Bitcoin Core  22.99.0
P2P Digital Currency
main_impl.h
Go to the documentation of this file.
1 /***********************************************************************
2  * Copyright (c) 2018-2020 Andrew Poelstra, Jonas Nick *
3  * Distributed under the MIT software license, see the accompanying *
4  * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
5  ***********************************************************************/
6 
7 #ifndef SECP256K1_MODULE_SCHNORRSIG_MAIN_H
8 #define SECP256K1_MODULE_SCHNORRSIG_MAIN_H
9 
10 #include "../../../include/secp256k1.h"
11 #include "../../../include/secp256k1_schnorrsig.h"
12 #include "../../hash.h"
13 
14 /* Initializes SHA256 with fixed midstate. This midstate was computed by applying
15  * SHA256 to SHA256("BIP0340/nonce")||SHA256("BIP0340/nonce"). */
18  sha->s[0] = 0x46615b35ul;
19  sha->s[1] = 0xf4bfbff7ul;
20  sha->s[2] = 0x9f8dc671ul;
21  sha->s[3] = 0x83627ab3ul;
22  sha->s[4] = 0x60217180ul;
23  sha->s[5] = 0x57358661ul;
24  sha->s[6] = 0x21a29e54ul;
25  sha->s[7] = 0x68b07b4cul;
26 
27  sha->bytes = 64;
28 }
29 
30 /* Initializes SHA256 with fixed midstate. This midstate was computed by applying
31  * SHA256 to SHA256("BIP0340/aux")||SHA256("BIP0340/aux"). */
34  sha->s[0] = 0x24dd3219ul;
35  sha->s[1] = 0x4eba7e70ul;
36  sha->s[2] = 0xca0fabb9ul;
37  sha->s[3] = 0x0fa3166dul;
38  sha->s[4] = 0x3afbe4b1ul;
39  sha->s[5] = 0x4c44df97ul;
40  sha->s[6] = 0x4aac2739ul;
41  sha->s[7] = 0x249e850aul;
42 
43  sha->bytes = 64;
44 }
45 
46 /* algo argument for nonce_function_bip340 to derive the nonce exactly as stated in BIP-340
47  * by using the correct tagged hash function. */
48 static const unsigned char bip340_algo[13] = "BIP0340/nonce";
49 
51 
52 static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) {
53  secp256k1_sha256 sha;
54  unsigned char masked_key[32];
55  int i;
56 
57  if (algo == NULL) {
58  return 0;
59  }
60 
61  if (data != NULL) {
63  secp256k1_sha256_write(&sha, data, 32);
64  secp256k1_sha256_finalize(&sha, masked_key);
65  for (i = 0; i < 32; i++) {
66  masked_key[i] ^= key32[i];
67  }
68  } else {
69  /* Precomputed TaggedHash("BIP0340/aux", 0x0000...00); */
70  static const unsigned char ZERO_MASK[32] = {
71  84, 241, 105, 207, 201, 226, 229, 114,
72  116, 128, 68, 31, 144, 186, 37, 196,
73  136, 244, 97, 199, 11, 94, 165, 220,
74  170, 247, 175, 105, 39, 10, 165, 20
75  };
76  for (i = 0; i < 32; i++) {
77  masked_key[i] = key32[i] ^ ZERO_MASK[i];
78  }
79  }
80 
81  /* Tag the hash with algo which is important to avoid nonce reuse across
82  * algorithms. If this nonce function is used in BIP-340 signing as defined
83  * in the spec, an optimized tagging implementation is used. */
84  if (algolen == sizeof(bip340_algo)
85  && secp256k1_memcmp_var(algo, bip340_algo, algolen) == 0) {
87  } else {
88  secp256k1_sha256_initialize_tagged(&sha, algo, algolen);
89  }
90 
91  /* Hash masked-key||pk||msg using the tagged hash as per the spec */
92  secp256k1_sha256_write(&sha, masked_key, 32);
93  secp256k1_sha256_write(&sha, xonly_pk32, 32);
94  secp256k1_sha256_write(&sha, msg, msglen);
95  secp256k1_sha256_finalize(&sha, nonce32);
96  return 1;
97 }
98 
100 
101 /* Initializes SHA256 with fixed midstate. This midstate was computed by applying
102  * SHA256 to SHA256("BIP0340/challenge")||SHA256("BIP0340/challenge"). */
105  sha->s[0] = 0x9cecba11ul;
106  sha->s[1] = 0x23925381ul;
107  sha->s[2] = 0x11679112ul;
108  sha->s[3] = 0xd1627e0ful;
109  sha->s[4] = 0x97c87550ul;
110  sha->s[5] = 0x003cc765ul;
111  sha->s[6] = 0x90f61164ul;
112  sha->s[7] = 0x33e9b66aul;
113  sha->bytes = 64;
114 }
115 
116 static void secp256k1_schnorrsig_challenge(secp256k1_scalar* e, const unsigned char *r32, const unsigned char *msg, size_t msglen, const unsigned char *pubkey32)
117 {
118  unsigned char buf[32];
119  secp256k1_sha256 sha;
120 
121  /* tagged hash(r.x, pk.x, msg) */
123  secp256k1_sha256_write(&sha, r32, 32);
124  secp256k1_sha256_write(&sha, pubkey32, 32);
125  secp256k1_sha256_write(&sha, msg, msglen);
126  secp256k1_sha256_finalize(&sha, buf);
127  /* Set scalar e to the challenge hash modulo the curve order as per
128  * BIP340. */
129  secp256k1_scalar_set_b32(e, buf, NULL);
130 }
131 
132 static int secp256k1_schnorrsig_sign_internal(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_keypair *keypair, secp256k1_nonce_function_hardened noncefp, void *ndata) {
133  secp256k1_scalar sk;
136  secp256k1_gej rj;
137  secp256k1_ge pk;
138  secp256k1_ge r;
139  unsigned char buf[32] = { 0 };
140  unsigned char pk_buf[32];
141  unsigned char seckey[32];
142  int ret = 1;
143 
144  VERIFY_CHECK(ctx != NULL);
146  ARG_CHECK(sig64 != NULL);
147  ARG_CHECK(msg != NULL || msglen == 0);
148  ARG_CHECK(keypair != NULL);
149 
150  if (noncefp == NULL) {
152  }
153 
154  ret &= secp256k1_keypair_load(ctx, &sk, &pk, keypair);
155  /* Because we are signing for a x-only pubkey, the secret key is negated
156  * before signing if the point corresponding to the secret key does not
157  * have an even Y. */
158  if (secp256k1_fe_is_odd(&pk.y)) {
159  secp256k1_scalar_negate(&sk, &sk);
160  }
161 
162  secp256k1_scalar_get_b32(seckey, &sk);
163  secp256k1_fe_get_b32(pk_buf, &pk.x);
164  ret &= !!noncefp(buf, msg, msglen, seckey, pk_buf, bip340_algo, sizeof(bip340_algo), ndata);
165  secp256k1_scalar_set_b32(&k, buf, NULL);
166  ret &= !secp256k1_scalar_is_zero(&k);
168 
170  secp256k1_ge_set_gej(&r, &rj);
171 
172  /* We declassify r to allow using it as a branch point. This is fine
173  * because r is not a secret. */
174  secp256k1_declassify(ctx, &r, sizeof(r));
176  if (secp256k1_fe_is_odd(&r.y)) {
178  }
180  secp256k1_fe_get_b32(&sig64[0], &r.x);
181 
182  secp256k1_schnorrsig_challenge(&e, &sig64[0], msg, msglen, pk_buf);
183  secp256k1_scalar_mul(&e, &e, &sk);
184  secp256k1_scalar_add(&e, &e, &k);
185  secp256k1_scalar_get_b32(&sig64[32], &e);
186 
187  secp256k1_memczero(sig64, 64, !ret);
190  memset(seckey, 0, sizeof(seckey));
191 
192  return ret;
193 }
194 
195 int secp256k1_schnorrsig_sign(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *aux_rand32) {
196  /* We cast away const from the passed aux_rand32 argument since we know the default nonce function does not modify it. */
197  return secp256k1_schnorrsig_sign_internal(ctx, sig64, msg32, 32, keypair, secp256k1_nonce_function_bip340, (unsigned char*)aux_rand32);
198 }
199 
200 int secp256k1_schnorrsig_sign_custom(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_keypair *keypair, secp256k1_schnorrsig_extraparams *extraparams) {
201  secp256k1_nonce_function_hardened noncefp = NULL;
202  void *ndata = NULL;
203  VERIFY_CHECK(ctx != NULL);
204 
205  if (extraparams != NULL) {
206  ARG_CHECK(secp256k1_memcmp_var(extraparams->magic,
208  sizeof(extraparams->magic)) == 0);
209  noncefp = extraparams->noncefp;
210  ndata = extraparams->ndata;
211  }
212  return secp256k1_schnorrsig_sign_internal(ctx, sig64, msg, msglen, keypair, noncefp, ndata);
213 }
214 
215 int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_xonly_pubkey *pubkey) {
218  secp256k1_gej rj;
219  secp256k1_ge pk;
220  secp256k1_gej pkj;
221  secp256k1_fe rx;
222  secp256k1_ge r;
223  unsigned char buf[32];
224  int overflow;
225 
226  VERIFY_CHECK(ctx != NULL);
227  ARG_CHECK(sig64 != NULL);
228  ARG_CHECK(msg != NULL || msglen == 0);
229  ARG_CHECK(pubkey != NULL);
230 
231  if (!secp256k1_fe_set_b32(&rx, &sig64[0])) {
232  return 0;
233  }
234 
235  secp256k1_scalar_set_b32(&s, &sig64[32], &overflow);
236  if (overflow) {
237  return 0;
238  }
239 
240  if (!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) {
241  return 0;
242  }
243 
244  /* Compute e. */
245  secp256k1_fe_get_b32(buf, &pk.x);
246  secp256k1_schnorrsig_challenge(&e, &sig64[0], msg, msglen, buf);
247 
248  /* Compute rj = s*G + (-e)*pkj */
249  secp256k1_scalar_negate(&e, &e);
250  secp256k1_gej_set_ge(&pkj, &pk);
251  secp256k1_ecmult(&rj, &pkj, &e, &s);
252 
253  secp256k1_ge_set_gej_var(&r, &rj);
254  if (secp256k1_ge_is_infinity(&r)) {
255  return 0;
256  }
257 
259  return !secp256k1_fe_is_odd(&r.y) &&
260  secp256k1_fe_equal_var(&rx, &r.x);
261 }
262 
263 #endif
secp256k1_sha256::s
uint32_t s[8]
Definition: hash.h:18
secp256k1_scalar_negate
static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a)
Compute the complement of a scalar (modulo the group order).
secp256k1_keypair_load
static int secp256k1_keypair_load(const secp256k1_context *ctx, secp256k1_scalar *sk, secp256k1_ge *pk, const secp256k1_keypair *keypair)
Definition: main_impl.h:175
VERIFY_CHECK
#define VERIFY_CHECK(cond)
Definition: util.h:95
secp256k1_schnorrsig_extraparams::ndata
void * ndata
Definition: secp256k1_schnorrsig.h:85
secp256k1_schnorrsig_sign_internal
static int secp256k1_schnorrsig_sign_internal(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_keypair *keypair, secp256k1_nonce_function_hardened noncefp, void *ndata)
Definition: main_impl.h:132
secp256k1_ge::y
secp256k1_fe y
Definition: group.h:19
secp256k1_scalar_get_b32
static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar *a)
Convert a scalar to a byte array.
secp256k1_context_struct
Definition: secp256k1.c:47
secp256k1_declassify
static SECP256K1_INLINE void secp256k1_declassify(const secp256k1_context *ctx, const void *p, size_t len)
Definition: secp256k1.c:185
secp256k1_fe_normalize_var
static void secp256k1_fe_normalize_var(secp256k1_fe *r)
Normalize a field element, without constant-time guarantee.
secp256k1_fe_set_b32
static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a)
Set a field element equal to 32-byte big endian value.
secp256k1_memcmp_var
static SECP256K1_INLINE int secp256k1_memcmp_var(const void *s1, const void *s2, size_t n)
Semantics like memcmp.
Definition: util.h:221
ARG_CHECK
#define ARG_CHECK(cond)
Definition: secp256k1.c:34
secp256k1_sha256
Definition: hash.h:13
secp256k1_scalar_cmov
static void secp256k1_scalar_cmov(secp256k1_scalar *r, const secp256k1_scalar *a, int flag)
If flag is true, set *r equal to *a; otherwise leave it.
secp256k1_ecmult
static void secp256k1_ecmult(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng)
Double multiply: R = na*A + ng*G.
secp256k1_scalar_add
static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b)
Add two scalars together (modulo the group order).
secp256k1_keypair
Opaque data structure that holds a keypair consisting of a secret and a public key.
Definition: secp256k1_extrakeys.h:33
secp256k1_scalar
A scalar modulo the group order of the secp256k1 curve.
Definition: scalar_4x64.h:13
secp256k1_nonce_function_bip340_sha256_tagged
static void secp256k1_nonce_function_bip340_sha256_tagged(secp256k1_sha256 *sha)
Definition: main_impl.h:16
secp256k1_ecmult_gen
static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context *ctx, secp256k1_gej *r, const secp256k1_scalar *a)
Multiply with the generator: R = a*G.
nonce_function_bip340
static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data)
Definition: main_impl.h:52
secp256k1_gej
A group element of the secp256k1 curve, in jacobian coordinates.
Definition: group.h:23
secp256k1_fe_equal_var
static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b)
Same as secp256k1_fe_equal, but may be variable time.
secp256k1_fe_is_odd
static int secp256k1_fe_is_odd(const secp256k1_fe *a)
Check the "oddness" of a field element.
secp256k1_ecmult_gen_context_is_built
static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context *ctx)
Definition: ecmult_gen_impl.h:22
secp256k1_sha256_write
static void secp256k1_sha256_write(secp256k1_sha256 *hash, const unsigned char *data, size_t size)
schnorrsig_extraparams_magic
static const unsigned char schnorrsig_extraparams_magic[4]
Definition: main_impl.h:50
secp256k1_nonce_function_bip340
const secp256k1_nonce_function_hardened secp256k1_nonce_function_bip340
An implementation of the nonce generation function as defined in Bitcoin Improvement Proposal 340 "Sc...
Definition: main_impl.h:99
secp256k1_fe
Definition: field_10x26.h:12
secp256k1_context_struct::ecmult_gen_ctx
secp256k1_ecmult_gen_context ecmult_gen_ctx
Definition: secp256k1.c:48
secp256k1_sha256_finalize
static void secp256k1_sha256_finalize(secp256k1_sha256 *hash, unsigned char *out32)
secp256k1_schnorrsig_sign_custom
int secp256k1_schnorrsig_sign_custom(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_keypair *keypair, secp256k1_schnorrsig_extraparams *extraparams)
Create a Schnorr signature with a more flexible API.
Definition: main_impl.h:200
secp256k1_xonly_pubkey_load
static SECP256K1_INLINE int secp256k1_xonly_pubkey_load(const secp256k1_context *ctx, secp256k1_ge *ge, const secp256k1_xonly_pubkey *pubkey)
Definition: main_impl.h:13
secp256k1_schnorrsig_sha256_tagged
static void secp256k1_schnorrsig_sha256_tagged(secp256k1_sha256 *sha)
Definition: main_impl.h:103
secp256k1_fe_get_b32
static void secp256k1_fe_get_b32(unsigned char *r, const secp256k1_fe *a)
Convert a field element to a 32-byte big endian value.
secp256k1_sha256_initialize
static void secp256k1_sha256_initialize(secp256k1_sha256 *hash)
secp256k1_schnorrsig_sign
int secp256k1_schnorrsig_sign(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *aux_rand32)
Create a Schnorr signature.
Definition: main_impl.h:195
secp256k1_scalar_one
static const secp256k1_scalar secp256k1_scalar_one
Definition: scalar_impl.h:31
secp256k1_memczero
static SECP256K1_INLINE void secp256k1_memczero(void *s, size_t len, int flag)
Definition: util.h:202
bip340_algo
static const unsigned char bip340_algo[13]
Definition: main_impl.h:48
secp256k1_nonce_function_bip340_sha256_tagged_aux
static void secp256k1_nonce_function_bip340_sha256_tagged_aux(secp256k1_sha256 *sha)
Definition: main_impl.h:32
secp256k1_schnorrsig_challenge
static void secp256k1_schnorrsig_challenge(secp256k1_scalar *e, const unsigned char *r32, const unsigned char *msg, size_t msglen, const unsigned char *pubkey32)
Definition: main_impl.h:116
secp256k1_nonce_function_hardened
int(* secp256k1_nonce_function_hardened)(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data)
This module implements a variant of Schnorr signatures compliant with Bitcoin Improvement Proposal 34...
Definition: secp256k1_schnorrsig.h:41
secp256k1_scalar_clear
static void secp256k1_scalar_clear(secp256k1_scalar *r)
Clear a scalar to prevent the leak of sensitive data.
secp256k1_scalar_is_zero
static int secp256k1_scalar_is_zero(const secp256k1_scalar *a)
Check whether a scalar equals zero.
secp256k1_schnorrsig_extraparams::magic
unsigned char magic[4]
Definition: secp256k1_schnorrsig.h:83
secp256k1_ge_set_gej_var
static void secp256k1_ge_set_gej_var(secp256k1_ge *r, secp256k1_gej *a)
Set a group element equal to another which is given in jacobian coordinates.
secp256k1_schnorrsig_verify
int secp256k1_schnorrsig_verify(const secp256k1_context *ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_xonly_pubkey *pubkey)
Verify a Schnorr signature.
Definition: main_impl.h:215
secp256k1_scalar_mul
static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b)
Multiply two scalars (modulo the group order).
secp256k1_ge::x
secp256k1_fe x
Definition: group.h:18
secp256k1_schnorrsig_extraparams::noncefp
secp256k1_nonce_function_hardened noncefp
Definition: secp256k1_schnorrsig.h:84
secp256k1_ge_is_infinity
static int secp256k1_ge_is_infinity(const secp256k1_ge *a)
Check whether a group element is the point at infinity.
secp256k1_scalar_set_b32
static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *bin, int *overflow)
Set a scalar from a big endian byte array.
secp256k1_sha256_initialize_tagged
static void secp256k1_sha256_initialize_tagged(secp256k1_sha256 *hash, const unsigned char *tag, size_t taglen)
Definition: hash_impl.h:169
secp256k1_ge
A group element of the secp256k1 curve, in affine coordinates.
Definition: group.h:13
ByteUnit::k
@ k
SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC
#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_MAGIC
Definition: secp256k1_schnorrsig.h:88
ctx
static secp256k1_context * ctx
Definition: tests.c:32
secp256k1_ge_set_gej
static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a)
Set a group element equal to another which is given in jacobian coordinates.
secp256k1_xonly_pubkey
Opaque data structure that holds a parsed and valid "x-only" public key.
Definition: secp256k1_extrakeys.h:22
secp256k1_gej_set_ge
static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a)
Set a group element (jacobian) equal to another which is given in affine coordinates.
secp256k1_sha256::bytes
size_t bytes
Definition: hash.h:20
secp256k1_schnorrsig_extraparams
Data structure that contains additional arguments for schnorrsig_sign_custom.
Definition: secp256k1_schnorrsig.h:82