Hush Full Node software. We were censored from Github, this is where all development happens now.
https://hush.is
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
183 lines
6.5 KiB
183 lines
6.5 KiB
/**********************************************************************
|
|
* Copyright (c) 2013, 2014 Pieter Wuille *
|
|
* Distributed under the MIT software license, see the accompanying *
|
|
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
|
|
**********************************************************************/
|
|
|
|
|
|
#ifndef _SECP256K1_ECDSA_IMPL_H_
|
|
#define _SECP256K1_ECDSA_IMPL_H_
|
|
|
|
#include "num.h"
|
|
#include "field.h"
|
|
#include "group.h"
|
|
#include "ecmult.h"
|
|
#include "ecmult_gen.h"
|
|
#include "ecdsa.h"
|
|
|
|
static int secp256k1_ecdsa_sig_parse(secp256k1_ecdsa_sig_t *r, const unsigned char *sig, int size) {
|
|
if (sig[0] != 0x30) return 0;
|
|
int lenr = sig[3];
|
|
if (5+lenr >= size) return 0;
|
|
int lens = sig[lenr+5];
|
|
if (sig[1] != lenr+lens+4) return 0;
|
|
if (lenr+lens+6 > size) return 0;
|
|
if (sig[2] != 0x02) return 0;
|
|
if (lenr == 0) return 0;
|
|
if (sig[lenr+4] != 0x02) return 0;
|
|
if (lens == 0) return 0;
|
|
secp256k1_num_set_bin(&r->r, sig+4, lenr);
|
|
secp256k1_num_set_bin(&r->s, sig+6+lenr, lens);
|
|
return 1;
|
|
}
|
|
|
|
static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, int *size, const secp256k1_ecdsa_sig_t *a) {
|
|
int lenR = (secp256k1_num_bits(&a->r) + 7)/8;
|
|
if (lenR == 0 || secp256k1_num_get_bit(&a->r, lenR*8-1))
|
|
lenR++;
|
|
int lenS = (secp256k1_num_bits(&a->s) + 7)/8;
|
|
if (lenS == 0 || secp256k1_num_get_bit(&a->s, lenS*8-1))
|
|
lenS++;
|
|
if (*size < 6+lenS+lenR)
|
|
return 0;
|
|
*size = 6 + lenS + lenR;
|
|
sig[0] = 0x30;
|
|
sig[1] = 4 + lenS + lenR;
|
|
sig[2] = 0x02;
|
|
sig[3] = lenR;
|
|
secp256k1_num_get_bin(sig+4, lenR, &a->r);
|
|
sig[4+lenR] = 0x02;
|
|
sig[5+lenR] = lenS;
|
|
secp256k1_num_get_bin(sig+lenR+6, lenS, &a->s);
|
|
return 1;
|
|
}
|
|
|
|
static int secp256k1_ecdsa_sig_recompute(secp256k1_num_t *r2, const secp256k1_ecdsa_sig_t *sig, const secp256k1_ge_t *pubkey, const secp256k1_num_t *message) {
|
|
const secp256k1_ge_consts_t *c = secp256k1_ge_consts;
|
|
|
|
if (secp256k1_num_is_neg(&sig->r) || secp256k1_num_is_neg(&sig->s))
|
|
return 0;
|
|
if (secp256k1_num_is_zero(&sig->r) || secp256k1_num_is_zero(&sig->s))
|
|
return 0;
|
|
if (secp256k1_num_cmp(&sig->r, &c->order) >= 0 || secp256k1_num_cmp(&sig->s, &c->order) >= 0)
|
|
return 0;
|
|
|
|
int ret = 0;
|
|
secp256k1_num_t sn, u1, u2;
|
|
secp256k1_num_init(&sn);
|
|
secp256k1_num_init(&u1);
|
|
secp256k1_num_init(&u2);
|
|
secp256k1_num_mod_inverse(&sn, &sig->s, &c->order);
|
|
secp256k1_num_mod_mul(&u1, &sn, message, &c->order);
|
|
secp256k1_num_mod_mul(&u2, &sn, &sig->r, &c->order);
|
|
secp256k1_gej_t pubkeyj; secp256k1_gej_set_ge(&pubkeyj, pubkey);
|
|
secp256k1_gej_t pr; secp256k1_ecmult(&pr, &pubkeyj, &u2, &u1);
|
|
if (!secp256k1_gej_is_infinity(&pr)) {
|
|
secp256k1_fe_t xr; secp256k1_gej_get_x_var(&xr, &pr);
|
|
secp256k1_fe_normalize(&xr);
|
|
unsigned char xrb[32]; secp256k1_fe_get_b32(xrb, &xr);
|
|
secp256k1_num_set_bin(r2, xrb, 32);
|
|
secp256k1_num_mod(r2, &c->order);
|
|
ret = 1;
|
|
}
|
|
secp256k1_num_free(&sn);
|
|
secp256k1_num_free(&u1);
|
|
secp256k1_num_free(&u2);
|
|
return ret;
|
|
}
|
|
|
|
static int secp256k1_ecdsa_sig_recover(const secp256k1_ecdsa_sig_t *sig, secp256k1_ge_t *pubkey, const secp256k1_num_t *message, int recid) {
|
|
const secp256k1_ge_consts_t *c = secp256k1_ge_consts;
|
|
|
|
if (secp256k1_num_is_neg(&sig->r) || secp256k1_num_is_neg(&sig->s))
|
|
return 0;
|
|
if (secp256k1_num_is_zero(&sig->r) || secp256k1_num_is_zero(&sig->s))
|
|
return 0;
|
|
if (secp256k1_num_cmp(&sig->r, &c->order) >= 0 || secp256k1_num_cmp(&sig->s, &c->order) >= 0)
|
|
return 0;
|
|
|
|
secp256k1_num_t rx;
|
|
secp256k1_num_init(&rx);
|
|
secp256k1_num_copy(&rx, &sig->r);
|
|
if (recid & 2) {
|
|
secp256k1_num_add(&rx, &rx, &c->order);
|
|
if (secp256k1_num_cmp(&rx, &secp256k1_fe_consts->p) >= 0)
|
|
return 0;
|
|
}
|
|
unsigned char brx[32];
|
|
secp256k1_num_get_bin(brx, 32, &rx);
|
|
secp256k1_num_free(&rx);
|
|
secp256k1_fe_t fx;
|
|
secp256k1_fe_set_b32(&fx, brx);
|
|
secp256k1_ge_t x;
|
|
if (!secp256k1_ge_set_xo(&x, &fx, recid & 1))
|
|
return 0;
|
|
secp256k1_gej_t xj;
|
|
secp256k1_gej_set_ge(&xj, &x);
|
|
secp256k1_num_t rn, u1, u2;
|
|
secp256k1_num_init(&rn);
|
|
secp256k1_num_init(&u1);
|
|
secp256k1_num_init(&u2);
|
|
secp256k1_num_mod_inverse(&rn, &sig->r, &c->order);
|
|
secp256k1_num_mod_mul(&u1, &rn, message, &c->order);
|
|
secp256k1_num_sub(&u1, &c->order, &u1);
|
|
secp256k1_num_mod_mul(&u2, &rn, &sig->s, &c->order);
|
|
secp256k1_gej_t qj;
|
|
secp256k1_ecmult(&qj, &xj, &u2, &u1);
|
|
secp256k1_ge_set_gej_var(pubkey, &qj);
|
|
secp256k1_num_free(&rn);
|
|
secp256k1_num_free(&u1);
|
|
secp256k1_num_free(&u2);
|
|
return !secp256k1_gej_is_infinity(&qj);
|
|
}
|
|
|
|
static int secp256k1_ecdsa_sig_verify(const secp256k1_ecdsa_sig_t *sig, const secp256k1_ge_t *pubkey, const secp256k1_num_t *message) {
|
|
secp256k1_num_t r2;
|
|
secp256k1_num_init(&r2);
|
|
int ret = 0;
|
|
ret = secp256k1_ecdsa_sig_recompute(&r2, sig, pubkey, message) && secp256k1_num_cmp(&sig->r, &r2) == 0;
|
|
secp256k1_num_free(&r2);
|
|
return ret;
|
|
}
|
|
|
|
static int secp256k1_ecdsa_sig_sign(secp256k1_ecdsa_sig_t *sig, const secp256k1_scalar_t *seckey, const secp256k1_scalar_t *message, const secp256k1_scalar_t *nonce, int *recid) {
|
|
secp256k1_gej_t rp;
|
|
secp256k1_ecmult_gen(&rp, nonce);
|
|
secp256k1_ge_t r;
|
|
secp256k1_ge_set_gej(&r, &rp);
|
|
unsigned char b[32];
|
|
secp256k1_fe_normalize(&r.x);
|
|
secp256k1_fe_normalize(&r.y);
|
|
secp256k1_fe_get_b32(b, &r.x);
|
|
int overflow = 0;
|
|
secp256k1_scalar_t sigr;
|
|
secp256k1_scalar_set_b32(&sigr, b, &overflow);
|
|
if (recid)
|
|
*recid = (overflow ? 2 : 0) | (secp256k1_fe_is_odd(&r.y) ? 1 : 0);
|
|
secp256k1_scalar_t n;
|
|
secp256k1_scalar_mul(&n, &sigr, seckey);
|
|
secp256k1_scalar_add(&n, &n, message);
|
|
secp256k1_scalar_t sigs;
|
|
secp256k1_scalar_inverse(&sigs, nonce);
|
|
secp256k1_scalar_mul(&sigs, &sigs, &n);
|
|
secp256k1_scalar_clear(&n);
|
|
secp256k1_gej_clear(&rp);
|
|
secp256k1_ge_clear(&r);
|
|
if (secp256k1_scalar_is_zero(&sigs))
|
|
return 0;
|
|
if (secp256k1_scalar_is_high(&sigs)) {
|
|
secp256k1_scalar_negate(&sigs, &sigs);
|
|
if (recid)
|
|
*recid ^= 1;
|
|
}
|
|
secp256k1_scalar_get_num(&sig->s, &sigs);
|
|
secp256k1_scalar_get_num(&sig->r, &sigr);
|
|
return 1;
|
|
}
|
|
|
|
static void secp256k1_ecdsa_sig_set_rs(secp256k1_ecdsa_sig_t *sig, const secp256k1_num_t *r, const secp256k1_num_t *s) {
|
|
secp256k1_num_copy(&sig->r, r);
|
|
secp256k1_num_copy(&sig->s, s);
|
|
}
|
|
|
|
#endif
|
|
|