Daniel Cousens
7 years ago
committed by
GitHub
GitHub
18 changed files with 224 additions and 577 deletions
@ -1,163 +0,0 @@ |
|||||
var Buffer = require('safe-buffer').Buffer |
|
||||
var createHmac = require('create-hmac') |
|
||||
var typeforce = require('typeforce') |
|
||||
var types = require('./types') |
|
||||
|
|
||||
var BigInteger = require('bigi') |
|
||||
|
|
||||
var ZERO = Buffer.alloc(1, 0) |
|
||||
var ONE = Buffer.alloc(1, 1) |
|
||||
|
|
||||
var ecurve = require('ecurve') |
|
||||
var secp256k1 = ecurve.getCurveByName('secp256k1') |
|
||||
|
|
||||
// https://tools.ietf.org/html/rfc6979#section-3.2
|
|
||||
function deterministicGenerateK (hash, x, checkSig) { |
|
||||
typeforce(types.tuple( |
|
||||
types.Hash256bit, |
|
||||
types.Buffer256bit, |
|
||||
types.Function |
|
||||
), arguments) |
|
||||
|
|
||||
// Step A, ignored as hash already provided
|
|
||||
// Step B
|
|
||||
// Step C
|
|
||||
var k = Buffer.alloc(32, 0) |
|
||||
var v = Buffer.alloc(32, 1) |
|
||||
|
|
||||
// Step D
|
|
||||
k = createHmac('sha256', k) |
|
||||
.update(v) |
|
||||
.update(ZERO) |
|
||||
.update(x) |
|
||||
.update(hash) |
|
||||
.digest() |
|
||||
|
|
||||
// Step E
|
|
||||
v = createHmac('sha256', k).update(v).digest() |
|
||||
|
|
||||
// Step F
|
|
||||
k = createHmac('sha256', k) |
|
||||
.update(v) |
|
||||
.update(ONE) |
|
||||
.update(x) |
|
||||
.update(hash) |
|
||||
.digest() |
|
||||
|
|
||||
// Step G
|
|
||||
v = createHmac('sha256', k).update(v).digest() |
|
||||
|
|
||||
// Step H1/H2a, ignored as tlen === qlen (256 bit)
|
|
||||
// Step H2b
|
|
||||
v = createHmac('sha256', k).update(v).digest() |
|
||||
|
|
||||
var T = BigInteger.fromBuffer(v) |
|
||||
|
|
||||
// Step H3, repeat until T is within the interval [1, n - 1] and is suitable for ECDSA
|
|
||||
while (T.signum() <= 0 || T.compareTo(secp256k1.n) >= 0 || !checkSig(T)) { |
|
||||
k = createHmac('sha256', k) |
|
||||
.update(v) |
|
||||
.update(ZERO) |
|
||||
.digest() |
|
||||
|
|
||||
v = createHmac('sha256', k).update(v).digest() |
|
||||
|
|
||||
// Step H1/H2a, again, ignored as tlen === qlen (256 bit)
|
|
||||
// Step H2b again
|
|
||||
v = createHmac('sha256', k).update(v).digest() |
|
||||
T = BigInteger.fromBuffer(v) |
|
||||
} |
|
||||
|
|
||||
return T |
|
||||
} |
|
||||
|
|
||||
var N_OVER_TWO = secp256k1.n.shiftRight(1) |
|
||||
|
|
||||
function sign (hash, d) { |
|
||||
typeforce(types.tuple(types.Hash256bit, types.BigInt), arguments) |
|
||||
|
|
||||
var x = d.toBuffer(32) |
|
||||
var e = BigInteger.fromBuffer(hash) |
|
||||
var n = secp256k1.n |
|
||||
var G = secp256k1.G |
|
||||
|
|
||||
var r, s |
|
||||
deterministicGenerateK(hash, x, function (k) { |
|
||||
var Q = G.multiply(k) |
|
||||
|
|
||||
if (secp256k1.isInfinity(Q)) return false |
|
||||
|
|
||||
r = Q.affineX.mod(n) |
|
||||
if (r.signum() === 0) return false |
|
||||
|
|
||||
s = k.modInverse(n).multiply(e.add(d.multiply(r))).mod(n) |
|
||||
if (s.signum() === 0) return false |
|
||||
|
|
||||
return true |
|
||||
}) |
|
||||
|
|
||||
// enforce low S values, see bip62: 'low s values in signatures'
|
|
||||
if (s.compareTo(N_OVER_TWO) > 0) { |
|
||||
s = n.subtract(s) |
|
||||
} |
|
||||
|
|
||||
return { |
|
||||
r: r, |
|
||||
s: s |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
function verify (hash, signature, Q) { |
|
||||
typeforce(types.tuple( |
|
||||
types.Hash256bit, |
|
||||
types.ECSignature, |
|
||||
types.ECPoint |
|
||||
), arguments) |
|
||||
|
|
||||
var n = secp256k1.n |
|
||||
var G = secp256k1.G |
|
||||
|
|
||||
var r = signature.r |
|
||||
var s = signature.s |
|
||||
|
|
||||
// 1.4.1 Enforce r and s are both integers in the interval [1, n − 1]
|
|
||||
if (r.signum() <= 0 || r.compareTo(n) >= 0) return false |
|
||||
if (s.signum() <= 0 || s.compareTo(n) >= 0) return false |
|
||||
|
|
||||
// 1.4.2 H = Hash(M), already done by the user
|
|
||||
// 1.4.3 e = H
|
|
||||
var e = BigInteger.fromBuffer(hash) |
|
||||
|
|
||||
// Compute s^-1
|
|
||||
var sInv = s.modInverse(n) |
|
||||
|
|
||||
// 1.4.4 Compute u1 = es^−1 mod n
|
|
||||
// u2 = rs^−1 mod n
|
|
||||
var u1 = e.multiply(sInv).mod(n) |
|
||||
var u2 = r.multiply(sInv).mod(n) |
|
||||
|
|
||||
// 1.4.5 Compute R = (xR, yR)
|
|
||||
// R = u1G + u2Q
|
|
||||
var R = G.multiplyTwo(u1, Q, u2) |
|
||||
|
|
||||
// 1.4.5 (cont.) Enforce R is not at infinity
|
|
||||
if (secp256k1.isInfinity(R)) return false |
|
||||
|
|
||||
// 1.4.6 Convert the field element R.x to an integer
|
|
||||
var xR = R.affineX |
|
||||
|
|
||||
// 1.4.7 Set v = xR mod n
|
|
||||
var v = xR.mod(n) |
|
||||
|
|
||||
// 1.4.8 If v = r, output "valid", and if v != r, output "invalid"
|
|
||||
return v.equals(r) |
|
||||
} |
|
||||
|
|
||||
module.exports = { |
|
||||
deterministicGenerateK: deterministicGenerateK, |
|
||||
sign: sign, |
|
||||
verify: verify, |
|
||||
|
|
||||
// TODO: remove
|
|
||||
__curve: secp256k1 |
|
||||
} |
|
||||
@ -1,135 +0,0 @@ |
|||||
/* global describe, it */ |
|
||||
|
|
||||
var assert = require('assert') |
|
||||
var bcrypto = require('../src/crypto') |
|
||||
var ecdsa = require('../src/ecdsa') |
|
||||
var hoodwink = require('hoodwink') |
|
||||
|
|
||||
var BigInteger = require('bigi') |
|
||||
|
|
||||
var curve = ecdsa.__curve |
|
||||
|
|
||||
var fixtures = require('./fixtures/ecdsa.json') |
|
||||
|
|
||||
describe('ecdsa', function () { |
|
||||
function fromRaw (signature) { |
|
||||
return { |
|
||||
r: new BigInteger(signature.r, 16), |
|
||||
s: new BigInteger(signature.s, 16) |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
function toRaw (signature) { |
|
||||
return { |
|
||||
r: signature.r.toHex(), |
|
||||
s: signature.s.toHex() |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
describe('deterministicGenerateK', function () { |
|
||||
function checkSig () { |
|
||||
return true |
|
||||
} |
|
||||
|
|
||||
fixtures.valid.ecdsa.forEach(function (f) { |
|
||||
it('for "' + f.message + '"', function () { |
|
||||
var x = BigInteger.fromHex(f.d).toBuffer(32) |
|
||||
var h1 = bcrypto.sha256(f.message) |
|
||||
|
|
||||
var k = ecdsa.deterministicGenerateK(h1, x, checkSig) |
|
||||
assert.strictEqual(k.toHex(), f.k) |
|
||||
}) |
|
||||
}) |
|
||||
|
|
||||
it('loops until an appropriate k value is found', hoodwink(function () { |
|
||||
this.mock(BigInteger, 'fromBuffer', function f (b) { |
|
||||
assert.strictEqual(b.length, 32) |
|
||||
if (f.calls === 0) return BigInteger.ZERO // < 1
|
|
||||
if (f.calls === 1) return curve.n // > n - 1
|
|
||||
if (f.calls === 2) return new BigInteger('42') // valid
|
|
||||
}, 3) |
|
||||
|
|
||||
var x = new BigInteger('1').toBuffer(32) |
|
||||
var h1 = Buffer.alloc(32) |
|
||||
var k = ecdsa.deterministicGenerateK(h1, x, checkSig) |
|
||||
|
|
||||
assert.strictEqual(k.toString(), '42') |
|
||||
})) |
|
||||
|
|
||||
it('loops until a suitable signature is found', hoodwink(function () { |
|
||||
var checkSigStub = this.stub(function f () { |
|
||||
if (f.calls === 0) return false // bad signature
|
|
||||
if (f.calls === 1) return true // good signature
|
|
||||
}, 2) |
|
||||
|
|
||||
var x = BigInteger.ONE.toBuffer(32) |
|
||||
var h1 = Buffer.alloc(32) |
|
||||
var k = ecdsa.deterministicGenerateK(h1, x, checkSigStub) |
|
||||
|
|
||||
assert.strictEqual(k.toHex(), 'a9b1a1a84a4c2f96b6158ed7a81404c50cb74373c22e8d9e02d0411d719acae2') |
|
||||
})) |
|
||||
|
|
||||
fixtures.valid.rfc6979.forEach(function (f) { |
|
||||
it('produces the expected k values for ' + f.message + " if k wasn't suitable", function () { |
|
||||
var x = BigInteger.fromHex(f.d).toBuffer(32) |
|
||||
var h1 = bcrypto.sha256(f.message) |
|
||||
|
|
||||
var results = [] |
|
||||
ecdsa.deterministicGenerateK(h1, x, function (k) { |
|
||||
results.push(k) |
|
||||
|
|
||||
return results.length === 16 |
|
||||
}) |
|
||||
|
|
||||
assert.strictEqual(results[0].toHex(), f.k0) |
|
||||
assert.strictEqual(results[1].toHex(), f.k1) |
|
||||
assert.strictEqual(results[15].toHex(), f.k15) |
|
||||
}) |
|
||||
}) |
|
||||
}) |
|
||||
|
|
||||
describe('sign', function () { |
|
||||
fixtures.valid.ecdsa.forEach(function (f) { |
|
||||
it('produces a deterministic signature for "' + f.message + '"', function () { |
|
||||
var d = BigInteger.fromHex(f.d) |
|
||||
var hash = bcrypto.sha256(f.message) |
|
||||
var signature = ecdsa.sign(hash, d) |
|
||||
|
|
||||
assert.deepEqual(toRaw(signature), f.signature) |
|
||||
}) |
|
||||
}) |
|
||||
|
|
||||
it('should sign with low S value', function () { |
|
||||
var hash = bcrypto.sha256('Vires in numeris') |
|
||||
var sig = ecdsa.sign(hash, BigInteger.ONE) |
|
||||
|
|
||||
// See BIP62 for more information
|
|
||||
var N_OVER_TWO = curve.n.shiftRight(1) |
|
||||
assert(sig.s.compareTo(N_OVER_TWO) <= 0) |
|
||||
}) |
|
||||
}) |
|
||||
|
|
||||
describe('verify', function () { |
|
||||
fixtures.valid.ecdsa.forEach(function (f) { |
|
||||
it('verifies a valid signature for "' + f.message + '"', function () { |
|
||||
var d = BigInteger.fromHex(f.d) |
|
||||
var H = bcrypto.sha256(f.message) |
|
||||
var signature = fromRaw(f.signature) |
|
||||
var Q = curve.G.multiply(d) |
|
||||
|
|
||||
assert(ecdsa.verify(H, signature, Q)) |
|
||||
}) |
|
||||
}) |
|
||||
|
|
||||
fixtures.invalid.verify.forEach(function (f) { |
|
||||
it('fails to verify with ' + f.description, function () { |
|
||||
var H = bcrypto.sha256(f.message) |
|
||||
var d = BigInteger.fromHex(f.d) |
|
||||
var signature = fromRaw(f.signature) |
|
||||
var Q = curve.G.multiply(d) |
|
||||
|
|
||||
assert.strictEqual(ecdsa.verify(H, signature, Q), false) |
|
||||
}) |
|
||||
}) |
|
||||
}) |
|
||||
}) |
|
||||
Loading…
Reference in new issue