bitcoin/bips
1
0
Fork 0
mirror of https://github.com/bitcoin/bips.git synced 2026-02-23 15:38:22 +00:00
Code Issues Releases Wiki Activity

Update test vectors and generation script

Browse Source
This commit is contained in:
Pieter Wuille
2020-08-18 11:28:17 -07:00
parent 8a3db73a84
commit afa13249ed
3 changed files with 63 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
bip-0340/test-vectors.py
View File

@@ -1,6 +1,14 @@
import sys
from reference import *
def is_square(x):
return int(pow(x, (p - 1) // 2, p)) == 1
def has_square_y(P):
"""Determine if P has a square Y coordinate. Used in an earlier draft of BIP340."""
assert not is_infinity(P)
return is_square(P[1])
def vector0():
seckey = bytes_from_int(3)
msg = bytes_from_int(0)
@@ -19,9 +27,16 @@ def vector0():
# we should have at least one test vector where the the point reconstructed
# from the public key has a square and one where it has a non-square Y
# coordinate. In this one Y is non-square.
pubkey_point = lift_x_even_y(pubkey)
pubkey_point = lift_x(pubkey)
assert(not has_square_y(pubkey_point))
# For historical reasons (R tiebreaker was squareness and not evenness)
# we should have at least one test vector where the the point reconstructed
# from the R.x coordinate has a square and one where it has a non-square Y
# coordinate. In this one Y is non-square.
R = lift_x(sig[0:32])
assert(not has_square_y(R))
return (seckey, pubkey, aux_rand, msg, sig, "TRUE", None)
def vector1():
@@ -30,6 +45,11 @@ def vector1():
aux_rand = bytes_from_int(1)
sig = schnorr_sign(msg, seckey, aux_rand)
# The point reconstructed from the R.x coordinate has a square Y coordinate.
R = lift_x(sig[0:32])
assert(has_square_y(R))
return (seckey, pubkey_gen(seckey), aux_rand, msg, sig, "TRUE", None)
def vector2():
@@ -40,13 +60,13 @@ def vector2():
# The point reconstructed from the public key has a square Y coordinate.
pubkey = pubkey_gen(seckey)
pubkey_point = lift_x_even_y(pubkey)
pubkey_point = lift_x(pubkey)
assert(has_square_y(pubkey_point))
# This signature vector would not verify if the implementer checked the
# squareness of the X coordinate of R instead of the Y coordinate.
R = lift_x_square_y(sig[0:32])
assert(not is_square(R[0]))
# evenness of the X coordinate of R instead of the Y coordinate.
R = lift_x(sig[0:32])
assert(R[0] % 2 == 1)
return (seckey, pubkey, aux_rand, msg, sig, "TRUE", None)
@@ -66,7 +86,7 @@ def vector3():
# Signs with a given nonce. This can be INSECURE and is only INTENDED FOR
# GENERATING TEST VECTORS. Results in an invalid signature if y(kG) is not
# square.
# even.
def insecure_schnorr_sign_fixed_nonce(msg, seckey0, k):
if len(msg) != 32:
raise ValueError('The message must be a 32-byte array.')
@@ -76,12 +96,12 @@ def insecure_schnorr_sign_fixed_nonce(msg, seckey0, k):
P = point_mul(G, seckey0)
seckey = seckey0 if has_even_y(P) else n - seckey0
R = point_mul(G, k)
e = int_from_bytes(tagged_hash("BIP340/challenge", bytes_from_point(R) + bytes_from_point(P) + msg)) % n
e = int_from_bytes(tagged_hash("BIP0340/challenge", bytes_from_point(R) + bytes_from_point(P) + msg)) % n
return bytes_from_point(R) + bytes_from_int((k + e * seckey) % n)
# Creates a singature with a small x(R) by using k = 1/2
# Creates a singature with a small x(R) by using k = -1/2
def vector4():
one_half = 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0
one_half = n - 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0
seckey = bytes_from_int(0x763758E5CBEEDEE4F7D3FC86F531C36578933228998226672F13C4F0EBE855EB)
msg = bytes_from_int(0x4DF3C3F68FCC83B27E9D42C90431A72499F17875C81A599B566C9889B9696703)
sig = insecure_schnorr_sign_fixed_nonce(msg, seckey, one_half)
@@ -100,21 +120,21 @@ def vector5():
sig = schnorr_sign(msg, seckey, default_aux_rand)
pubkey = bytes_from_int(0xEEFDEA4CDB677750A420FEE807EACF21EB9898AE79B9768766E4FAA04A2D4A34)
assert(lift_x_even_y(pubkey) is None)
assert(lift_x(pubkey) is None)
return (None, pubkey, None, msg, sig, "FALSE", "public key not on the curve")
def vector6():
seckey = default_seckey
msg = default_msg
k = 3
k = 6
sig = insecure_schnorr_sign_fixed_nonce(msg, seckey, k)
# Y coordinate of R is not a square
# Y coordinate of R is not even
R = point_mul(G, k)
assert(not has_square_y(R))
assert(not has_even_y(R))
return (None, pubkey_gen(seckey), None, msg, sig, "FALSE", "has_square_y(R) is false")
return (None, pubkey_gen(seckey), None, msg, sig, "FALSE", "has_even_y(R) is false")
def vector7():
seckey = default_seckey
@@ -147,7 +167,7 @@ def vector9():
sig = insecure_schnorr_sign_fixed_nonce(msg, seckey, k)
bytes_from_point.__code__ = bytes_from_point_tmp
return (None, pubkey_gen(seckey), None, msg, sig, "FALSE", "sG - eP is infinite. Test fails in single verification if has_square_y(inf) is defined as true and x(inf) as 0")
return (None, pubkey_gen(seckey), None, msg, sig, "FALSE", "sG - eP is infinite. Test fails in single verification if has_even_y(inf) is defined as true and x(inf) as 0")
def bytes_from_point_inf1(P):
if P == None:
@@ -166,7 +186,7 @@ def vector10():
sig = insecure_schnorr_sign_fixed_nonce(msg, seckey, k)
bytes_from_point.__code__ = bytes_from_point_tmp
return (None, pubkey_gen(seckey), None, msg, sig, "FALSE", "sG - eP is infinite. Test fails in single verification if has_square_y(inf) is defined as true and x(inf) as 1")
return (None, pubkey_gen(seckey), None, msg, sig, "FALSE", "sG - eP is infinite. Test fails in single verification if has_even_y(inf) is defined as true and x(inf) as 1")
# It's cryptographically impossible to create a test vector that fails if run
# in an implementation which merely misses the check that sig[0:32] is an X
@@ -178,7 +198,7 @@ def vector11():
# Replace R's X coordinate with an X coordinate that's not on the curve
x_not_on_curve = bytes_from_int(0x4A298DACAE57395A15D0795DDBFD1DCB564DA82B0F269BC70A74F8220429BA1D)
assert(lift_x_square_y(x_not_on_curve) is None)
assert(lift_x(x_not_on_curve) is None)
sig = x_not_on_curve + sig[32:64]
return (None, pubkey_gen(seckey), None, msg, sig, "FALSE", "sig[0:32] is not an X coordinate on the curve")
@@ -222,10 +242,10 @@ def vector14():
sig = schnorr_sign(msg, seckey, default_aux_rand)
pubkey_int = p + 1
pubkey = bytes_from_int(pubkey_int)
assert(lift_x_even_y(pubkey) is None)
assert(lift_x(pubkey) is None)
# If an implementation would reduce a given public key modulo p then the
# pubkey would be valid
assert(lift_x_even_y(bytes_from_int(pubkey_int % p)) is not None)
assert(lift_x(bytes_from_int(pubkey_int % p)) is not None)
return (None, pubkey, None, msg, sig, "FALSE", "public key is not a valid X coordinate because it exceeds the field size")