BlockstreamResearch · apoelstra · Jul 28, 2026 · Jul 20, 2026 · Jul 21, 2026 · Jul 21, 2026
diff --git a/Cargo-recent.lock b/Cargo-recent.lock
@@ -29,8 +29,8 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2c8d66485a3a2ea485c1913c4572ce0256067a5377ac8c75c4960e1cda98605f"
 dependencies = [
- "bitcoin-internals",
- "bitcoin_hashes",
+ "bitcoin-internals 0.3.0",
+ "bitcoin_hashes 0.14.1",
 ]
 
 [[package]]
@@ -66,16 +66,25 @@ dependencies = [
  "base58ck",
  "base64 0.21.7",
  "bech32",
- "bitcoin-internals",
+ "bitcoin-internals 0.3.0",
  "bitcoin-io",
  "bitcoin-units",
- "bitcoin_hashes",
+ "bitcoin_hashes 0.14.1",
  "hex-conservative 0.2.2",
  "hex_lit",
  "secp256k1",
  "serde",
 ]
 
+[[package]]
+name = "bitcoin-consensus-encoding"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "207311705279250ba465076a1bac4b1ac982855fff73fc5f67e22158ac58cdc9"
+dependencies = [
+ "bitcoin-internals 0.6.0",
+]
+
 [[package]]
 name = "bitcoin-internals"
 version = "0.3.0"
@@ -85,6 +94,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bitcoin-internals"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d573f4cf32996a8dce612e4348cece65a241f1882ed594047c9ba348e8869fa5"
+
 [[package]]
 name = "bitcoin-io"
 version = "0.1.4"
@@ -103,7 +118,7 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5285c8bcaa25876d07f37e3d30c303f2609179716e11d688f51e8f1fe70063e2"
 dependencies = [
- "bitcoin-internals",
+ "bitcoin-internals 0.3.0",
  "serde",
 ]
 
@@ -118,6 +133,17 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bitcoin_hashes"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a67800fcf7f3ca52f7796d4466948a424326b225950c79d1e76d0458760bb25d"
+dependencies = [
+ "bitcoin-consensus-encoding",
+ "bitcoin-internals 0.6.0",
+ "hex-conservative 1.2.0",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.19.0"
@@ -218,6 +244,15 @@ dependencies = [
  "arrayvec",
 ]
 
+[[package]]
+name = "hex-conservative"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35431185f361ccf3ffc58254628af5f1f5d5f28531da2e02e5d6c82bbc282a10"
+dependencies = [
+ "arrayvec",
+]
+
 [[package]]
 name = "hex_lit"
 version = "0.1.1"
@@ -450,7 +485,7 @@ version = "0.29.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9465315bc9d4566e1724f0fffcbcc446268cb522e60f9a27bcded6b19c108113"
 dependencies = [
- "bitcoin_hashes",
+ "bitcoin_hashes 0.14.1",
  "rand",
  "secp256k1-sys",
  "serde",
@@ -566,7 +601,7 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d75c8fb4a18e63fbce4cf16026c36a6c38066e4f4a09ce5e81be817d0e36d8f8"
 dependencies = [
- "bitcoin_hashes",
+ "bitcoin_hashes 0.14.1",
  "byteorder",
  "getrandom 0.2.16",
  "hex-conservative 0.1.2",
@@ -580,12 +615,12 @@ name = "simplicity-lang"
 version = "0.8.0"
 dependencies = [
  "bitcoin",
- "bitcoin_hashes",
+ "bitcoin_hashes 1.1.0",
  "byteorder",
  "elements",
  "getrandom 0.2.16",
  "ghost-cell",
- "hex-conservative 0.2.2",
+ "hex-conservative 1.2.0",
  "logos",
  "miniscript",
  "serde",
@@ -599,15 +634,15 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cd2cc5d458a8032d328ea85e824f54f61664ab84c3d42b3b7f8804fb9b81572"
 dependencies = [
- "bitcoin_hashes",
+ "bitcoin_hashes 0.14.1",
  "cc",
 ]
 
 [[package]]
 name = "simplicity-sys"
 version = "0.7.0"
 dependencies = [
- "bitcoin_hashes",
+ "bitcoin_hashes 1.1.0",
  "cc",
 ]
 

diff --git a/Cargo.toml b/Cargo.toml
@@ -28,8 +28,8 @@ bitcoin-miniscript = { package = "miniscript", version = "12.0.0" }
 byteorder = "1.3"
 elements = { version = "0.25.3", optional = true, default-features = false }
 ghost-cell = { version = "0.2.6", default-features = false }
-hashes = { package = "bitcoin_hashes", version = "0.14" }
-hex = { package = "hex-conservative", version = "0.2.1" }
+hashes = { package = "bitcoin_hashes", version = "1.1.0" }
+hex = { package = "hex-conservative", version = "1.2.0" }
 logos = { version = "0.15", optional = true }
 simplicity-sys = { version = "0.7.0", path = "./simplicity-sys" }
 serde = { version = "1.0.103", features = ["derive"], optional = true }

diff --git a/fuzz/fuzz_targets/c_rust_merkle.rs b/fuzz/fuzz_targets/c_rust_merkle.rs
@@ -53,9 +53,18 @@ fn do_test(data: &[u8]) {
             println!("{}", rust_data.amr());
             println!("{}", rust_data.ihr());
             */
-            assert_eq!(&Midstate::from(c_data.cmr)[..], rust_data.cmr().as_ref(),);
-            assert_eq!(&Midstate::from(c_data.amr)[..], rust_data.amr().as_ref(),);
-            assert_eq!(&Midstate::from(c_data.ihr)[..], rust_data.ihr().as_ref(),);
+            assert_eq!(
+                &Midstate::from(c_data.cmr).to_parts().0,
+                rust_data.cmr().as_ref(),
+            );
+            assert_eq!(
+                &Midstate::from(c_data.amr).to_parts().0,
+                rust_data.amr().as_ref(),
+            );
+            assert_eq!(
+                &Midstate::from(c_data.ihr).to_parts().0,
+                rust_data.ihr().as_ref(),
+            );
         }
     }
 }

diff --git a/jets-bench/src/data_structures.rs b/jets-bench/src/data_structures.rs
@@ -5,11 +5,8 @@ use bitcoin::secp256k1;
 use elements::Txid;
 use rand::{thread_rng, RngCore};
 use simplicity::{
-    bitcoin, elements,
-    hashes::Hash,
-    hex::FromHex,
-    types::Final,
-    BitIter, EarlyEndOfStreamError, Value,
+    bitcoin, elements, elements::hashes::Hash as _, types::Final, BitIter, EarlyEndOfStreamError,
+    Value,
 };
 
 /// Engine to compute SHA256 hash function.
@@ -206,7 +203,7 @@ impl SimplicityEncode for elements::confidential::Value {
             elements::confidential::Value::Explicit(v) => {
                 let left = Final::product(Final::u1(), Final::u256());
                 Value::right(left, Value::u64(*v))
-            },
+            }
             elements::confidential::Value::Confidential(v) => {
                 let ser = v.serialize();
                 let x_bytes = (&ser[1..33]).try_into().unwrap();
@@ -331,7 +328,7 @@ impl BenchSample for elements::confidential::Asset {
             elements::confidential::Asset::Explicit(asset)
         } else {
             let asset_str = "0abb0d5d5843b9378c7f245fd7329d6fcef6926554f0c95f7cf0316239178f743c";
-            let asset_bytes = Vec::<u8>::from_hex(asset_str).unwrap();
+            let asset_bytes = simplicity::hex::decode_to_vec(asset_str).unwrap();
             elements::confidential::Asset::from_commitment(&asset_bytes).unwrap()
         }
     }
@@ -345,7 +342,7 @@ impl BenchSample for elements::confidential::Value {
             elements::confidential::Value::Explicit(value)
         } else {
             let value_str = "09bb0d5d5843b9378c7f245fd7329d6fcef6926554f0c95f7cf0316239178f743c";
-            let value_bytes = Vec::<u8>::from_hex(value_str).unwrap();
+            let value_bytes = simplicity::hex::decode_to_vec(value_str).unwrap();
             elements::confidential::Value::from_commitment(&value_bytes).unwrap()
         }
     }
@@ -357,7 +354,7 @@ impl BenchSample for elements::confidential::Nonce {
             elements::confidential::Nonce::Null
         } else {
             let nonce_str = "03bb0d5d5843b9378c7f245fd7329d6fcef6926554f0c95f7cf0316239178f743c";
-            let nonce_bytes = Vec::<u8>::from_hex(nonce_str).unwrap();
+            let nonce_bytes = simplicity::hex::decode_to_vec(nonce_str).unwrap();
             elements::confidential::Nonce::from_commitment(&nonce_bytes).unwrap()
         }
     }

diff --git a/jets-bench/src/env.rs b/jets-bench/src/env.rs
diff --git a/jets-bench/src/input.rs b/jets-bench/src/input.rs
@@ -7,7 +7,6 @@ use rand::{Rng, RngCore};
 use simplicity::ffi::c_jets::frame_ffi::c_writeBit;
 use simplicity::ffi::ffi::UWORD;
 use simplicity::ffi::CFrameItem;
-use simplicity::hashes::Hash;
 use simplicity::jet::{Elements, ElementsTxEnv, JetEnvironment};
 use simplicity::types::{self, CompleteBound};
 use simplicity::Value;
@@ -1274,15 +1273,12 @@ impl InputSample for CheckSigSignature {
         use simplicity::{bitcoin, hashes};
 
         fn tagged_hash(tag: &[u8], msg_block: [u8; 64]) -> hashes::sha256::Hash {
-            use simplicity::hashes::{Hash as _, HashEngine as _};
+            use hashes::HashEngine as _;
 
-            let tag_hash = hashes::sha256::Hash::hash(tag);
-            let block = [tag_hash.to_byte_array(), tag_hash.to_byte_array()].concat();
-            let mut engine = hashes::sha256::Hash::engine();
-            engine.input(&block);
-            engine.input(&msg_block);
-
-            hashes::sha256::Hash::from_engine(engine)
+            hashes::sha256::Midstate::hash_tag(tag)
+                .to_engine()
+                .with_input(&msg_block)
+                .finalize()
         }
 
         assert_eq!(

diff --git a/simplicity-sys/Cargo.toml b/simplicity-sys/Cargo.toml
@@ -15,7 +15,7 @@ links = "rustsimplicity_0_7"
 cc = "1.0.83"
 
 [dependencies]
-hashes = { package = "bitcoin_hashes", version = "0.14" }
+hashes = { package = "bitcoin_hashes", version = "1.1.0" }
 
 [features]
 test-utils = []

diff --git a/simplicity-sys/depend/simplicity-HEAD-revision.txt b/simplicity-sys/depend/simplicity-HEAD-revision.txt
@@ -1,2 +1,2 @@
 # This file has been automatically generated.
-c6ab4dd8f17838506f92f0d829c40618168817cd
+ba967b1a0d57e069c37cd4041b8bae53f12fd456
diff --git a/simplicity-sys/depend/simplicity/dag.c b/simplicity-sys/depend/simplicity/dag.c
@@ -116,6 +116,7 @@ sha256_midstate rustsimplicity_0_7_computeWordCMR(const bitstring* value, size_t
      case 0: i = getBit(value, 0); break;
      case 1: i = 2 + ((1U * getBit(value, 0) << 1) | getBit(value, 1)); break;
      case 2: i = 6 + ((1U * getBit(value, 0) << 3) | (1U * getBit(value, 1) << 2) | (1U * getBit(value, 2) << 1) | getBit(value, 3)); break;
+     default: SIMPLICITY_UNREACHABLE;
     }
     memcpy(stack_ptr, &word_cmr[i], sizeof(uint32_t[8]));
   } else {
@@ -174,14 +175,15 @@ void rustsimplicity_0_7_computeCommitmentMerkleRoot(dag_node* dag, const uint_fa
    case PAIR:
     memcpy(block + j, dag[dag[i].child[1]].cmr.s, sizeof(uint32_t[8]));
     j = 0;
-    /*@fallthrough@*/
+    SIMPLICITY_FALLTHROUGH;
    case DISCONNECT: /* Only the first child is used in the CMR. */
    case INJL:
    case INJR:
    case TAKE:
    case DROP:
     memcpy(block + j, dag[dag[i].child[0]].cmr.s, sizeof(uint32_t[8]));
     rustsimplicity_0_7_sha256_compression(dag[i].cmr.s, block);
+    SIMPLICITY_FALLTHROUGH;
    case IDEN:
    case UNIT:
    case WITNESS:
@@ -224,13 +226,14 @@ static void computeIdentityHashRoots(sha256_midstate* ihr, const dag_node* dag,
      case DISCONNECT:
       memcpy(block + j, ihr[dag[i].child[1]].s, sizeof(uint32_t[8]));
       j = 0;
-      /*@fallthrough@*/
+      SIMPLICITY_FALLTHROUGH;
      case INJL:
      case INJR:
      case TAKE:
      case DROP:
       memcpy(block + j, ihr[dag[i].child[0]].s, sizeof(uint32_t[8]));
       rustsimplicity_0_7_sha256_compression(ihr[i].s, block);
+      SIMPLICITY_FALLTHROUGH;
      case IDEN:
      case UNIT:
      case HIDDEN:
@@ -420,6 +423,7 @@ simplicity_err rustsimplicity_0_7_verifyCanonicalOrder(dag_node* dag, const uint
         continue;
       }
       if (bottom == child) bottom++;
+      SIMPLICITY_FALLTHROUGH;
      case IDEN:
      case UNIT:
      case WITNESS:
@@ -444,6 +448,7 @@ simplicity_err rustsimplicity_0_7_verifyCanonicalOrder(dag_node* dag, const uint
         continue;
       }
       if (bottom == child) bottom++;
+      SIMPLICITY_FALLTHROUGH;
      case INJL:
      case INJR:
      case TAKE:

diff --git a/simplicity-sys/depend/simplicity/eval.c b/simplicity-sys/depend/simplicity/eval.c
@@ -462,7 +462,7 @@ static simplicity_err runTCO(evalState state, call* stack, const dag_node* dag,
       skip(state.activeWriteFrame, pad( INJR == dag[pc].tag
                                  , type_dag[INJ_B(dag, type_dag, pc)].bitSize
                                  , type_dag[INJ_C(dag, type_dag, pc)].bitSize));
-      /*@fallthrough@*/
+      SIMPLICITY_FALLTHROUGH;
      case TAKE:
       rustsimplicity_0_7_debug_assert(calling);
       /* TAIL_CALL(dag[pc].child[0], SAME_TCO); */
@@ -496,7 +496,7 @@ static simplicity_err runTCO(evalState state, call* stack, const dag_node* dag,
       } else {
         writeValue(state.activeWriteFrame, &dag[pc].compactValue, dag[pc].targetType, type_dag);
       }
-      /*@fallthrough@*/
+      SIMPLICITY_FALLTHROUGH;
      case UNIT:
       rustsimplicity_0_7_debug_assert(calling);
       if (get_tco_flag(&stack[pc])) {

diff --git a/simplicity-sys/depend/simplicity/simplicity_assert.h b/simplicity-sys/depend/simplicity/simplicity_assert.h
@@ -34,4 +34,18 @@
 #  define SIMPLICITY_UNREACHABLE assert(NULL == "SIMPLICITY_UNCREACHABLE was reached")
 #endif
 
+/* Defines a FALLTHROUGH macro to annotate intentional switch fallthroughs, silencing -Wimplicit-fallthrough
+ * warnings on compilers that support the 'fallthrough' attribute.
+ * No-op on compilers (e.g. MSVC) that don't support it.
+ */
+#if defined(__has_attribute)
+#  if __has_attribute(fallthrough)
+#    define SIMPLICITY_FALLTHROUGH __attribute__((fallthrough))
+#  endif
+#endif
+
+#ifndef SIMPLICITY_FALLTHROUGH
+#  define SIMPLICITY_FALLTHROUGH ((void)0)
+#endif
+
 #endif /* SIMPLICITY_SIMPLICITY_ASSERT_H */
diff --git a/simplicity-sys/src/c_jets/c_env/elements.rs b/simplicity-sys/src/c_jets/c_env/elements.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: CC0-1.0
 
-use hashes::{sha256, Hash};
+use hashes::sha256;
 
 use crate::ffi::sha256::CSha256Midstate;
 use crate::ffi::{c_size_t, c_uchar, c_uint, c_uint_fast32_t};
@@ -148,8 +148,11 @@ extern "C" {
 }
 impl CTxEnv {
     pub fn sighash_all(&self) -> sha256::Hash {
+        // This is a little bit sketchy, directly interpreting a midstate as a sha256 hash. Bit
-        // This is a little bit sketchy, directly interpreting a midstate as a sha256 hash. Bit
+        // This is a little bit sketchy, directly interpreting a midstate as a sha256 hash. But
-        // This is a little bit sketchy, directly interpreting a midstate as a sha256 hash. Bit
+        // This is a little bit sketchy, directly interpreting a midstate as a sha256 hash. But
+        // it is okay because sighash data is public and unambiguously encoded, so there is no
+        // risk of length-extension attacks.
         let midstate: sha256::Midstate = self.sighash_all.into();
-        sha256::Hash::from_byte_array(midstate.to_byte_array())
+        sha256::Hash::from_byte_array(midstate.to_parts().0)
     }
 }