diff --git a/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/secp256k1/FieldP.kt b/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/secp256k1/FieldP.kt
index ca502844b..eb16dfa0b 100644
--- a/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/secp256k1/FieldP.kt
+++ b/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/secp256k1/FieldP.kt
@@ -171,6 +171,10 @@ internal object FieldP {
      * out = -a mod p = P - a. Specialized for P = [P0, -1, -1, -1]:
      * P[i]-a[i] = ~a[i] for i>=1 (bitwise NOT), with borrow from limb 0.
      * Avoids generic U256.subTo + P field reads (~260 calls/verify).
+     *
+     * Branch-free for a == 0: P - 0 = P, which is then reduced to 0 by the
+     * trailing reduceSelf. Removing the early return matches the C fe_negate
+     * path and eliminates a data-dependent branch that the JIT can't optimize.
      */
     fun neg(
         out: Fe4,
@@ -178,13 +182,6 @@ internal object FieldP {
     ) {
         // Normalize input: P - a underflows if a > P (from lazy add)
         reduceSelf(a)
-        if (a.isZero()) {
-            out.l0 = 0L
-            out.l1 = 0L
-            out.l2 = 0L
-            out.l3 = 0L
-            return
-        }
         // P - a: limb 0 is P0 - a.l0, limbs 1-3 are (-1) - a[i] = ~a[i]
         out.l0 = P0 - a.l0
         val borrow = if (uLtInline(P0, a.l0)) 1L else 0L
@@ -194,6 +191,8 @@ internal object FieldP {
         out.l2 = a.l2.inv() - b1
         val b2 = if (a.l2 == -1L && b1 != 0L) 1L else 0L
         out.l3 = a.l3.inv() - b2
+        // a == 0 ⇒ out == P here; reduceSelf folds P back to 0.
+        reduceSelf(out)
     }
 
     /**
diff --git a/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1.kt b/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1.kt
index a6f195dc5..b46acdfd5 100644
--- a/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1.kt
+++ b/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1.kt
@@ -358,7 +358,11 @@ object Secp256k1 {
         U256.fromBytesInto(sc.scalarTmp1, sc.bytesTmp2, 0)
         ScalarN.reduceTo(sc.scalarTmp1, sc.scalarTmp1)
         val k0 = sc.scalarTmp1
-        require(!k0.isZero())
+        // BIP-340 step "Fail if k' = 0". Probability ~2^-256, unreachable in
+        // practice but the spec requires refusal. `check` here (vs the prior
+        // `require`) communicates it as an internal invariant rather than an
+        // argument error, matching the semantics of the C side returning 0.
+        check(!k0.isZero()) { "BIP-340 nonce derived to 0 — refuse to sign" }
 
         // R = k0·G
         ECPoint.mulG(sc.entryResult, k0, sc)
@@ -521,7 +525,14 @@ object Secp256k1 {
 
     // ==================== Tweak operations ====================
 
-    /** Add a tweak to a private key: result = (seckey + tweak) mod n. Used by BIP-32. */
+    /**
+     * Add a tweak to a private key: result = (seckey + tweak) mod n. Used by BIP-32.
+     *
+     * Throws `IllegalArgumentException` for wrong-size inputs and
+     * `IllegalStateException` when the result is 0 or >= n (matching the
+     * C side which returns 0). The latter is a ~2^-128 cryptographic edge
+     * case that indicates an adversarial tweak choice.
+     */
     fun privKeyTweakAdd(
         seckey: ByteArray,
         tweak: ByteArray,
@@ -537,7 +548,10 @@ object Secp256k1 {
         U256.fromBytesInto(a, seckey, 0)
         U256.fromBytesInto(b, tweak, 0)
         ScalarN.addTo(r, a, b)
-        require(!r.isZero() && U256.cmp(r, ScalarN.N) < 0)
+        // ScalarN.addTo already reduces mod n, so r < n is guaranteed.
+        // The only remaining invalid state is r == 0, which matches the
+        // C side's `scalar_is_zero(&r)` failure.
+        check(!r.isZero()) { "Tweaked private key is zero — invalid tweak" }
         return U256.toBytes(r)
     }
 
diff --git a/quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/FieldPTest.kt b/quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/FieldPTest.kt
index e532d1761..e53a17290 100644
--- a/quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/FieldPTest.kt
+++ b/quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/FieldPTest.kt
@@ -70,9 +70,12 @@ class FieldPTest {
     @Test
     fun addNearP() {
         // (p - 1) + 1 = p ≡ 0 (mod p)
+        // FieldP.add is lazy: the result here is the literal limb pattern for p
+        // rather than the canonical 0. Compare after an explicit reduceSelf.
         val pMinus1 = hex("fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2e")
         val one = Fe4(1L, 0L, 0L, 0L)
         val result = FieldP.add(pMinus1, one)
+        FieldP.reduceSelf(result)
         assertTrue(result.isZero())
     }
 
@@ -112,6 +115,9 @@ class FieldPTest {
     fun addNegIsZero() {
         val a = hex("67e56582298859ddae725f972992a07c6c4fb9f62a8fff58ce3ca926a1063530")
         val result = FieldP.add(a, FieldP.neg(a))
+        // a + (-a) = a + (p - a) = p, which the lazy adder stores as the raw
+        // limb pattern for p rather than 0. Reduce before checking.
+        FieldP.reduceSelf(result)
         assertTrue(result.isZero())
     }
 
@@ -149,6 +155,7 @@ class FieldPTest {
         val aInv = FieldP.inv(a)
         val product = FieldP.mul(a, aInv)
         val one = Fe4(1L, 0L, 0L, 0L)
+        FieldP.reduceSelf(product)
         assertEquals(toHex(one), toHex(product))
     }
 
@@ -180,12 +187,14 @@ class FieldPTest {
 
     @Test
     fun halfOfOdd() {
-        // half(1) = (1 + p) / 2 = (p + 1) / 2
+        // half(1) = (1 + p) / 2. Then 2 * half(1) ≡ 1 (mod p).
+        // The lazy adder may leave `doubled` as a representation of 1 + p
+        // rather than the canonical 1; reduce before comparing.
         val out = Fe4()
         val one = Fe4(1L, 0L, 0L, 0L)
         FieldP.half(out, one)
-        // Verify: 2 * half(1) = 1 mod p
         val doubled = FieldP.add(out, out)
+        FieldP.reduceSelf(doubled)
         assertEquals(1L, doubled.l0)
         assertEquals(0L, doubled.l1)
         assertEquals(0L, doubled.l2)
@@ -238,9 +247,12 @@ class FieldPTest {
 
     @Test
     fun reduceWideWithMaxValues() {
-        // Multiply two values near p and verify result is < p
+        // Multiply two values near p and verify result is mathematically < p.
+        // fe_mul is lazy, so the raw limbs can temporarily be in [P, 2^256);
+        // we explicitly normalize, then compare both bounds and value.
         val pMinus1 = hex("fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2e")
         val result = FieldP.mul(pMinus1, pMinus1)
+        FieldP.reduceSelf(result)
         assertTrue(U256.cmp(result, FieldP.P) < 0, "Result should be < p")
         // (p-1)² ≡ 1 (mod p)
         val one = Fe4(1L, 0L, 0L, 0L)
@@ -283,6 +295,7 @@ class FieldPTest {
         val inv2 = FieldP.inv(two)
         val product = FieldP.mul(two, inv2)
         val one = Fe4(1L, 0L, 0L, 0L)
+        FieldP.reduceSelf(product)
         assertEquals(toHex(one), toHex(product))
     }
 
@@ -310,4 +323,80 @@ class FieldPTest {
         FieldP.mul(aCopy, aCopy, b) // out == a
         assertEquals(toHex(expected), toHex(aCopy))
     }
+
+    // ==================== Adversarial carry-fold regression tests ====================
+    //
+    // These tests exercise the code path where the reduction's final fold has
+    // to loop more than once. A naïve single-pass fold (the shape the C and
+    // Kotlin reducers had historically) silently drops a carry out of the top
+    // limb when the result grows past 2^256. The while-loop fold makes the
+    // invariant "output in [0, 2^256)" robust for any reachable input,
+    // including pathological lazy-reduced chains like these.
+    //
+    // The Kotlin field arithmetic uses lazy reduction, so results up to
+    // ~2^256 can be representationally in [P, 2^256) rather than in [0, P).
+    // These tests compare after an explicit `reduceSelf` to compare the
+    // mathematical value rather than the raw limb bytes.
+
+    private fun reduced(a: Fe4): Fe4 {
+        val r = a.copyOf()
+        FieldP.reduceSelf(r)
+        return r
+    }
+
+    @Test
+    fun chainedLazyAddThenMulReducesCorrectly() {
+        // Build a value close to 2^256 via chained lazy adds so the
+        // subsequent multiplication feeds the reducer an input near its
+        // upper bound. Verify: 4*(p-1) ≡ p-4 (mod p).
+        val pMinus1 = hex("fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2e")
+        val two = FieldP.add(pMinus1, pMinus1)
+        val four = FieldP.add(two, two)
+        val expected = hex("fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2b")
+        val one = Fe4(1L, 0L, 0L, 0L)
+        val product = FieldP.mul(four, one)
+        assertEquals(toHex(expected), toHex(reduced(product)))
+    }
+
+    @Test
+    fun mulOfLargeValuesStaysReduced() {
+        // ((p-1)^2)^2 ≡ 1 (mod p). Feed the squared result back into another
+        // multiplication to flush any hidden lazy state.
+        val pMinus1 = hex("fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2e")
+        val sq = FieldP.sqr(pMinus1)
+        val sqAgain = FieldP.mul(sq, sq)
+        val one = Fe4(1L, 0L, 0L, 0L)
+        assertEquals(toHex(one), toHex(reduced(sqAgain)))
+    }
+
+    @Test
+    fun repeatedSquaringConvergesAcrossMulAndSqrPaths() {
+        // Squaring chain: a, a², a⁴, …, a^(2^10). Any latent carry-drop
+        // would compound across 10 iterations. Run via both fe_mul(x, x)
+        // and the dedicated fe_sqr path and compare results.
+        val a = hex("fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2d") // p-2
+        var byMul = a
+        repeat(10) { byMul = FieldP.mul(byMul, byMul) }
+        var bySqr = a
+        val out = Fe4()
+        repeat(10) {
+            FieldP.sqr(out, bySqr)
+            bySqr = out.copyOf()
+        }
+        assertEquals(toHex(reduced(byMul)), toHex(reduced(bySqr)))
+    }
+
+    @Test
+    fun mulRoundTripViaInvStressesLazyInput() {
+        // Build a large, possibly-unreduced value and check the round trip
+        // (x * b) * inv(b) ≡ x (mod p). Exercises the full pipeline:
+        // unreduced input → mul → reduce → inv → mul → reduce.
+        val pMinus1 = hex("fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2e")
+        val lazyBig = FieldP.add(pMinus1, pMinus1) // may be lazy
+        val b = hex("0000000000000000000000000000000000000000000000000000000000000042")
+        val ref = FieldP.mul(lazyBig, b)
+        val bInv = FieldP.inv(b)
+        val back = FieldP.mul(ref, bInv)
+        assertEquals(toHex(reduced(lazyBig)), toHex(reduced(back)))
+    }
 }
diff --git a/quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/GlvTest.kt b/quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/GlvTest.kt
index fd58b3f20..d6983004d 100644
--- a/quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/GlvTest.kt
+++ b/quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/GlvTest.kt
@@ -102,9 +102,13 @@ class GlvTest {
 
     @Test
     fun betaCubedIsOne() {
-        // β³ ≡ 1 (mod p) — the defining property of the cube root of unity
+        // β³ ≡ 1 (mod p) — the defining property of the cube root of unity.
+        // FieldP.mul is lazy, so the result may be the raw limb pattern for
+        // 1 + p (mathematically 1 mod p, but not bit-equal to the canonical
+        // representation). Reduce explicitly before comparing.
         val b2 = FieldP.sqr(Glv.BETA)
         val b3 = FieldP.mul(b2, Glv.BETA)
+        FieldP.reduceSelf(b3)
         val one = Fe4(1L, 0L, 0L, 0L)
         assertEquals(toHex(one), toHex(b3))
     }
diff --git a/quartz/src/jvmTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1Benchmark.kt b/quartz/src/jvmTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1Benchmark.kt
index 1aa305208..34ce057e1 100644
--- a/quartz/src/jvmTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1Benchmark.kt
+++ b/quartz/src/jvmTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1Benchmark.kt
@@ -35,6 +35,26 @@ import fr.acinq.secp256k1.Secp256k1 as NativeSecp256k1
  * benefit from the pubkey decompression cache and P-table cache. This is realistic
  * for Nostr (feed from one author) but not representative of first-time verification.
  *
+ * ## Benchmark Fairness Notes
+ *
+ * The comparisons below are apples-to-apples wherever possible, but a few
+ * intentional asymmetries remain because the public APIs don't line up 1:1:
+ *
+ * - **signSchnorr (XPubKey)**: the Kotlin side uses `signSchnorrWithPubKey`,
+ *   which skips the internal pubkey derivation when the caller already has
+ *   the compressed pubkey cached. The ACINQ side always derives the pubkey
+ *   inside `signSchnorr`. A separate `signSchnorr` row below exercises the
+ *   same derivation path on both sides for a fair comparison.
+ *
+ * - **ecdhXOnly (NIP-44)**: ACINQ has no x-only ECDH API, so the native
+ *   baseline uses `pubKeyTweakMul` + x-coordinate extraction. Both paths
+ *   compute the same shared secret but the native side pays an extra
+ *   (de)serialization step that the Kotlin side skips.
+ *
+ * - **privKeyTweakAdd**: ACINQ mutates its first argument, so the native
+ *   side does `privKey.copyOf()` before each call, adding one allocation
+ *   to the native measurement that the Kotlin side doesn't incur.
+ *
  * Run with: ./gradlew :quartz:jvmTest --tests "*.Secp256k1Benchmark"
  */
 class Secp256k1Benchmark {
@@ -270,6 +290,35 @@ class Secp256k1Benchmark {
                 },
             )
 
+        // --- taggedHash (BIP-340, heavily used by NIP-44 key derivation) ---
+        // The cached BIP-340 tag prefixes in Secp256k1.kt make each call
+        // exactly 1 SHA-256 over (64-byte prefix || message). ACINQ has no
+        // dedicated tagged-hash API, so we compose sha256(sha256(tag) ||
+        // sha256(tag) || msg) by hand on the native side using the same
+        // challenge prefix bytes. This measures raw SHA-256 throughput
+        // through the different SHA implementations.
+        val challengeTag = "BIP0340/challenge".toByteArray()
+        val tagHash =
+            java.security.MessageDigest
+                .getInstance("SHA-256")
+                .digest(challengeTag)
+        val nativeTaggedInput = tagHash + tagHash + msg32
+        val nativeDigest = java.security.MessageDigest.getInstance("SHA-256")
+        results +=
+            bench(
+                name = "taggedHash (NIP-44/BIP340)",
+                warmup = 5000,
+                iterations = 100000,
+                nativeOp = {
+                    nativeDigest.reset()
+                    nativeDigest.digest(nativeTaggedInput)
+                },
+                kotlinOp = {
+                    com.vitorpamplona.quartz.utils.secp256k1.Secp256k1
+                        .taggedHash("BIP0340/challenge", msg32)
+                },
+            )
+
         // Print results
         println()
         println("=".repeat(76))
diff --git a/quartz/src/jvmTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1CrossValidationTest.kt b/quartz/src/jvmTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1CrossValidationTest.kt
new file mode 100644
index 000000000..2232f7f4b
--- /dev/null
+++ b/quartz/src/jvmTest/kotlin/com/vitorpamplona/quartz/utils/secp256k1/Secp256k1CrossValidationTest.kt
@@ -0,0 +1,227 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.quartz.utils.secp256k1
+
+import com.vitorpamplona.quartz.utils.Secp256k1InstanceC
+import java.util.Random
+import kotlin.test.Test
+import kotlin.test.assertContentEquals
+import kotlin.test.assertTrue
+import fr.acinq.secp256k1.Secp256k1 as NativeSecp256k1
+
+/**
+ * Byte-for-byte cross-validation between the three secp256k1 implementations
+ * available on JVM:
+ *   1. ACINQ / libsecp256k1-kmp (reference implementation)
+ *   2. Pure Kotlin ([Secp256k1])
+ *   3. Custom C library via JNI ([Secp256k1InstanceC]) — when loadable
+ *
+ * BIP-340 signatures are deterministic given (privkey, message, aux_rand),
+ * so two correct implementations MUST produce identical signature bytes.
+ * This catches subtle reduction/limb-representation bugs that wouldn't show
+ * up in a roundtrip verify test (where a wrong-but-internally-consistent
+ * implementation can still verify its own output).
+ */
+class Secp256k1CrossValidationTest {
+    private val acinq = NativeSecp256k1.get()
+
+    // Deterministic RNG for reproducible test failures. java.util.Random has
+    // a documented LCG and is fine for non-cryptographic test data.
+    private val rng = Random(0xAFEE5EED1234L)
+
+    private fun randomSeckey(): ByteArray {
+        while (true) {
+            val b = ByteArray(32).also { rng.nextBytes(it) }
+            if (Secp256k1.secKeyVerify(b)) return b
+        }
+    }
+
+    private fun randomMessage(size: Int): ByteArray = ByteArray(size).also { rng.nextBytes(it) }
+
+    private fun randomAuxRand(): ByteArray = ByteArray(32).also { rng.nextBytes(it) }
+
+    @Test
+    fun pubkeyCreateMatchesAcinq() {
+        // 50 distinct private keys must produce identical uncompressed pubkeys.
+        repeat(50) {
+            val seckey = randomSeckey()
+            val kotlinPub = Secp256k1.pubkeyCreate(seckey)
+            val acinqPub = acinq.pubkeyCreate(seckey)
+            assertContentEquals(
+                acinqPub,
+                kotlinPub,
+                "pubkeyCreate must be byte-identical to ACINQ for seckey=${seckey.toHex()}",
+            )
+        }
+    }
+
+    @Test
+    fun signSchnorrMatchesAcinq() {
+        // 50 random (seckey, message, auxrand) triples must yield byte-identical
+        // BIP-340 signatures. Any divergence here points at a reduction or
+        // limb-representation bug in one implementation.
+        repeat(50) {
+            val seckey = randomSeckey()
+            val msg = randomMessage(32) // Nostr event IDs are 32 bytes
+            val aux = randomAuxRand()
+            val kotlinSig = Secp256k1.signSchnorr(msg, seckey, aux)
+            val acinqSig = acinq.signSchnorr(msg, seckey, aux)
+            assertContentEquals(
+                acinqSig,
+                kotlinSig,
+                "signSchnorr must be byte-identical to ACINQ for seckey=${seckey.toHex()} msg=${msg.toHex()}",
+            )
+        }
+    }
+
+    @Test
+    fun signSchnorrVariableMessageLengthSelfConsistent() {
+        // ACINQ's signSchnorr API hard-codes the BIP-340 convention that the
+        // message is exactly 32 bytes. Our Kotlin implementation accepts
+        // messages of any length (NIP-01 event bodies can hash to something
+        // other than 32 bytes in custom protocols). For non-32 inputs we
+        // verify that the Kotlin signer and verifier at least self-agree:
+        // any (msg, sig, pub) tuple produced by the signer must verify.
+        val lengths = intArrayOf(0, 1, 31, 33, 55, 56, 64, 65, 127, 128, 511, 512, 1024)
+        val seckey = randomSeckey()
+        val xOnly = Secp256k1.pubKeyCompress(Secp256k1.pubkeyCreate(seckey)).copyOfRange(1, 33)
+        for (len in lengths) {
+            val msg = randomMessage(len)
+            val aux = randomAuxRand()
+            val sig = Secp256k1.signSchnorr(msg, seckey, aux)
+            assertTrue(
+                Secp256k1.verifySchnorr(sig, msg, xOnly),
+                "Kotlin self-verify failed at message length $len",
+            )
+        }
+
+        // For the 32-byte case we can cross-check against ACINQ for
+        // byte-identical signatures, since that's what BIP-340 covers.
+        val msg32 = randomMessage(32)
+        val aux = randomAuxRand()
+        val kotlinSig = Secp256k1.signSchnorr(msg32, seckey, aux)
+        val acinqSig = acinq.signSchnorr(msg32, seckey, aux)
+        assertContentEquals(acinqSig, kotlinSig)
+    }
+
+    @Test
+    fun customCImplementationMatchesAcinqAndKotlin() {
+        val cAvailable =
+            try {
+                Secp256k1InstanceC.init()
+                true
+            } catch (e: UnsatisfiedLinkError) {
+                println("SKIP: custom C library not loadable (${e.message})")
+                false
+            } catch (e: Throwable) {
+                println("SKIP: custom C library init failed (${e.message})")
+                false
+            }
+        if (!cAvailable) return
+
+        // 25 triples — fewer than the pure tests because each round exercises
+        // three implementations and the test is slower.
+        repeat(25) {
+            val seckey = randomSeckey()
+            val msg = randomMessage(32)
+            val aux = randomAuxRand()
+
+            val kotlinPubCompressed = Secp256k1.pubKeyCompress(Secp256k1.pubkeyCreate(seckey))
+            val acinqPubCompressed = acinq.pubKeyCompress(acinq.pubkeyCreate(seckey))
+            val cPubCompressed = Secp256k1InstanceC.compressedPubKeyFor(seckey)
+            assertContentEquals(acinqPubCompressed, kotlinPubCompressed, "pubkey: Kotlin vs ACINQ")
+            assertContentEquals(acinqPubCompressed, cPubCompressed, "pubkey: C vs ACINQ")
+
+            val kotlinSig = Secp256k1.signSchnorr(msg, seckey, aux)
+            val acinqSig = acinq.signSchnorr(msg, seckey, aux)
+            val cSig = Secp256k1InstanceC.signSchnorr(msg, seckey, aux)
+            assertContentEquals(acinqSig, kotlinSig, "sig: Kotlin vs ACINQ")
+            assertContentEquals(acinqSig, cSig, "sig: C vs ACINQ")
+        }
+    }
+
+    @Test
+    fun privKeyTweakAddMatchesAcinq() {
+        repeat(30) {
+            val seckey = randomSeckey()
+            val tweak = randomSeckey()
+            val kotlinResult = Secp256k1.privKeyTweakAdd(seckey, tweak)
+            val acinqResult = acinq.privKeyTweakAdd(seckey.copyOf(), tweak)
+            assertContentEquals(
+                acinqResult,
+                kotlinResult,
+                "privKeyTweakAdd mismatch for seckey=${seckey.toHex()} tweak=${tweak.toHex()}",
+            )
+        }
+    }
+
+    @Test
+    fun batchOfSignaturesRoundTripAcrossImpls() {
+        // Sign with ACINQ, verify with Kotlin and C. Sign with Kotlin, verify
+        // with ACINQ and C. This is the weakest form of interoperability check,
+        // but covers the case where a signing bug produces a valid-looking
+        // signature that only the producing implementation accepts.
+        val seckey = randomSeckey()
+        val kotlinPubCompressed = Secp256k1.pubKeyCompress(Secp256k1.pubkeyCreate(seckey))
+        val xOnly = kotlinPubCompressed.copyOfRange(1, 33)
+
+        repeat(20) {
+            val msg = randomMessage(32)
+            val aux = randomAuxRand()
+            val kotlinSig = Secp256k1.signSchnorr(msg, seckey, aux)
+            val acinqSig = acinq.signSchnorr(msg, seckey, aux)
+
+            // Same inputs → same signature (BIP-340 determinism).
+            assertContentEquals(acinqSig, kotlinSig)
+
+            assertTrue(acinq.verifySchnorr(kotlinSig, msg, xOnly), "ACINQ must verify Kotlin sig")
+            assertTrue(
+                Secp256k1.verifySchnorr(acinqSig, msg, xOnly),
+                "Kotlin must verify ACINQ sig",
+            )
+        }
+    }
+
+    @Test
+    fun ecdhXOnlySymmetric() {
+        // Kotlin ecdhXOnly shared secret should equal what ACINQ's
+        // pubKeyTweakMul produces (after extracting the x coordinate). The
+        // two sides of an ECDH must also see the same shared secret.
+        repeat(20) {
+            val skA = randomSeckey()
+            val skB = randomSeckey()
+            val pubA = Secp256k1.pubKeyCompress(Secp256k1.pubkeyCreate(skA))
+            val pubB = Secp256k1.pubKeyCompress(Secp256k1.pubkeyCreate(skB))
+            val xA = pubA.copyOfRange(1, 33)
+            val xB = pubB.copyOfRange(1, 33)
+
+            val kotlinAB = Secp256k1.ecdhXOnly(xB, skA)
+            val kotlinBA = Secp256k1.ecdhXOnly(xA, skB)
+            assertContentEquals(kotlinAB, kotlinBA, "ECDH must be symmetric")
+
+            // Compare against ACINQ's pubKeyTweakMul + extract x
+            val acinqAB = acinq.pubKeyTweakMul(pubB, skA).copyOfRange(1, 33)
+            assertContentEquals(acinqAB, kotlinAB, "Kotlin ECDH must match ACINQ")
+        }
+    }
+
+    private fun ByteArray.toHex(): String = joinToString("") { b -> ((b.toInt() and 0xFF) or 0x100).toString(16).substring(1) }
+}
diff --git a/quartz/src/main/c/secp256k1/CMakeLists.txt b/quartz/src/main/c/secp256k1/CMakeLists.txt
index 08dee3102..a4f0555da 100644
--- a/quartz/src/main/c/secp256k1/CMakeLists.txt
+++ b/quartz/src/main/c/secp256k1/CMakeLists.txt
@@ -3,6 +3,22 @@ project(secp256k1_amethyst C)
 
 set(CMAKE_C_STANDARD 11)
 
+# ==================== Link-Time Optimization ====================
+#
+# LTO lets the linker inline fe_mul / fe_sqr across translation units
+# (field.c ↔ point.c ↔ scalar.c ↔ schnorr.c), recovering ~5-15% on the
+# hot Jacobian formulas where fe_mul would otherwise be a call boundary.
+# Disabled automatically when the toolchain doesn't support it.
+
+include(CheckIPOSupported)
+check_ipo_supported(RESULT LTO_SUPPORTED OUTPUT LTO_ERROR)
+if(LTO_SUPPORTED)
+    message(STATUS "LTO supported - enabling interprocedural optimization")
+    set(CMAKE_INTERPROCEDURAL_OPTIMIZATION TRUE)
+else()
+    message(STATUS "LTO not supported: ${LTO_ERROR}")
+endif()
+
 # ==================== Platform-specific optimizations ====================
 
 if(CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64|arm64|ARM64")
diff --git a/quartz/src/main/c/secp256k1/field.c b/quartz/src/main/c/secp256k1/field.c
index 6790d70eb..14ba30c11 100644
--- a/quartz/src/main/c/secp256k1/field.c
+++ b/quartz/src/main/c/secp256k1/field.c
@@ -32,7 +32,6 @@ void mul_wide(uint64_t out[8], const uint64_t a[4], const uint64_t b[4]) {
      * This avoids the column-based carry overflow problem.
      */
     uint128_t acc;
-    uint64_t carry;
 
     /* Row 0: out += a[0] * b */
     acc = (uint128_t)a[0] * b[0];
@@ -106,18 +105,29 @@ void reduce_wide(secp256k1_fe *r, const uint64_t w[8]) {
     r->d[3] = (uint64_t)acc;
     uint64_t carry = (uint64_t)(acc >> 64);
 
-    /* Round 2: fold remaining carry */
-    if (carry) {
+    /* Round 2+: fold remaining carry through C. Looped for correctness
+     * against any reachable input (see fe_mul for the detailed bound). */
+    while (carry) {
         acc = (uint128_t)r->d[0] + (uint128_t)carry * FIELD_C;
         r->d[0] = (uint64_t)acc;
-        carry = (uint64_t)(acc >> 64);
-        if (carry) {
-            r->d[1] += carry;
-            if (r->d[1] < carry) {
-                r->d[2]++;
-                if (r->d[2] == 0) r->d[3]++;
+        uint64_t c1 = (uint64_t)(acc >> 64);
+        if (c1) {
+            uint64_t s = r->d[1] + c1;
+            uint64_t cc = (s < c1) ? 1 : 0;
+            r->d[1] = s;
+            if (cc) {
+                s = r->d[2] + 1;
+                cc = (s == 0) ? 1 : 0;
+                r->d[2] = s;
+                if (cc) {
+                    s = r->d[3] + 1;
+                    r->d[3] = s;
+                    carry = (s == 0) ? 1 : 0;
+                    continue;
+                }
             }
         }
+        carry = 0;
     }
 
     /* No fe_normalize — lazy. Output is in [0, 2^256), possibly in [P, P+C).
@@ -186,10 +196,32 @@ void fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *b) {
     acc += (uint128_t)lo3 + (uint128_t)hi3 * FIELD_C;
     r->d[3] = (uint64_t)acc;
     uint64_t carry = (uint64_t)(acc >> 64);
-    if (carry) {
+    /* Final fold: carry * C back into the low limbs. In theory two rounds
+     * suffice because carry ≤ ~2^34 on the first pass and carry*C < 2^67
+     * produces at most a 3-bit secondary carry. The loop is cheap and makes
+     * the invariant "output < 2^256" hold for any reachable inputs — not
+     * only from fe_mul itself but also from chained lazy fe_add results. */
+    while (carry) {
         acc = (uint128_t)r->d[0] + (uint128_t)carry * FIELD_C;
-        r->d[0] = (uint64_t)acc; carry = (uint64_t)(acc >> 64);
-        if (carry) { r->d[1] += carry; if (r->d[1] < carry) { r->d[2]++; if (!r->d[2]) r->d[3]++; } }
+        r->d[0] = (uint64_t)acc;
+        uint64_t c1 = (uint64_t)(acc >> 64);
+        if (c1) {
+            uint64_t s = r->d[1] + c1;
+            uint64_t cc = (s < c1) ? 1 : 0;
+            r->d[1] = s;
+            if (cc) {
+                s = r->d[2] + 1;
+                cc = (s == 0) ? 1 : 0;
+                r->d[2] = s;
+                if (cc) {
+                    s = r->d[3] + 1;
+                    r->d[3] = s;
+                    carry = (s == 0) ? 1 : 0;
+                    continue;
+                }
+            }
+        }
+        carry = 0;
     }
     /* No fe_normalize — lazy. Output is in [0, 2^256), possibly in [P, P+C).
      * This is safe: mul/add/sub all handle unreduced inputs.
@@ -201,16 +233,9 @@ void fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *b) {
 #endif
 }
 
-/*
- * Squaring: just call fe_mul(r, a, a).
- * With 4x64 limbs, a dedicated sqr doesn't help because:
- * - Cross-product doubling overflows uint128 (64+64+1 > 128 bits)
- * - fe_mul is already inlined with optimal instruction scheduling
- * - Saves 0 products (still 16 MUL instructions either way)
- */
-void fe_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
-    fe_mul(r, a, a);
-}
+/* fe_sqr is now defined as static inline in field.h (10-mul dedicated
+ * squaring using __int128). This routes through fe_sqr_inline to save 6
+ * multiplications per squaring compared to fe_mul(a, a). */
 #endif /* !FE_MUL_ASM */
 
 #else /* Portable fallback (no HAVE_INT128) */
@@ -246,17 +271,34 @@ void fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *b) {
         carry2 = c_hi + (sum < w[i] ? 1 : 0);
         r->d[i] = sum;
     }
-    if (carry2) {
+    while (carry2) {
         mul64(&c_hi, &c_lo, carry2, FIELD_C);
         uint64_t sum = r->d[0] + c_lo;
+        uint64_t new_carry = (sum < c_lo) ? 1 : 0;
         r->d[0] = sum;
-        if (sum < c_lo) { r->d[1]++; if (!r->d[1]) { r->d[2]++; if (!r->d[2]) r->d[3]++; } }
+        uint64_t s1 = r->d[1] + c_hi + new_carry;
+        uint64_t nc1 = (s1 < c_hi) || (new_carry && s1 == c_hi) ? 1 : 0;
+        r->d[1] = s1;
+        if (nc1) {
+            uint64_t s2 = r->d[2] + 1;
+            uint64_t nc2 = (s2 == 0) ? 1 : 0;
+            r->d[2] = s2;
+            if (nc2) {
+                uint64_t s3 = r->d[3] + 1;
+                r->d[3] = s3;
+                carry2 = (s3 == 0) ? 1 : 0;
+                continue;
+            }
+        }
+        carry2 = 0;
     }
     /* No fe_normalize — lazy. Output is in [0, 2^256), possibly in [P, P+C).
      * This is safe: mul/add/sub all handle unreduced inputs.
      * Only neg/half/isZero/cmp/toBytes need explicit normalize. */
 }
 
+/* Portable fallback squaring: use fe_mul(a, a) because the 10-mul inline path
+ * requires __int128 and this branch is for compilers without it. */
 void fe_sqr(secp256k1_fe *r, const secp256k1_fe *a) { fe_mul(r, a, a); }
 
 #endif /* HAVE_INT128 */
diff --git a/quartz/src/main/c/secp256k1/field.h b/quartz/src/main/c/secp256k1/field.h
index d2c484fb2..bb0300749 100644
--- a/quartz/src/main/c/secp256k1/field.h
+++ b/quartz/src/main/c/secp256k1/field.h
@@ -128,26 +128,23 @@ static inline void fe_add_assign(secp256k1_fe *r, const secp256k1_fe *a) {
 }
 
 /* r = -a mod p.
- * Uses 2P - a instead of P - a to handle unnormalized inputs in [0, 2P).
- * Result is in [0, 2P). */
+ *
+ * Normalizes a first (fast — usually a no-op), then computes P - a. When
+ * a == 0, P - 0 = P, which a final fe_normalize collapses back to 0. This
+ * branch-free form matches the Kotlin FieldP.neg path and avoids the
+ * data-dependent early-return the previous version had. */
 static inline void fe_negate(secp256k1_fe *r, const secp256k1_fe *a, int m) {
     (void)m;
-    /* 2P = [2*P0, MAX, MAX, MAX-1] + carry handling.
-     * Since P = [P0, MAX, MAX, MAX], 2P = [2*P0, MAX+carry, ...].
-     * Actually 2P mod 2^256 = 2*P0 with carries. Let's just do P + (P - a). */
-    /* Simpler: normalize a first, then P - a. The normalize is fast (usually no-op). */
     secp256k1_fe t = *a;
     fe_normalize(&t);
-    if (t.d[0] == 0 && t.d[1] == 0 && t.d[2] == 0 && t.d[3] == 0) {
-        *r = FE_ZERO;
-        return;
-    }
     uint64_t borrow = 0;
     for (int i = 0; i < 4; i++) {
         uint64_t diff = FE_P.d[i] - t.d[i] - borrow;
         borrow = (FE_P.d[i] < t.d[i] + borrow) || (borrow && t.d[i] == UINT64_MAX) ? 1 : 0;
         r->d[i] = diff;
     }
+    /* If a was 0, r is now P; fold back to 0. Normal inputs leave r < P. */
+    fe_normalize(r);
 }
 
 /* ==================== Function declarations ==================== */
@@ -159,8 +156,156 @@ static inline void fe_negate(secp256k1_fe *r, const secp256k1_fe *a, int m) {
  * calling fe_mul), we rely on LTO or the static inline below. */
 #include "field_asm.h"
 
+#if HAVE_INT128
+/*
+ * Dedicated field squaring using 10 multiplications instead of the 16 that
+ * an unspecialized 4x4 schoolbook mul would use. Exploits symmetry
+ * a[i]*a[j] == a[j]*a[i] with 4 diagonal + 6 doubled cross products.
+ *
+ * Three-pass structure (same as the Kotlin U256.sqrWide):
+ *   Pass 1: compute un-doubled cross-product sum in 6 limbs
+ *   Pass 2: shift left by 1 (doubles every cross product simultaneously)
+ *   Pass 3: add the 4 diagonal products a[i]^2
+ *
+ * NOTE: this inline is only wired up for the non-FE_MUL_ASM build path.
+ * On x86_64 GCC with BMI2/ADX and on ARM64 GCC, fe_mul_asm's hand-tuned
+ * MULX + ADCX/ADOX (or ARM64 MUL/UMULH) carry-chain scheduling beats the
+ * __int128 path despite fe_mul_asm using 16 muls. Benchmark measurement
+ * (bench_vs_acinq) showed fe_sqr_inline regressed verify/batch-verify by
+ * ~10-25% on x86_64 when used in place of fe_mul_asm(r, a, a), so on
+ * ASM platforms we keep fe_mul_asm(r, a, a) for fe_sqr. The 10-mul
+ * version still helps portable builds (clang, MSVC, non-GCC toolchains).
+ */
+static inline void fe_sqr_inline(secp256k1_fe *r, const secp256k1_fe *a) {
+    uint64_t a0 = a->d[0], a1 = a->d[1], a2 = a->d[2], a3 = a->d[3];
+    uint128_t acc;
+
+    /* ===== Pass 1: un-doubled cross-product sum =====
+     * Cross products and their column positions:
+     *   col 1: a0*a1
+     *   col 2: a0*a2
+     *   col 3: a0*a3 + a1*a2  (two products in one column)
+     *   col 4: a1*a3
+     *   col 5: a2*a3
+     *
+     * Cols 1,2,4,5 each have a single product, so the 128-bit accumulator
+     * trick (`acc += new_product; extract low 64`) stays within bounds:
+     * after the extract, acc < 2^64, and adding another full 128-bit product
+     * gives at most (2^64-1)+(2^128-2^65+1) = 2^128-2^64 which still fits.
+     *
+     * Col 3 is the only column with two products, so the straightforward
+     * `acc += p1; acc += p2` sum can overflow 128 bits. We instead extract
+     * the low limb after the first product, then manually fold the second
+     * product's low/high halves into the running accumulator with an
+     * explicit carry flag.
+     */
+    acc = (uint128_t)a0 * a1;
+    uint64_t x1 = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)a0 * a2;
+    uint64_t x2 = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)a0 * a3;
+    uint64_t x3_partial = (uint64_t)acc; acc >>= 64;
+    /* Fold the second col-3 product (a1*a2) into x3 and the running carry. */
+    uint128_t p12 = (uint128_t)a1 * a2;
+    uint64_t p12_lo = (uint64_t)p12;
+    uint64_t p12_hi = (uint64_t)(p12 >> 64);
+    uint64_t x3 = x3_partial + p12_lo;
+    uint64_t x3_carry = (x3 < x3_partial) ? 1ULL : 0ULL;
+    acc += (uint128_t)p12_hi + x3_carry;
+    acc += (uint128_t)a1 * a3;
+    uint64_t x4 = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)a2 * a3;
+    uint64_t x5 = (uint64_t)acc;
+    uint64_t x6 = (uint64_t)(acc >> 64);
+
+    /* ===== Pass 2: shift the cross-product sum left by one bit ===== */
+    uint64_t x7 = x6 >> 63;
+    x6 = (x6 << 1) | (x5 >> 63);
+    x5 = (x5 << 1) | (x4 >> 63);
+    x4 = (x4 << 1) | (x3 >> 63);
+    x3 = (x3 << 1) | (x2 >> 63);
+    x2 = (x2 << 1) | (x1 >> 63);
+    x1 = x1 << 1;
+
+    /* ===== Pass 3: add the 4 diagonal products a[i]^2 ===== */
+    uint64_t d0lo, d0hi, d1lo, d1hi, d2lo, d2hi, d3lo, d3hi;
+    acc = (uint128_t)a0 * a0;
+    d0lo = (uint64_t)acc; d0hi = (uint64_t)(acc >> 64);
+    acc = (uint128_t)a1 * a1;
+    d1lo = (uint64_t)acc; d1hi = (uint64_t)(acc >> 64);
+    acc = (uint128_t)a2 * a2;
+    d2lo = (uint64_t)acc; d2hi = (uint64_t)(acc >> 64);
+    acc = (uint128_t)a3 * a3;
+    d3lo = (uint64_t)acc; d3hi = (uint64_t)(acc >> 64);
+
+    /* w[] = full 8-limb product, cross-sum already doubled. */
+    uint64_t w0 = d0lo;
+    acc = (uint128_t)x1 + d0hi;
+    uint64_t w1 = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)x2 + d1lo;
+    uint64_t w2 = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)x3 + d1hi;
+    uint64_t w3 = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)x4 + d2lo;
+    uint64_t w4 = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)x5 + d2hi;
+    uint64_t w5 = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)x6 + d3lo;
+    uint64_t w6 = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)x7 + d3hi;
+    uint64_t w7 = (uint64_t)acc;
+    /* Any carry out of w7 is impossible: the full product a^2 < 2^512,
+     * and we've accounted for every bit. */
+
+    /* ===== Reduce: r = w[0..3] + w[4..7] * C ===== */
+    const uint64_t FC = 0x1000003D1ULL;
+    acc = (uint128_t)w0 + (uint128_t)w4 * FC;
+    r->d[0] = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)w1 + (uint128_t)w5 * FC;
+    r->d[1] = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)w2 + (uint128_t)w6 * FC;
+    r->d[2] = (uint64_t)acc; acc >>= 64;
+    acc += (uint128_t)w3 + (uint128_t)w7 * FC;
+    r->d[3] = (uint64_t)acc;
+    uint64_t carry = (uint64_t)(acc >> 64);
+
+    /* Final fold loop (same shape as fe_mul). */
+    while (carry) {
+        acc = (uint128_t)r->d[0] + (uint128_t)carry * FC;
+        r->d[0] = (uint64_t)acc;
+        uint64_t c1 = (uint64_t)(acc >> 64);
+        if (c1) {
+            uint64_t s = r->d[1] + c1;
+            uint64_t cc = (s < c1) ? 1 : 0;
+            r->d[1] = s;
+            if (cc) {
+                s = r->d[2] + 1;
+                cc = (s == 0) ? 1 : 0;
+                r->d[2] = s;
+                if (cc) {
+                    s = r->d[3] + 1;
+                    r->d[3] = s;
+                    carry = (s == 0) ? 1 : 0;
+                    continue;
+                }
+            }
+        }
+        carry = 0;
+    }
+}
+#endif /* HAVE_INT128 */
+
 #if FE_MUL_ASM
-/* Use the ASM version directly as static inline so point.c can inline it */
+/* Use the ASM version directly as static inline so point.c can inline it.
+ *
+ * fe_sqr: on FE_MUL_ASM platforms (x86_64 GCC with BMI2/ADX, ARM64 GCC) the
+ * hand-tuned fe_mul_asm uses MULX + dual ADCX/ADOX carry chains that the
+ * __int128-based fe_sqr_inline cannot match in practice. Measurement showed
+ * that saving 6 multiplications via symmetry doesn't compensate for losing
+ * the ASM's optimized carry-chain scheduling and register usage. So on ASM
+ * platforms we just square via fe_mul_asm(r, a, a), which is faster in
+ * wall-clock terms. The 10-mul fe_sqr_inline is still used for compilers
+ * without the ASM path (clang, MSVC, portable fallback). */
 static inline void fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *b) {
     fe_mul_asm(r, a, b);
 }
@@ -169,8 +314,14 @@ static inline void fe_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
 }
 #else
 void fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *b);
+#if HAVE_INT128
+static inline void fe_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
+    fe_sqr_inline(r, a);
+}
+#else
 void fe_sqr(secp256k1_fe *r, const secp256k1_fe *a);
 #endif
+#endif
 void fe_inv(secp256k1_fe *r, const secp256k1_fe *a);
 int fe_sqrt(secp256k1_fe *r, const secp256k1_fe *a);
 void fe_half(secp256k1_fe *r, const secp256k1_fe *a);
diff --git a/quartz/src/main/c/secp256k1/jni_bridge.c b/quartz/src/main/c/secp256k1/jni_bridge.c
index 38a67a29a..a1e74b894 100644
--- a/quartz/src/main/c/secp256k1/jni_bridge.c
+++ b/quartz/src/main/c/secp256k1/jni_bridge.c
@@ -31,6 +31,38 @@ static jbyteArray make_bytes(JNIEnv *env, const uint8_t *data, int len) {
     return arr;
 }
 
+/*
+ * Copy a variable-length Java byte[] into a native buffer without pinning.
+ *
+ * GetByteArrayElements pins the underlying Java array, blocking GC compaction
+ * for the duration of the call. For short-lived crypto operations (signing
+ * or verifying a Nostr event, almost always a 32-byte message digest), copying
+ * via GetByteArrayRegion into a stack or heap buffer is both cheaper and
+ * friendlier to the GC. Small messages (<=512 B) go on the stack; larger
+ * ones allocate via malloc. Caller frees `*out_buf` only if `*needs_free`.
+ */
+static int copy_msg_bytes(JNIEnv *env, jbyteArray arr,
+                          uint8_t *stack_buf, size_t stack_cap,
+                          uint8_t **out_buf, size_t *out_len,
+                          int *needs_free) {
+    if (!arr) return 0;
+    jint len = (*env)->GetArrayLength(env, arr);
+    if (len < 0) return 0;
+    *out_len = (size_t)len;
+    *needs_free = 0;
+    if ((size_t)len <= stack_cap) {
+        *out_buf = stack_buf;
+    } else {
+        *out_buf = (uint8_t *)malloc((size_t)len);
+        if (!*out_buf) return 0;
+        *needs_free = 1;
+    }
+    if (len > 0) {
+        (*env)->GetByteArrayRegion(env, arr, 0, len, (jbyte *)*out_buf);
+    }
+    return 1;
+}
+
 /* ==================== Library Init ==================== */
 
 JNIEXPORT void JNICALL
@@ -83,9 +115,14 @@ Java_com_vitorpamplona_quartz_utils_Secp256k1C_nativeSchnorrSign(
     uint8_t sk[32], aux[32], sig[64];
     if (!get_bytes(env, seckey, sk, 32)) return NULL;
 
-    jint msg_len = (*env)->GetArrayLength(env, msg);
-    uint8_t *msg_buf = (uint8_t *)(*env)->GetByteArrayElements(env, msg, NULL);
-    if (!msg_buf) return NULL;
+    uint8_t stack_msg[512];
+    uint8_t *msg_buf = NULL;
+    size_t msg_len = 0;
+    int needs_free = 0;
+    if (!copy_msg_bytes(env, msg, stack_msg, sizeof(stack_msg),
+                        &msg_buf, &msg_len, &needs_free)) {
+        return NULL;
+    }
 
     uint8_t *aux_ptr = NULL;
     if (auxrand) {
@@ -94,8 +131,8 @@ Java_com_vitorpamplona_quartz_utils_Secp256k1C_nativeSchnorrSign(
         }
     }
 
-    int ok = secp256k1c_schnorr_sign(sig, msg_buf, (size_t)msg_len, sk, aux_ptr);
-    (*env)->ReleaseByteArrayElements(env, msg, (jbyte *)msg_buf, JNI_ABORT);
+    int ok = secp256k1c_schnorr_sign(sig, msg_buf, msg_len, sk, aux_ptr);
+    if (needs_free) free(msg_buf);
 
     return ok ? make_bytes(env, sig, 64) : NULL;
 }
@@ -110,9 +147,14 @@ Java_com_vitorpamplona_quartz_utils_Secp256k1C_nativeSchnorrSignXOnly(
     if (!get_bytes(env, seckey, sk, 32)) return NULL;
     if (!get_bytes(env, xonlyPub, xonly, 32)) return NULL;
 
-    jint msg_len = (*env)->GetArrayLength(env, msg);
-    uint8_t *msg_buf = (uint8_t *)(*env)->GetByteArrayElements(env, msg, NULL);
-    if (!msg_buf) return NULL;
+    uint8_t stack_msg[512];
+    uint8_t *msg_buf = NULL;
+    size_t msg_len = 0;
+    int needs_free = 0;
+    if (!copy_msg_bytes(env, msg, stack_msg, sizeof(stack_msg),
+                        &msg_buf, &msg_len, &needs_free)) {
+        return NULL;
+    }
 
     uint8_t *aux_ptr = NULL;
     if (auxrand) {
@@ -121,8 +163,8 @@ Java_com_vitorpamplona_quartz_utils_Secp256k1C_nativeSchnorrSignXOnly(
         }
     }
 
-    int ok = secp256k1c_schnorr_sign_xonly(sig, msg_buf, (size_t)msg_len, sk, xonly, aux_ptr);
-    (*env)->ReleaseByteArrayElements(env, msg, (jbyte *)msg_buf, JNI_ABORT);
+    int ok = secp256k1c_schnorr_sign_xonly(sig, msg_buf, msg_len, sk, xonly, aux_ptr);
+    if (needs_free) free(msg_buf);
 
     return ok ? make_bytes(env, sig, 64) : NULL;
 }
@@ -138,12 +180,17 @@ Java_com_vitorpamplona_quartz_utils_Secp256k1C_nativeSchnorrVerify(
     if (!get_bytes(env, sig, s, 64)) return JNI_FALSE;
     if (!get_bytes(env, pub, p, 32)) return JNI_FALSE;
 
-    jint msg_len = (*env)->GetArrayLength(env, msg);
-    uint8_t *msg_buf = (uint8_t *)(*env)->GetByteArrayElements(env, msg, NULL);
-    if (!msg_buf) return JNI_FALSE;
+    uint8_t stack_msg[512];
+    uint8_t *msg_buf = NULL;
+    size_t msg_len = 0;
+    int needs_free = 0;
+    if (!copy_msg_bytes(env, msg, stack_msg, sizeof(stack_msg),
+                        &msg_buf, &msg_len, &needs_free)) {
+        return JNI_FALSE;
+    }
 
-    int ok = secp256k1c_schnorr_verify(s, msg_buf, (size_t)msg_len, p);
-    (*env)->ReleaseByteArrayElements(env, msg, (jbyte *)msg_buf, JNI_ABORT);
+    int ok = secp256k1c_schnorr_verify(s, msg_buf, msg_len, p);
+    if (needs_free) free(msg_buf);
     return ok ? JNI_TRUE : JNI_FALSE;
 }
 
@@ -156,12 +203,17 @@ Java_com_vitorpamplona_quartz_utils_Secp256k1C_nativeSchnorrVerifyFast(
     if (!get_bytes(env, sig, s, 64)) return JNI_FALSE;
     if (!get_bytes(env, pub, p, 32)) return JNI_FALSE;
 
-    jint msg_len = (*env)->GetArrayLength(env, msg);
-    uint8_t *msg_buf = (uint8_t *)(*env)->GetByteArrayElements(env, msg, NULL);
-    if (!msg_buf) return JNI_FALSE;
+    uint8_t stack_msg[512];
+    uint8_t *msg_buf = NULL;
+    size_t msg_len = 0;
+    int needs_free = 0;
+    if (!copy_msg_bytes(env, msg, stack_msg, sizeof(stack_msg),
+                        &msg_buf, &msg_len, &needs_free)) {
+        return JNI_FALSE;
+    }
 
-    int ok = secp256k1c_schnorr_verify_fast(s, msg_buf, (size_t)msg_len, p);
-    (*env)->ReleaseByteArrayElements(env, msg, (jbyte *)msg_buf, JNI_ABORT);
+    int ok = secp256k1c_schnorr_verify_fast(s, msg_buf, msg_len, p);
+    if (needs_free) free(msg_buf);
     return ok ? JNI_TRUE : JNI_FALSE;
 }
 
@@ -282,12 +334,17 @@ Java_com_vitorpamplona_quartz_utils_Secp256k1C_nativeSha256(
     JNIEnv *env, jclass cls, jbyteArray data
 ) {
     (void)cls;
-    jint len = (*env)->GetArrayLength(env, data);
-    uint8_t *buf = (uint8_t *)(*env)->GetByteArrayElements(env, data, NULL);
-    if (!buf) return NULL;
+    uint8_t stack_buf[1024];
+    uint8_t *buf = NULL;
+    size_t len = 0;
+    int needs_free = 0;
+    if (!copy_msg_bytes(env, data, stack_buf, sizeof(stack_buf),
+                        &buf, &len, &needs_free)) {
+        return NULL;
+    }
 
     uint8_t out[32];
-    secp256k1_sha256_hash(out, buf, (size_t)len);
-    (*env)->ReleaseByteArrayElements(env, data, (jbyte *)buf, JNI_ABORT);
+    secp256k1_sha256_hash(out, buf, len);
+    if (needs_free) free(buf);
     return make_bytes(env, out, 32);
 }
diff --git a/quartz/src/main/c/secp256k1/scalar.c b/quartz/src/main/c/secp256k1/scalar.c
index 7bd17fcf5..051de7b4a 100644
--- a/quartz/src/main/c/secp256k1/scalar.c
+++ b/quartz/src/main/c/secp256k1/scalar.c
@@ -5,6 +5,11 @@
 #include "scalar.h"
 #include <string.h>
 
+/* 2^256 mod n — a ~129-bit constant. Used by scalar_add and scalar_mul. */
+static const uint64_t SCALAR_NC[4] = {
+    0x402DA1732FC9BEBFULL, 0x4551231950B75FC4ULL, 1, 0
+};
+
 int scalar_is_zero(const secp256k1_scalar *a) {
     return (a->d[0] | a->d[1] | a->d[2] | a->d[3]) == 0;
 }
@@ -52,14 +57,9 @@ void scalar_reduce(secp256k1_scalar *r) {
 void scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
     int carry = add256(r->d, a->d, b->d);
     if (carry) {
-        /* Overflow: subtract n. n_complement = 2^256 - n */
-        uint64_t nc[4] = {
-            ~SCALAR_N.d[0] + 1,
-            ~SCALAR_N.d[1] + (!SCALAR_N.d[0] ? 1ULL : 0ULL),
-            ~SCALAR_N.d[2] + (!(SCALAR_N.d[0] | SCALAR_N.d[1]) ? 1ULL : 0ULL),
-            ~SCALAR_N.d[3]
-        };
-        add256(r->d, r->d, nc);
+        /* Overflow past 2^256: r_true = (a+b) - 2^256 + 2^256 = r + 2^256.
+         * Since 2^256 ≡ NC (mod n), adding NC undoes the wraparound mod n. */
+        add256(r->d, r->d, SCALAR_NC);
     }
     scalar_reduce(r);
 }
@@ -81,62 +81,50 @@ void scalar_sub(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_
 /* Use the field module's proven mul_wide for 4x4 → 8-limb product */
 extern void mul_wide(uint64_t out[8], const uint64_t a[4], const uint64_t b[4]);
 
-/* Multiply mod n: r = (a * b) mod n */
+/*
+ * Multiply mod n: r = (a * b) mod n.
+ *
+ * Fully reduces the 512-bit product via repeated folding: 2^256 ≡ NC (mod n).
+ * Because NC < 2^130, each round strictly shrinks the high half, so the fold
+ * converges in at most 3 iterations before hi is entirely zero. Loop-driven
+ * to avoid the subtle third-fold carry-drop bug the previous unrolled version
+ * had, and to give correct results in the portable (!HAVE_INT128) path too.
+ */
 void scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
-    /* 2^256 mod n */
-    static const uint64_t NC[4] = {
-        0x402DA1732FC9BEBFULL, 0x4551231950B75FC4ULL, 1, 0
-    };
-
     uint64_t t[8];
     mul_wide(t, a->d, b->d);
 
-    /* Reduce: r = t[0..3] + t[4..7]*NC. Use mul_wide for the hi*NC product. */
-    uint64_t hc[8];
-    mul_wide(hc, &t[4], NC);
+    uint64_t lo[4] = { t[0], t[1], t[2], t[3] };
+    uint64_t hi[4] = { t[4], t[5], t[6], t[7] };
 
-    /* Add lo + hc */
-#if HAVE_INT128
-    uint128_t acc = 0;
-    uint64_t sum[8];
-    for (int i = 0; i < 8; i++) {
-        acc += (uint128_t)(i < 4 ? t[i] : 0) + hc[i];
-        sum[i] = (uint64_t)acc;
-        acc >>= 64;
-    }
-    /* Second fold: sum[4..7] * NC + sum[0..3] */
-    if (sum[4] | sum[5] | sum[6] | sum[7]) {
-        uint64_t hc2[8];
-        mul_wide(hc2, &sum[4], NC);
-        acc = 0;
-        uint64_t sum2[8];
-        for (int i = 0; i < 8; i++) {
-            acc += (uint128_t)(i < 4 ? sum[i] : 0) + hc2[i];
-            sum2[i] = (uint64_t)acc;
-            acc >>= 64;
+    while ((hi[0] | hi[1] | hi[2] | hi[3]) != 0) {
+        /* wide = hi * NC (an 8-limb product), then wide += lo. */
+        uint64_t wide[8];
+        mul_wide(wide, hi, SCALAR_NC);
+        uint64_t carry = 0;
+        for (int i = 0; i < 4; i++) {
+            uint64_t s1 = lo[i] + wide[i];
+            uint64_t c1 = (s1 < lo[i]) ? 1ULL : 0ULL;
+            uint64_t s2 = s1 + carry;
+            uint64_t c2 = (s2 < s1) ? 1ULL : 0ULL;
+            wide[i] = s2;
+            carry = c1 + c2;
         }
-        /* Third fold if still > 256 bits (sum2 is at most ~130 bits above 256) */
-        if (sum2[4] | sum2[5] | sum2[6] | sum2[7]) {
-            /* sum2[4..7] is tiny (~2 limbs at most). Use reduce_wide pattern. */
-            acc = (uint128_t)sum2[0] + (uint128_t)sum2[4] * NC[0];
-            r->d[0] = (uint64_t)acc; acc >>= 64;
-            acc += (uint128_t)sum2[1] + (uint128_t)sum2[4] * NC[1] + (uint128_t)sum2[5] * NC[0];
-            r->d[1] = (uint64_t)acc; acc >>= 64;
-            acc += (uint128_t)sum2[2] + (uint128_t)sum2[4] * NC[2] + (uint128_t)sum2[5] * NC[1] + (uint128_t)sum2[6] * NC[0];
-            r->d[2] = (uint64_t)acc; acc >>= 64;
-            acc += (uint128_t)sum2[3] + (uint128_t)sum2[5] * NC[2] + (uint128_t)sum2[6] * NC[1] + (uint128_t)sum2[7] * NC[0];
-            r->d[3] = (uint64_t)acc;
-            /* Any remaining carry is negligible — handled by while loop below */
-        } else {
-            r->d[0] = sum2[0]; r->d[1] = sum2[1]; r->d[2] = sum2[2]; r->d[3] = sum2[3];
+        for (int i = 4; i < 8 && carry != 0; i++) {
+            uint64_t s = wide[i] + carry;
+            carry = (s < wide[i]) ? 1ULL : 0ULL;
+            wide[i] = s;
         }
-    } else {
-        r->d[0] = sum[0]; r->d[1] = sum[1]; r->d[2] = sum[2]; r->d[3] = sum[3];
+        /* carry out of wide[7] is impossible: NC < 2^130, so hi * NC is
+         * bounded by 2^256 * 2^130 = 2^386, fitting comfortably in wide[].
+         * Adding lo (< 2^256) and a tiny running carry stays inside wide[]. */
+
+        lo[0] = wide[0]; lo[1] = wide[1]; lo[2] = wide[2]; lo[3] = wide[3];
+        hi[0] = wide[4]; hi[1] = wide[5]; hi[2] = wide[6]; hi[3] = wide[7];
     }
-#else
-    /* Portable: just take low 4 limbs and subtract n repeatedly */
-    r->d[0] = t[0]; r->d[1] = t[1]; r->d[2] = t[2]; r->d[3] = t[3];
-#endif
+
+    r->d[0] = lo[0]; r->d[1] = lo[1]; r->d[2] = lo[2]; r->d[3] = lo[3];
+    /* At this point r < n + small-epsilon; a single subtract is enough. */
     while (scalar_cmp(r, &SCALAR_N) >= 0) {
         sub256(r->d, r->d, SCALAR_N.d);
     }