Daniel Cousens
7 years ago
committed by
GitHub
GitHub
18 changed files with 224 additions and 577 deletions
@ -1,163 +0,0 @@ |
|||
var Buffer = require('safe-buffer').Buffer |
|||
var createHmac = require('create-hmac') |
|||
var typeforce = require('typeforce') |
|||
var types = require('./types') |
|||
|
|||
var BigInteger = require('bigi') |
|||
|
|||
var ZERO = Buffer.alloc(1, 0) |
|||
var ONE = Buffer.alloc(1, 1) |
|||
|
|||
var ecurve = require('ecurve') |
|||
var secp256k1 = ecurve.getCurveByName('secp256k1') |
|||
|
|||
// https://tools.ietf.org/html/rfc6979#section-3.2
|
|||
function deterministicGenerateK (hash, x, checkSig) { |
|||
typeforce(types.tuple( |
|||
types.Hash256bit, |
|||
types.Buffer256bit, |
|||
types.Function |
|||
), arguments) |
|||
|
|||
// Step A, ignored as hash already provided
|
|||
// Step B
|
|||
// Step C
|
|||
var k = Buffer.alloc(32, 0) |
|||
var v = Buffer.alloc(32, 1) |
|||
|
|||
// Step D
|
|||
k = createHmac('sha256', k) |
|||
.update(v) |
|||
.update(ZERO) |
|||
.update(x) |
|||
.update(hash) |
|||
.digest() |
|||
|
|||
// Step E
|
|||
v = createHmac('sha256', k).update(v).digest() |
|||
|
|||
// Step F
|
|||
k = createHmac('sha256', k) |
|||
.update(v) |
|||
.update(ONE) |
|||
.update(x) |
|||
.update(hash) |
|||
.digest() |
|||
|
|||
// Step G
|
|||
v = createHmac('sha256', k).update(v).digest() |
|||
|
|||
// Step H1/H2a, ignored as tlen === qlen (256 bit)
|
|||
// Step H2b
|
|||
v = createHmac('sha256', k).update(v).digest() |
|||
|
|||
var T = BigInteger.fromBuffer(v) |
|||
|
|||
// Step H3, repeat until T is within the interval [1, n - 1] and is suitable for ECDSA
|
|||
while (T.signum() <= 0 || T.compareTo(secp256k1.n) >= 0 || !checkSig(T)) { |
|||
k = createHmac('sha256', k) |
|||
.update(v) |
|||
.update(ZERO) |
|||
.digest() |
|||
|
|||
v = createHmac('sha256', k).update(v).digest() |
|||
|
|||
// Step H1/H2a, again, ignored as tlen === qlen (256 bit)
|
|||
// Step H2b again
|
|||
v = createHmac('sha256', k).update(v).digest() |
|||
T = BigInteger.fromBuffer(v) |
|||
} |
|||
|
|||
return T |
|||
} |
|||
|
|||
var N_OVER_TWO = secp256k1.n.shiftRight(1) |
|||
|
|||
function sign (hash, d) { |
|||
typeforce(types.tuple(types.Hash256bit, types.BigInt), arguments) |
|||
|
|||
var x = d.toBuffer(32) |
|||
var e = BigInteger.fromBuffer(hash) |
|||
var n = secp256k1.n |
|||
var G = secp256k1.G |
|||
|
|||
var r, s |
|||
deterministicGenerateK(hash, x, function (k) { |
|||
var Q = G.multiply(k) |
|||
|
|||
if (secp256k1.isInfinity(Q)) return false |
|||
|
|||
r = Q.affineX.mod(n) |
|||
if (r.signum() === 0) return false |
|||
|
|||
s = k.modInverse(n).multiply(e.add(d.multiply(r))).mod(n) |
|||
if (s.signum() === 0) return false |
|||
|
|||
return true |
|||
}) |
|||
|
|||
// enforce low S values, see bip62: 'low s values in signatures'
|
|||
if (s.compareTo(N_OVER_TWO) > 0) { |
|||
s = n.subtract(s) |
|||
} |
|||
|
|||
return { |
|||
r: r, |
|||
s: s |
|||
} |
|||
} |
|||
|
|||
function verify (hash, signature, Q) { |
|||
typeforce(types.tuple( |
|||
types.Hash256bit, |
|||
types.ECSignature, |
|||
types.ECPoint |
|||
), arguments) |
|||
|
|||
var n = secp256k1.n |
|||
var G = secp256k1.G |
|||
|
|||
var r = signature.r |
|||
var s = signature.s |
|||
|
|||
// 1.4.1 Enforce r and s are both integers in the interval [1, n − 1]
|
|||
if (r.signum() <= 0 || r.compareTo(n) >= 0) return false |
|||
if (s.signum() <= 0 || s.compareTo(n) >= 0) return false |
|||
|
|||
// 1.4.2 H = Hash(M), already done by the user
|
|||
// 1.4.3 e = H
|
|||
var e = BigInteger.fromBuffer(hash) |
|||
|
|||
// Compute s^-1
|
|||
var sInv = s.modInverse(n) |
|||
|
|||
// 1.4.4 Compute u1 = es^−1 mod n
|
|||
// u2 = rs^−1 mod n
|
|||
var u1 = e.multiply(sInv).mod(n) |
|||
var u2 = r.multiply(sInv).mod(n) |
|||
|
|||
// 1.4.5 Compute R = (xR, yR)
|
|||
// R = u1G + u2Q
|
|||
var R = G.multiplyTwo(u1, Q, u2) |
|||
|
|||
// 1.4.5 (cont.) Enforce R is not at infinity
|
|||
if (secp256k1.isInfinity(R)) return false |
|||
|
|||
// 1.4.6 Convert the field element R.x to an integer
|
|||
var xR = R.affineX |
|||
|
|||
// 1.4.7 Set v = xR mod n
|
|||
var v = xR.mod(n) |
|||
|
|||
// 1.4.8 If v = r, output "valid", and if v != r, output "invalid"
|
|||
return v.equals(r) |
|||
} |
|||
|
|||
module.exports = { |
|||
deterministicGenerateK: deterministicGenerateK, |
|||
sign: sign, |
|||
verify: verify, |
|||
|
|||
// TODO: remove
|
|||
__curve: secp256k1 |
|||
} |
|||
@ -1,135 +0,0 @@ |
|||
/* global describe, it */ |
|||
|
|||
var assert = require('assert') |
|||
var bcrypto = require('../src/crypto') |
|||
var ecdsa = require('../src/ecdsa') |
|||
var hoodwink = require('hoodwink') |
|||
|
|||
var BigInteger = require('bigi') |
|||
|
|||
var curve = ecdsa.__curve |
|||
|
|||
var fixtures = require('./fixtures/ecdsa.json') |
|||
|
|||
describe('ecdsa', function () { |
|||
function fromRaw (signature) { |
|||
return { |
|||
r: new BigInteger(signature.r, 16), |
|||
s: new BigInteger(signature.s, 16) |
|||
} |
|||
} |
|||
|
|||
function toRaw (signature) { |
|||
return { |
|||
r: signature.r.toHex(), |
|||
s: signature.s.toHex() |
|||
} |
|||
} |
|||
|
|||
describe('deterministicGenerateK', function () { |
|||
function checkSig () { |
|||
return true |
|||
} |
|||
|
|||
fixtures.valid.ecdsa.forEach(function (f) { |
|||
it('for "' + f.message + '"', function () { |
|||
var x = BigInteger.fromHex(f.d).toBuffer(32) |
|||
var h1 = bcrypto.sha256(f.message) |
|||
|
|||
var k = ecdsa.deterministicGenerateK(h1, x, checkSig) |
|||
assert.strictEqual(k.toHex(), f.k) |
|||
}) |
|||
}) |
|||
|
|||
it('loops until an appropriate k value is found', hoodwink(function () { |
|||
this.mock(BigInteger, 'fromBuffer', function f (b) { |
|||
assert.strictEqual(b.length, 32) |
|||
if (f.calls === 0) return BigInteger.ZERO // < 1
|
|||
if (f.calls === 1) return curve.n // > n - 1
|
|||
if (f.calls === 2) return new BigInteger('42') // valid
|
|||
}, 3) |
|||
|
|||
var x = new BigInteger('1').toBuffer(32) |
|||
var h1 = Buffer.alloc(32) |
|||
var k = ecdsa.deterministicGenerateK(h1, x, checkSig) |
|||
|
|||
assert.strictEqual(k.toString(), '42') |
|||
})) |
|||
|
|||
it('loops until a suitable signature is found', hoodwink(function () { |
|||
var checkSigStub = this.stub(function f () { |
|||
if (f.calls === 0) return false // bad signature
|
|||
if (f.calls === 1) return true // good signature
|
|||
}, 2) |
|||
|
|||
var x = BigInteger.ONE.toBuffer(32) |
|||
var h1 = Buffer.alloc(32) |
|||
var k = ecdsa.deterministicGenerateK(h1, x, checkSigStub) |
|||
|
|||
assert.strictEqual(k.toHex(), 'a9b1a1a84a4c2f96b6158ed7a81404c50cb74373c22e8d9e02d0411d719acae2') |
|||
})) |
|||
|
|||
fixtures.valid.rfc6979.forEach(function (f) { |
|||
it('produces the expected k values for ' + f.message + " if k wasn't suitable", function () { |
|||
var x = BigInteger.fromHex(f.d).toBuffer(32) |
|||
var h1 = bcrypto.sha256(f.message) |
|||
|
|||
var results = [] |
|||
ecdsa.deterministicGenerateK(h1, x, function (k) { |
|||
results.push(k) |
|||
|
|||
return results.length === 16 |
|||
}) |
|||
|
|||
assert.strictEqual(results[0].toHex(), f.k0) |
|||
assert.strictEqual(results[1].toHex(), f.k1) |
|||
assert.strictEqual(results[15].toHex(), f.k15) |
|||
}) |
|||
}) |
|||
}) |
|||
|
|||
describe('sign', function () { |
|||
fixtures.valid.ecdsa.forEach(function (f) { |
|||
it('produces a deterministic signature for "' + f.message + '"', function () { |
|||
var d = BigInteger.fromHex(f.d) |
|||
var hash = bcrypto.sha256(f.message) |
|||
var signature = ecdsa.sign(hash, d) |
|||
|
|||
assert.deepEqual(toRaw(signature), f.signature) |
|||
}) |
|||
}) |
|||
|
|||
it('should sign with low S value', function () { |
|||
var hash = bcrypto.sha256('Vires in numeris') |
|||
var sig = ecdsa.sign(hash, BigInteger.ONE) |
|||
|
|||
// See BIP62 for more information
|
|||
var N_OVER_TWO = curve.n.shiftRight(1) |
|||
assert(sig.s.compareTo(N_OVER_TWO) <= 0) |
|||
}) |
|||
}) |
|||
|
|||
describe('verify', function () { |
|||
fixtures.valid.ecdsa.forEach(function (f) { |
|||
it('verifies a valid signature for "' + f.message + '"', function () { |
|||
var d = BigInteger.fromHex(f.d) |
|||
var H = bcrypto.sha256(f.message) |
|||
var signature = fromRaw(f.signature) |
|||
var Q = curve.G.multiply(d) |
|||
|
|||
assert(ecdsa.verify(H, signature, Q)) |
|||
}) |
|||
}) |
|||
|
|||
fixtures.invalid.verify.forEach(function (f) { |
|||
it('fails to verify with ' + f.description, function () { |
|||
var H = bcrypto.sha256(f.message) |
|||
var d = BigInteger.fromHex(f.d) |
|||
var signature = fromRaw(f.signature) |
|||
var Q = curve.G.multiply(d) |
|||
|
|||
assert.strictEqual(ecdsa.verify(H, signature, Q), false) |
|||
}) |
|||
}) |
|||
}) |
|||
}) |
|||
Loading…
Reference in new issue