secp256k1 0.1.10 → 0.1.11
raw patch · 11 files changed
+364/−109 lines, 11 files
Files
- Makefile.am +2/−1
- include/secp256k1.h +101/−27
- include/secp256k1_recovery.h +1/−1
- secp256k1.cabal +1/−1
- src/ecdsa_impl.h +105/−39
- src/modules/recovery/main_impl.h +1/−0
- src/modules/recovery/tests_impl.h +11/−12
- src/modules/schnorr/tests_impl.h +9/−9
- src/secp256k1.c +55/−1
- src/testrand.h +11/−1
- src/testrand_impl.h +67/−17
Makefile.am view
@@ -40,6 +40,7 @@ noinst_HEADERS += src/field.h noinst_HEADERS += src/field_impl.h noinst_HEADERS += src/bench.h+noinst_HEADERS += contrib/lax_der_parsing.h pkgconfigdir = $(libdir)/pkgconfig pkgconfig_DATA = libsecp256k1.pc@@ -64,7 +65,7 @@ if USE_TESTS noinst_PROGRAMS += tests tests_SOURCES = src/tests.c-tests_CPPFLAGS = -DVERIFY -I$(top_srcdir)/src $(SECP_INCLUDES) $(SECP_TEST_INCLUDES)+tests_CPPFLAGS = -DVERIFY -I$(top_srcdir)/src -I$(top_srcdir)/include $(SECP_INCLUDES) $(SECP_TEST_INCLUDES) tests_LDADD = $(SECP_LIBS) $(SECP_TEST_LIBS) tests_LDFLAGS = -static TESTS = tests
include/secp256k1.h view
@@ -271,6 +271,27 @@ unsigned int flags ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); +/** Parse an ECDSA signature in compact (64 bytes) format.+ *+ * Returns: 1 when the signature could be parsed, 0 otherwise.+ * Args: ctx: a secp256k1 context object+ * Out: sig: a pointer to a signature object+ * In: input64: a pointer to the 64-byte array to parse+ *+ * The signature must consist of a 32-byte big endian R value, followed by a+ * 32-byte big endian S value. If R or S fall outside of [0..order-1], the+ * encoding is invalid. R and S with value 0 are allowed in the encoding.+ *+ * After the call, sig will always be initialized. If parsing failed or R or+ * S are zero, the resulting sig value is guaranteed to fail validation for any+ * message and public key.+ */+SECP256K1_API int secp256k1_ecdsa_signature_parse_compact(+ const secp256k1_context* ctx,+ secp256k1_ecdsa_signature* sig,+ const unsigned char *input64+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);+ /** Parse a DER ECDSA signature. * * Returns: 1 when the signature could be parsed, 0 otherwise.@@ -279,7 +300,12 @@ * In: input: a pointer to the signature to be parsed * inputlen: the length of the array pointed to be input *- * Note that this function also supports some violations of DER and even BER.+ * This function will accept any valid DER encoded signature, even if the+ * encoded numbers are out of range.+ *+ * After the call, sig will always be initialized. If parsing failed or the+ * encoded numbers are out of range, signature validation with it is+ * guaranteed to fail for every message and public key. */ SECP256K1_API int secp256k1_ecdsa_signature_parse_der( const secp256k1_context* ctx,@@ -306,6 +332,21 @@ const secp256k1_ecdsa_signature* sig ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); +/** Serialize an ECDSA signature in compact (64 byte) format.+ *+ * Returns: 1+ * Args: ctx: a secp256k1 context object+ * Out: output64: a pointer to a 64-byte array to store the compact serialization+ * In: sig: a pointer to an initialized signature object+ *+ * See secp256k1_ecdsa_signature_parse_compact for details about the encoding.+ */+SECP256K1_API int secp256k1_ecdsa_signature_serialize_compact(+ const secp256k1_context* ctx,+ unsigned char *output64,+ const secp256k1_ecdsa_signature* sig+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);+ /** Verify an ECDSA signature. * * Returns: 1: correct signature@@ -314,6 +355,15 @@ * In: sig: the signature being verified (cannot be NULL) * msg32: the 32-byte message hash being verified (cannot be NULL) * pubkey: pointer to an initialized public key to verify with (cannot be NULL)+ *+ * To avoid accepting malleable signatures, only ECDSA signatures in lower-S+ * form are accepted.+ *+ * If you need to accept ECDSA signatures from sources that do not obey this+ * rule, apply secp256k1_ecdsa_signature_normalize to the signature prior to+ * validation, but be aware that doing so results in malleable signatures.+ *+ * For details, see the comments for that function. */ SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_verify( const secp256k1_context* ctx,@@ -322,6 +372,54 @@ const secp256k1_pubkey *pubkey ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); +/** Convert a signature to a normalized lower-S form.+ *+ * Returns: 1 if sigin was not normalized, 0 if it already was.+ * Args: ctx: a secp256k1 context object+ * Out: sigout: a pointer to a signature to fill with the normalized form,+ * or copy if the input was already normalized. (can be NULL if+ * you're only interested in whether the input was already+ * normalized).+ * In: sigin: a pointer to a signature to check/normalize (cannot be NULL,+ * can be identical to sigout)+ *+ * With ECDSA a third-party can forge a second distinct signature of the same+ * message, given a single initial signature, but without knowing the key. This+ * is done by negating the S value modulo the order of the curve, 'flipping'+ * the sign of the random point R which is not included in the signature.+ *+ * Forgery of the same message isn't universally problematic, but in systems+ * where message malleability or uniqueness of signatures is important this can+ * cause issues. This forgery can be blocked by all verifiers forcing signers+ * to use a normalized form.+ *+ * The lower-S form reduces the size of signatures slightly on average when+ * variable length encodings (such as DER) are used and is cheap to verify,+ * making it a good choice. Security of always using lower-S is assured because+ * anyone can trivially modify a signature after the fact to enforce this+ * property anyway.+ *+ * The lower S value is always between 0x1 and+ * 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0,+ * inclusive.+ *+ * No other forms of ECDSA malleability are known and none seem likely, but+ * there is no formal proof that ECDSA, even with this additional restriction,+ * is free of other malleability. Commonly used serialization schemes will also+ * accept various non-unique encodings, so care should be taken when this+ * property is required for an application.+ *+ * The secp256k1_ecdsa_sign function will by default create signatures in the+ * lower-S form, and secp256k1_ecdsa_verify will not accept others. In case+ * signatures come from a system that cannot enforce this property,+ * secp256k1_ecdsa_signature_normalize must be called before verification.+ */+SECP256K1_API int secp256k1_ecdsa_signature_normalize(+ const secp256k1_context* ctx,+ secp256k1_ecdsa_signature *sigout,+ const secp256k1_ecdsa_signature *sigin+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3);+ /** An implementation of RFC6979 (using HMAC-SHA256) as nonce generation function. * If a data pointer is passed, it is assumed to be a pointer to 32 bytes of * extra entropy.@@ -342,32 +440,8 @@ * noncefp:pointer to a nonce generation function. If NULL, secp256k1_nonce_function_default is used * ndata: pointer to arbitrary data used by the nonce generation function (can be NULL) *- * The sig always has an s value in the lower half of the range (From 0x1- * to 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0,- * inclusive), unlike many other implementations.- *- * With ECDSA a third-party can can forge a second distinct signature- * of the same message given a single initial signature without knowing- * the key by setting s to its additive inverse mod-order, 'flipping' the- * sign of the random point R which is not included in the signature.- * Since the forgery is of the same message this isn't universally- * problematic, but in systems where message malleability or uniqueness- * of signatures is important this can cause issues. This forgery can be- * blocked by all verifiers forcing signers to use a canonical form. The- * lower-S form reduces the size of signatures slightly on average when- * variable length encodings (such as DER) are used and is cheap to- * verify, making it a good choice. Security of always using lower-S is- * assured because anyone can trivially modify a signature after the- * fact to enforce this property. Adjusting it inside the signing- * function avoids the need to re-serialize or have curve specific- * constants outside of the library. By always using a canonical form- * even in applications where it isn't needed it becomes possible to- * impose a requirement later if a need is discovered.- * No other forms of ECDSA malleability are known and none seem likely,- * but there is no formal proof that ECDSA, even with this additional- * restriction, is free of other malleability. Commonly used serialization- * schemes will also accept various non-unique encodings, so care should- * be taken when this property is required for an application.+ * The created signature is always in lower-S form. See+ * secp256k1_ecdsa_signature_normalize for more details. */ SECP256K1_API int secp256k1_ecdsa_sign( const secp256k1_context* ctx,
include/secp256k1_recovery.h view
@@ -65,7 +65,7 @@ unsigned char *output64, int *recid, const secp256k1_ecdsa_recoverable_signature* sig-) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4);+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); /** Create a recoverable ECDSA signature. *
secp256k1.cabal view
@@ -1,5 +1,5 @@ name: secp256k1-version: 0.1.10+version: 0.1.11 synopsis: secp256k1 bindings for Haskell description: Please see README.md homepage: http://github.com/haskoin/secp256k1#readme
src/ecdsa_impl.h view
@@ -1,5 +1,5 @@ /**********************************************************************- * Copyright (c) 2013, 2014 Pieter Wuille *+ * Copyright (c) 2013-2015 Pieter Wuille * * Distributed under the MIT software license, see the accompanying * * file COPYING or http://www.opensource.org/licenses/mit-license.php.* **********************************************************************/@@ -46,66 +46,132 @@ 0, 0, 0, 1, 0x45512319UL, 0x50B75FC4UL, 0x402DA172UL, 0x2FC9BAEEUL ); -static int secp256k1_ecdsa_sig_parse(secp256k1_scalar *rr, secp256k1_scalar *rs, const unsigned char *sig, size_t size) {- unsigned char ra[32] = {0}, sa[32] = {0};- const unsigned char *rp;- const unsigned char *sp;- size_t lenr;- size_t lens;- int overflow;- if (sig[0] != 0x30) {- return 0;+static int secp256k1_der_read_len(const unsigned char **sigp, const unsigned char *sigend) {+ int lenleft, b1;+ size_t ret = 0;+ if (*sigp >= sigend) {+ return -1; }- lenr = sig[3];- if (5+lenr >= size) {- return 0;+ b1 = *((*sigp)++);+ if (b1 == 0xFF) {+ /* X.690-0207 8.1.3.5.c the value 0xFF shall not be used. */+ return -1; }- lens = sig[lenr+5];- if (sig[1] != lenr+lens+4) {- return 0;+ if ((b1 & 0x80) == 0) {+ /* X.690-0207 8.1.3.4 short form length octets */+ return b1; }- if (lenr+lens+6 > size) {- return 0;+ if (b1 == 0x80) {+ /* Indefinite length is not allowed in DER. */+ return -1; }- if (sig[2] != 0x02) {+ /* X.690-207 8.1.3.5 long form length octets */+ lenleft = b1 & 0x7F;+ if (lenleft > sigend - *sigp) {+ return -1;+ }+ if (**sigp == 0) {+ /* Not the shortest possible length encoding. */+ return -1;+ }+ if ((size_t)lenleft > sizeof(size_t)) {+ /* The resulthing length would exceed the range of a size_t, so+ certainly longer than the passed array size. */+ return -1;+ }+ while (lenleft > 0) {+ if ((ret >> ((sizeof(size_t) - 1) * 8)) != 0) {+ }+ ret = (ret << 8) | **sigp;+ if (ret + lenleft > (size_t)(sigend - *sigp)) {+ /* Result exceeds the length of the passed array. */+ return -1;+ }+ (*sigp)++;+ lenleft--;+ }+ if (ret < 128) {+ /* Not the shortest possible length encoding. */+ return -1;+ }+ return ret;+}++static int secp256k1_der_parse_integer(secp256k1_scalar *r, const unsigned char **sig, const unsigned char *sigend) {+ int overflow = 0;+ unsigned char ra[32] = {0};+ int rlen;++ if (*sig == sigend || **sig != 0x02) {+ /* Not a primitive integer (X.690-0207 8.3.1). */ return 0; }- if (lenr == 0) {+ (*sig)++;+ rlen = secp256k1_der_read_len(sig, sigend);+ if (rlen <= 0 || (*sig) + rlen > sigend) {+ /* Exceeds bounds or not at least length 1 (X.690-0207 8.3.1). */ return 0; }- if (sig[lenr+4] != 0x02) {+ if (**sig == 0x00 && rlen > 1 && (((*sig)[1]) & 0x80) == 0x00) {+ /* Excessive 0x00 padding. */ return 0; }- if (lens == 0) {+ if (**sig == 0xFF && rlen > 1 && (((*sig)[1]) & 0x80) == 0x80) {+ /* Excessive 0xFF padding. */ return 0; }- sp = sig + 6 + lenr;- while (lens > 0 && sp[0] == 0) {- lens--;- sp++;+ if ((**sig & 0x80) == 0x80) {+ /* Negative. */+ overflow = 1; }- if (lens > 32) {+ while (rlen > 0 && **sig == 0) {+ /* Skip leading zero bytes */+ rlen--;+ (*sig)++;+ }+ if (rlen > 32) {+ overflow = 1;+ }+ if (!overflow) {+ memcpy(ra + 32 - rlen, *sig, rlen);+ secp256k1_scalar_set_b32(r, ra, &overflow);+ }+ if (overflow) {+ secp256k1_scalar_set_int(r, 0);+ }+ (*sig) += rlen;+ return 1;+}++static int secp256k1_ecdsa_sig_parse(secp256k1_scalar *rr, secp256k1_scalar *rs, const unsigned char *sig, size_t size) {+ const unsigned char *sigend = sig + size;+ int rlen;+ if (sig == sigend || *(sig++) != 0x30) {+ /* The encoding doesn't start with a constructed sequence (X.690-0207 8.9.1). */ return 0; }- rp = sig + 4;- while (lenr > 0 && rp[0] == 0) {- lenr--;- rp++;+ rlen = secp256k1_der_read_len(&sig, sigend);+ if (rlen < 0 || sig + rlen > sigend) {+ /* Tuple exceeds bounds */+ return 0; }- if (lenr > 32) {+ if (sig + rlen != sigend) {+ /* Garbage after tuple. */ return 0; }- memcpy(ra + 32 - lenr, rp, lenr);- memcpy(sa + 32 - lens, sp, lens);- overflow = 0;- secp256k1_scalar_set_b32(rr, ra, &overflow);- if (overflow) {++ if (!secp256k1_der_parse_integer(rr, &sig, sigend)) { return 0; }- secp256k1_scalar_set_b32(rs, sa, &overflow);- if (overflow) {+ if (!secp256k1_der_parse_integer(rs, &sig, sigend)) { return 0; }++ if (sig != sigend) {+ /* Trailing garbage inside tuple. */+ return 0;+ }+ return 1; }
src/modules/recovery/main_impl.h view
@@ -63,6 +63,7 @@ (void)ctx; ARG_CHECK(output64 != NULL); ARG_CHECK(sig != NULL);+ ARG_CHECK(recid != NULL); secp256k1_ecdsa_recoverable_signature_load(ctx, &r, &s, recid, sig); secp256k1_scalar_get_b32(&output64[0], &r);
src/modules/recovery/tests_impl.h view
@@ -56,7 +56,7 @@ CHECK(memcmp(&pubkey, &recpubkey, sizeof(pubkey)) == 0); /* Serialize/destroy/parse signature and verify again. */ CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, &rsignature[4]) == 1);- sig[secp256k1_rand32() % 64] += 1 + (secp256k1_rand32() % 255);+ sig[secp256k1_rand_bits(6)] += 1 + secp256k1_rand_int(255); CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsignature[4], sig, recid) == 1); CHECK(secp256k1_ecdsa_recoverable_signature_convert(ctx, &signature[4], &rsignature[4]) == 1); CHECK(secp256k1_ecdsa_verify(ctx, &signature[4], message, &pubkey) == 0);@@ -163,25 +163,24 @@ CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(ctx, &rsig, sigb64, recid2) == 1); CHECK(secp256k1_ecdsa_recover(ctx, &pubkey2b, &rsig, msg32) == 1); /* Verifying with (order + r,4) should always fail. */- CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderlong, sizeof(sigbderlong)) == 0);+ CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderlong, sizeof(sigbderlong)) == 1);+ CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0); } /* DER parsing tests. */ /* Zero length r/s. */ CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigcder_zr, sizeof(sigcder_zr)) == 0); CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigcder_zs, sizeof(sigcder_zs)) == 0); /* Leading zeros. */- CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt1, sizeof(sigbderalt1)) == 1);- CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 1);- CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt2, sizeof(sigbderalt2)) == 1);- CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 1);- CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt3, sizeof(sigbderalt3)) == 1);- CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 1);- CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt4, sizeof(sigbderalt4)) == 1);- CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 1);- sigbderalt3[4] = 1;+ CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt1, sizeof(sigbderalt1)) == 0);+ CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt2, sizeof(sigbderalt2)) == 0); CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt3, sizeof(sigbderalt3)) == 0);- sigbderalt4[7] = 1; CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt4, sizeof(sigbderalt4)) == 0);+ sigbderalt3[4] = 1;+ CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt3, sizeof(sigbderalt3)) == 1);+ CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0);+ sigbderalt4[7] = 1;+ CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbderalt4, sizeof(sigbderalt4)) == 1);+ CHECK(secp256k1_ecdsa_verify(ctx, &sig, msg32, &pubkeyb) == 0); /* Damage signature. */ sigbder[7]++; CHECK(secp256k1_ecdsa_signature_parse_der(ctx, &sig, sigbder, sizeof(sigbder)) == 1);
src/modules/schnorr/tests_impl.h view
@@ -33,7 +33,7 @@ CHECK(secp256k1_schnorr_recover(ctx, &recpubkey, schnorr_signature, message) == 1); CHECK(memcmp(&pubkey, &recpubkey, sizeof(pubkey)) == 0); /* Destroy signature and verify again. */- schnorr_signature[secp256k1_rand32() % 64] += 1 + (secp256k1_rand32() % 255);+ schnorr_signature[secp256k1_rand_bits(6)] += 1 + secp256k1_rand_int(255); CHECK(secp256k1_schnorr_verify(ctx, schnorr_signature, message, &pubkey) == 0); CHECK(secp256k1_schnorr_recover(ctx, &recpubkey, schnorr_signature, message) != 1 || memcmp(&pubkey, &recpubkey, sizeof(pubkey)) != 0);@@ -73,8 +73,8 @@ CHECK(secp256k1_schnorr_sig_verify(&ctx->ecmult_ctx, sig64[k], &pubkey[k], &test_schnorr_hash, msg32)); for (i = 0; i < 4; i++) {- int pos = secp256k1_rand32() % 64;- int mod = 1 + (secp256k1_rand32() % 255);+ int pos = secp256k1_rand_bits(6);+ int mod = 1 + secp256k1_rand_int(255); sig64[k][pos] ^= mod; CHECK(secp256k1_schnorr_sig_verify(&ctx->ecmult_ctx, sig64[k], &pubkey[k], &test_schnorr_hash, msg32) == 0); sig64[k][pos] ^= mod;@@ -97,9 +97,9 @@ int damage; int ret = 0; - damage = (secp256k1_rand32() % 2) ? (1 + (secp256k1_rand32() % 4)) : 0;+ damage = secp256k1_rand_bits(1) ? (1 + secp256k1_rand_int(4)) : 0; secp256k1_rand256_test(msg);- n = 2 + (secp256k1_rand32() % 4);+ n = 2 + secp256k1_rand_int(4); for (i = 0; i < n; i++) { do { secp256k1_rand256_test(sec[i]);@@ -109,9 +109,9 @@ pubs[i] = &pub[i]; } if (damage == 1) {- nonce[secp256k1_rand32() % n][secp256k1_rand32() % 32] ^= 1 + (secp256k1_rand32() % 255);+ nonce[secp256k1_rand_int(n)][secp256k1_rand_int(32)] ^= 1 + secp256k1_rand_int(255); } else if (damage == 2) {- sec[secp256k1_rand32() % n][secp256k1_rand32() % 32] ^= 1 + (secp256k1_rand32() % 255);+ sec[secp256k1_rand_int(n)][secp256k1_rand_int(32)] ^= 1 + secp256k1_rand_int(255); } for (i = 0; i < n; i++) { secp256k1_pubkey allpubnonce;@@ -128,14 +128,14 @@ sigs[i] = sig[i]; } if (damage == 3) {- sig[secp256k1_rand32() % n][secp256k1_rand32() % 64] ^= 1 + (secp256k1_rand32() % 255);+ sig[secp256k1_rand_int(n)][secp256k1_rand_bits(6)] ^= 1 + secp256k1_rand_int(255); } ret |= (secp256k1_ec_pubkey_combine(ctx, &allpub, pubs, n) != 1) * 2; if ((ret & 1) == 0) { ret |= (secp256k1_schnorr_partial_combine(ctx, allsig, sigs, n) != 1) * 4; } if (damage == 4) {- allsig[secp256k1_rand32() % 32] ^= 1 + (secp256k1_rand32() % 255);+ allsig[secp256k1_rand_int(32)] ^= 1 + secp256k1_rand_int(255); } if ((ret & 7) == 0) { ret |= (secp256k1_schnorr_verify(ctx, allsig, msg, &allpub) != 1) * 8;
src/secp256k1.c view
@@ -210,6 +210,27 @@ } } +int secp256k1_ecdsa_signature_parse_compact(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input64) {+ secp256k1_scalar r, s;+ int ret = 1;+ int overflow = 0;++ (void)ctx;+ ARG_CHECK(sig != NULL);+ ARG_CHECK(input64 != NULL);++ secp256k1_scalar_set_b32(&r, &input64[0], &overflow);+ ret &= !overflow;+ secp256k1_scalar_set_b32(&s, &input64[32], &overflow);+ ret &= !overflow;+ if (ret) {+ secp256k1_ecdsa_signature_save(sig, &r, &s);+ } else {+ memset(sig, 0, sizeof(*sig));+ }+ return ret;+}+ int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature* sig) { secp256k1_scalar r, s; @@ -222,6 +243,38 @@ return secp256k1_ecdsa_sig_serialize(output, outputlen, &r, &s); } +int secp256k1_ecdsa_signature_serialize_compact(const secp256k1_context* ctx, unsigned char *output64, const secp256k1_ecdsa_signature* sig) {+ secp256k1_scalar r, s;++ (void)ctx;+ ARG_CHECK(output64 != NULL);+ ARG_CHECK(sig != NULL);++ secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);+ secp256k1_scalar_get_b32(&output64[0], &r);+ secp256k1_scalar_get_b32(&output64[32], &s);+ return 1;+}++int secp256k1_ecdsa_signature_normalize(const secp256k1_context* ctx, secp256k1_ecdsa_signature *sigout, const secp256k1_ecdsa_signature *sigin) {+ secp256k1_scalar r, s;+ int ret = 0;++ VERIFY_CHECK(ctx != NULL);+ ARG_CHECK(sigin != NULL);++ secp256k1_ecdsa_signature_load(ctx, &r, &s, sigin);+ ret = secp256k1_scalar_is_high(&s);+ if (sigout != NULL) {+ if (ret) {+ secp256k1_scalar_negate(&s, &s);+ }+ secp256k1_ecdsa_signature_save(sigout, &r, &s);+ }++ return ret;+}+ int secp256k1_ecdsa_verify(const secp256k1_context* ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msg32, const secp256k1_pubkey *pubkey) { secp256k1_ge q; secp256k1_scalar r, s;@@ -234,7 +287,8 @@ secp256k1_scalar_set_b32(&m, msg32, NULL); secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);- return (secp256k1_pubkey_load(ctx, &q, pubkey) &&+ return (!secp256k1_scalar_is_high(&s) &&+ secp256k1_pubkey_load(ctx, &q, pubkey) && secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &r, &s, &q, &m)); }
src/testrand.h view
@@ -16,13 +16,23 @@ /** Seed the pseudorandom number generator for testing. */ SECP256K1_INLINE static void secp256k1_rand_seed(const unsigned char *seed16); -/** Generate a pseudorandom 32-bit number. */+/** Generate a pseudorandom number in the range [0..2**32-1]. */ static uint32_t secp256k1_rand32(void); +/** Generate a pseudorandom number in the range [0..2**bits-1]. Bits must be 1 or+ * more. */+static uint32_t secp256k1_rand_bits(int bits);++/** Generate a pseudorandom number in the range [0..range-1]. */+static uint32_t secp256k1_rand_int(uint32_t range);+ /** Generate a pseudorandom 32-byte array. */ static void secp256k1_rand256(unsigned char *b32); /** Generate a pseudorandom 32-byte array with long sequences of zero and one bits. */ static void secp256k1_rand256_test(unsigned char *b32);++/** Generate pseudorandom bytes with long sequences of zero and one bits. */+static void secp256k1_rand_bytes_test(unsigned char *bytes, size_t len); #endif
src/testrand_impl.h view
@@ -1,5 +1,5 @@ /**********************************************************************- * Copyright (c) 2013, 2014 Pieter Wuille *+ * Copyright (c) 2013-2015 Pieter Wuille * * Distributed under the MIT software license, see the accompanying * * file COPYING or http://www.opensource.org/licenses/mit-license.php.* **********************************************************************/@@ -16,6 +16,8 @@ static secp256k1_rfc6979_hmac_sha256_t secp256k1_test_rng; static uint32_t secp256k1_test_rng_precomputed[8]; static int secp256k1_test_rng_precomputed_used = 8;+static uint64_t secp256k1_test_rng_integer;+static int secp256k1_test_rng_integer_bits_left = 0; SECP256K1_INLINE static void secp256k1_rand_seed(const unsigned char *seed16) { secp256k1_rfc6979_hmac_sha256_initialize(&secp256k1_test_rng, seed16, 16);@@ -29,32 +31,80 @@ return secp256k1_test_rng_precomputed[secp256k1_test_rng_precomputed_used++]; } +static uint32_t secp256k1_rand_bits(int bits) {+ uint32_t ret;+ if (secp256k1_test_rng_integer_bits_left < bits) {+ secp256k1_test_rng_integer |= (((uint64_t)secp256k1_rand32()) << secp256k1_test_rng_integer_bits_left);+ secp256k1_test_rng_integer_bits_left += 32;+ }+ ret = secp256k1_test_rng_integer;+ secp256k1_test_rng_integer >>= bits;+ secp256k1_test_rng_integer_bits_left -= bits;+ ret &= ((~((uint32_t)0)) >> (32 - bits));+ return ret;+}++static uint32_t secp256k1_rand_int(uint32_t range) {+ /* We want a uniform integer between 0 and range-1, inclusive.+ * B is the smallest number such that range <= 2**B.+ * two mechanisms implemented here:+ * - generate B bits numbers until one below range is found, and return it+ * - find the largest multiple M of range that is <= 2**(B+A), generate B+A+ * bits numbers until one below M is found, and return it modulo range+ * The second mechanism consumes A more bits of entropy in every iteration,+ * but may need fewer iterations due to M being closer to 2**(B+A) then+ * range is to 2**B. The array below (indexed by B) contains a 0 when the+ * first mechanism is to be used, and the number A otherwise.+ */+ static const int addbits[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 2, 2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 2, 1, 0};+ uint32_t trange, mult;+ int bits = 0;+ if (range <= 1) {+ return 0;+ }+ trange = range - 1;+ while (trange > 0) {+ trange >>= 1;+ bits++;+ }+ if (addbits[bits]) {+ bits = bits + addbits[bits];+ mult = ((~((uint32_t)0)) >> (32 - bits)) / range;+ trange = range * mult;+ } else {+ trange = range;+ mult = 1;+ }+ while(1) {+ uint32_t x = secp256k1_rand_bits(bits);+ if (x < trange) {+ return (mult == 1) ? x : (x % range);+ }+ }+}+ static void secp256k1_rand256(unsigned char *b32) { secp256k1_rfc6979_hmac_sha256_generate(&secp256k1_test_rng, b32, 32); } -static void secp256k1_rand256_test(unsigned char *b32) {- int bits=0;- uint64_t ent = 0;- int entleft = 0;- memset(b32, 0, 32);- while (bits < 256) {+static void secp256k1_rand_bytes_test(unsigned char *bytes, size_t len) {+ size_t bits = 0;+ memset(bytes, 0, len);+ while (bits < len * 8) { int now; uint32_t val;- if (entleft < 12) {- ent |= ((uint64_t)secp256k1_rand32()) << entleft;- entleft += 32;- }- now = 1 + ((ent % 64)*((ent >> 6) % 32)+16)/31;- val = 1 & (ent >> 11);- ent >>= 12;- entleft -= 12;- while (now > 0 && bits < 256) {- b32[bits / 8] |= val << (bits % 8);+ now = 1 + (secp256k1_rand_bits(6) * secp256k1_rand_bits(5) + 16) / 31;+ val = secp256k1_rand_bits(1);+ while (now > 0 && bits < len * 8) {+ bytes[bits / 8] |= val << (bits % 8); now--; bits++; } }+}++static void secp256k1_rand256_test(unsigned char *b32) {+ secp256k1_rand_bytes_test(b32, 32); } #endif