Bitcoin Core  27.99.0
P2P Digital Currency
ecdsa.c
Go to the documentation of this file.
1 /*************************************************************************
2  * Written in 2020-2022 by Elichai Turkel *
3  * To the extent possible under law, the author(s) have dedicated all *
4  * copyright and related and neighboring rights to the software in this *
5  * file to the public domain worldwide. This software is distributed *
6  * without any warranty. For the CC0 Public Domain Dedication, see *
7  * EXAMPLES_COPYING or https://creativecommons.org/publicdomain/zero/1.0 *
8  *************************************************************************/
9 
10 #include <stdio.h>
11 #include <assert.h>
12 #include <string.h>
13 
14 #include <secp256k1.h>
15 
16 #include "examples_util.h"
17 
18 int main(void) {
19  /* Instead of signing the message directly, we must sign a 32-byte hash.
20  * Here the message is "Hello, world!" and the hash function was SHA-256.
21  * An actual implementation should just call SHA-256, but this example
22  * hardcodes the output to avoid depending on an additional library.
23  * See https://bitcoin.stackexchange.com/questions/81115/if-someone-wanted-to-pretend-to-be-satoshi-by-posting-a-fake-signature-to-defrau/81116#81116 */
24  unsigned char msg_hash[32] = {
25  0x31, 0x5F, 0x5B, 0xDB, 0x76, 0xD0, 0x78, 0xC4,
26  0x3B, 0x8A, 0xC0, 0x06, 0x4E, 0x4A, 0x01, 0x64,
27  0x61, 0x2B, 0x1F, 0xCE, 0x77, 0xC8, 0x69, 0x34,
28  0x5B, 0xFC, 0x94, 0xC7, 0x58, 0x94, 0xED, 0xD3,
29  };
30  unsigned char seckey[32];
31  unsigned char randomize[32];
32  unsigned char compressed_pubkey[33];
33  unsigned char serialized_signature[64];
34  size_t len;
35  int is_signature_valid, is_signature_valid2;
36  int return_val;
37  secp256k1_pubkey pubkey;
39  /* Before we can call actual API functions, we need to create a "context". */
41  if (!fill_random(randomize, sizeof(randomize))) {
42  printf("Failed to generate randomness\n");
43  return 1;
44  }
45  /* Randomizing the context is recommended to protect against side-channel
46  * leakage See `secp256k1_context_randomize` in secp256k1.h for more
47  * information about it. This should never fail. */
48  return_val = secp256k1_context_randomize(ctx, randomize);
49  assert(return_val);
50 
51  /*** Key Generation ***/
52 
53  /* If the secret key is zero or out of range (bigger than secp256k1's
54  * order), we try to sample a new key. Note that the probability of this
55  * happening is negligible. */
56  while (1) {
57  if (!fill_random(seckey, sizeof(seckey))) {
58  printf("Failed to generate randomness\n");
59  return 1;
60  }
61  if (secp256k1_ec_seckey_verify(ctx, seckey)) {
62  break;
63  }
64  }
65 
66  /* Public key creation using a valid context with a verified secret key should never fail */
67  return_val = secp256k1_ec_pubkey_create(ctx, &pubkey, seckey);
68  assert(return_val);
69 
70  /* Serialize the pubkey in a compressed form(33 bytes). Should always return 1. */
71  len = sizeof(compressed_pubkey);
72  return_val = secp256k1_ec_pubkey_serialize(ctx, compressed_pubkey, &len, &pubkey, SECP256K1_EC_COMPRESSED);
73  assert(return_val);
74  /* Should be the same size as the size of the output, because we passed a 33 byte array. */
75  assert(len == sizeof(compressed_pubkey));
76 
77  /*** Signing ***/
78 
79  /* Generate an ECDSA signature `noncefp` and `ndata` allows you to pass a
80  * custom nonce function, passing `NULL` will use the RFC-6979 safe default.
81  * Signing with a valid context, verified secret key
82  * and the default nonce function should never fail. */
83  return_val = secp256k1_ecdsa_sign(ctx, &sig, msg_hash, seckey, NULL, NULL);
84  assert(return_val);
85 
86  /* Serialize the signature in a compact form. Should always return 1
87  * according to the documentation in secp256k1.h. */
88  return_val = secp256k1_ecdsa_signature_serialize_compact(ctx, serialized_signature, &sig);
89  assert(return_val);
90 
91 
92  /*** Verification ***/
93 
94  /* Deserialize the signature. This will return 0 if the signature can't be parsed correctly. */
95  if (!secp256k1_ecdsa_signature_parse_compact(ctx, &sig, serialized_signature)) {
96  printf("Failed parsing the signature\n");
97  return 1;
98  }
99 
100  /* Deserialize the public key. This will return 0 if the public key can't be parsed correctly. */
101  if (!secp256k1_ec_pubkey_parse(ctx, &pubkey, compressed_pubkey, sizeof(compressed_pubkey))) {
102  printf("Failed parsing the public key\n");
103  return 1;
104  }
105 
106  /* Verify a signature. This will return 1 if it's valid and 0 if it's not. */
107  is_signature_valid = secp256k1_ecdsa_verify(ctx, &sig, msg_hash, &pubkey);
108 
109  printf("Is the signature valid? %s\n", is_signature_valid ? "true" : "false");
110  printf("Secret Key: ");
111  print_hex(seckey, sizeof(seckey));
112  printf("Public Key: ");
113  print_hex(compressed_pubkey, sizeof(compressed_pubkey));
114  printf("Signature: ");
115  print_hex(serialized_signature, sizeof(serialized_signature));
116 
117  /* This will clear everything from the context and free the memory */
119 
120  /* Bonus example: if all we need is signature verification (and no key
121  generation or signing), we don't need to use a context created via
122  secp256k1_context_create(). We can simply use the static (i.e., global)
123  context secp256k1_context_static. See its description in
124  include/secp256k1.h for details. */
125  is_signature_valid2 = secp256k1_ecdsa_verify(secp256k1_context_static,
126  &sig, msg_hash, &pubkey);
127  assert(is_signature_valid2 == is_signature_valid);
128 
129  /* It's best practice to try to clear secrets from memory after using them.
130  * This is done because some bugs can allow an attacker to leak memory, for
131  * example through "out of bounds" array access (see Heartbleed), Or the OS
132  * swapping them to disk. Hence, we overwrite the secret key buffer with zeros.
133  *
134  * Here we are preventing these writes from being optimized out, as any good compiler
135  * will remove any writes that aren't used. */
136  secure_erase(seckey, sizeof(seckey));
137 
138  return 0;
139 }
int main(void)
Definition: ecdsa.c:18
static int fill_random(unsigned char *data, size_t size)
Definition: examples_util.h:43
static void secure_erase(void *ptr, size_t len)
Definition: examples_util.h:86
static void print_hex(unsigned char *data, size_t size)
Definition: examples_util.h:72
void printf(const char *fmt, const Args &... args)
Format list of arguments to std::cout, according to the given format string.
Definition: tinyformat.h:1077
SECP256K1_API void secp256k1_context_destroy(secp256k1_context *ctx) SECP256K1_ARG_NONNULL(1)
Destroy a secp256k1 context object (created in dynamically allocated memory).
Definition: secp256k1.c:187
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_context_randomize(secp256k1_context *ctx, const unsigned char *seed32) SECP256K1_ARG_NONNULL(1)
Randomizes the context to provide enhanced protection against side-channel leakage.
Definition: secp256k1.c:768
SECP256K1_API int secp256k1_ecdsa_signature_parse_compact(const secp256k1_context *ctx, secp256k1_ecdsa_signature *sig, const unsigned char *input64) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Parse an ECDSA signature in compact (64 bytes) format.
Definition: secp256k1.c:397
SECP256K1_API int secp256k1_ec_pubkey_serialize(const secp256k1_context *ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey *pubkey, unsigned int flags) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize a pubkey object into a serialized byte sequence.
Definition: secp256k1.c:280
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_verify(const secp256k1_context *ctx, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
Verify an ECDSA secret key.
Definition: secp256k1.c:590
SECP256K1_API int secp256k1_ecdsa_sign(const secp256k1_context *ctx, secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void *ndata) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create an ECDSA signature.
Definition: secp256k1.c:576
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_parse(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const unsigned char *input, size_t inputlen) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Parse a variable-length public key into the pubkey object.
Definition: secp256k1.c:262
#define SECP256K1_CONTEXT_NONE
Context flags to pass to secp256k1_context_create, secp256k1_context_preallocated_size,...
Definition: secp256k1.h:205
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_create(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute the public key for a secret key.
Definition: secp256k1.c:613
SECP256K1_API secp256k1_context * secp256k1_context_create(unsigned int flags) SECP256K1_WARN_UNUSED_RESULT
Create a secp256k1 context object (in dynamically allocated memory).
Definition: secp256k1.c:141
#define SECP256K1_EC_COMPRESSED
Flag to pass to secp256k1_ec_pubkey_serialize.
Definition: secp256k1.h:215
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_verify(const secp256k1_context *ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const secp256k1_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Verify an ECDSA signature.
Definition: secp256k1.c:462
SECP256K1_API int secp256k1_ecdsa_signature_serialize_compact(const secp256k1_context *ctx, unsigned char *output64, const secp256k1_ecdsa_signature *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Serialize an ECDSA signature in compact (64 byte) format.
Definition: secp256k1.c:430
SECP256K1_API const secp256k1_context * secp256k1_context_static
A built-in constant secp256k1 context object with static storage duration, to be used in conjunction ...
Definition: secp256k1.h:236
Opaque data structured that holds a parsed ECDSA signature.
Definition: secp256k1.h:87
Opaque data structure that holds a parsed and valid public key.
Definition: secp256k1.h:74
assert(!tx.IsCoinBase())