@ -1,5 +1,5 @@
/**********************************************************************
/**********************************************************************
* Copyright ( c ) 2013 , 2014 Pieter Wuille * * Copyright ( c ) 2013 , 2014 , 2015 Pieter Wuille , Gregory Maxwell *
* Distributed under the MIT software license , see the accompanying * * Distributed under the MIT software license , see the accompanying *
* file COPYING or http : //www.opensource.org/licenses/mit-license.php.*
* file COPYING or http : //www.opensource.org/licenses/mit-license.php.*
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */ * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
@ -24,6 +24,7 @@
# endif # endif
static int count = 64 ; static int count = 64 ;
static secp256k1_context_t * ctx = NULL ;
void random_field_element_test ( secp256k1_fe_t * fe ) { void random_field_element_test ( secp256k1_fe_t * fe ) {
do { do {
@ -55,8 +56,9 @@ void random_group_element_test(secp256k1_ge_t *ge) {
secp256k1_fe_t fe ; secp256k1_fe_t fe ;
do { do {
random_field_element_test ( & fe ) ; random_field_element_test ( & fe ) ;
if ( secp256k1_ge_set_xo_var ( ge , & fe , secp256k1_rand32 ( ) & 1 ) ) if ( secp256k1_ge_set_xo_var ( ge , & fe , secp256k1_rand32 ( ) & 1 ) ) {
break ; break ;
}
} while ( 1 ) ; } while ( 1 ) ;
} }
@ -81,8 +83,9 @@ void random_scalar_order_test(secp256k1_scalar_t *num) {
int overflow = 0 ; int overflow = 0 ;
secp256k1_rand256_test ( b32 ) ; secp256k1_rand256_test ( b32 ) ;
secp256k1_scalar_set_b32 ( num , b32 , & overflow ) ; secp256k1_scalar_set_b32 ( num , b32 , & overflow ) ;
if ( overflow | | secp256k1_scalar_is_zero ( num ) ) if ( overflow | | secp256k1_scalar_is_zero ( num ) ) {
continue ; continue ;
}
break ; break ;
} while ( 1 ) ; } while ( 1 ) ;
} }
@ -93,12 +96,60 @@ void random_scalar_order(secp256k1_scalar_t *num) {
int overflow = 0 ; int overflow = 0 ;
secp256k1_rand256 ( b32 ) ; secp256k1_rand256 ( b32 ) ;
secp256k1_scalar_set_b32 ( num , b32 , & overflow ) ; secp256k1_scalar_set_b32 ( num , b32 , & overflow ) ;
if ( overflow | | secp256k1_scalar_is_zero ( num ) ) if ( overflow | | secp256k1_scalar_is_zero ( num ) ) {
continue ; continue ;
}
break ; break ;
} while ( 1 ) ; } while ( 1 ) ;
} }
void run_context_tests ( void ) {
secp256k1_context_t * none = secp256k1_context_create ( 0 ) ;
secp256k1_context_t * sign = secp256k1_context_create ( SECP256K1_CONTEXT_SIGN ) ;
secp256k1_context_t * vrfy = secp256k1_context_create ( SECP256K1_CONTEXT_VERIFY ) ;
secp256k1_context_t * both = secp256k1_context_create ( SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY ) ;
secp256k1_gej_t pubj ;
secp256k1_ge_t pub ;
secp256k1_scalar_t msg , key , nonce ;
secp256k1_ecdsa_sig_t sig ;
/*** clone and destroy all of them to make sure cloning was complete ***/
{
secp256k1_context_t * ctx_tmp ;
ctx_tmp = none ; none = secp256k1_context_clone ( none ) ; secp256k1_context_destroy ( ctx_tmp ) ;
ctx_tmp = sign ; sign = secp256k1_context_clone ( sign ) ; secp256k1_context_destroy ( ctx_tmp ) ;
ctx_tmp = vrfy ; vrfy = secp256k1_context_clone ( vrfy ) ; secp256k1_context_destroy ( ctx_tmp ) ;
ctx_tmp = both ; both = secp256k1_context_clone ( both ) ; secp256k1_context_destroy ( ctx_tmp ) ;
}
/*** attempt to use them ***/
random_scalar_order_test ( & msg ) ;
random_scalar_order_test ( & key ) ;
secp256k1_ecmult_gen ( & both - > ecmult_gen_ctx , & pubj , & key ) ;
secp256k1_ge_set_gej ( & pub , & pubj ) ;
/* obtain a working nonce */
do {
random_scalar_order_test ( & nonce ) ;
} while ( ! secp256k1_ecdsa_sig_sign ( & both - > ecmult_gen_ctx , & sig , & key , & msg , & nonce , NULL ) ) ;
/* try signing */
CHECK ( secp256k1_ecdsa_sig_sign ( & sign - > ecmult_gen_ctx , & sig , & key , & msg , & nonce , NULL ) ) ;
CHECK ( secp256k1_ecdsa_sig_sign ( & both - > ecmult_gen_ctx , & sig , & key , & msg , & nonce , NULL ) ) ;
/* try verifying */
CHECK ( secp256k1_ecdsa_sig_verify ( & vrfy - > ecmult_ctx , & sig , & pub , & msg ) ) ;
CHECK ( secp256k1_ecdsa_sig_verify ( & both - > ecmult_ctx , & sig , & pub , & msg ) ) ;
/* cleanup */
secp256k1_context_destroy ( none ) ;
secp256k1_context_destroy ( sign ) ;
secp256k1_context_destroy ( vrfy ) ;
secp256k1_context_destroy ( both ) ;
}
/***** HASH TESTS *****/ /***** HASH TESTS *****/
void run_sha256_tests ( void ) { void run_sha256_tests ( void ) {
@ -229,9 +280,10 @@ void run_rfc6979_hmac_sha256_tests(void) {
# ifndef USE_NUM_NONE # ifndef USE_NUM_NONE
void random_num_negate ( secp256k1_num_t * num ) { void random_num_negate ( secp256k1_num_t * num ) {
if ( secp256k1_rand32 ( ) & 1 ) if ( secp256k1_rand32 ( ) & 1 ) {
secp256k1_num_negate ( num ) ; secp256k1_num_negate ( num ) ;
} }
}
void random_num_order_test ( secp256k1_num_t * num ) { void random_num_order_test ( secp256k1_num_t * num ) {
secp256k1_scalar_t sc ; secp256k1_scalar_t sc ;
@ -624,9 +676,10 @@ void random_fe_non_zero(secp256k1_fe_t *nz) {
while ( - - tries > = 0 ) { while ( - - tries > = 0 ) {
random_fe ( nz ) ; random_fe ( nz ) ;
secp256k1_fe_normalize ( nz ) ; secp256k1_fe_normalize ( nz ) ;
if ( ! secp256k1_fe_is_zero ( nz ) ) if ( ! secp256k1_fe_is_zero ( nz ) ) {
break ; break ;
} }
}
/* Infinitesimal probability of spurious failure here */ /* Infinitesimal probability of spurious failure here */
CHECK ( tries > = 0 ) ; CHECK ( tries > = 0 ) ;
} }
@ -700,12 +753,22 @@ void run_field_misc(void) {
CHECK ( secp256k1_fe_equal_var ( & x , & x ) ) ; CHECK ( secp256k1_fe_equal_var ( & x , & x ) ) ;
z = x ; z = x ;
secp256k1_fe_add ( & z , & y ) ; secp256k1_fe_add ( & z , & y ) ;
secp256k1_fe_normalize ( & z ) ; /* Test fe conditional move; z is not normalized here. */
q = x ;
secp256k1_fe_cmov ( & x , & z , 0 ) ;
secp256k1_fe_cmov ( & x , & x , 1 ) ;
CHECK ( memcmp ( & x , & z , sizeof ( x ) ) ! = 0 ) ;
CHECK ( memcmp ( & x , & q , sizeof ( x ) ) = = 0 ) ;
secp256k1_fe_cmov ( & q , & z , 1 ) ;
CHECK ( memcmp ( & q , & z , sizeof ( q ) ) = = 0 ) ;
/* Test storage conversion and conditional moves. */ /* Test storage conversion and conditional moves. */
secp256k1_fe_normalize ( & z ) ;
CHECK ( ! secp256k1_fe_equal_var ( & x , & z ) ) ;
secp256k1_fe_to_storage ( & xs , & x ) ; secp256k1_fe_to_storage ( & xs , & x ) ;
secp256k1_fe_to_storage ( & ys , & y ) ; secp256k1_fe_to_storage ( & ys , & y ) ;
secp256k1_fe_to_storage ( & zs , & z ) ; secp256k1_fe_to_storage ( & zs , & z ) ;
secp256k1_fe_storage_cmov ( & zs , & xs , 0 ) ; secp256k1_fe_storage_cmov ( & zs , & xs , 0 ) ;
secp256k1_fe_storage_cmov ( & zs , & zs , 1 ) ;
CHECK ( memcmp ( & xs , & zs , sizeof ( xs ) ) ! = 0 ) ; CHECK ( memcmp ( & xs , & zs , sizeof ( xs ) ) ! = 0 ) ;
secp256k1_fe_storage_cmov ( & ys , & xs , 1 ) ; secp256k1_fe_storage_cmov ( & ys , & xs , 1 ) ;
CHECK ( memcmp ( & xs , & ys , sizeof ( xs ) ) = = 0 ) ; CHECK ( memcmp ( & xs , & ys , sizeof ( xs ) ) = = 0 ) ;
@ -765,16 +828,19 @@ void run_field_inv_all_var(void) {
for ( i = 0 ; i < count ; i + + ) { for ( i = 0 ; i < count ; i + + ) {
size_t j ; size_t j ;
size_t len = ( secp256k1_rand32 ( ) & 15 ) + 1 ; size_t len = ( secp256k1_rand32 ( ) & 15 ) + 1 ;
for ( j = 0 ; j < len ; j + + ) for ( j = 0 ; j < len ; j + + ) {
random_fe_non_zero ( & x [ j ] ) ; random_fe_non_zero ( & x [ j ] ) ;
}
secp256k1_fe_inv_all_var ( len , xi , x ) ; secp256k1_fe_inv_all_var ( len , xi , x ) ;
for ( j = 0 ; j < len ; j + + ) for ( j = 0 ; j < len ; j + + ) {
CHECK ( check_fe_inverse ( & x [ j ] , & xi [ j ] ) ) ; CHECK ( check_fe_inverse ( & x [ j ] , & xi [ j ] ) ) ;
}
secp256k1_fe_inv_all_var ( len , xii , xi ) ; secp256k1_fe_inv_all_var ( len , xii , xi ) ;
for ( j = 0 ; j < len ; j + + ) for ( j = 0 ; j < len ; j + + ) {
CHECK ( check_fe_equal ( & x [ j ] , & xii [ j ] ) ) ; CHECK ( check_fe_equal ( & x [ j ] , & xii [ j ] ) ) ;
} }
} }
}
void run_sqr ( void ) { void run_sqr ( void ) {
secp256k1_fe_t x , s ; secp256k1_fe_t x , s ;
@ -844,18 +910,42 @@ void run_sqrt(void) {
void ge_equals_ge ( const secp256k1_ge_t * a , const secp256k1_ge_t * b ) { void ge_equals_ge ( const secp256k1_ge_t * a , const secp256k1_ge_t * b ) {
CHECK ( a - > infinity = = b - > infinity ) ; CHECK ( a - > infinity = = b - > infinity ) ;
if ( a - > infinity ) if ( a - > infinity ) {
return ; return ;
}
CHECK ( secp256k1_fe_equal_var ( & a - > x , & b - > x ) ) ; CHECK ( secp256k1_fe_equal_var ( & a - > x , & b - > x ) ) ;
CHECK ( secp256k1_fe_equal_var ( & b - > y , & b - > y ) ) ; CHECK ( secp256k1_fe_equal_var ( & b - > y , & b - > y ) ) ;
} }
/* This compares jacobian points including their Z, not just their geometric meaning. */
int gej_xyz_equals_gej ( const secp256k1_gej_t * a , const secp256k1_gej_t * b ) {
secp256k1_gej_t a2 ;
secp256k1_gej_t b2 ;
int ret = 1 ;
ret & = a - > infinity = = b - > infinity ;
if ( ret & & ! a - > infinity ) {
a2 = * a ;
b2 = * b ;
secp256k1_fe_normalize ( & a2 . x ) ;
secp256k1_fe_normalize ( & a2 . y ) ;
secp256k1_fe_normalize ( & a2 . z ) ;
secp256k1_fe_normalize ( & b2 . x ) ;
secp256k1_fe_normalize ( & b2 . y ) ;
secp256k1_fe_normalize ( & b2 . z ) ;
ret & = secp256k1_fe_cmp_var ( & a2 . x , & b2 . x ) = = 0 ;
ret & = secp256k1_fe_cmp_var ( & a2 . y , & b2 . y ) = = 0 ;
ret & = secp256k1_fe_cmp_var ( & a2 . z , & b2 . z ) = = 0 ;
}
return ret ;
}
void ge_equals_gej ( const secp256k1_ge_t * a , const secp256k1_gej_t * b ) { void ge_equals_gej ( const secp256k1_ge_t * a , const secp256k1_gej_t * b ) {
secp256k1_fe_t z2s ; secp256k1_fe_t z2s ;
secp256k1_fe_t u1 , u2 , s1 , s2 ; secp256k1_fe_t u1 , u2 , s1 , s2 ;
CHECK ( a - > infinity = = b - > infinity ) ; CHECK ( a - > infinity = = b - > infinity ) ;
if ( a - > infinity ) if ( a - > infinity ) {
return ; return ;
}
/* Check a.x * b.z^2 == b.x && a.y * b.z^3 == b.y, to avoid inverses. */ /* Check a.x * b.z^2 == b.x && a.y * b.z^3 == b.y, to avoid inverses. */
secp256k1_fe_sqr ( & z2s , & b - > z ) ; secp256k1_fe_sqr ( & z2s , & b - > z ) ;
secp256k1_fe_mul ( & u1 , & a - > x , & z2s ) ; secp256k1_fe_mul ( & u1 , & a - > x , & z2s ) ;
@ -874,8 +964,8 @@ void test_ge(void) {
* All magnitudes are randomized . * All magnitudes are randomized .
* All 17 * 17 combinations of points are added to eachother , using all applicable methods . * All 17 * 17 combinations of points are added to eachother , using all applicable methods .
*/ */
secp256k1_ge_t * ge = malloc ( sizeof ( secp256k1_ge_t ) * ( 1 + 4 * runs ) ) ; secp256k1_ge_t * ge = ( secp256k1_ge_t * ) malloc ( sizeof ( secp256k1_ge_t ) * ( 1 + 4 * runs ) ) ;
secp256k1_gej_t * gej = malloc ( sizeof ( secp256k1_gej_t ) * ( 1 + 4 * runs ) ) ; secp256k1_gej_t * gej = ( secp256k1_gej_t * ) malloc ( sizeof ( secp256k1_gej_t ) * ( 1 + 4 * runs ) ) ;
secp256k1_gej_set_infinity ( & gej [ 0 ] ) ; secp256k1_gej_set_infinity ( & gej [ 0 ] ) ;
secp256k1_ge_clear ( & ge [ 0 ] ) ; secp256k1_ge_clear ( & ge [ 0 ] ) ;
secp256k1_ge_set_gej_var ( & ge [ 0 ] , & gej [ 0 ] ) ; secp256k1_ge_set_gej_var ( & ge [ 0 ] , & gej [ 0 ] ) ;
@ -951,7 +1041,7 @@ void test_ge(void) {
/* Test adding all points together in random order equals infinity. */ /* Test adding all points together in random order equals infinity. */
{ {
secp256k1_gej_t sum = SECP256K1_GEJ_CONST_INFINITY ; secp256k1_gej_t sum = SECP256K1_GEJ_CONST_INFINITY ;
secp256k1_gej_t * gej_shuffled = malloc ( ( 4 * runs + 1 ) * sizeof ( secp256k1_gej_t ) ) ; secp256k1_gej_t * gej_shuffled = ( secp256k1_gej_t * ) malloc ( ( 4 * runs + 1 ) * sizeof ( secp256k1_gej_t ) ) ;
for ( i = 0 ; i < 4 * runs + 1 ; i + + ) { for ( i = 0 ; i < 4 * runs + 1 ; i + + ) {
gej_shuffled [ i ] = gej [ i ] ; gej_shuffled [ i ] = gej [ i ] ;
} }
@ -972,9 +1062,12 @@ void test_ge(void) {
/* Test batch gej -> ge conversion. */ /* Test batch gej -> ge conversion. */
{ {
secp256k1_ge_t * ge_set_all = malloc ( ( 4 * runs + 1 ) * sizeof ( secp256k1_ge_t ) ) ; secp256k1_ge_t * ge_set_all = ( secp256k1_ge_t * ) malloc ( ( 4 * runs + 1 ) * sizeof ( secp256k1_ge_t ) ) ;
secp256k1_ge_set_all_gej_var ( 4 * runs + 1 , ge_set_all , gej ) ; secp256k1_ge_set_all_gej_var ( 4 * runs + 1 , ge_set_all , gej ) ;
for ( i = 0 ; i < 4 * runs + 1 ; i + + ) { for ( i = 0 ; i < 4 * runs + 1 ; i + + ) {
secp256k1_fe_t s ;
random_fe_non_zero ( & s ) ;
secp256k1_gej_rescale ( & gej [ i ] , & s ) ;
ge_equals_gej ( & ge_set_all [ i ] , & gej [ i ] ) ; ge_equals_gej ( & ge_set_all [ i ] , & gej [ i ] ) ;
} }
free ( ge_set_all ) ; free ( ge_set_all ) ;
@ -1025,7 +1118,7 @@ void run_ecmult_chain(void) {
x = a ; x = a ;
for ( i = 0 ; i < 200 * count ; i + + ) { for ( i = 0 ; i < 200 * count ; i + + ) {
/* in each iteration, compute X = xn*X + gn*G; */ /* in each iteration, compute X = xn*X + gn*G; */
secp256k1_ecmult ( & x , & x , & xn , & gn ) ; secp256k1_ecmult ( & ctx - > ecmult_ctx , & x , & x , & xn , & gn ) ;
/* also compute ae and ge: the actual accumulated factors for A and G */ /* also compute ae and ge: the actual accumulated factors for A and G */
/* if X was (ae*A+ge*G), xn*X + gn*G results in (xn*ae*A + (xn*ge+gn)*G) */ /* if X was (ae*A+ge*G), xn*X + gn*G results in (xn*ae*A + (xn*ge+gn)*G) */
secp256k1_scalar_mul ( & ae , & ae , & xn ) ; secp256k1_scalar_mul ( & ae , & ae , & xn ) ;
@ -1051,7 +1144,7 @@ void run_ecmult_chain(void) {
} }
} }
/* redo the computation, but directly with the resulting ae and ge coefficients: */ /* redo the computation, but directly with the resulting ae and ge coefficients: */
secp256k1_ecmult ( & x2 , & a , & ae , & ge ) ; secp256k1_ecmult ( & ctx - > ecmult_ctx , & x2 , & a , & ae , & ge ) ;
secp256k1_gej_neg ( & x2 , & x2 ) ; secp256k1_gej_neg ( & x2 , & x2 ) ;
secp256k1_gej_add_var ( & x2 , & x2 , & x ) ; secp256k1_gej_add_var ( & x2 , & x2 , & x ) ;
CHECK ( secp256k1_gej_is_infinity ( & x2 ) ) ; CHECK ( secp256k1_gej_is_infinity ( & x2 ) ) ;
@ -1067,8 +1160,8 @@ void test_point_times_order(const secp256k1_gej_t *point) {
int psize = 65 ; int psize = 65 ;
random_scalar_order_test ( & x ) ; random_scalar_order_test ( & x ) ;
secp256k1_scalar_negate ( & nx , & x ) ; secp256k1_scalar_negate ( & nx , & x ) ;
secp256k1_ecmult ( & res1 , point , & x , & x ) ; /* calc res1 = x * point + x * G; */ secp256k1_ecmult ( & ctx - > ecmult_ctx , & res1 , point , & x , & x ) ; /* calc res1 = x * point + x * G; */
secp256k1_ecmult ( & res2 , point , & nx , & nx ) ; /* calc res2 = (order - x) * point + (order - x) * G; */ secp256k1_ecmult ( & ctx - > ecmult_ctx , & res2 , point , & nx , & nx ) ; /* calc res2 = (order - x) * point + (order - x) * G; */
secp256k1_gej_add_var ( & res1 , & res1 , & res2 ) ; secp256k1_gej_add_var ( & res1 , & res1 , & res2 ) ;
CHECK ( secp256k1_gej_is_infinity ( & res1 ) ) ; CHECK ( secp256k1_gej_is_infinity ( & res1 ) ) ;
CHECK ( secp256k1_gej_is_valid_var ( & res1 ) = = 0 ) ; CHECK ( secp256k1_gej_is_valid_var ( & res1 ) = = 0 ) ;
@ -1141,17 +1234,96 @@ void run_wnaf(void) {
secp256k1_scalar_t n ; secp256k1_scalar_t n ;
for ( i = 0 ; i < count ; i + + ) { for ( i = 0 ; i < count ; i + + ) {
random_scalar_order ( & n ) ; random_scalar_order ( & n ) ;
if ( i % 1 )
secp256k1_scalar_negate ( & n , & n ) ;
test_wnaf ( & n , 4 + ( i % 10 ) ) ; test_wnaf ( & n , 4 + ( i % 10 ) ) ;
} }
} }
void test_ecmult_constants ( void ) {
/* Test ecmult_gen() for [0..36) and [order-36..0). */
secp256k1_scalar_t x ;
secp256k1_gej_t r ;
secp256k1_ge_t ng ;
int i ;
int j ;
secp256k1_ge_neg ( & ng , & secp256k1_ge_const_g ) ;
for ( i = 0 ; i < 36 ; i + + ) {
secp256k1_scalar_set_int ( & x , i ) ;
secp256k1_ecmult_gen ( & ctx - > ecmult_gen_ctx , & r , & x ) ;
for ( j = 0 ; j < i ; j + + ) {
if ( j = = i - 1 ) {
ge_equals_gej ( & secp256k1_ge_const_g , & r ) ;
}
secp256k1_gej_add_ge ( & r , & r , & ng ) ;
}
CHECK ( secp256k1_gej_is_infinity ( & r ) ) ;
}
for ( i = 1 ; i < = 36 ; i + + ) {
secp256k1_scalar_set_int ( & x , i ) ;
secp256k1_scalar_negate ( & x , & x ) ;
secp256k1_ecmult_gen ( & ctx - > ecmult_gen_ctx , & r , & x ) ;
for ( j = 0 ; j < i ; j + + ) {
if ( j = = i - 1 ) {
ge_equals_gej ( & ng , & r ) ;
}
secp256k1_gej_add_ge ( & r , & r , & secp256k1_ge_const_g ) ;
}
CHECK ( secp256k1_gej_is_infinity ( & r ) ) ;
}
}
void run_ecmult_constants ( void ) {
test_ecmult_constants ( ) ;
}
void test_ecmult_gen_blind ( void ) {
/* Test ecmult_gen() blinding and confirm that the blinding changes, the affline points match, and the z's don't match. */
secp256k1_scalar_t key ;
secp256k1_scalar_t b ;
unsigned char seed32 [ 32 ] ;
secp256k1_gej_t pgej ;
secp256k1_gej_t pgej2 ;
secp256k1_gej_t i ;
secp256k1_ge_t pge ;
random_scalar_order_test ( & key ) ;
secp256k1_ecmult_gen ( & ctx - > ecmult_gen_ctx , & pgej , & key ) ;
secp256k1_rand256 ( seed32 ) ;
b = ctx - > ecmult_gen_ctx . blind ;
i = ctx - > ecmult_gen_ctx . initial ;
secp256k1_ecmult_gen_blind ( & ctx - > ecmult_gen_ctx , seed32 ) ;
CHECK ( ! secp256k1_scalar_eq ( & b , & ctx - > ecmult_gen_ctx . blind ) ) ;
secp256k1_ecmult_gen ( & ctx - > ecmult_gen_ctx , & pgej2 , & key ) ;
CHECK ( ! gej_xyz_equals_gej ( & pgej , & pgej2 ) ) ;
CHECK ( ! gej_xyz_equals_gej ( & i , & ctx - > ecmult_gen_ctx . initial ) ) ;
secp256k1_ge_set_gej ( & pge , & pgej ) ;
ge_equals_gej ( & pge , & pgej2 ) ;
}
void test_ecmult_gen_blind_reset ( void ) {
/* Test ecmult_gen() blinding reset and confirm that the blinding is consistent. */
secp256k1_scalar_t b ;
secp256k1_gej_t initial ;
secp256k1_ecmult_gen_blind ( & ctx - > ecmult_gen_ctx , 0 ) ;
b = ctx - > ecmult_gen_ctx . blind ;
initial = ctx - > ecmult_gen_ctx . initial ;
secp256k1_ecmult_gen_blind ( & ctx - > ecmult_gen_ctx , 0 ) ;
CHECK ( secp256k1_scalar_eq ( & b , & ctx - > ecmult_gen_ctx . blind ) ) ;
CHECK ( gej_xyz_equals_gej ( & initial , & ctx - > ecmult_gen_ctx . initial ) ) ;
}
void run_ecmult_gen_blind ( void ) {
int i ;
test_ecmult_gen_blind_reset ( ) ;
for ( i = 0 ; i < 10 ; i + + ) {
test_ecmult_gen_blind ( ) ;
}
}
void random_sign ( secp256k1_ecdsa_sig_t * sig , const secp256k1_scalar_t * key , const secp256k1_scalar_t * msg , int * recid ) { void random_sign ( secp256k1_ecdsa_sig_t * sig , const secp256k1_scalar_t * key , const secp256k1_scalar_t * msg , int * recid ) {
secp256k1_scalar_t nonce ; secp256k1_scalar_t nonce ;
do { do {
random_scalar_order_test ( & nonce ) ; random_scalar_order_test ( & nonce ) ;
} while ( ! secp256k1_ecdsa_sig_sign ( sig , key , msg , & nonce , recid ) ) ; } while ( ! secp256k1_ecdsa_sig_sign ( & ctx - > ecmult_gen_ctx , sig , key , msg , & nonce , recid ) ) ;
} }
void test_ecdsa_sign_verify ( void ) { void test_ecdsa_sign_verify ( void ) {
@ -1164,15 +1336,17 @@ void test_ecdsa_sign_verify(void) {
int getrec ; int getrec ;
random_scalar_order_test ( & msg ) ; random_scalar_order_test ( & msg ) ;
random_scalar_order_test ( & key ) ; random_scalar_order_test ( & key ) ;
secp256k1_ecmult_gen ( & pubj , & key ) ; secp256k1_ecmult_gen ( & ctx - > ecmult_gen_ctx , & pubj , & key ) ;
secp256k1_ge_set_gej ( & pub , & pubj ) ; secp256k1_ge_set_gej ( & pub , & pubj ) ;
getrec = secp256k1_rand32 ( ) & 1 ; getrec = secp256k1_rand32 ( ) & 1 ;
random_sign ( & sig , & key , & msg , getrec ? & recid : NULL ) ; random_sign ( & sig , & key , & msg , getrec ? & recid : NULL ) ;
if ( getrec ) CHECK ( recid > = 0 & & recid < 4 ) ; if ( getrec ) {
CHECK ( secp256k1_ecdsa_sig_verify ( & sig , & pub , & msg ) ) ; CHECK ( recid > = 0 & & recid < 4 ) ;
}
CHECK ( secp256k1_ecdsa_sig_verify ( & ctx - > ecmult_ctx , & sig , & pub , & msg ) ) ;
secp256k1_scalar_set_int ( & one , 1 ) ; secp256k1_scalar_set_int ( & one , 1 ) ;
secp256k1_scalar_add ( & msg , & msg , & one ) ; secp256k1_scalar_add ( & msg , & msg , & one ) ;
CHECK ( ! secp256k1_ecdsa_sig_verify ( & sig , & pub , & msg ) ) ; CHECK ( ! secp256k1_ecdsa_sig_verify ( & ctx - > ecmult_ctx , & sig , & pub , & msg ) ) ;
} }
void run_ecdsa_sign_verify ( void ) { void run_ecdsa_sign_verify ( void ) {
@ -1192,7 +1366,9 @@ static int precomputed_nonce_function(unsigned char *nonce32, const unsigned cha
static int nonce_function_test_fail ( unsigned char * nonce32 , const unsigned char * msg32 , const unsigned char * key32 , unsigned int counter , const void * data ) { static int nonce_function_test_fail ( unsigned char * nonce32 , const unsigned char * msg32 , const unsigned char * key32 , unsigned int counter , const void * data ) {
/* Dummy nonce generator that has a fatal error on the first counter value. */ /* Dummy nonce generator that has a fatal error on the first counter value. */
if ( counter = = 0 ) return 0 ; if ( counter = = 0 ) {
return 0 ;
}
return nonce_function_rfc6979 ( nonce32 , msg32 , key32 , counter - 1 , data ) ; return nonce_function_rfc6979 ( nonce32 , msg32 , key32 , counter - 1 , data ) ;
} }
@ -1200,7 +1376,9 @@ static int nonce_function_test_retry(unsigned char *nonce32, const unsigned char
/* Dummy nonce generator that produces unacceptable nonces for the first several counter values. */ /* Dummy nonce generator that produces unacceptable nonces for the first several counter values. */
if ( counter < 3 ) { if ( counter < 3 ) {
memset ( nonce32 , counter = = 0 ? 0 : 255 , 32 ) ; memset ( nonce32 , counter = = 0 ? 0 : 255 , 32 ) ;
if ( counter = = 2 ) nonce32 [ 31 ] - - ; if ( counter = = 2 ) {
nonce32 [ 31 ] - - ;
}
return 1 ; return 1 ;
} }
if ( counter < 5 ) { if ( counter < 5 ) {
@ -1211,12 +1389,16 @@ static int nonce_function_test_retry(unsigned char *nonce32, const unsigned char
0xBF , 0xD2 , 0x5E , 0x8C , 0xD0 , 0x36 , 0x41 , 0x41 0xBF , 0xD2 , 0x5E , 0x8C , 0xD0 , 0x36 , 0x41 , 0x41
} ; } ;
memcpy ( nonce32 , order , 32 ) ; memcpy ( nonce32 , order , 32 ) ;
if ( counter = = 4 ) nonce32 [ 31 ] + + ; if ( counter = = 4 ) {
nonce32 [ 31 ] + + ;
}
return 1 ; return 1 ;
} }
/* Retry rate of 6979 is negligible esp. as we only call this in determinstic tests. */ /* Retry rate of 6979 is negligible esp. as we only call this in determinstic tests. */
/* If someone does fine a case where it retries for secp256k1, we'd like to know. */ /* If someone does fine a case where it retries for secp256k1, we'd like to know. */
if ( counter > 5 ) return 0 ; if ( counter > 5 ) {
return 0 ;
}
return nonce_function_rfc6979 ( nonce32 , msg32 , key32 , counter - 5 , data ) ; return nonce_function_rfc6979 ( nonce32 , msg32 , key32 , counter - 5 , data ) ;
} }
@ -1257,16 +1439,16 @@ void test_ecdsa_end_to_end(void) {
} }
/* Construct and verify corresponding public key. */ /* Construct and verify corresponding public key. */
CHECK ( secp256k1_ec_seckey_verify ( privkey ) = = 1 ) ; CHECK ( secp256k1_ec_seckey_verify ( ctx , privkey ) = = 1 ) ;
CHECK ( secp256k1_ec_pubkey_create ( pubkey , & pubkeylen , privkey , ( secp256k1_rand32 ( ) & 3 ) ! = 0 ) = = 1 ) ; CHECK ( secp256k1_ec_pubkey_create ( ctx , pubkey , & pubkeylen , privkey , ( secp256k1_rand32 ( ) & 3 ) ! = 0 ) = = 1 ) ;
if ( secp256k1_rand32 ( ) & 1 ) { if ( secp256k1_rand32 ( ) & 1 ) {
CHECK ( secp256k1_ec_pubkey_decompress ( pubkey , & pubkeylen ) ) ; CHECK ( secp256k1_ec_pubkey_decompress ( ctx , pubkey , & pubkeylen ) ) ;
} }
CHECK ( secp256k1_ec_pubkey_verify ( pubkey , pubkeylen ) ) ; CHECK ( secp256k1_ec_pubkey_verify ( ctx , pubkey , pubkeylen ) ) ;
/* Verify private key import and export. */ /* Verify private key import and export. */
CHECK ( secp256k1_ec_privkey_export ( privkey , seckey , & seckeylen , secp256k1_rand32 ( ) % 2 ) = = 1 ) ; CHECK ( secp256k1_ec_privkey_export ( ctx , privkey , seckey , & seckeylen , secp256k1_rand32 ( ) % 2 ) = = 1 ) ;
CHECK ( secp256k1_ec_privkey_import ( privkey2 , seckey , seckeylen ) = = 1 ) ; CHECK ( secp256k1_ec_privkey_import ( ctx , privkey2 , seckey , seckeylen ) = = 1 ) ;
CHECK ( memcmp ( privkey , privkey2 , 32 ) = = 0 ) ; CHECK ( memcmp ( privkey , privkey2 , 32 ) = = 0 ) ;
/* Optionally tweak the keys using addition. */ /* Optionally tweak the keys using addition. */
@ -1277,11 +1459,13 @@ void test_ecdsa_end_to_end(void) {
unsigned char pubkey2 [ 65 ] ; unsigned char pubkey2 [ 65 ] ;
int pubkeylen2 = 65 ; int pubkeylen2 = 65 ;
secp256k1_rand256_test ( rnd ) ; secp256k1_rand256_test ( rnd ) ;
ret1 = secp256k1_ec_privkey_tweak_add ( privkey , rnd ) ; ret1 = secp256k1_ec_privkey_tweak_add ( ctx , privkey , rnd ) ;
ret2 = secp256k1_ec_pubkey_tweak_add ( pubkey , pubkeylen , rnd ) ; ret2 = secp256k1_ec_pubkey_tweak_add ( ctx , pubkey , pubkeylen , rnd ) ;
CHECK ( ret1 = = ret2 ) ; CHECK ( ret1 = = ret2 ) ;
if ( ret1 = = 0 ) return ; if ( ret1 = = 0 ) {
CHECK ( secp256k1_ec_pubkey_create ( pubkey2 , & pubkeylen2 , privkey , pubkeylen = = 33 ) = = 1 ) ; return ;
}
CHECK ( secp256k1_ec_pubkey_create ( ctx , pubkey2 , & pubkeylen2 , privkey , pubkeylen = = 33 ) = = 1 ) ;
CHECK ( memcmp ( pubkey , pubkey2 , pubkeylen ) = = 0 ) ; CHECK ( memcmp ( pubkey , pubkey2 , pubkeylen ) = = 0 ) ;
} }
@ -1293,25 +1477,27 @@ void test_ecdsa_end_to_end(void) {
unsigned char pubkey2 [ 65 ] ; unsigned char pubkey2 [ 65 ] ;
int pubkeylen2 = 65 ; int pubkeylen2 = 65 ;
secp256k1_rand256_test ( rnd ) ; secp256k1_rand256_test ( rnd ) ;
ret1 = secp256k1_ec_privkey_tweak_mul ( privkey , rnd ) ; ret1 = secp256k1_ec_privkey_tweak_mul ( ctx , privkey , rnd ) ;
ret2 = secp256k1_ec_pubkey_tweak_mul ( pubkey , pubkeylen , rnd ) ; ret2 = secp256k1_ec_pubkey_tweak_mul ( ctx , pubkey , pubkeylen , rnd ) ;
CHECK ( ret1 = = ret2 ) ; CHECK ( ret1 = = ret2 ) ;
if ( ret1 = = 0 ) return ; if ( ret1 = = 0 ) {
CHECK ( secp256k1_ec_pubkey_create ( pubkey2 , & pubkeylen2 , privkey , pubkeylen = = 33 ) = = 1 ) ; return ;
}
CHECK ( secp256k1_ec_pubkey_create ( ctx , pubkey2 , & pubkeylen2 , privkey , pubkeylen = = 33 ) = = 1 ) ;
CHECK ( memcmp ( pubkey , pubkey2 , pubkeylen ) = = 0 ) ; CHECK ( memcmp ( pubkey , pubkey2 , pubkeylen ) = = 0 ) ;
} }
/* Sign. */ /* Sign. */
CHECK ( secp256k1_ecdsa_sign ( message , signature , & signaturelen , privkey , NULL , NULL ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , message , signature , & signaturelen , privkey , NULL , NULL ) = = 1 ) ;
CHECK ( signaturelen > 0 ) ; CHECK ( signaturelen > 0 ) ;
CHECK ( secp256k1_ecdsa_sign ( message , signature2 , & signaturelen2 , privkey , NULL , extra ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , message , signature2 , & signaturelen2 , privkey , NULL , extra ) = = 1 ) ;
CHECK ( signaturelen2 > 0 ) ; CHECK ( signaturelen2 > 0 ) ;
extra [ 31 ] = 1 ; extra [ 31 ] = 1 ;
CHECK ( secp256k1_ecdsa_sign ( message , signature3 , & signaturelen3 , privkey , NULL , extra ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , message , signature3 , & signaturelen3 , privkey , NULL , extra ) = = 1 ) ;
CHECK ( signaturelen3 > 0 ) ; CHECK ( signaturelen3 > 0 ) ;
extra [ 31 ] = 0 ; extra [ 31 ] = 0 ;
extra [ 0 ] = 1 ; extra [ 0 ] = 1 ;
CHECK ( secp256k1_ecdsa_sign ( message , signature4 , & signaturelen4 , privkey , NULL , extra ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , message , signature4 , & signaturelen4 , privkey , NULL , extra ) = = 1 ) ;
CHECK ( signaturelen3 > 0 ) ; CHECK ( signaturelen3 > 0 ) ;
CHECK ( ( signaturelen ! = signaturelen2 ) | | ( memcmp ( signature , signature2 , signaturelen ) ! = 0 ) ) ; CHECK ( ( signaturelen ! = signaturelen2 ) | | ( memcmp ( signature , signature2 , signaturelen ) ! = 0 ) ) ;
CHECK ( ( signaturelen ! = signaturelen3 ) | | ( memcmp ( signature , signature3 , signaturelen ) ! = 0 ) ) ; CHECK ( ( signaturelen ! = signaturelen3 ) | | ( memcmp ( signature , signature3 , signaturelen ) ! = 0 ) ) ;
@ -1320,24 +1506,24 @@ void test_ecdsa_end_to_end(void) {
CHECK ( ( signaturelen4 ! = signaturelen2 ) | | ( memcmp ( signature4 , signature2 , signaturelen4 ) ! = 0 ) ) ; CHECK ( ( signaturelen4 ! = signaturelen2 ) | | ( memcmp ( signature4 , signature2 , signaturelen4 ) ! = 0 ) ) ;
CHECK ( ( signaturelen4 ! = signaturelen ) | | ( memcmp ( signature4 , signature , signaturelen4 ) ! = 0 ) ) ; CHECK ( ( signaturelen4 ! = signaturelen ) | | ( memcmp ( signature4 , signature , signaturelen4 ) ! = 0 ) ) ;
/* Verify. */ /* Verify. */
CHECK ( secp256k1_ecdsa_verify ( message , signature , signaturelen , pubkey , pubkeylen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , message , signature , signaturelen , pubkey , pubkeylen ) = = 1 ) ;
CHECK ( secp256k1_ecdsa_verify ( message , signature2 , signaturelen2 , pubkey , pubkeylen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , message , signature2 , signaturelen2 , pubkey , pubkeylen ) = = 1 ) ;
CHECK ( secp256k1_ecdsa_verify ( message , signature3 , signaturelen3 , pubkey , pubkeylen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , message , signature3 , signaturelen3 , pubkey , pubkeylen ) = = 1 ) ;
CHECK ( secp256k1_ecdsa_verify ( message , signature4 , signaturelen4 , pubkey , pubkeylen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , message , signature4 , signaturelen4 , pubkey , pubkeylen ) = = 1 ) ;
/* Destroy signature and verify again. */ /* Destroy signature and verify again. */
signature [ signaturelen - 1 - secp256k1_rand32 ( ) % 20 ] + = 1 + ( secp256k1_rand32 ( ) % 255 ) ; signature [ signaturelen - 1 - secp256k1_rand32 ( ) % 20 ] + = 1 + ( secp256k1_rand32 ( ) % 255 ) ;
CHECK ( secp256k1_ecdsa_verify ( message , signature , signaturelen , pubkey , pubkeylen ) ! = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , message , signature , signaturelen , pubkey , pubkeylen ) ! = 1 ) ;
/* Compact sign. */ /* Compact sign. */
CHECK ( secp256k1_ecdsa_sign_compact ( message , csignature , privkey , NULL , NULL , & recid ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign_compact ( ctx , message , csignature , privkey , NULL , NULL , & recid ) = = 1 ) ;
CHECK ( ! is_empty_compact_signature ( csignature ) ) ; CHECK ( ! is_empty_compact_signature ( csignature ) ) ;
/* Recover. */ /* Recover. */
CHECK ( secp256k1_ecdsa_recover_compact ( message , csignature , recpubkey , & recpubkeylen , pubkeylen = = 33 , recid ) = = 1 ) ; CHECK ( secp256k1_ecdsa_recover_compact ( ctx , message , csignature , recpubkey , & recpubkeylen , pubkeylen = = 33 , recid ) = = 1 ) ;
CHECK ( recpubkeylen = = pubkeylen ) ; CHECK ( recpubkeylen = = pubkeylen ) ;
CHECK ( memcmp ( pubkey , recpubkey , pubkeylen ) = = 0 ) ; CHECK ( memcmp ( pubkey , recpubkey , pubkeylen ) = = 0 ) ;
/* Destroy signature and verify again. */ /* Destroy signature and verify again. */
csignature [ secp256k1_rand32 ( ) % 64 ] + = 1 + ( secp256k1_rand32 ( ) % 255 ) ; csignature [ secp256k1_rand32 ( ) % 64 ] + = 1 + ( secp256k1_rand32 ( ) % 255 ) ;
CHECK ( secp256k1_ecdsa_recover_compact ( message , csignature , recpubkey , & recpubkeylen , pubkeylen = = 33 , recid ) ! = 1 | | CHECK ( secp256k1_ecdsa_recover_compact ( ctx , message , csignature , recpubkey , & recpubkeylen , pubkeylen = = 33 , recid ) ! = 1 | |
memcmp ( pubkey , recpubkey , pubkeylen ) ! = 0 ) ; memcmp ( pubkey , recpubkey , pubkeylen ) ! = 0 ) ;
CHECK ( recpubkeylen = = pubkeylen ) ; CHECK ( recpubkeylen = = pubkeylen ) ;
@ -1351,7 +1537,9 @@ void test_random_pubkeys(void) {
uint32_t r = secp256k1_rand32 ( ) ; uint32_t r = secp256k1_rand32 ( ) ;
int len = ( r & 3 ) = = 0 ? 65 : 33 ; int len = ( r & 3 ) = = 0 ? 65 : 33 ;
r > > = 2 ; r > > = 2 ;
if ( ( r & 3 ) = = 0 ) len = ( r & 252 ) > > 3 ; if ( ( r & 3 ) = = 0 ) {
len = ( r & 252 ) > > 3 ;
}
r > > = 8 ; r > > = 8 ;
if ( len = = 65 ) { if ( len = = 65 ) {
in [ 0 ] = ( r & 2 ) ? 4 : ( r & 1 ? 6 : 7 ) ; in [ 0 ] = ( r & 2 ) ? 4 : ( r & 1 ? 6 : 7 ) ;
@ -1359,10 +1547,16 @@ void test_random_pubkeys(void) {
in [ 0 ] = ( r & 1 ) ? 2 : 3 ; in [ 0 ] = ( r & 1 ) ? 2 : 3 ;
} }
r > > = 2 ; r > > = 2 ;
if ( ( r & 7 ) = = 0 ) in [ 0 ] = ( r & 2040 ) > > 3 ; if ( ( r & 7 ) = = 0 ) {
in [ 0 ] = ( r & 2040 ) > > 3 ;
}
r > > = 11 ; r > > = 11 ;
if ( len > 1 ) secp256k1_rand256 ( & in [ 1 ] ) ; if ( len > 1 ) {
if ( len > 33 ) secp256k1_rand256 ( & in [ 33 ] ) ; secp256k1_rand256 ( & in [ 1 ] ) ;
}
if ( len > 33 ) {
secp256k1_rand256 ( & in [ 33 ] ) ;
}
if ( secp256k1_eckey_pubkey_parse ( & elem , in , len ) ) { if ( secp256k1_eckey_pubkey_parse ( & elem , in , len ) ) {
unsigned char out [ 65 ] ; unsigned char out [ 65 ] ;
unsigned char firstb ; unsigned char firstb ;
@ -1374,7 +1568,9 @@ void test_random_pubkeys(void) {
CHECK ( size = = len ) ; CHECK ( size = = len ) ;
CHECK ( memcmp ( & in [ 1 ] , & out [ 1 ] , len - 1 ) = = 0 ) ; CHECK ( memcmp ( & in [ 1 ] , & out [ 1 ] , len - 1 ) = = 0 ) ;
/* ... except for the type of hybrid inputs. */ /* ... except for the type of hybrid inputs. */
if ( ( in [ 0 ] ! = 6 ) & & ( in [ 0 ] ! = 7 ) ) CHECK ( in [ 0 ] = = out [ 0 ] ) ; if ( ( in [ 0 ] ! = 6 ) & & ( in [ 0 ] ! = 7 ) ) {
CHECK ( in [ 0 ] = = out [ 0 ] ) ;
}
size = 65 ; size = 65 ;
CHECK ( secp256k1_eckey_pubkey_serialize ( & elem , in , & size , 0 ) ) ; CHECK ( secp256k1_eckey_pubkey_serialize ( & elem , in , & size , 0 ) ) ;
CHECK ( size = = 65 ) ; CHECK ( size = = 65 ) ;
@ -1384,8 +1580,11 @@ void test_random_pubkeys(void) {
in [ 0 ] = ( r & 1 ) ? 6 : 7 ; in [ 0 ] = ( r & 1 ) ? 6 : 7 ;
res = secp256k1_eckey_pubkey_parse ( & elem2 , in , size ) ; res = secp256k1_eckey_pubkey_parse ( & elem2 , in , size ) ;
if ( firstb = = 2 | | firstb = = 3 ) { if ( firstb = = 2 | | firstb = = 3 ) {
if ( in [ 0 ] = = firstb + 4 ) CHECK ( res ) ; if ( in [ 0 ] = = firstb + 4 ) {
else CHECK ( ! res ) ; CHECK ( res ) ;
} else {
CHECK ( ! res ) ;
}
} }
if ( res ) { if ( res ) {
ge_equals_ge ( & elem , & elem2 ) ; ge_equals_ge ( & elem , & elem2 ) ;
@ -1447,10 +1646,10 @@ void test_ecdsa_edge_cases(void) {
int pubkeyblen = 33 ; int pubkeyblen = 33 ;
int recid ; int recid ;
CHECK ( ! secp256k1_ecdsa_recover_compact ( msg32 , sig64 , pubkey , & pubkeylen , 0 , 0 ) ) ; CHECK ( ! secp256k1_ecdsa_recover_compact ( ctx , msg32 , sig64 , pubkey , & pubkeylen , 0 , 0 ) ) ;
CHECK ( secp256k1_ecdsa_recover_compact ( msg32 , sig64 , pubkey , & pubkeylen , 0 , 1 ) ) ; CHECK ( secp256k1_ecdsa_recover_compact ( ctx , msg32 , sig64 , pubkey , & pubkeylen , 0 , 1 ) ) ;
CHECK ( ! secp256k1_ecdsa_recover_compact ( msg32 , sig64 , pubkey , & pubkeylen , 0 , 2 ) ) ; CHECK ( ! secp256k1_ecdsa_recover_compact ( ctx , msg32 , sig64 , pubkey , & pubkeylen , 0 , 2 ) ) ;
CHECK ( ! secp256k1_ecdsa_recover_compact ( msg32 , sig64 , pubkey , & pubkeylen , 0 , 3 ) ) ; CHECK ( ! secp256k1_ecdsa_recover_compact ( ctx , msg32 , sig64 , pubkey , & pubkeylen , 0 , 3 ) ) ;
for ( recid = 0 ; recid < 4 ; recid + + ) { for ( recid = 0 ; recid < 4 ; recid + + ) {
int i ; int i ;
@ -1495,42 +1694,44 @@ void test_ecdsa_edge_cases(void) {
0xE6 , 0xAF , 0x48 , 0xA0 , 0x3B , 0xBF , 0xD2 , 0x5E , 0xE6 , 0xAF , 0x48 , 0xA0 , 0x3B , 0xBF , 0xD2 , 0x5E ,
0x8C , 0xD0 , 0x36 , 0x41 , 0x45 , 0x02 , 0x01 , 0x04 0x8C , 0xD0 , 0x36 , 0x41 , 0x45 , 0x02 , 0x01 , 0x04
} ; } ;
CHECK ( secp256k1_ecdsa_recover_compact ( msg32 , sigb64 , pubkeyb , & pubkeyblen , 1 , recid ) ) ; CHECK ( secp256k1_ecdsa_recover_compact ( ctx , msg32 , sigb64 , pubkeyb , & pubkeyblen , 1 , recid ) ) ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbder , sizeof ( sigbder ) , pubkeyb , pubkeyblen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbder , sizeof ( sigbder ) , pubkeyb , pubkeyblen ) = = 1 ) ;
for ( recid2 = 0 ; recid2 < 4 ; recid2 + + ) { for ( recid2 = 0 ; recid2 < 4 ; recid2 + + ) {
unsigned char pubkey2b [ 33 ] ; unsigned char pubkey2b [ 33 ] ;
int pubkey2blen = 33 ; int pubkey2blen = 33 ;
CHECK ( secp256k1_ecdsa_recover_compact ( msg32 , sigb64 , pubkey2b , & pubkey2blen , 1 , recid2 ) ) ; CHECK ( secp256k1_ecdsa_recover_compact ( ctx , msg32 , sigb64 , pubkey2b , & pubkey2blen , 1 , recid2 ) ) ;
/* Verifying with (order + r,4) should always fail. */ /* Verifying with (order + r,4) should always fail. */
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbderlong , sizeof ( sigbderlong ) , pubkey2b , pubkey2blen ) ! = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbderlong , sizeof ( sigbderlong ) , pubkey2b , pubkey2blen ) ! = 1 ) ;
} }
/* DER parsing tests. */ /* DER parsing tests. */
/* Zero length r/s. */ /* Zero length r/s. */
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigcder_zr , sizeof ( sigcder_zr ) , pubkeyb , pubkeyblen ) = = - 2 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigcder_zr , sizeof ( sigcder_zr ) , pubkeyb , pubkeyblen ) = = - 2 ) ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigcder_zs , sizeof ( sigcder_zs ) , pubkeyb , pubkeyblen ) = = - 2 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigcder_zs , sizeof ( sigcder_zs ) , pubkeyb , pubkeyblen ) = = - 2 ) ;
/* Leading zeros. */ /* Leading zeros. */
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbderalt1 , sizeof ( sigbderalt1 ) , pubkeyb , pubkeyblen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbderalt1 , sizeof ( sigbderalt1 ) , pubkeyb , pubkeyblen ) = = 1 ) ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbderalt2 , sizeof ( sigbderalt2 ) , pubkeyb , pubkeyblen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbderalt2 , sizeof ( sigbderalt2 ) , pubkeyb , pubkeyblen ) = = 1 ) ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbderalt3 , sizeof ( sigbderalt3 ) , pubkeyb , pubkeyblen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbderalt3 , sizeof ( sigbderalt3 ) , pubkeyb , pubkeyblen ) = = 1 ) ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbderalt4 , sizeof ( sigbderalt4 ) , pubkeyb , pubkeyblen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbderalt4 , sizeof ( sigbderalt4 ) , pubkeyb , pubkeyblen ) = = 1 ) ;
sigbderalt3 [ 4 ] = 1 ; sigbderalt3 [ 4 ] = 1 ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbderalt3 , sizeof ( sigbderalt3 ) , pubkeyb , pubkeyblen ) = = - 2 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbderalt3 , sizeof ( sigbderalt3 ) , pubkeyb , pubkeyblen ) = = - 2 ) ;
sigbderalt4 [ 7 ] = 1 ; sigbderalt4 [ 7 ] = 1 ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbderalt4 , sizeof ( sigbderalt4 ) , pubkeyb , pubkeyblen ) = = - 2 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbderalt4 , sizeof ( sigbderalt4 ) , pubkeyb , pubkeyblen ) = = - 2 ) ;
/* Damage signature. */ /* Damage signature. */
sigbder [ 7 ] + + ; sigbder [ 7 ] + + ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbder , sizeof ( sigbder ) , pubkeyb , pubkeyblen ) = = 0 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbder , sizeof ( sigbder ) , pubkeyb , pubkeyblen ) = = 0 ) ;
sigbder [ 7 ] - - ; sigbder [ 7 ] - - ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbder , 6 , pubkeyb , pubkeyblen ) = = - 2 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbder , 6 , pubkeyb , pubkeyblen ) = = - 2 ) ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbder , sizeof ( sigbder ) - 1 , pubkeyb , pubkeyblen ) = = - 2 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbder , sizeof ( sigbder ) - 1 , pubkeyb , pubkeyblen ) = = - 2 ) ;
for ( i = 0 ; i < 8 ; i + + ) { for ( i = 0 ; i < 8 ; i + + ) {
int c ; int c ;
unsigned char orig = sigbder [ i ] ; unsigned char orig = sigbder [ i ] ;
/*Try every single-byte change.*/ /*Try every single-byte change.*/
for ( c = 0 ; c < 256 ; c + + ) { for ( c = 0 ; c < 256 ; c + + ) {
if ( c = = orig ) continue ; if ( c = = orig ) {
continue ;
}
sigbder [ i ] = c ; sigbder [ i ] = c ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigbder , sizeof ( sigbder ) , pubkeyb , pubkeyblen ) = = CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigbder , sizeof ( sigbder ) , pubkeyb , pubkeyblen ) = =
( i = = 4 | | i = = 7 ) ? 0 : - 2 ) ; ( i = = 4 | | i = = 7 ) ? 0 : - 2 ) ;
} }
sigbder [ i ] = orig ; sigbder [ i ] = orig ;
@ -1547,10 +1748,10 @@ void test_ecdsa_edge_cases(void) {
secp256k1_scalar_negate ( & sig . s , & sig . s ) ; secp256k1_scalar_negate ( & sig . s , & sig . s ) ;
secp256k1_scalar_inverse ( & sig . s , & sig . s ) ; secp256k1_scalar_inverse ( & sig . s , & sig . s ) ;
secp256k1_scalar_set_int ( & sig . r , 1 ) ; secp256k1_scalar_set_int ( & sig . r , 1 ) ;
secp256k1_ecmult_gen ( & keyj , & sig . r ) ; secp256k1_ecmult_gen ( & ctx - > ecmult_gen_ctx , & keyj , & sig . r ) ;
secp256k1_ge_set_gej ( & key , & keyj ) ; secp256k1_ge_set_gej ( & key , & keyj ) ;
msg = sig . s ; msg = sig . s ;
CHECK ( secp256k1_ecdsa_sig_verify ( & sig , & key , & msg ) = = 0 ) ; CHECK ( secp256k1_ecdsa_sig_verify ( & ctx - > ecmult_ctx , & sig , & key , & msg ) = = 0 ) ;
} }
/* Test r/s equal to zero */ /* Test r/s equal to zero */
@ -1569,18 +1770,18 @@ void test_ecdsa_edge_cases(void) {
} ; } ;
unsigned char pubkeyc [ 65 ] ; unsigned char pubkeyc [ 65 ] ;
int pubkeyclen = 65 ; int pubkeyclen = 65 ;
CHECK ( secp256k1_ecdsa_recover_compact ( msg32 , sigc64 , pubkeyc , & pubkeyclen , 0 , 0 ) = = 1 ) ; CHECK ( secp256k1_ecdsa_recover_compact ( ctx , msg32 , sigc64 , pubkeyc , & pubkeyclen , 0 , 0 ) = = 1 ) ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigcder , sizeof ( sigcder ) , pubkeyc , pubkeyclen ) = = 1 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigcder , sizeof ( sigcder ) , pubkeyc , pubkeyclen ) = = 1 ) ;
sigcder [ 4 ] = 0 ; sigcder [ 4 ] = 0 ;
sigc64 [ 31 ] = 0 ; sigc64 [ 31 ] = 0 ;
CHECK ( secp256k1_ecdsa_recover_compact ( msg32 , sigc64 , pubkeyb , & pubkeyblen , 1 , 0 ) = = 0 ) ; CHECK ( secp256k1_ecdsa_recover_compact ( ctx , msg32 , sigc64 , pubkeyb , & pubkeyblen , 1 , 0 ) = = 0 ) ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigcder , sizeof ( sigcder ) , pubkeyc , pubkeyclen ) = = 0 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigcder , sizeof ( sigcder ) , pubkeyc , pubkeyclen ) = = 0 ) ;
sigcder [ 4 ] = 1 ; sigcder [ 4 ] = 1 ;
sigcder [ 7 ] = 0 ; sigcder [ 7 ] = 0 ;
sigc64 [ 31 ] = 1 ; sigc64 [ 31 ] = 1 ;
sigc64 [ 63 ] = 0 ; sigc64 [ 63 ] = 0 ;
CHECK ( secp256k1_ecdsa_recover_compact ( msg32 , sigc64 , pubkeyb , & pubkeyblen , 1 , 0 ) = = 0 ) ; CHECK ( secp256k1_ecdsa_recover_compact ( ctx , msg32 , sigc64 , pubkeyb , & pubkeyblen , 1 , 0 ) = = 0 ) ;
CHECK ( secp256k1_ecdsa_verify ( msg32 , sigcder , sizeof ( sigcder ) , pubkeyc , pubkeyclen ) = = 0 ) ; CHECK ( secp256k1_ecdsa_verify ( ctx , msg32 , sigcder , sizeof ( sigcder ) , pubkeyc , pubkeyclen ) = = 0 ) ;
} }
/*Signature where s would be zero.*/ /*Signature where s would be zero.*/
@ -1611,18 +1812,18 @@ void test_ecdsa_edge_cases(void) {
} ; } ;
unsigned char sig [ 72 ] ; unsigned char sig [ 72 ] ;
int siglen = 72 ; int siglen = 72 ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , precomputed_nonce_function , nonce ) = = 0 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , precomputed_nonce_function , nonce ) = = 0 ) ;
CHECK ( siglen = = 0 ) ; CHECK ( siglen = = 0 ) ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , precomputed_nonce_function , nonce2 ) = = 0 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , precomputed_nonce_function , nonce2 ) = = 0 ) ;
CHECK ( siglen = = 0 ) ; CHECK ( siglen = = 0 ) ;
msg [ 31 ] = 0xaa ; msg [ 31 ] = 0xaa ;
siglen = 72 ; siglen = 72 ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , precomputed_nonce_function , nonce ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , precomputed_nonce_function , nonce ) = = 1 ) ;
CHECK ( siglen > 0 ) ; CHECK ( siglen > 0 ) ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , precomputed_nonce_function , nonce2 ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , precomputed_nonce_function , nonce2 ) = = 1 ) ;
CHECK ( siglen > 0 ) ; CHECK ( siglen > 0 ) ;
siglen = 10 ; siglen = 10 ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , precomputed_nonce_function , nonce ) ! = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , precomputed_nonce_function , nonce ) ! = 1 ) ;
CHECK ( siglen = = 0 ) ; CHECK ( siglen = = 0 ) ;
} }
@ -1644,41 +1845,41 @@ void test_ecdsa_edge_cases(void) {
msg [ 31 ] = 1 ; msg [ 31 ] = 1 ;
/* High key results in signature failure. */ /* High key results in signature failure. */
memset ( key , 0xFF , 32 ) ; memset ( key , 0xFF , 32 ) ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , NULL , extra ) = = 0 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , NULL , extra ) = = 0 ) ;
CHECK ( siglen = = 0 ) ; CHECK ( siglen = = 0 ) ;
/* Zero key results in signature failure. */ /* Zero key results in signature failure. */
memset ( key , 0 , 32 ) ; memset ( key , 0 , 32 ) ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , NULL , extra ) = = 0 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , NULL , extra ) = = 0 ) ;
CHECK ( siglen = = 0 ) ; CHECK ( siglen = = 0 ) ;
/* Nonce function failure results in signature failure. */ /* Nonce function failure results in signature failure. */
key [ 31 ] = 1 ; key [ 31 ] = 1 ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , nonce_function_test_fail , extra ) = = 0 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , nonce_function_test_fail , extra ) = = 0 ) ;
CHECK ( siglen = = 0 ) ; CHECK ( siglen = = 0 ) ;
CHECK ( secp256k1_ecdsa_sign_compact ( msg , sig , key , nonce_function_test_fail , extra , & recid ) = = 0 ) ; CHECK ( secp256k1_ecdsa_sign_compact ( ctx , msg , sig , key , nonce_function_test_fail , extra , & recid ) = = 0 ) ;
CHECK ( is_empty_compact_signature ( sig ) ) ; CHECK ( is_empty_compact_signature ( sig ) ) ;
/* The retry loop successfully makes its way to the first good value. */ /* The retry loop successfully makes its way to the first good value. */
siglen = 72 ; siglen = 72 ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , nonce_function_test_retry , extra ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , nonce_function_test_retry , extra ) = = 1 ) ;
CHECK ( siglen > 0 ) ; CHECK ( siglen > 0 ) ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig2 , & siglen2 , key , nonce_function_rfc6979 , extra ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig2 , & siglen2 , key , nonce_function_rfc6979 , extra ) = = 1 ) ;
CHECK ( siglen > 0 ) ; CHECK ( siglen > 0 ) ;
CHECK ( ( siglen = = siglen2 ) & & ( memcmp ( sig , sig2 , siglen ) = = 0 ) ) ; CHECK ( ( siglen = = siglen2 ) & & ( memcmp ( sig , sig2 , siglen ) = = 0 ) ) ;
CHECK ( secp256k1_ecdsa_sign_compact ( msg , sig , key , nonce_function_test_retry , extra , & recid ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign_compact ( ctx , msg , sig , key , nonce_function_test_retry , extra , & recid ) = = 1 ) ;
CHECK ( ! is_empty_compact_signature ( sig ) ) ; CHECK ( ! is_empty_compact_signature ( sig ) ) ;
CHECK ( secp256k1_ecdsa_sign_compact ( msg , sig2 , key , nonce_function_rfc6979 , extra , & recid2 ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign_compact ( ctx , msg , sig2 , key , nonce_function_rfc6979 , extra , & recid2 ) = = 1 ) ;
CHECK ( ! is_empty_compact_signature ( sig2 ) ) ; CHECK ( ! is_empty_compact_signature ( sig2 ) ) ;
CHECK ( ( recid = = recid2 ) & & ( memcmp ( sig , sig2 , 64 ) = = 0 ) ) ; CHECK ( ( recid = = recid2 ) & & ( memcmp ( sig , sig2 , 64 ) = = 0 ) ) ;
/* The default nonce function is determinstic. */ /* The default nonce function is determinstic. */
siglen = 72 ; siglen = 72 ;
siglen2 = 72 ; siglen2 = 72 ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig , & siglen , key , NULL , extra ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig , & siglen , key , NULL , extra ) = = 1 ) ;
CHECK ( siglen > 0 ) ; CHECK ( siglen > 0 ) ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig2 , & siglen2 , key , NULL , extra ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig2 , & siglen2 , key , NULL , extra ) = = 1 ) ;
CHECK ( siglen2 > 0 ) ; CHECK ( siglen2 > 0 ) ;
CHECK ( ( siglen = = siglen2 ) & & ( memcmp ( sig , sig2 , siglen ) = = 0 ) ) ; CHECK ( ( siglen = = siglen2 ) & & ( memcmp ( sig , sig2 , siglen ) = = 0 ) ) ;
CHECK ( secp256k1_ecdsa_sign_compact ( msg , sig , key , NULL , extra , & recid ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign_compact ( ctx , msg , sig , key , NULL , extra , & recid ) = = 1 ) ;
CHECK ( ! is_empty_compact_signature ( sig ) ) ; CHECK ( ! is_empty_compact_signature ( sig ) ) ;
CHECK ( secp256k1_ecdsa_sign_compact ( msg , sig2 , key , NULL , extra , & recid2 ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign_compact ( ctx , msg , sig2 , key , NULL , extra , & recid2 ) = = 1 ) ;
CHECK ( ! is_empty_compact_signature ( sig ) ) ; CHECK ( ! is_empty_compact_signature ( sig ) ) ;
CHECK ( ( recid = = recid2 ) & & ( memcmp ( sig , sig2 , 64 ) = = 0 ) ) ; CHECK ( ( recid = = recid2 ) & & ( memcmp ( sig , sig2 , 64 ) = = 0 ) ) ;
/* The default nonce function changes output with different messages. */ /* The default nonce function changes output with different messages. */
@ -1686,7 +1887,7 @@ void test_ecdsa_edge_cases(void) {
int j ; int j ;
siglen2 = 72 ; siglen2 = 72 ;
msg [ 0 ] = i ; msg [ 0 ] = i ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig2 , & siglen2 , key , NULL , extra ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig2 , & siglen2 , key , NULL , extra ) = = 1 ) ;
CHECK ( ! is_empty_compact_signature ( sig ) ) ; CHECK ( ! is_empty_compact_signature ( sig ) ) ;
CHECK ( secp256k1_ecdsa_sig_parse ( & s [ i ] , sig2 , siglen2 ) ) ; CHECK ( secp256k1_ecdsa_sig_parse ( & s [ i ] , sig2 , siglen2 ) ) ;
for ( j = 0 ; j < i ; j + + ) { for ( j = 0 ; j < i ; j + + ) {
@ -1700,7 +1901,7 @@ void test_ecdsa_edge_cases(void) {
int j ; int j ;
siglen2 = 72 ; siglen2 = 72 ;
key [ 0 ] = i - 256 ; key [ 0 ] = i - 256 ;
CHECK ( secp256k1_ecdsa_sign ( msg , sig2 , & siglen2 , key , NULL , extra ) = = 1 ) ; CHECK ( secp256k1_ecdsa_sign ( ctx , msg , sig2 , & siglen2 , key , NULL , extra ) = = 1 ) ;
CHECK ( secp256k1_ecdsa_sig_parse ( & s [ i ] , sig2 , siglen2 ) ) ; CHECK ( secp256k1_ecdsa_sig_parse ( & s [ i ] , sig2 , siglen2 ) ) ;
for ( j = 0 ; j < i ; j + + ) { for ( j = 0 ; j < i ; j + + ) {
CHECK ( ! secp256k1_scalar_eq ( & s [ i ] . r , & s [ j ] . r ) ) ; CHECK ( ! secp256k1_scalar_eq ( & s [ i ] . r , & s [ j ] . r ) ) ;
@ -1719,8 +1920,8 @@ void test_ecdsa_edge_cases(void) {
0xbf , 0xd2 , 0x5e , 0x8c , 0xd0 , 0x36 , 0x41 , 0x41 , 0xbf , 0xd2 , 0x5e , 0x8c , 0xd0 , 0x36 , 0x41 , 0x41 ,
} ; } ;
int outlen = 300 ; int outlen = 300 ;
CHECK ( ! secp256k1_ec_privkey_export ( seckey , privkey , & outlen , 0 ) ) ; CHECK ( ! secp256k1_ec_privkey_export ( ctx , seckey , privkey , & outlen , 0 ) ) ;
CHECK ( ! secp256k1_ec_privkey_export ( seckey , privkey , & outlen , 1 ) ) ; CHECK ( ! secp256k1_ec_privkey_export ( ctx , seckey , privkey , & outlen , 1 ) ) ;
} }
} }
@ -1735,7 +1936,7 @@ EC_KEY *get_openssl_key(const secp256k1_scalar_t *key) {
const unsigned char * pbegin = privkey ; const unsigned char * pbegin = privkey ;
int compr = secp256k1_rand32 ( ) & 1 ; int compr = secp256k1_rand32 ( ) & 1 ;
EC_KEY * ec_key = EC_KEY_new_by_curve_name ( NID_secp256k1 ) ; EC_KEY * ec_key = EC_KEY_new_by_curve_name ( NID_secp256k1 ) ;
CHECK ( secp256k1_eckey_privkey_serialize ( privkey , & privkeylen , key , compr ) ) ; CHECK ( secp256k1_eckey_privkey_serialize ( & ctx - > ecmult_gen_ctx , privkey , & privkeylen , key , compr ) ) ;
CHECK ( d2i_ECPrivateKey ( & ec_key , & pbegin , privkeylen ) ) ; CHECK ( d2i_ECPrivateKey ( & ec_key , & pbegin , privkeylen ) ) ;
CHECK ( EC_KEY_check_key ( ec_key ) ) ; CHECK ( EC_KEY_check_key ( ec_key ) ) ;
return ec_key ; return ec_key ;
@ -1756,16 +1957,16 @@ void test_ecdsa_openssl(void) {
secp256k1_rand256_test ( message ) ; secp256k1_rand256_test ( message ) ;
secp256k1_scalar_set_b32 ( & msg , message , NULL ) ; secp256k1_scalar_set_b32 ( & msg , message , NULL ) ;
random_scalar_order_test ( & key ) ; random_scalar_order_test ( & key ) ;
secp256k1_ecmult_gen ( & qj , & key ) ; secp256k1_ecmult_gen ( & ctx - > ecmult_gen_ctx , & qj , & key ) ;
secp256k1_ge_set_gej ( & q , & qj ) ; secp256k1_ge_set_gej ( & q , & qj ) ;
ec_key = get_openssl_key ( & key ) ; ec_key = get_openssl_key ( & key ) ;
CHECK ( ec_key ) ; CHECK ( ec_key ) ;
CHECK ( ECDSA_sign ( 0 , message , sizeof ( message ) , signature , & sigsize , ec_key ) ) ; CHECK ( ECDSA_sign ( 0 , message , sizeof ( message ) , signature , & sigsize , ec_key ) ) ;
CHECK ( secp256k1_ecdsa_sig_parse ( & sig , signature , sigsize ) ) ; CHECK ( secp256k1_ecdsa_sig_parse ( & sig , signature , sigsize ) ) ;
CHECK ( secp256k1_ecdsa_sig_verify ( & sig , & q , & msg ) ) ; CHECK ( secp256k1_ecdsa_sig_verify ( & ctx - > ecmult_ctx , & sig , & q , & msg ) ) ;
secp256k1_scalar_set_int ( & one , 1 ) ; secp256k1_scalar_set_int ( & one , 1 ) ;
secp256k1_scalar_add ( & msg2 , & msg , & one ) ; secp256k1_scalar_add ( & msg2 , & msg , & one ) ;
CHECK ( ! secp256k1_ecdsa_sig_verify ( & sig , & q , & msg2 ) ) ; CHECK ( ! secp256k1_ecdsa_sig_verify ( & ctx - > ecmult_ctx , & sig , & q , & msg2 ) ) ;
random_sign ( & sig , & key , & msg , NULL ) ; random_sign ( & sig , & key , & msg , NULL ) ;
CHECK ( secp256k1_ecdsa_sig_serialize ( signature , & secp_sigsize , & sig ) ) ; CHECK ( secp256k1_ecdsa_sig_serialize ( signature , & secp_sigsize , & sig ) ) ;
@ -1825,10 +2026,13 @@ int main(int argc, char **argv) {
printf ( " random seed = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x \n " , seed16 [ 0 ] , seed16 [ 1 ] , seed16 [ 2 ] , seed16 [ 3 ] , seed16 [ 4 ] , seed16 [ 5 ] , seed16 [ 6 ] , seed16 [ 7 ] , seed16 [ 8 ] , seed16 [ 9 ] , seed16 [ 10 ] , seed16 [ 11 ] , seed16 [ 12 ] , seed16 [ 13 ] , seed16 [ 14 ] , seed16 [ 15 ] ) ; printf ( " random seed = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x \n " , seed16 [ 0 ] , seed16 [ 1 ] , seed16 [ 2 ] , seed16 [ 3 ] , seed16 [ 4 ] , seed16 [ 5 ] , seed16 [ 6 ] , seed16 [ 7 ] , seed16 [ 8 ] , seed16 [ 9 ] , seed16 [ 10 ] , seed16 [ 11 ] , seed16 [ 12 ] , seed16 [ 13 ] , seed16 [ 14 ] , seed16 [ 15 ] ) ;
/* initialize */ /* initialize */
secp256k1_start ( SECP256K1_START_SIGN | SECP256K1_START_VERIFY ) ; run_context_tests ( ) ;
ctx = secp256k1_context_create ( SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY ) ;
/* initializing a second time shouldn't cause any harm or memory leaks. */ if ( secp256k1_rand32 ( ) & 1 ) {
secp256k1_start ( SECP256K1_START_SIGN | SECP256K1_START_VERIFY ) ; secp256k1_rand256 ( run32 ) ;
CHECK ( secp256k1_context_randomize ( ctx , secp256k1_rand32 ( ) & 1 ? run32 : NULL ) ) ;
}
run_sha256_tests ( ) ; run_sha256_tests ( ) ;
run_hmac_sha256_tests ( ) ; run_hmac_sha256_tests ( ) ;
@ -1858,6 +2062,8 @@ int main(int argc, char **argv) {
run_wnaf ( ) ; run_wnaf ( ) ;
run_point_times_order ( ) ; run_point_times_order ( ) ;
run_ecmult_chain ( ) ; run_ecmult_chain ( ) ;
run_ecmult_constants ( ) ;
run_ecmult_gen_blind ( ) ;
/* ecdsa tests */ /* ecdsa tests */
run_random_pubkeys ( ) ; run_random_pubkeys ( ) ;
@ -1872,9 +2078,6 @@ int main(int argc, char **argv) {
printf ( " random run = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x \n " , run32 [ 0 ] , run32 [ 1 ] , run32 [ 2 ] , run32 [ 3 ] , run32 [ 4 ] , run32 [ 5 ] , run32 [ 6 ] , run32 [ 7 ] , run32 [ 8 ] , run32 [ 9 ] , run32 [ 10 ] , run32 [ 11 ] , run32 [ 12 ] , run32 [ 13 ] , run32 [ 14 ] , run32 [ 15 ] ) ; printf ( " random run = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x \n " , run32 [ 0 ] , run32 [ 1 ] , run32 [ 2 ] , run32 [ 3 ] , run32 [ 4 ] , run32 [ 5 ] , run32 [ 6 ] , run32 [ 7 ] , run32 [ 8 ] , run32 [ 9 ] , run32 [ 10 ] , run32 [ 11 ] , run32 [ 12 ] , run32 [ 13 ] , run32 [ 14 ] , run32 [ 15 ] ) ;
/* shutdown */ /* shutdown */
secp256k1_stop ( ) ; secp256k1_context_destroy ( ctx ) ;
/* shutting down twice shouldn't cause any double frees. */
secp256k1_stop ( ) ;
return 0 ; return 0 ;
} }
Pieter Wuille
10 years ago