/modules/recovery/tests_impl.h
+++ b/src/secp256k1/src/modules/recovery/tests_impl.h
@@ -25,7 +25,7 @@ static int recovery_test_nonce_function(unsigned char *nonce32, const unsigned c
     }
     /* On the next run, return a valid nonce, but flip a coin as to whether or not to fail signing. */
     memset(nonce32, 1, 32);
-    return secp256k1_testrand_bits(1);
+    return testrand_bits(1);
 }
 
 static void test_ecdsa_recovery_api(void) {
@@ -106,8 +106,8 @@ static void test_ecdsa_recovery_end_to_end(void) {
     /* Generate a random key and message. */
     {
         secp256k1_scalar msg, key;
-        random_scalar_order_test(&msg);
-        random_scalar_order_test(&key);
+        testutil_random_scalar_order_test(&msg);
+        testutil_random_scalar_order_test(&key);
         secp256k1_scalar_get_b32(privkey, &key);
         secp256k1_scalar_get_b32(message, &msg);
     }
@@ -141,7 +141,7 @@ static void test_ecdsa_recovery_end_to_end(void) {
     CHECK(secp256k1_memcmp_var(&pubkey, &recpubkey, sizeof(pubkey)) == 0);
     /* Serialize/destroy/parse signature and verify again. */
     CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(CTX, sig, &recid, &rsignature[4]) == 1);
-    sig[secp256k1_testrand_bits(6)] += 1 + secp256k1_testrand_int(255);
+    sig[testrand_bits(6)] += 1 + testrand_int(255);
     CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, &rsignature[4], sig, recid) == 1);
     CHECK(secp256k1_ecdsa_recoverable_signature_convert(CTX, &signature[4], &rsignature[4]) == 1);
     CHECK(secp256k1_ecdsa_verify(CTX, &signature[4], message, &pubkey) == 0);
diff --git a/src/secp256k1/src/modules/schnorrsig/tests_exhaustive_impl.h b/src/secp256k1/src/modules/schnorrsig/tests_exhaustive_impl.h
index bc31d81107..601b54975d 100644
--- a/src/secp256k1/src/modules/schnorrsig/tests_exhaustive_impl.h
+++ b/src/secp256k1/src/modules/schnorrsig/tests_exhaustive_impl.h
@@ -104,7 +104,7 @@ static void test_exhaustive_schnorrsig_verify(const secp256k1_context *ctx, cons
             while (e_count_done < EXHAUSTIVE_TEST_ORDER) {
                 secp256k1_scalar e;
                 unsigned char msg32[32];
-                secp256k1_testrand256(msg32);
+                testrand256(msg32);
                 secp256k1_schnorrsig_challenge(&e, sig64, msg32, sizeof(msg32), pk32);
                 /* Only do work if we hit a challenge we haven't tried before. */
                 if (!e_done[e]) {
@@ -120,7 +120,7 @@ static void test_exhaustive_schnorrsig_verify(const secp256k1_context *ctx, cons
                             expect_valid = actual_k != -1 && s != EXHAUSTIVE_TEST_ORDER &&
                                            (s == (actual_k + actual_d * e) % EXHAUSTIVE_TEST_ORDER);
                         } else {
-                            secp256k1_testrand256(sig64 + 32);
+                            testrand256(sig64 + 32);
                             expect_valid = 0;
                         }
                         valid = secp256k1_schnorrsig_verify(ctx, sig64, msg32, sizeof(msg32), &pubkeys[d - 1]);
@@ -161,7 +161,7 @@ static void test_exhaustive_schnorrsig_sign(const secp256k1_context *ctx, unsign
             /* Generate random messages until all challenges have been tried. */
             while (e_count_done < EXHAUSTIVE_TEST_ORDER) {
                 secp256k1_scalar e;
-                secp256k1_testrand256(msg32);
+                testrand256(msg32);
                 secp256k1_schnorrsig_challenge(&e, xonly_pubkey_bytes[k - 1], msg32, sizeof(msg32), xonly_pubkey_bytes[d - 1]);
                 /* Only do work if we hit a challenge we haven't tried before. */
                 if (!e_done[e]) {
diff --git a/src/secp256k1/src/modules/schnorrsig/tests_impl.h b/src/secp256k1/src/modules/schnorrsig/tests_impl.h
index 8ada90a87b..aa4fc38270 100644
--- a/src/secp256k1/src/modules/schnorrsig/tests_impl.h
+++ b/src/secp256k1/src/modules/schnorrsig/tests_impl.h
@@ -15,7 +15,7 @@
 static void nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes, size_t msglen, size_t algolen) {
     unsigned char nonces[2][32];
     CHECK(nonce_function_bip340(nonces[0], args[0], msglen, args[1], args[2], args[3], algolen, args[4]) == 1);
-    secp256k1_testrand_flip(args[n_flip], n_bytes);
+    testrand_flip(args[n_flip], n_bytes);
     CHECK(nonce_function_bip340(nonces[1], args[0], msglen, args[1], args[2], args[3], algolen, args[4]) == 1);
     CHECK(secp256k1_memcmp_var(nonces[0], nonces[1], 32) != 0);
 }
@@ -50,10 +50,10 @@ static void run_nonce_function_bip340_tests(void) {
     secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha_optimized);
     test_sha256_eq(&sha, &sha_optimized);
 
-    secp256k1_testrand256(msg);
-    secp256k1_testrand256(key);
-    secp256k1_testrand256(pk);
-    secp256k1_testrand256(aux_rand);
+    testrand256(msg);
+    testrand256(key);
+    testrand256(pk);
+    testrand256(aux_rand);
 
     /* Check that a bitflip in an argument results in different nonces. */
     args[0] = msg;
@@ -76,12 +76,12 @@ static void run_nonce_function_bip340_tests(void) {
     CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, NULL, 0, NULL) == 0);
     CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
     /* Other algo is fine */
-    secp256k1_testrand_bytes_test(algo, algolen);
+    testrand_bytes_test(algo, algolen);
     CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
 
     for (i = 0; i < COUNT; i++) {
         unsigned char nonce2[32];
-        uint32_t offset = secp256k1_testrand_int(msglen - 1);
+        uint32_t offset = testrand_int(msglen - 1);
         size_t msglen_tmp = (msglen + offset) % msglen;
         size_t algolen_tmp;
 
@@ -90,7 +90,7 @@ static void run_nonce_function_bip340_tests(void) {
         CHECK(secp256k1_memcmp_var(nonce, nonce2, 32) != 0);
 
         /* Different algolen gives different nonce */
-        offset = secp256k1_testrand_int(algolen - 1);
+        offset = testrand_int(algolen - 1);
         algolen_tmp = (algolen + offset) % algolen;
         CHECK(nonce_function_bip340(nonce2, msg, msglen, key, pk, algo, algolen_tmp, NULL) == 1);
         CHECK(secp256k1_memcmp_var(nonce, nonce2, 32) != 0);
@@ -116,10 +116,10 @@ static void test_schnorrsig_api(void) {
     secp256k1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
     secp256k1_schnorrsig_extraparams invalid_extraparams = {{ 0 }, NULL, NULL};
 
-    secp256k1_testrand256(sk1);
-    secp256k1_testrand256(sk2);
-    secp256k1_testrand256(sk3);
-    secp256k1_testrand256(msg);
+    testrand256(sk1);
+    testrand256(sk2);
+    testrand256(sk3);
+    testrand256(msg);
     CHECK(secp256k1_keypair_create(CTX, &keypairs[0], sk1) == 1);
     CHECK(secp256k1_keypair_create(CTX, &keypairs[1], sk2) == 1);
     CHECK(secp256k1_keypair_create(CTX, &keypairs[2], sk3) == 1);
@@ -813,8 +813,8 @@ static void test_schnorrsig_sign(void) {
     secp256k1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
     unsigned char aux_rand[32];
 
-    secp256k1_testrand256(sk);
-    secp256k1_testrand256(aux_rand);
+    testrand256(sk);
+    testrand256(aux_rand);
     CHECK(secp256k1_keypair_create(CTX, &keypair, sk));
     CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair));
     CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, &keypair, NULL) == 1);
@@ -861,12 +861,12 @@ static void test_schnorrsig_sign_verify(void) {
     secp256k1_xonly_pubkey pk;
     secp256k1_scalar s;
 
-    secp256k1_testrand256(sk);
+    testrand256(sk);
     CHECK(secp256k1_keypair_create(CTX, &keypair, sk));
     CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair));
 
     for (i = 0; i < N_SIGS; i++) {
-        secp256k1_testrand256(msg[i]);
+        testrand256(msg[i]);
         CHECK(secp256k1_schnorrsig_sign32(CTX, sig[i], msg[i], &keypair, NULL));
         CHECK(secp256k1_schnorrsig_verify(CTX, sig[i], msg[i], sizeof(msg[i]), &pk));
     }
@@ -874,19 +874,19 @@ static void test_schnorrsig_sign_verify(void) {
     {
         /* Flip a few bits in the signature and in the message and check that
          * verify and verify_batch (TODO) fail */
-        size_t sig_idx = secp256k1_testrand_int(N_SIGS);
-        size_t byte_idx = secp256k1_testrand_bits(5);
-        unsigned char xorbyte = secp256k1_testrand_int(254)+1;
+        size_t sig_idx = testrand_int(N_SIGS);
+        size_t byte_idx = testrand_bits(5);
+        unsigned char xorbyte = testrand_int(254)+1;
         sig[sig_idx][byte_idx] ^= xorbyte;
         CHECK(!secp256k1_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
         sig[sig_idx][byte_idx] ^= xorbyte;
 
-        byte_idx = secp256k1_testrand_bits(5);
+        byte_idx = testrand_bits(5);
         sig[sig_idx][32+byte_idx] ^= xorbyte;
         CHECK(!secp256k1_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
         sig[sig_idx][32+byte_idx] ^= xorbyte;
 
-        byte_idx = secp256k1_testrand_bits(5);
+        byte_idx = testrand_bits(5);
         msg[sig_idx][byte_idx] ^= xorbyte;
         CHECK(!secp256k1_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
         msg[sig_idx][byte_idx] ^= xorbyte;
@@ -916,9 +916,9 @@ static void test_schnorrsig_sign_verify(void) {
     {
         /* Test varying message lengths */
         unsigned char msg_large[32 * 8];
-        uint32_t msglen  = secp256k1_testrand_int(sizeof(msg_large));
+        uint32_t msglen  = testrand_int(sizeof(msg_large));
         for (i = 0; i < sizeof(msg_large); i += 32) {
-            secp256k1_testrand256(&msg_large[i]);
+            testrand256(&msg_large[i]);
         }
         CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig[0], msg_large, msglen, &keypair, NULL) == 1);
         CHECK(secp256k1_schnorrsig_verify(CTX, sig[0], msg_large, msglen, &pk) == 1);
@@ -942,7 +942,7 @@ static void test_schnorrsig_taproot(void) {
     unsigned char sig[64];
 
     /* Create output key */
-    secp256k1_testrand256(sk);
+    testrand256(sk);
     CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
     CHECK(secp256k1_keypair_xonly_pub(CTX, &internal_pk, NULL, &keypair) == 1);
     /* In actual taproot the tweak would be hash of internal_pk */
@@ -952,7 +952,7 @@ static void test_schnorrsig_taproot(void) {
     CHECK(secp256k1_xonly_pubkey_serialize(CTX, output_pk_bytes, &output_pk) == 1);
 
     /* Key spend */
-    secp256k1_testrand256(msg);
+    testrand256(msg);
     CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, &keypair, NULL) == 1);
     /* Verify key spend */
     CHECK(secp256k1_xonly_pubkey_parse(CTX, &output_pk, output_pk_bytes) == 1);
diff --git a/src/secp256k1/src/secp256k1.c b/src/secp256k1/src/secp256k1.c
index 7a32769408..72d725a74e 100644
--- a/src/secp256k1/src/secp256k1.c
+++ b/src/secp256k1/src/secp256k1.c
@@ -76,7 +76,7 @@ const secp256k1_context *secp256k1_context_no_precomp = &secp256k1_context_stati
 
 /* Helper function that determines if a context is proper, i.e., is not the static context or a copy thereof.
  *
- * This is intended for "context" functions such as secp256k1_context_clone. Function which need specific
+ * This is intended for "context" functions such as secp256k1_context_clone. Functions that need specific
  * features of a context should still check for these features directly. For example, a function that needs
  * ecmult_gen should directly check for the existence of the ecmult_gen context. */
 static int secp256k1_context_is_proper(const secp256k1_context* ctx) {
@@ -544,7 +544,7 @@ static int secp256k1_ecdsa_sign_inner(const secp256k1_context* ctx, secp256k1_sc
             break;
         }
         is_nonce_valid = secp256k1_scalar_set_b32_seckey(&non, nonce32);
-        /* The nonce is still secret here, but it being invalid is is less likely than 1:2^255. */
+        /* The nonce is still secret here, but it being invalid is less likely than 1:2^255. */
         secp256k1_declassify(ctx, &is_nonce_valid, sizeof(is_nonce_valid));
         if (is_nonce_valid) {
             ret = secp256k1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, r, s, &sec, &msg, &non, recid);
diff --git a/src/secp256k1/src/testrand.h b/src/secp256k1/src/testrand.h
index 721099d039..3c1ed3d45d 100644
--- a/src/secp256k1/src/testrand.h
+++ b/src/secp256k1/src/testrand.h
@@ -12,37 +12,37 @@
 /* A non-cryptographic RNG used only for test infrastructure. */
 
 /** Seed the pseudorandom number generator for testing. */
-SECP256K1_INLINE static void secp256k1_testrand_seed(const unsigned char *seed16);
+SECP256K1_INLINE static void testrand_seed(const unsigned char *seed16);
 
 /** Generate a pseudorandom number in the range [0..2**32-1]. */
-SECP256K1_INLINE static uint32_t secp256k1_testrand32(void);
+SECP256K1_INLINE static uint32_t testrand32(void);
 
 /** Generate a pseudorandom number in the range [0..2**64-1]. */
-SECP256K1_INLINE static uint64_t secp256k1_testrand64(void);
+SECP256K1_INLINE static uint64_t testrand64(void);
 
 /** Generate a pseudorandom number in the range [0..2**bits-1]. Bits must be 1 or
  *  more. */
-SECP256K1_INLINE static uint64_t secp256k1_testrand_bits(int bits);
+SECP256K1_INLINE static uint64_t testrand_bits(int bits);
 
 /** Generate a pseudorandom number in the range [0..range-1]. */
-static uint32_t secp256k1_testrand_int(uint32_t range);
+static uint32_t testrand_int(uint32_t range);
 
 /** Generate a pseudorandom 32-byte array. */
-static void secp256k1_testrand256(unsigned char *b32);
+static void testrand256(unsigned char *b32);
 
 /** Generate a pseudorandom 32-byte array with long sequences of zero and one bits. */
-static void secp256k1_testrand256_test(unsigned char *b32);
+static void testrand256_test(unsigned char *b32);
 
 /** Generate pseudorandom bytes with long sequences of zero and one bits. */
-static void secp256k1_testrand_bytes_test(unsigned char *bytes, size_t len);
+static void testrand_bytes_test(unsigned char *bytes, size_t len);
 
 /** Flip a single random bit in a byte array */
-static void secp256k1_testrand_flip(unsigned char *b, size_t len);
+static void testrand_flip(unsigned char *b, size_t len);
 
 /** Initialize the test RNG using (hex encoded) array up to 16 bytes, or randomly if hexseed is NULL. */
-static void secp256k1_testrand_init(const char* hexseed);
+static void testrand_init(const char* hexseed);
 
 /** Print final test information. */
-static void secp256k1_testrand_finish(void);
+static void testrand_finish(void);
 
 #endif /* SECP256K1_TESTRAND_H */
diff --git a/src/secp256k1/src/testrand_impl.h b/src/secp256k1/src/testrand_impl.h
index fe97620435..07564f7f3f 100644
--- a/src/secp256k1/src/testrand_impl.h
+++ b/src/secp256k1/src/testrand_impl.h
@@ -17,7 +17,7 @@
 
 static uint64_t secp256k1_test_state[4];
 
-SECP256K1_INLINE static void secp256k1_testrand_seed(const unsigned char *seed16) {
+SECP256K1_INLINE static void testrand_seed(const unsigned char *seed16) {
     static const unsigned char PREFIX[19] = "secp256k1 test init";
     unsigned char out32[32];
     secp256k1_sha256 hash;
@@ -40,7 +40,7 @@ SECP256K1_INLINE static uint64_t rotl(const uint64_t x, int k) {
     return (x << k) | (x >> (64 - k));
 }
 
-SECP256K1_INLINE static uint64_t secp256k1_testrand64(void) {
+SECP256K1_INLINE static uint64_t testrand64(void) {
     /* Test-only Xoshiro256++ RNG. See https://prng.di.unimi.it/ */
     const uint64_t result = rotl(secp256k1_test_state[0] + secp256k1_test_state[3], 23) + secp256k1_test_state[0];
     const uint64_t t = secp256k1_test_state[1] << 17;
@@ -53,16 +53,16 @@ SECP256K1_INLINE static uint64_t secp256k1_testrand64(void) {
     return result;
 }
 
-SECP256K1_INLINE static uint64_t secp256k1_testrand_bits(int bits) {
+SECP256K1_INLINE static uint64_t testrand_bits(int bits) {
     if (bits == 0) return 0;
-    return secp256k1_testrand64() >> (64 - bits);
+    return testrand64() >> (64 - bits);
 }
 
-SECP256K1_INLINE static uint32_t secp256k1_testrand32(void) {
-    return secp256k1_testrand64() >> 32;
+SECP256K1_INLINE static uint32_t testrand32(void) {
+    return testrand64() >> 32;
 }
 
-static uint32_t secp256k1_testrand_int(uint32_t range) {
+static uint32_t testrand_int(uint32_t range) {
     uint32_t mask = 0;
     uint32_t range_copy;
     /* Reduce range by 1, changing its meaning to "maximum value". */
@@ -76,15 +76,15 @@ static uint32_t secp256k1_testrand_int(uint32_t range) {
     }
     /* Generation loop. */
     while (1) {
-        uint32_t val = secp256k1_testrand64() & mask;
+        uint32_t val = testrand64() & mask;
         if (val <= range) return val;
     }
 }
 
-static void secp256k1_testrand256(unsigned char *b32) {
+static void testrand256(unsigned char *b32) {
     int i;
     for (i = 0; i < 4; ++i) {
-        uint64_t val = secp256k1_testrand64();
+        uint64_t val = testrand64();
         b32[0] = val;
         b32[1] = val >> 8;
         b32[2] = val >> 16;
@@ -97,14 +97,14 @@ static void secp256k1_testrand256(unsigned char *b32) {
     }
 }
 
-static void secp256k1_testrand_bytes_test(unsigned char *bytes, size_t len) {
+static void testrand_bytes_test(unsigned char *bytes, size_t len) {
     size_t bits = 0;
     memset(bytes, 0, len);
     while (bits < len * 8) {
         int now;
         uint32_t val;
-        now = 1 + (secp256k1_testrand_bits(6) * secp256k1_testrand_bits(5) + 16) / 31;
-        val = secp256k1_testrand_bits(1);
+        now = 1 + (testrand_bits(6) * testrand_bits(5) + 16) / 31;
+        val = testrand_bits(1);
         while (now > 0 && bits < len * 8) {
             bytes[bits / 8] |= val << (bits % 8);
             now--;
@@ -113,15 +113,15 @@ static void secp256k1_testrand_bytes_test(unsigned char *bytes, size_t len) {
     }
 }
 
-static void secp256k1_testrand256_test(unsigned char *b32) {
-    secp256k1_testrand_bytes_test(b32, 32);
+static void testrand256_test(unsigned char *b32) {
+    testrand_bytes_test(b32, 32);
 }
 
-static void secp256k1_testrand_flip(unsigned char *b, size_t len) {
-    b[secp256k1_testrand_int(len)] ^= (1 << secp256k1_testrand_bits(3));
+static void testrand_flip(unsigned char *b, size_t len) {
+    b[testrand_int(len)] ^= (1 << testrand_bits(3));
 }
 
-static void secp256k1_testrand_init(const char* hexseed) {
+static void testrand_init(const char* hexseed) {
     unsigned char seed16[16] = {0};
     if (hexseed && strlen(hexseed) != 0) {
         int pos = 0;
@@ -155,12 +155,12 @@ static void secp256k1_testrand_init(const char* hexseed) {
     }
 
     printf("random seed = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", seed16[0], seed16[1], seed16[2], seed16[3], seed16[4], seed16[5], seed16[6], seed16[7], seed16[8], seed16[9], seed16[10], seed16[11], seed16[12], seed16[13], seed16[14], seed16[15]);
-    secp256k1_testrand_seed(seed16);
+    testrand_seed(seed16);
 }
 
-static void secp256k1_testrand_finish(void) {
+static void testrand_finish(void) {
     unsigned char run32[32];
-    secp256k1_testrand256(run32);
+    testrand256(run32);
     printf("random run = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", run32[0], run32[1], run32[2], run32[3], run32[4], run32[5], run32[6], run32[7], run32[8], run32[9], run32[10], run32[11], run32[12], run32[13], run32[14], run32[15]);
 }
 
diff --git a/src/secp256k1/src/tests.c b/src/secp256k1/src/tests.c
index dab47608c2..6b401e52c0 100644
--- a/src/secp256k1/src/tests.c
+++ b/src/secp256k1/src/tests.c
@@ -96,122 +96,6 @@ static void uncounting_illegal_callback_fn(const char* str, void* data) {
     (*p)--;
 }
 
-static void random_field_element_magnitude(secp256k1_fe *fe, int m) {
-    secp256k1_fe zero;
-    int n = secp256k1_testrand_int(m + 1);
-    secp256k1_fe_normalize(fe);
-    if (n == 0) {
-        return;
-    }
-    secp256k1_fe_clear(&zero);
-    secp256k1_fe_negate(&zero, &zero, 0);
-    secp256k1_fe_mul_int_unchecked(&zero, n - 1);
-    secp256k1_fe_add(fe, &zero);
-#ifdef VERIFY
-    CHECK(fe->magnitude == n);
-#endif
-}
-
-static void random_fe_test(secp256k1_fe *x) {
-    unsigned char bin[32];
-    do {
-        secp256k1_testrand256_test(bin);
-        if (secp256k1_fe_set_b32_limit(x, bin)) {
-            return;
-        }
-    } while(1);
-}
-
-static void random_fe_non_zero_test(secp256k1_fe *fe) {
-    do {
-        random_fe_test(fe);
-    } while(secp256k1_fe_is_zero(fe));
-}
-
-static void random_fe_magnitude(secp256k1_fe *fe) {
-    random_field_element_magnitude(fe, 8);
-}
-
-static void random_ge_x_magnitude(secp256k1_ge *ge) {
-    random_field_element_magnitude(&ge->x, SECP256K1_GE_X_MAGNITUDE_MAX);
-}
-
-static void random_ge_y_magnitude(secp256k1_ge *ge) {
-    random_field_element_magnitude(&ge->y, SECP256K1_GE_Y_MAGNITUDE_MAX);
-}
-
-static void random_gej_x_magnitude(secp256k1_gej *gej) {
-    random_field_element_magnitude(&gej->x, SECP256K1_GEJ_X_MAGNITUDE_MAX);
-}
-
-static void random_gej_y_magnitude(secp256k1_gej *gej) {
-    random_field_element_magnitude(&gej->y, SECP256K1_GEJ_Y_MAGNITUDE_MAX);
-}
-
-static void random_gej_z_magnitude(secp256k1_gej *gej) {
-    random_field_element_magnitude(&gej->z, SECP256K1_GEJ_Z_MAGNITUDE_MAX);
-}
-
-static void random_group_element_test(secp256k1_ge *ge) {
-    secp256k1_fe fe;
-    do {
-        random_fe_test(&fe);
-        if (secp256k1_ge_set_xo_var(ge, &fe, secp256k1_testrand_bits(1))) {
-            secp256k1_fe_normalize(&ge->y);
-            break;
-        }
-    } while(1);
-    ge->infinity = 0;
-}
-
-static void random_group_element_jacobian_test(secp256k1_gej *gej, const secp256k1_ge *ge) {
-    secp256k1_fe z2, z3;
-    random_fe_non_zero_test(&gej->z);
-    secp256k1_fe_sqr(&z2, &gej->z);
-    secp256k1_fe_mul(&z3, &z2, &gej->z);
-    secp256k1_fe_mul(&gej->x, &ge->x, &z2);
-    secp256k1_fe_mul(&gej->y, &ge->y, &z3);
-    gej->infinity = ge->infinity;
-}
-
-static void random_gej_test(secp256k1_gej *gej) {
-    secp256k1_ge ge;
-    random_group_element_test(&ge);
-    random_group_element_jacobian_test(gej, &ge);
-}
-
-static void random_scalar_order_test(secp256k1_scalar *num) {
-    do {
-        unsigned char b32[32];
-        int overflow = 0;
-        secp256k1_testrand256_test(b32);
-        secp256k1_scalar_set_b32(num, b32, &overflow);
-        if (overflow || secp256k1_scalar_is_zero(num)) {
-            continue;
-        }
-        break;
-    } while(1);
-}
-
-static void random_scalar_order(secp256k1_scalar *num) {
-    do {
-        unsigned char b32[32];
-        int overflow = 0;
-        secp256k1_testrand256(b32);
-        secp256k1_scalar_set_b32(num, b32, &overflow);
-        if (overflow || secp256k1_scalar_is_zero(num)) {
-            continue;
-        }
-        break;
-    } while(1);
-}
-
-static void random_scalar_order_b32(unsigned char *b32) {
-    secp256k1_scalar num;
-    random_scalar_order(&num);
-    secp256k1_scalar_get_b32(b32, &num);
-}
-
 static void run_xoshiro256pp_tests(void) {
     {
         size_t i;
@@ -233,9 +117,9 @@ static void run_xoshiro256pp_tests(void) {
             0x4C, 0xCC, 0xC1, 0x18, 0xB2, 0xD8, 0x8F, 0xEF,
             0x43, 0x26, 0x15, 0x57, 0x37, 0x00, 0xEF, 0x30,
         };
-        secp256k1_testrand_seed(seed16);
+        testrand_seed(seed16);
         for (i = 0; i < 17; i++) {
-            secp256k1_testrand256(buf32);
+            testrand256(buf32);
         }
         CHECK(secp256k1_memcmp_var(buf32, buf32_expected, sizeof(buf32)) == 0);
     }
@@ -444,14 +328,14 @@ static void run_proper_context_tests(int use_prealloc) {
     CHECK(context_eq(my_ctx, my_ctx_fresh));
 
     /*** attempt to use them ***/
-    random_scalar_order_test(&msg);
-    random_scalar_order_test(&key);
+    testutil_random_scalar_order_test(&msg);
+    testutil_random_scalar_order_test(&key);
     secp256k1_ecmult_gen(&my_ctx->ecmult_gen_ctx, &pubj, &key);
     secp256k1_ge_set_gej(&pub, &pubj);
 
     /* obtain a working nonce */
     do {
-        random_scalar_order_test(&nonce);
+        testutil_random_scalar_order_test(&nonce);
     } while(!secp256k1_ecdsa_sig_sign(&my_ctx->ecmult_gen_ctx, &sigr, &sigs, &key, &msg, &nonce, NULL));
 
     /* try signing */
@@ -608,7 +492,7 @@ static void run_sha256_known_output_tests(void) {
         CHECK(secp256k1_memcmp_var(out, outputs[i], 32) == 0);
         /* 2. Run: split the input bytestrings randomly before writing */
         if (strlen(inputs[i]) > 0) {
-            int split = secp256k1_testrand_int(strlen(inputs[i]));
+            int split = testrand_int(strlen(inputs[i]));
             secp256k1_sha256_initialize(&hasher);
             j = repeat[i];
             while (j > 0) {
@@ -769,7 +653,7 @@ static void run_hmac_sha256_tests(void) {
         secp256k1_hmac_sha256_finalize(&hasher, out);
         CHECK(secp256k1_memcmp_var(out, outputs[i], 32) == 0);
         if (strlen(inputs[i]) > 0) {
-            int split = secp256k1_testrand_int(strlen(inputs[i]));
+            int split = testrand_int(strlen(inputs[i]));
             secp256k1_hmac_sha256_initialize(&hasher, (const unsigned char*)(keys[i]), strlen(keys[i]));
             secp256k1_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i]), split);
             secp256k1_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i] + split), strlen(inputs[i]) - split);
@@ -969,7 +853,7 @@ static void signed30_to_uint16(uint16_t* out, const secp256k1_modinv32_signed30*
 static void mutate_sign_signed30(secp256k1_modinv32_signed30* x) {
     int i;
     for (i = 0; i < 16; ++i) {
-        int pos = secp256k1_testrand_bits(3);
+        int pos = testrand_bits(3);
         if (x->v[pos] > 0 && x->v[pos + 1] <= 0x3fffffff) {
             x->v[pos] -= 0x40000000;
             x->v[pos + 1] += 1;
@@ -1061,7 +945,7 @@ static void mutate_sign_signed62(secp256k1_modinv64_signed62* x) {
     static const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
     int i;
     for (i = 0; i < 8; ++i) {
-        int pos = secp256k1_testrand_bits(2);
+        int pos = testrand_bits(2);
         if (x->v[pos] > 0 && x->v[pos + 1] <= M62) {
             x->v[pos] -= (M62 + 1);
             x->v[pos + 1] += 1;
@@ -1774,8 +1658,8 @@ static void run_modinv_tests(void) {
         /* generate random xd and md, so that md is odd, md>1, xd<md, and gcd(xd,md)=1 */
         do {
             /* generate random xd and md (with many subsequent 0s and 1s) */
-            secp256k1_testrand256_test((unsigned char*)xd);
-            secp256k1_testrand256_test((unsigned char*)md);
+            testrand256_test((unsigned char*)xd);
+            testrand256_test((unsigned char*)md);
             md[0] |= 1; /* modulus must be odd */
             /* If modulus is 1, find another one. */
             ok = md[0] != 1;
@@ -1907,7 +1791,7 @@ static void run_int128_test_case(void) {
     int i;
 
     /* Generate 32-byte random value. */
-    secp256k1_testrand256_test(buf);
+    testrand256_test(buf);
     /* Convert into 4 64-bit integers. */
     for (i = 0; i < 4; ++i) {
         uint64_t vi = 0;
@@ -2133,13 +2017,13 @@ static void scalar_test(void) {
     unsigned char c[32];
 
     /* Set 's' to a random scalar, with value 'snum'. */
-    random_scalar_order_test(&s);
+    testutil_random_scalar_order_test(&s);
 
     /* Set 's1' to a random scalar, with value 's1num'. */
-    random_scalar_order_test(&s1);
+    testutil_random_scalar_order_test(&s1);
 
     /* Set 's2' to a random scalar, with value 'snum2', and byte array representation 'c'. */
-    random_scalar_order_test(&s2);
+    testutil_random_scalar_order_test(&s2);
     secp256k1_scalar_get_b32(c, &s2);
 
     {
@@ -2167,7 +2051,7 @@ static void scalar_test(void) {
         while (i < 256) {
             secp256k1_scalar t;
             int j;
-            int now = secp256k1_testrand_int(15) + 1;
+            int now = testrand_int(15) + 1;
             if (now + i > 256) {
                 now = 256 - i;
             }
@@ -2194,7 +2078,7 @@ static void scalar_test(void) {
         secp256k1_scalar b;
         int i;
         /* Test add_bit. */
-        int bit = secp256k1_testrand_bits(8);
+        int bit = testrand_bits(8);
         secp256k1_scalar_set_int(&b, 1);
         CHECK(secp256k1_scalar_is_one(&b));
         for (i = 0; i < bit; i++) {
@@ -2287,7 +2171,7 @@ static void run_scalar_set_b32_seckey_tests(void) {
     secp256k1_scalar s2;
 
     /* Usually set_b32 and set_b32_seckey give the same result */
-    random_scalar_order_b32(b32);
+    testutil_random_scalar_order_b32(b32);
     secp256k1_scalar_set_b32(&s1, b32, NULL);
     CHECK(secp256k1_scalar_set_b32_seckey(&s2, b32) == 1);
     CHECK(secp256k1_scalar_eq(&s1, &s2) == 1);
@@ -2948,7 +2832,7 @@ static void run_scalar_tests(void) {
 
 static void random_fe_non_square(secp256k1_fe *ns) {
     secp256k1_fe r;
-    random_fe_non_zero(ns);
+    testutil_random_fe_non_zero(ns);
     if (secp256k1_fe_sqrt(&r, ns)) {
         secp256k1_fe_negate(ns, ns, 1);
     }
@@ -3125,12 +3009,12 @@ static void run_field_misc(void) {
     for (i = 0; i < 1000 * COUNT; i++) {
         secp256k1_fe_storage xs, ys, zs;
         if (i & 1) {
-            random_fe(&x);
+            testutil_random_fe(&x);
         } else {
-            random_fe_test(&x);
+            testutil_random_fe_test(&x);
         }
-        random_fe_non_zero(&y);
-        v = secp256k1_testrand_bits(15);
+        testutil_random_fe_non_zero(&y);
+        v = testrand_bits(15);
         /* Test that fe_add_int is equivalent to fe_set_int + fe_add. */
         secp256k1_fe_set_int(&q, v); /* q = v */
         z = x; /* z = x */
@@ -3268,14 +3152,14 @@ static void run_fe_mul(void) {
     int i;
     for (i = 0; i < 100 * COUNT; ++i) {
         secp256k1_fe a, b, c, d;
-        random_fe(&a);
-        random_fe_magnitude(&a);
-        random_fe(&b);
-        random_fe_magnitude(&b);
-        random_fe_test(&c);
-        random_fe_magnitude(&c);
-        random_fe_test(&d);
-        random_fe_magnitude(&d);
+        testutil_random_fe(&a);
+        testutil_random_fe_magnitude(&a, 8);
+        testutil_random_fe(&b);
+        testutil_random_fe_magnitude(&b, 8);
+        testutil_random_fe_test(&c);
+        testutil_random_fe_magnitude(&c, 8);
+        testutil_random_fe_test(&d);
+        testutil_random_fe_magnitude(&d, 8);
         test_fe_mul(&a, &a, 1);
         test_fe_mul(&c, &c, 1);
         test_fe_mul(&a, &b, 0);
@@ -3297,7 +3181,7 @@ static void run_sqr(void) {
         secp256k1_fe_normalize(&x);
 
         /* Check that (x+y)*(x-y) = x^2 - y*2 for some random values y */
-        random_fe_test(&y);
+        testutil_random_fe_test(&y);
 
         lhs = x;
         secp256k1_fe_add(&lhs, &y);         /* lhs = x+y */
@@ -3351,7 +3235,7 @@ static void run_sqrt(void) {
         int j;
         random_fe_non_square(&ns);
         for (j = 0; j < COUNT; j++) {
-            random_fe(&x);
+            testutil_random_fe(&x);
             secp256k1_fe_sqr(&s, &x);
             CHECK(secp256k1_fe_is_square_var(&s));
             test_sqrt(&s, &x);
@@ -3665,7 +3549,7 @@ static void run_inverse_tests(void)
     /* test 128*count random inputs; half with testrand256_test, half with testrand256 */
     for (testrand = 0; testrand <= 1; ++testrand) {
         for (i = 0; i < 64 * COUNT; ++i) {
-            (testrand ? secp256k1_testrand256_test : secp256k1_testrand256)(b32);
+            (testrand ? testrand256_test : testrand256)(b32);
             secp256k1_scalar_set_b32(&x_scalar, b32, NULL);
             secp256k1_fe_set_b32_mod(&x_fe, b32);
             for (var = 0; var <= 1; ++var) {
@@ -3731,8 +3615,8 @@ static void test_hsort(size_t element_len) {
 
     /* Test hsort with array of random length n */
     for (i = 0; i < COUNT; i++) {
-        int n = secp256k1_testrand_int(NUM);
-        secp256k1_testrand_bytes_test(elements, n*element_len);
+        int n = testrand_int(NUM);
+        testrand_bytes_test(elements, n*element_len);
         secp256k1_hsort(elements, n, element_len, test_hsort_cmp, &data);
         test_hsort_is_sorted(elements, n, element_len);
     }
@@ -3792,7 +3676,7 @@ static void test_ge(void) {
     for (i = 0; i < runs; i++) {
         int j, k;
         secp256k1_ge g;
-        random_group_element_test(&g);
+        testutil_random_ge_test(&g);
         if (i >= runs - 2) {
             secp256k1_ge_mul_lambda(&g, &ge[1]);
             CHECK(!secp256k1_ge_eq_var(&g, &ge[1]));
@@ -3805,15 +3689,15 @@ static void test_ge(void) {
         secp256k1_ge_neg(&ge[3 + 4 * i], &g);
         secp256k1_ge_neg(&ge[4 + 4 * i], &g);
         secp256k1_gej_set_ge(&gej[1 + 4 * i], &ge[1 + 4 * i]);
-        random_group_element_jacobian_test(&gej[2 + 4 * i], &ge[2 + 4 * i]);
+        testutil_random_ge_jacobian_test(&gej[2 + 4 * i], &ge[2 + 4 * i]);
         secp256k1_gej_set_ge(&gej[3 + 4 * i], &ge[3 + 4 * i]);
-        random_group_element_jacobian_test(&gej[4 + 4 * i], &ge[4 + 4 * i]);
+        testutil_random_ge_jacobian_test(&gej[4 + 4 * i], &ge[4 + 4 * i]);
         for (j = 0; j < 4; j++) {
-            random_ge_x_magnitude(&ge[1 + j + 4 * i]);
-            random_ge_y_magnitude(&ge[1 + j + 4 * i]);
-            random_gej_x_magnitude(&gej[1 + j + 4 * i]);
-            random_gej_y_magnitude(&gej[1 + j + 4 * i]);
-            random_gej_z_magnitude(&gej[1 + j + 4 * i]);
+            testutil_random_ge_x_magnitude(&ge[1 + j + 4 * i]);
+            testutil_random_ge_y_magnitude(&ge[1 + j + 4 * i]);
+            testutil_random_gej_x_magnitude(&gej[1 + j + 4 * i]);
+            testutil_random_gej_y_magnitude(&gej[1 + j + 4 * i]);
+            testutil_random_gej_z_magnitude(&gej[1 + j + 4 * i]);
         }
 
         for (j = 0; j < 4; ++j) {
@@ -3828,14 +3712,14 @@ static void test_ge(void) {
     }
 
     /* Generate random zf, and zfi2 = 1/zf^2, zfi3 = 1/zf^3 */
-    random_fe_non_zero_test(&zf);
-    random_fe_magnitude(&zf);
+    testutil_random_fe_non_zero_test(&zf);
+    testutil_random_fe_magnitude(&zf, 8);
     secp256k1_fe_inv_var(&zfi3, &zf);
     secp256k1_fe_sqr(&zfi2, &zfi3);
     secp256k1_fe_mul(&zfi3, &zfi3, &zfi2);
 
     /* Generate random r */
-    random_fe_non_zero_test(&r);
+    testutil_random_fe_non_zero_test(&r);
 
     for (i1 = 0; i1 < 1 + 4 * runs; i1++) {
         int i2;
@@ -3865,8 +3749,8 @@ static void test_ge(void) {
                 secp256k1_ge ge2_zfi = ge[i2]; /* the second term with x and y rescaled for z = 1/zf */
                 secp256k1_fe_mul(&ge2_zfi.x, &ge2_zfi.x, &zfi2);
                 secp256k1_fe_mul(&ge2_zfi.y, &ge2_zfi.y, &zfi3);
-                random_ge_x_magnitude(&ge2_zfi);
-                random_ge_y_magnitude(&ge2_zfi);
+                testutil_random_ge_x_magnitude(&ge2_zfi);
+                testutil_random_ge_y_magnitude(&ge2_zfi);
                 secp256k1_gej_add_zinv_var(&resj, &gej[i1], &ge2_zfi, &zf);
                 CHECK(secp256k1_gej_eq_ge_var(&resj, &ref));
             }
@@ -3922,7 +3806,7 @@ static void test_ge(void) {
             gej_shuffled[i] = gej[i];
         }
         for (i = 0; i < 4 * runs + 1; i++) {
-            int swap = i + secp256k1_testrand_int(4 * runs + 1 - i);
+            int swap = i + testrand_int(4 * runs + 1 - i);
             if (swap != i) {
                 secp256k1_gej t = gej_shuffled[i];
                 gej_shuffled[i] = gej_shuffled[swap];
@@ -3942,7 +3826,7 @@ static void test_ge(void) {
         secp256k1_ge_set_all_gej_var(ge_set_all, gej, 4 * runs + 1);
         for (i = 0; i < 4 * runs + 1; i++) {
             secp256k1_fe s;
-            random_fe_non_zero(&s);
+            testutil_random_fe_non_zero(&s);
             secp256k1_gej_rescale(&gej[i], &s);
             CHECK(secp256k1_gej_eq_ge_var(&gej[i], &ge_set_all[i]));
         }
@@ -3975,7 +3859,7 @@ static void test_ge(void) {
     /* Test batch gej -> ge conversion with many infinities. */
     for (i = 0; i < 4 * runs + 1; i++) {
         int odd;
-        random_group_element_test(&ge[i]);
+        testutil_random_ge_test(&ge[i]);
         odd = secp256k1_fe_is_odd(&ge[i].x);
         CHECK(odd == 0 || odd == 1);
         /* randomly set half the points to infinity */
@@ -4012,7 +3896,7 @@ static void test_intialized_inf(void) {
     secp256k1_fe zinv;
 
     /* Test that adding P+(-P) results in a fully initialized infinity*/
-    random_group_element_test(&p);
+    testutil_random_ge_test(&p);
     secp256k1_gej_set_ge(&pj, &p);
     secp256k1_gej_neg(&npj, &pj);
 
@@ -4125,14 +4009,14 @@ static void run_gej(void) {
         secp256k1_gej_set_infinity(&b);
         test_gej_cmov(&a, &b);
 
-        random_gej_test(&a);
+        testutil_random_gej_test(&a);
         test_gej_cmov(&a, &b);
         test_gej_cmov(&b, &a);
 
         b = a;
         test_gej_cmov(&a, &b);
 
-        random_gej_test(&b);
+        testutil_random_gej_test(&b);
         test_gej_cmov(&a, &b);
         test_gej_cmov(&b, &a);
     }
@@ -4140,12 +4024,12 @@ static void run_gej(void) {
     /* Tests for secp256k1_gej_eq_var */
     for (i = 0; i < COUNT; i++) {
         secp256k1_fe fe;
-        random_gej_test(&a);
-        random_gej_test(&b);
+        testutil_random_gej_test(&a);
+        testutil_random_gej_test(&b);
         CHECK(!secp256k1_gej_eq_var(&a, &b));
 
         b = a;
-        random_fe_non_zero_test(&fe);
+        testutil_random_fe_non_zero_test(&fe);
         secp256k1_gej_rescale(&a, &fe);
         CHECK(secp256k1_gej_eq_var(&a, &b));
     }
@@ -4162,7 +4046,7 @@ static void test_ec_combine(void) {
     int i;
     for (i = 1; i <= 6; i++) {
         secp256k1_scalar s;
-        random_scalar_order_test(&s);
+        testutil_random_scalar_order_test(&s);
         secp256k1_scalar_add(&sum, &sum, &s);
         secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &Qj, &s);
         secp256k1_ge_set_gej(&Q, &Qj);
@@ -4222,7 +4106,7 @@ static void run_group_decompress(void) {
     int i;
     for (i = 0; i < COUNT * 4; i++) {
         secp256k1_fe fe;
-        random_fe_test(&fe);
+        testutil_random_fe_test(&fe);
         test_group_decompress(&fe);
     }
 }
@@ -4370,7 +4254,7 @@ static void test_point_times_order(const secp256k1_gej *point) {
     secp256k1_ge res3;
     unsigned char pub[65];
     size_t psize = 65;
-    random_scalar_order_test(&x);
+    testutil_random_scalar_order_test(&x);
     secp256k1_scalar_negate(&nx, &x);
     secp256k1_ecmult(&res1, point, &x, &x); /* calc res1 = x * point + x * G; */
     secp256k1_ecmult(&res2, point, &nx, &nx); /* calc res2 = (order - x) * point + (order - x) * G; */
@@ -4431,13 +4315,13 @@ static void test_ecmult_target(const secp256k1_scalar* target, int mode) {
     secp256k1_gej pj, p1j, p2j, ptj;
 
     /* Generate random n1,n2 such that n1+n2 = -target. */
-    random_scalar_order_test(&n1);
+    testutil_random_scalar_order_test(&n1);
     secp256k1_scalar_add(&n2, &n1, target);
     secp256k1_scalar_negate(&n2, &n2);
 
     /* Generate a random input point. */
     if (mode != 0) {
-        random_group_element_test(&p);
+        testutil_random_ge_test(&p);
         secp256k1_gej_set_ge(&pj, &p);
     }
 
@@ -4529,8 +4413,8 @@ static void ecmult_const_commutativity(void) {
     secp256k1_gej res2;
     secp256k1_ge mid1;
     secp256k1_ge mid2;
-    random_scalar_order_test(&a);
-    random_scalar_order_test(&b);
+    testutil_random_scalar_order_test(&a);
+    testutil_random_scalar_order_test(&b);
 
     secp256k1_ecmult_const(&res1, &secp256k1_ge_const_g, &a);
     secp256k1_ecmult_const(&res2, &secp256k1_ge_const_g, &b);
@@ -4551,9 +4435,9 @@ static void ecmult_const_mult_zero_one(void) {
     secp256k1_ge point;
     secp256k1_ge inf;
 
-    random_scalar_order_test(&s);
+    testutil_random_scalar_order_test(&s);
     secp256k1_scalar_negate(&negone, &secp256k1_scalar_one);
-    random_group_element_test(&point);
+    testutil_random_ge_test(&point);
     secp256k1_ge_set_infinity(&inf);
 
     /* 0*point */
@@ -4606,7 +4490,7 @@ static void ecmult_const_edges(void) {
             secp256k1_scalar_add(&q, &q, &scalars_near_split_bounds[i - 1]);
             secp256k1_scalar_add(&q, &q, &scalars_near_split_bounds[i - 1]);
         }
-        random_group_element_test(&point);
+        testutil_random_ge_test(&point);
         secp256k1_ecmult_const(&res, &point, &q);
         ecmult_const_check_result(&point, &q, &res);
     }
@@ -4623,12 +4507,12 @@ static void ecmult_const_mult_xonly(void) {
         secp256k1_scalar q;
         int res;
         /* Random base point. */
-        random_group_element_test(&base);
+        testutil_random_ge_test(&base);
         /* Random scalar to multiply it with. */
-        random_scalar_order_test(&q);
+        testutil_random_scalar_order_test(&q);
         /* If i is odd, n=d*base.x for random non-zero d */
         if (i & 1) {
-            random_fe_non_zero_test(&d);
+            testutil_random_fe_non_zero_test(&d);
             secp256k1_fe_mul(&n, &base.x, &d);
         } else {
             n = base.x;
@@ -4650,14 +4534,14 @@ static void ecmult_const_mult_xonly(void) {
         secp256k1_fe x, n, d, r;
         int res;
         secp256k1_scalar q;
-        random_scalar_order_test(&q);
+        testutil_random_scalar_order_test(&q);
         /* Generate random X coordinate not on the curve. */
         do {
-            random_fe_test(&x);
+            testutil_random_fe_test(&x);
         } while (secp256k1_ge_x_on_curve_var(&x));
         /* If i is odd, n=d*x for random non-zero d. */
         if (i & 1) {
-            random_fe_non_zero_test(&d);
+            testutil_random_fe_non_zero_test(&d);
             secp256k1_fe_mul(&n, &x, &d);
         } else {
             n = x;
@@ -4740,10 +4624,10 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
     for (ncount = 0; ncount < COUNT; ncount++) {
         secp256k1_ge ptg;
         secp256k1_gej ptgj;
-        random_scalar_order(&sc[0]);
-        random_scalar_order(&sc[1]);
+        testutil_random_scalar_order(&sc[0]);
+        testutil_random_scalar_order(&sc[1]);
 
-        random_group_element_test(&ptg);
+        testutil_random_ge_test(&ptg);
         secp256k1_gej_set_ge(&ptgj, &ptg);
         pt[0] = ptg;
         pt[1] = secp256k1_ge_const_g;
@@ -4780,7 +4664,7 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
 
         for (j = 0; j < 3; j++) {
             for (i = 0; i < 32; i++) {
-                random_scalar_order(&sc[i]);
+                testutil_random_scalar_order(&sc[i]);
                 secp256k1_ge_set_infinity(&pt[i]);
             }
             CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &secp256k1_scalar_zero, ecmult_multi_callback, &data, sizes[j]));
@@ -4789,7 +4673,7 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
 
         for (j = 0; j < 3; j++) {
             for (i = 0; i < 32; i++) {
-                random_group_element_test(&ptg);
+                testutil_random_ge_test(&ptg);
                 pt[i] = ptg;
                 secp256k1_scalar_set_int(&sc[i], 0);
             }
@@ -4798,9 +4682,9 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
         }
 
         for (j = 0; j < 3; j++) {
-            random_group_element_test(&ptg);
+            testutil_random_ge_test(&ptg);
             for (i = 0; i < 16; i++) {
-                random_scalar_order(&sc[2*i]);
+                testutil_random_scalar_order(&sc[2*i]);
                 secp256k1_scalar_negate(&sc[2*i + 1], &sc[2*i]);
                 pt[2 * i] = ptg;
                 pt[2 * i + 1] = ptg;
@@ -4809,9 +4693,9 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
             CHECK(ecmult_multi(&CTX->error_callback, scratch, &r, &secp256k1_scalar_zero, ecmult_multi_callback, &data, sizes[j]));
             CHECK(secp256k1_gej_is_infinity(&r));
 
-            random_scalar_order(&sc[0]);
+            testutil_random_scalar_order(&sc[0]);
             for (i = 0; i < 16; i++) {
-                random_group_element_test(&ptg);
+                testutil_random_ge_test(&ptg);
 
                 sc[2*i] = sc[0];
                 sc[2*i+1] = sc[0];
@@ -4823,13 +4707,13 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
             CHECK(secp256k1_gej_is_infinity(&r));
         }
 
-        random_group_element_test(&ptg);
+        testutil_random_ge_test(&ptg);
         secp256k1_scalar_set_int(&sc[0], 0);
         pt[0] = ptg;
         for (i = 1; i < 32; i++) {
             pt[i] = ptg;
 
-            random_scalar_order(&sc[i]);
+            testutil_random_scalar_order(&sc[i]);
             secp256k1_scalar_add(&sc[0], &sc[0], &sc[i]);
             secp256k1_scalar_negate(&sc[i], &sc[i]);
         }
@@ -4843,11 +4727,11 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
         size_t i;
         secp256k1_gej_set_infinity(&r);
 
-        random_scalar_order(&sc[0]);
+        testutil_random_scalar_order(&sc[0]);
         for (i = 0; i < 20; i++) {
             secp256k1_ge ptg;
             sc[i] = sc[0];
-            random_group_element_test(&ptg);
+            testutil_random_ge_test(&ptg);
             pt[i] = ptg;
             secp256k1_gej_add_ge_var(&r, &r, &pt[i], NULL);
         }
@@ -4865,9 +4749,9 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
         secp256k1_scalar rs;
         secp256k1_scalar_set_int(&rs, 0);
 
-        random_group_element_test(&ptg);
+        testutil_random_ge_test(&ptg);
         for (i = 0; i < 20; i++) {
-            random_scalar_order(&sc[i]);
+            testutil_random_scalar_order(&sc[i]);
             pt[i] = ptg;
             secp256k1_scalar_add(&rs, &rs, &sc[i]);
         }
@@ -4880,8 +4764,8 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
 
     /* Sanity check that zero scalars don't cause problems */
     for (ncount = 0; ncount < 20; ncount++) {
-        random_scalar_order(&sc[ncount]);
-        random_group_element_test(&pt[ncount]);
+        testutil_random_scalar_order(&sc[ncount]);
+        testutil_random_ge_test(&pt[ncount]);
     }
 
     secp256k1_scalar_clear(&sc[0]);
@@ -4902,7 +4786,7 @@ static void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi
         secp256k1_ge ptg;
         secp256k1_gej ptgj;
 
-        random_group_element_test(&ptg);
+        testutil_random_ge_test(&ptg);
         secp256k1_gej_set_ge(&ptgj, &ptg);
 
         for(t0i = 0; t0i < TOP; t0i++) {
@@ -4973,29 +4857,29 @@ static int test_ecmult_multi_random(secp256k1_scratch *scratch) {
 
     int i;
     /* Which multiplication function to use */
-    int fn = secp256k1_testrand_int(3);
+    int fn = testrand_int(3);
     secp256k1_ecmult_multi_func ecmult_multi = fn == 0 ? secp256k1_ecmult_multi_var :
                                                fn == 1 ? secp256k1_ecmult_strauss_batch_single :
                                                secp256k1_ecmult_pippenger_batch_single;
     /* Simulate exponentially distributed num. */
-    int num_bits = 2 + secp256k1_testrand_int(6);
+    int num_bits = 2 + testrand_int(6);
     /* Number of (scalar, point) inputs (excluding g). */
-    int num = secp256k1_testrand_int((1 << num_bits) + 1);
+    int num = testrand_int((1 << num_bits) + 1);
     /* Number of those which are nonzero. */
-    int num_nonzero = secp256k1_testrand_int(num + 1);
+    int num_nonzero = testrand_int(num + 1);
     /* Whether we're aiming to create an input with nonzero expected result. */
-    int nonzero_result = secp256k1_testrand_bits(1);
+    int nonzero_result = testrand_bits(1);
     /* Whether we will provide nonzero g multiplicand. In some cases our hand
      * is forced here based on num_nonzero and nonzero_result. */
     int g_nonzero = num_nonzero == 0 ? nonzero_result :
                     num_nonzero == 1 && !nonzero_result ? 1 :
-                    (int)secp256k1_testrand_bits(1);
+                    (int)testrand_bits(1);
     /* Which g_scalar pointer to pass into ecmult_multi(). */
-    const secp256k1_scalar* g_scalar_ptr = (g_nonzero || secp256k1_testrand_bits(1)) ? &g_scalar : NULL;
+    const secp256k1_scalar* g_scalar_ptr = (g_nonzero || testrand_bits(1)) ? &g_scalar : NULL;
     /* How many EC multiplications were performed in this function. */
     int mults = 0;
     /* How many randomization steps to apply to the input list. */
-    int rands = (int)secp256k1_testrand_bits(3);
+    int rands = (int)testrand_bits(3);
     if (rands > num_nonzero) rands = num_nonzero;
 
     secp256k1_gej_set_infinity(&expected);
@@ -5004,11 +4888,11 @@ static int test_ecmult_multi_random(secp256k1_scratch *scratch) {
 
     if (g_nonzero) {
         /* If g_nonzero, set g_scalar to nonzero value r. */
-        random_scalar_order_test(&g_scalar);
+        testutil_random_scalar_order_test(&g_scalar);
         if (!nonzero_result) {
             /* If expected=0 is desired, add a (a*r, -(1/a)*g) term to compensate. */
             CHECK(num_nonzero > filled);
-            random_scalar_order_test(&sc_tmp);
+            testutil_random_scalar_order_test(&sc_tmp);
             secp256k1_scalar_mul(&scalars[filled], &sc_tmp, &g_scalar);
             secp256k1_scalar_inverse_var(&sc_tmp, &sc_tmp);
             secp256k1_scalar_negate(&sc_tmp, &sc_tmp);
@@ -5020,8 +4904,8 @@ static int test_ecmult_multi_random(secp256k1_scratch *scratch) {
 
     if (nonzero_result && filled < num_nonzero) {
         /* If a nonzero result is desired, and there is space, add a random nonzero term. */
-        random_scalar_order_test(&scalars[filled]);
-        random_group_element_test(&ge_tmp);
+        testutil_random_scalar_order_test(&scalars[filled]);
+        testutil_random_ge_test(&ge_tmp);
         secp256k1_gej_set_ge(&gejs[filled], &ge_tmp);
         ++filled;
     }
@@ -5040,12 +4924,12 @@ static int test_ecmult_multi_random(secp256k1_scratch *scratch) {
     /* Add entries to scalars,gejs so that there are num of them. All the added entries
      * either have scalar=0 or point=infinity, so these do not change the expected result. */
     while (filled < num) {
-        if (secp256k1_testrand_bits(1)) {
+        if (testrand_bits(1)) {
             secp256k1_gej_set_infinity(&gejs[filled]);
-            random_scalar_order_test(&scalars[filled]);
+            testutil_random_scalar_order_test(&scalars[filled]);
         } else {
             secp256k1_scalar_set_int(&scalars[filled], 0);
-            random_group_element_test(&ge_tmp);
+            testutil_random_ge_test(&ge_tmp);
             secp256k1_gej_set_ge(&gejs[filled], &ge_tmp);
         }
         ++filled;
@@ -5059,7 +4943,7 @@ static int test_ecmult_multi_random(secp256k1_scratch *scratch) {
         secp256k1_scalar v, iv;
         /* Shuffle the entries. */
         for (j = 0; j < num_nonzero; ++j) {
-            int k = secp256k1_testrand_int(num_nonzero - j);
+            int k = testrand_int(num_nonzero - j);
             if (k != 0) {
                 secp256k1_gej gej = gejs[j];
                 secp256k1_scalar sc = scalars[j];
@@ -5079,7 +4963,7 @@ static int test_ecmult_multi_random(secp256k1_scratch *scratch) {
         }
         /* Transform the last input: a*P -> (v*a) * ((1/v)*P). */
         CHECK(num_nonzero >= 1);
-        random_scalar_order_test(&v);
+        testutil_random_scalar_order_test(&v);
         secp256k1_scalar_inverse(&iv, &v);
         secp256k1_scalar_mul(&scalars[num_nonzero - 1], &scalars[num_nonzero - 1], &v);
         secp256k1_ecmult(&gejs[num_nonzero - 1], &gejs[num_nonzero - 1], &iv, NULL);
@@ -5088,7 +4972,7 @@ static int test_ecmult_multi_random(secp256k1_scratch *scratch) {
 
     /* Shuffle all entries (0..num-1). */
     for (i = 0; i < num; ++i) {
-        int j = secp256k1_testrand_int(num - i);
+        int j = testrand_int(num - i);
         if (j != 0) {
             secp256k1_gej gej = gejs[i];
             secp256k1_scalar sc = scalars[i];
@@ -5118,8 +5002,8 @@ static void test_ecmult_multi_batch_single(secp256k1_ecmult_multi_func ecmult_mu
     ecmult_multi_data data;
     secp256k1_scratch *scratch_empty;
 
-    random_group_element_test(&pt);
-    random_scalar_order(&sc);
+    testutil_random_ge_test(&pt);
+    testutil_random_scalar_order(&sc);
     data.sc = &sc;
     data.pt = &pt;
 
@@ -5150,7 +5034,7 @@ static void test_secp256k1_pippenger_bucket_window_inv(void) {
  * for a given scratch space.
  */
 static void test_ecmult_multi_pippenger_max_points(void) {
-    size_t scratch_size = secp256k1_testrand_bits(8);
+    size_t scratch_size = testrand_bits(8);
     size_t max_size = secp256k1_pippenger_scratch_size(secp256k1_pippenger_bucket_window_inv(PIPPENGER_MAX_BUCKET_WINDOW-1)+512, 12);
     secp256k1_scratch *scratch;
     size_t n_points_supported;
@@ -5244,15 +5128,15 @@ static void test_ecmult_multi_batching(void) {
     secp256k1_gej_set_infinity(&r2);
 
     /* Get random scalars and group elements and compute result */
-    random_scalar_order(&scG);
+    testutil_random_scalar_order(&scG);
     secp256k1_ecmult(&r2, &r2, &secp256k1_scalar_zero, &scG);
     for(i = 0; i < n_points; i++) {
         secp256k1_ge ptg;
         secp256k1_gej ptgj;
-        random_group_element_test(&ptg);
+        testutil_random_ge_test(&ptg);
         secp256k1_gej_set_ge(&ptgj, &ptg);
         pt[i] = ptg;
-        random_scalar_order(&sc[i]);
+        testutil_random_scalar_order(&sc[i]);
         secp256k1_ecmult(&ptgj, &ptgj, &sc[i], NULL);
         secp256k1_gej_add_var(&r2, &r2, &ptgj, NULL);
     }
@@ -5464,7 +5348,7 @@ static void run_wnaf(void) {
     test_fixed_wnaf_small();
     /* Random tests */
     for (i = 0; i < COUNT; i++) {
-        random_scalar_order(&n);
+        testutil_random_scalar_order(&n);
         test_wnaf(&n, 4+(i%10));
         test_fixed_wnaf(&n, 4 + (i % 10));
     }
@@ -5645,9 +5529,9 @@ static void test_ecmult_gen_blind(void) {
     secp256k1_gej pgej2;
     secp256k1_ge p;
     secp256k1_ge pge;
-    random_scalar_order_test(&key);
+    testutil_random_scalar_order_test(&key);
     secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &pgej, &key);
-    secp256k1_testrand256(seed32);
+    testrand256(seed32);
     b = CTX->ecmult_gen_ctx.scalar_offset;
     p = CTX->ecmult_gen_ctx.ge_offset;
     secp256k1_ecmult_gen_blind(&CTX->ecmult_gen_ctx, seed32);
@@ -5741,7 +5625,7 @@ static void run_endomorphism_tests(void) {
 
     for (i = 0; i < 100U * COUNT; ++i) {
         secp256k1_scalar full;
-        random_scalar_order_test(&full);
+        testutil_random_scalar_order_test(&full);
         test_scalar_split(&full);
     }
     for (i = 0; i < sizeof(scalars_near_split_bounds) / sizeof(scalars_near_split_bounds[0]); ++i) {
@@ -6327,7 +6211,7 @@ static void run_eckey_negate_test(void) {
     unsigned char seckey[32];
     unsigned char seckey_tmp[32];
 
-    random_scalar_order_b32(seckey);
+    testutil_random_scalar_order_b32(seckey);
     memcpy(seckey_tmp, seckey, 32);
 
     /* Verify negation changes the key and changes it back */
@@ -6351,7 +6235,7 @@ static void run_eckey_negate_test(void) {
     /* Negating an overflowing seckey fails and the seckey is zeroed. In this
      * test, the seckey has 16 random bytes to ensure that ec_seckey_negate
      * doesn't just set seckey to a constant value in case of failure. */
-    random_scalar_order_b32(seckey);
+    testutil_random_scalar_order_b32(seckey);
     memset(seckey, 0xFF, 16);
     memset(seckey_tmp, 0, 32);
     CHECK(secp256k1_ec_seckey_negate(CTX, seckey) == 0);
@@ -6361,7 +6245,7 @@ static void run_eckey_negate_test(void) {
 static void random_sign(secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *key, const secp256k1_scalar *msg, int *recid) {
     secp256k1_scalar nonce;
     do {
-        random_scalar_order_test(&nonce);
+        testutil_random_scalar_order_test(&nonce);
     } while(!secp256k1_ecdsa_sig_sign(&CTX->ecmult_gen_ctx, sigr, sigs, key, msg, &nonce, recid));
 }
 
@@ -6373,11 +6257,11 @@ static void test_ecdsa_sign_verify(void) {
     secp256k1_scalar sigr, sigs;
     int getrec;
     int recid;
-    random_scalar_order_test(&msg);
-    random_scalar_order_test(&key);
+    testutil_random_scalar_order_test(&msg);
+    testutil_random_scalar_order_test(&key);
     secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &pubj, &key);
     secp256k1_ge_set_gej(&pub, &pubj);
-    getrec = secp256k1_testrand_bits(1);
+    getrec = testrand_bits(1);
     /* The specific way in which this conditional is written sidesteps a potential bug in clang.
        See the commit messages of the commit that introduced this comment for details. */
     if (getrec) {
@@ -6470,8 +6354,8 @@ static void test_ecdsa_end_to_end(void) {
     /* Generate a random key and message. */
     {
         secp256k1_scalar msg, key;
-        random_scalar_order_test(&msg);
-        random_scalar_order_test(&key);
+        testutil_random_scalar_order_test(&msg);
+        testutil_random_scalar_order_test(&key);
         secp256k1_scalar_get_b32(privkey, &key);
         secp256k1_scalar_get_b32(message, &msg);
     }
@@ -6481,7 +6365,7 @@ static void test_ecdsa_end_to_end(void) {
     CHECK(secp256k1_ec_pubkey_create(CTX, &pubkey, privkey) == 1);
 
     /* Verify exporting and importing public key. */
-    CHECK(secp256k1_ec_pubkey_serialize(CTX, pubkeyc, &pubkeyclen, &pubkey, secp256k1_testrand_bits(1) == 1 ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED));
+    CHECK(secp256k1_ec_pubkey_serialize(CTX, pubkeyc, &pubkeyclen, &pubkey, testrand_bits(1) == 1 ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED));
     memset(&pubkey, 0, sizeof(pubkey));
     CHECK(secp256k1_ec_pubkey_parse(CTX, &pubkey, pubkeyc, pubkeyclen) == 1);
 
@@ -6493,19 +6377,19 @@ static void test_ecdsa_end_to_end(void) {
     CHECK(secp256k1_memcmp_var(&pubkey_tmp, &pubkey, sizeof(pubkey)) == 0);
 
     /* Verify private key import and export. */
-    CHECK(ec_privkey_export_der(CTX, seckey, &seckeylen, privkey, secp256k1_testrand_bits(1) == 1));
+    CHECK(ec_privkey_export_der(CTX, seckey, &seckeylen, privkey, testrand_bits(1) == 1));
     CHECK(ec_privkey_import_der(CTX, privkey2, seckey, seckeylen) == 1);
     CHECK(secp256k1_memcmp_var(privkey, privkey2, 32) == 0);
 
     /* Optionally tweak the keys using addition. */
-    if (secp256k1_testrand_int(3) == 0) {
+    if (testrand_int(3) == 0) {
         int ret1;
         int ret2;
         int ret3;
         unsigned char rnd[32];
         unsigned char privkey_tmp[32];
         secp256k1_pubkey pubkey2;
-        secp256k1_testrand256_test(rnd);
+        testrand256_test(rnd);
         memcpy(privkey_tmp, privkey, 32);
         ret1 = secp256k1_ec_seckey_tweak_add(CTX, privkey, rnd);
         ret2 = secp256k1_ec_pubkey_tweak_add(CTX, &pubkey, rnd);
@@ -6522,14 +6406,14 @@ static void test_ecdsa_end_to_end(void) {
     }
 
     /* Optionally tweak the keys using multiplication. */
-    if (secp256k1_testrand_int(3) == 0) {
+    if (testrand_int(3) == 0) {
         int ret1;
         int ret2;
         int ret3;
         unsigned char rnd[32];
         unsigned char privkey_tmp[32];
         secp256k1_pubkey pubkey2;
-        secp256k1_testrand256_test(rnd);
+        testrand256_test(rnd);
         memcpy(privkey_tmp, privkey, 32);
         ret1 = secp256k1_ec_seckey_tweak_mul(CTX, privkey, rnd);
         ret2 = secp256k1_ec_pubkey_tweak_mul(CTX, &pubkey, rnd);
@@ -6591,7 +6475,7 @@ static void test_ecdsa_end_to_end(void) {
     /* Serialize/destroy/parse DER and verify again. */
     siglen = 74;
     CHECK(secp256k1_ecdsa_signature_serialize_der(CTX, sig, &siglen, &signature[0]) == 1);
-    sig[secp256k1_testrand_int(siglen)] += 1 + secp256k1_testrand_int(255);
+    sig[testrand_int(siglen)] += 1 + testrand_int(255);
     CHECK(secp256k1_ecdsa_signature_parse_der(CTX, &signature[0], sig, siglen) == 0 ||
           secp256k1_ecdsa_verify(CTX, &signature[0], message, &pubkey) == 0);
 }
@@ -6601,23 +6485,23 @@ static void test_random_pubkeys(void) {
     secp256k1_ge elem2;
     unsigned char in[65];
     /* Generate some randomly sized pubkeys. */
-    size_t len = secp256k1_testrand_bits(2) == 0 ? 65 : 33;
-    if (secp256k1_testrand_bits(2) == 0) {
-        len = secp256k1_testrand_bits(6);
+    size_t len = testrand_bits(2) == 0 ? 65 : 33;
+    if (testrand_bits(2) == 0) {
+        len = testrand_bits(6);
     }
     if (len == 65) {
-      in[0] = secp256k1_testrand_bits(1) ? 4 : (secp256k1_testrand_bits(1) ? 6 : 7);
+      in[0] = testrand_bits(1) ? 4 : (testrand_bits(1) ? 6 : 7);
     } else {
-      in[0] = secp256k1_testrand_bits(1) ? 2 : 3;
+      in[0] = testrand_bits(1) ? 2 : 3;
     }
-    if (secp256k1_testrand_bits(3) == 0) {
-        in[0] = secp256k1_testrand_bits(8);
+    if (testrand_bits(3) == 0) {
+        in[0] = testrand_bits(8);
     }
     if (len > 1) {
-        secp256k1_testrand256(&in[1]);
+        testrand256(&in[1]);
     }
     if (len > 33) {
-        secp256k1_testrand256(&in[33]);
+        testrand256(&in[33]);
     }
     if (secp256k1_eckey_pubkey_parse(&elem, in, len)) {
         unsigned char out[65];
@@ -6639,7 +6523,7 @@ static void test_random_pubkeys(void) {
         CHECK(secp256k1_eckey_pubkey_parse(&elem2, in, size));
         CHECK(secp256k1_ge_eq_var(&elem2, &elem));
         /* Check that the X9.62 hybrid type is checked. */
-        in[0] = secp256k1_testrand_bits(1) ? 6 : 7;
+        in[0] = testrand_bits(1) ? 6 : 7;
         res = secp256k1_eckey_pubkey_parse(&elem2, in, size);
         if (firstb == 2 || firstb == 3) {
             if (in[0] == firstb + 4) {
@@ -6718,7 +6602,7 @@ static void permute(size_t *arr, size_t n) {
     size_t i;
     for (i = n - 1; i >= 1; i--) {
         size_t tmp, j;
-        j = secp256k1_testrand_int(i + 1);
+        j = testrand_int(i + 1);
         tmp = arr[i];
         arr[i] = arr[j];
         arr[j] = tmp;
@@ -6728,7 +6612,7 @@ static void permute(size_t *arr, size_t n) {
 static void rand_pk(secp256k1_pubkey *pk) {
     unsigned char seckey[32];
     secp256k1_keypair keypair;
-    secp256k1_testrand256(seckey);
+    testrand256(seckey);
     CHECK(secp256k1_keypair_create(CTX, &keypair, seckey) == 1);
     CHECK(secp256k1_keypair_pub(CTX, pk, &keypair) == 1);
 }
@@ -6944,27 +6828,27 @@ static void assign_big_endian(unsigned char *ptr, size_t ptrlen, uint32_t val) {
 
 static void damage_array(unsigned char *sig, size_t *len) {
     int pos;
-    int action = secp256k1_testrand_bits(3);
+    int action = testrand_bits(3);
     if (action < 1 && *len > 3) {
         /* Delete a byte. */
-        pos = secp256k1_testrand_int(*len);
+        pos = testrand_int(*len);
         memmove(sig + pos, sig + pos + 1, *len - pos - 1);
         (*len)--;
         return;
     } else if (action < 2 && *len < 2048) {
         /* Insert a byte. */
-        pos = secp256k1_testrand_int(1 + *len);
+        pos = testrand_int(1 + *len);
         memmove(sig + pos + 1, sig + pos, *len - pos);
-        sig[pos] = secp256k1_testrand_bits(8);
+        sig[pos] = testrand_bits(8);
         (*len)++;
         return;
     } else if (action < 4) {
         /* Modify a byte. */
-        sig[secp256k1_testrand_int(*len)] += 1 + secp256k1_testrand_int(255);
+        sig[testrand_int(*len)] += 1 + testrand_int(255);
         return;
     } else { /* action < 8 */
         /* Modify a bit. */
-        sig[secp256k1_testrand_int(*len)] ^= 1 << secp256k1_testrand_bits(3);
+        sig[testrand_int(*len)] ^= 1 << testrand_bits(3);
         return;
     }
 }
@@ -6977,23 +6861,23 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     int n;
 
     *len = 0;
-    der = secp256k1_testrand_bits(2) == 0;
+    der = testrand_bits(2) == 0;
     *certainly_der = der;
     *certainly_not_der = 0;
-    indet = der ? 0 : secp256k1_testrand_int(10) == 0;
+    indet = der ? 0 : testrand_int(10) == 0;
 
     for (n = 0; n < 2; n++) {
         /* We generate two classes of numbers: nlow==1 "low" ones (up to 32 bytes), nlow==0 "high" ones (32 bytes with 129 top bits set, or larger than 32 bytes) */
-        nlow[n] = der ? 1 : (secp256k1_testrand_bits(3) != 0);
+        nlow[n] = der ? 1 : (testrand_bits(3) != 0);
         /* The length of the number in bytes (the first byte of which will always be nonzero) */
-        nlen[n] = nlow[n] ? secp256k1_testrand_int(33) : 32 + secp256k1_testrand_int(200) * secp256k1_testrand_bits(3) / 8;
+        nlen[n] = nlow[n] ? testrand_int(33) : 32 + testrand_int(200) * testrand_bits(3) / 8;
         CHECK(nlen[n] <= 232);
         /* The top bit of the number. */
-        nhbit[n] = (nlow[n] == 0 && nlen[n] == 32) ? 1 : (nlen[n] == 0 ? 0 : secp256k1_testrand_bits(1));
+        nhbit[n] = (nlow[n] == 0 && nlen[n] == 32) ? 1 : (nlen[n] == 0 ? 0 : testrand_bits(1));
         /* The top byte of the number (after the potential hardcoded 16 0xFF characters for "high" 32 bytes numbers) */
-        nhbyte[n] = nlen[n] == 0 ? 0 : (nhbit[n] ? 128 + secp256k1_testrand_bits(7) : 1 + secp256k1_testrand_int(127));
+        nhbyte[n] = nlen[n] == 0 ? 0 : (nhbit[n] ? 128 + testrand_bits(7) : 1 + testrand_int(127));
         /* The number of zero bytes in front of the number (which is 0 or 1 in case of DER, otherwise we extend up to 300 bytes) */
-        nzlen[n] = der ? ((nlen[n] == 0 || nhbit[n]) ? 1 : 0) : (nlow[n] ? secp256k1_testrand_int(3) : secp256k1_testrand_int(300 - nlen[n]) * secp256k1_testrand_bits(3) / 8);
+        nzlen[n] = der ? ((nlen[n] == 0 || nhbit[n]) ? 1 : 0) : (nlow[n] ? testrand_int(3) : testrand_int(300 - nlen[n]) * testrand_bits(3) / 8);
         if (nzlen[n] > ((nlen[n] == 0 || nhbit[n]) ? 1 : 0)) {
             *certainly_not_der = 1;
         }
@@ -7002,7 +6886,7 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
         nlenlen[n] = nlen[n] + nzlen[n] < 128 ? 0 : (nlen[n] + nzlen[n] < 256 ? 1 : 2);
         if (!der) {
             /* nlenlen[n] max 127 bytes */
-            int add = secp256k1_testrand_int(127 - nlenlen[n]) * secp256k1_testrand_bits(4) * secp256k1_testrand_bits(4) / 256;
+            int add = testrand_int(127 - nlenlen[n]) * testrand_bits(4) * testrand_bits(4) / 256;
             nlenlen[n] += add;
             if (add != 0) {
                 *certainly_not_der = 1;
@@ -7016,7 +6900,7 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     CHECK(tlen <= 856);
 
     /* The length of the garbage inside the tuple. */
-    elen = (der || indet) ? 0 : secp256k1_testrand_int(980 - tlen) * secp256k1_testrand_bits(3) / 8;
+    elen = (der || indet) ? 0 : testrand_int(980 - tlen) * testrand_bits(3) / 8;
     if (elen != 0) {
         *certainly_not_der = 1;
     }
@@ -7024,7 +6908,7 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     CHECK(tlen <= 980);
 
     /* The length of the garbage after the end of the tuple. */
-    glen = der ? 0 : secp256k1_testrand_int(990 - tlen) * secp256k1_testrand_bits(3) / 8;
+    glen = der ? 0 : testrand_int(990 - tlen) * testrand_bits(3) / 8;
     if (glen != 0) {
         *certainly_not_der = 1;
     }
@@ -7039,7 +6923,7 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     } else {
         int tlenlen = tlen < 128 ? 0 : (tlen < 256 ? 1 : 2);
         if (!der) {
-            int add = secp256k1_testrand_int(127 - tlenlen) * secp256k1_testrand_bits(4) * secp256k1_testrand_bits(4) / 256;
+            int add = testrand_int(127 - tlenlen) * testrand_bits(4) * testrand_bits(4) / 256;
             tlenlen += add;
             if (add != 0) {
                 *certainly_not_der = 1;
@@ -7090,13 +6974,13 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
             nlen[n]--;
         }
         /* Generate remaining random bytes of number */
-        secp256k1_testrand_bytes_test(sig + *len, nlen[n]);
+        testrand_bytes_test(sig + *len, nlen[n]);
         *len += nlen[n];
         nlen[n] = 0;
     }
 
     /* Generate random garbage inside tuple. */
-    secp256k1_testrand_bytes_test(sig + *len, elen);
+    testrand_bytes_test(sig + *len, elen);
     *len += elen;
 
     /* Generate end-of-contents bytes. */
@@ -7108,7 +6992,7 @@ static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly
     CHECK(tlen + glen <= 1121);
 
     /* Generate random garbage outside tuple. */
-    secp256k1_testrand_bytes_test(sig + *len, glen);
+    testrand_bytes_test(sig + *len, glen);
     *len += glen;
     tlen += glen;
     CHECK(tlen <= 1121);
@@ -7771,7 +7655,7 @@ int main(int argc, char **argv) {
     run_xoshiro256pp_tests();
 
     /* find random seed */
-    secp256k1_testrand_init(argc > 2 ? argv[2] : NULL);
+    testrand_init(argc > 2 ? argv[2] : NULL);
 
     /*** Setup test environment ***/
 
@@ -7780,9 +7664,9 @@ int main(int argc, char **argv) {
     /* Randomize the context only with probability 15/16
        to make sure we test without context randomization from time to time.
        TODO Reconsider this when recalibrating the tests. */
-    if (secp256k1_testrand_bits(4)) {
+    if (testrand_bits(4)) {
         unsigned char rand32[32];
-        secp256k1_testrand256(rand32);
+        testrand256(rand32);
         CHECK(secp256k1_context_randomize(CTX, rand32));
     }
     /* Make a writable copy of secp256k1_context_static in order to test the effect of API functions
@@ -7909,7 +7793,7 @@ int main(int argc, char **argv) {
     free(STATIC_CTX);
     secp256k1_context_destroy(CTX);
 
-    secp256k1_testrand_finish();
+    testrand_finish();
 
     printf("no problems found\n");
     return 0;
diff --git a/src/secp256k1/src/tests_exhaustive.c b/src/secp256k1/src/tests_exhaustive.c
index 5843b3e1f5..6efa88982e 100644
--- a/src/secp256k1/src/tests_exhaustive.c
+++ b/src/secp256k1/src/tests_exhaustive.c
@@ -171,7 +171,7 @@ static void test_exhaustive_ecmult(const secp256k1_ge *group, const secp256k1_ge
                 CHECK(secp256k1_fe_equal(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
 
                 /* Test secp256k1_ecmult_const_xonly with all curve X coordinates, with random xd. */
-                random_fe_non_zero(&xd);
+                testutil_random_fe_non_zero(&xd);
                 secp256k1_fe_mul(&xn, &xd, &group[i].x);
                 ret = secp256k1_ecmult_const_xonly(&tmpf, &xn, &xd, &ng, 0);
                 CHECK(ret);
@@ -375,7 +375,7 @@ int main(int argc, char** argv) {
     printf("test count = %i\n", count);
 
     /* find random seed */
-    secp256k1_testrand_init(argc > 2 ? argv[2] : NULL);
+    testrand_init(argc > 2 ? argv[2] : NULL);
 
     /* set up split processing */
     if (argc > 4) {
@@ -395,7 +395,7 @@ int main(int argc, char** argv) {
     while (count--) {
         /* Build context */
         ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
-        secp256k1_testrand256(rand32);
+        testrand256(rand32);
         CHECK(secp256k1_context_randomize(ctx, rand32));
 
         /* Generate the entire group */
@@ -408,7 +408,7 @@ int main(int argc, char** argv) {
                 /* Set a different random z-value for each Jacobian point, except z=1
                    is used in the last iteration. */
                 secp256k1_fe z;
-                random_fe(&z);
+                testutil_random_fe(&z);
                 secp256k1_gej_rescale(&groupj[i], &z);
             }
 
@@ -459,7 +459,7 @@ int main(int argc, char** argv) {
         secp256k1_context_destroy(ctx);
     }
 
-    secp256k1_testrand_finish();
+    testrand_finish();
 
     printf("no problems found\n");
     return 0;
diff --git a/src/secp256k1/src/testutil.h b/src/secp256k1/src/testutil.h
index 4e2cb7d5b3..8296a5fb99 100644
--- a/src/secp256k1/src/testutil.h
+++ b/src/secp256k1/src/testutil.h
@@ -7,23 +7,136 @@
 #define SECP256K1_TESTUTIL_H
 
 #include "field.h"
+#include "group.h"
 #include "testrand.h"
 #include "util.h"
 
-static void random_fe(secp256k1_fe *x) {
+static void testutil_random_fe(secp256k1_fe *x) {
     unsigned char bin[32];
     do {
-        secp256k1_testrand256(bin);
+        testrand256(bin);
         if (secp256k1_fe_set_b32_limit(x, bin)) {
             return;
         }
     } while(1);
 }
 
-static void random_fe_non_zero(secp256k1_fe *nz) {
+static void testutil_random_fe_non_zero(secp256k1_fe *nz) {
     do {
-        random_fe(nz);
+        testutil_random_fe(nz);
     } while (secp256k1_fe_is_zero(nz));
 }
 
+static void testutil_random_fe_magnitude(secp256k1_fe *fe, int m) {
+    secp256k1_fe zero;
+    int n = testrand_int(m + 1);
+    secp256k1_fe_normalize(fe);
+    if (n == 0) {
+        return;
+    }
+    secp256k1_fe_clear(&zero);
+    secp256k1_fe_negate(&zero, &zero, 0);
+    secp256k1_fe_mul_int_unchecked(&zero, n - 1);
+    secp256k1_fe_add(fe, &zero);
+#ifdef VERIFY
+    CHECK(fe->magnitude == n);
+#endif
+}
+
+static void testutil_random_fe_test(secp256k1_fe *x) {
+    unsigned char bin[32];
+    do {
+        testrand256_test(bin);
+        if (secp256k1_fe_set_b32_limit(x, bin)) {
+            return;
+        }
+    } while(1);
+}
+
+static void testutil_random_fe_non_zero_test(secp256k1_fe *fe) {
+    do {
+        testutil_random_fe_test(fe);
+    } while(secp256k1_fe_is_zero(fe));
+}
+
+static void testutil_random_ge_x_magnitude(secp256k1_ge *ge) {
+    testutil_random_fe_magnitude(&ge->x, SECP256K1_GE_X_MAGNITUDE_MAX);
+}
+
+static void testutil_random_ge_y_magnitude(secp256k1_ge *ge) {
+    testutil_random_fe_magnitude(&ge->y, SECP256K1_GE_Y_MAGNITUDE_MAX);
+}
+
+static void testutil_random_gej_x_magnitude(secp256k1_gej *gej) {
+    testutil_random_fe_magnitude(&gej->x, SECP256K1_GEJ_X_MAGNITUDE_MAX);
+}
+
+static void testutil_random_gej_y_magnitude(secp256k1_gej *gej) {
+    testutil_random_fe_magnitude(&gej->y, SECP256K1_GEJ_Y_MAGNITUDE_MAX);
+}
+
+static void testutil_random_gej_z_magnitude(secp256k1_gej *gej) {
+    testutil_random_fe_magnitude(&gej->z, SECP256K1_GEJ_Z_MAGNITUDE_MAX);
+}
+
+static void testutil_random_ge_test(secp256k1_ge *ge) {
+    secp256k1_fe fe;
+    do {
+        testutil_random_fe_test(&fe);
+        if (secp256k1_ge_set_xo_var(ge, &fe, testrand_bits(1))) {
+            secp256k1_fe_normalize(&ge->y);
+            break;
+        }
+    } while(1);
+    ge->infinity = 0;
+}
+
+static void testutil_random_ge_jacobian_test(secp256k1_gej *gej, const secp256k1_ge *ge) {
+    secp256k1_fe z2, z3;
+    testutil_random_fe_non_zero_test(&gej->z);
+    secp256k1_fe_sqr(&z2, &gej->z);
+    secp256k1_fe_mul(&z3, &z2, &gej->z);
+    secp256k1_fe_mul(&gej->x, &ge->x, &z2);
+    secp256k1_fe_mul(&gej->y, &ge->y, &z3);
+    gej->infinity = ge->infinity;
+}
+
+static void testutil_random_gej_test(secp256k1_gej *gej) {
+    secp256k1_ge ge;
+    testutil_random_ge_test(&ge);
+    testutil_random_ge_jacobian_test(gej, &ge);
+}
+
+static void testutil_random_scalar_order_test(secp256k1_scalar *num) {
+    do {
+        unsigned char b32[32];
+        int overflow = 0;
+        testrand256_test(b32);
+        secp256k1_scalar_set_b32(num, b32, &overflow);
+        if (overflow || secp256k1_scalar_is_zero(num)) {
+            continue;
+        }
+        break;
+    } while(1);
+}
+
+static void testutil_random_scalar_order(secp256k1_scalar *num) {
+    do {
+        unsigned char b32[32];
+        int overflow = 0;
+        testrand256(b32);
+        secp256k1_scalar_set_b32(num, b32, &overflow);
+        if (overflow || secp256k1_scalar_is_zero(num)) {
+            continue;
+        }
+        break;
+    } while(1);
+}
+
+static void testutil_random_scalar_order_b32(unsigned char *b32) {
+    secp256k1_scalar num;
+    testutil_random_scalar_order(&num);
+    secp256k1_scalar_get_b32(b32, &num);
+}
+
 #endif /* SECP256K1_TESTUTIL_H */