From 41a8a2a65b5f11835148e904652eacb014fd27e1 Mon Sep 17 00:00:00 2001 From: Tim Ruffing Date: Thu, 5 Mar 2026 10:10:19 +0100 Subject: [PATCH] ecdsa_adaptor: Clarify identifiers --- src/modules/ecdsa_adaptor/dleq_impl.h | 2 ++ src/modules/ecdsa_adaptor/main_impl.h | 26 +++++++++++++------------- 2 files changed, 15 insertions(+), 13 deletions(-) diff --git a/src/modules/ecdsa_adaptor/dleq_impl.h b/src/modules/ecdsa_adaptor/dleq_impl.h index a2f1b5ea..f183e50a 100644 --- a/src/modules/ecdsa_adaptor/dleq_impl.h +++ b/src/modules/ecdsa_adaptor/dleq_impl.h @@ -90,6 +90,8 @@ static void secp256k1_dleq_pair(const secp256k1_ecmult_gen_context *ecmult_gen_c /* Generates a proof that the discrete logarithm of P1 to the secp256k1 base G is the * same as the discrete logarithm of P2 to the base Y */ static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *s, secp256k1_scalar *e, const secp256k1_scalar *sk, secp256k1_ge *gen2, secp256k1_ge *p1, secp256k1_ge *p2, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) { + /* Note: r[2] and k are local to the DLEQ proof, and they differ from the + * values with the same identifiers in main_impl.h. */ secp256k1_ge r[2]; secp256k1_scalar k = { 0 }; unsigned char sk32[32]; diff --git a/src/modules/ecdsa_adaptor/main_impl.h b/src/modules/ecdsa_adaptor/main_impl.h index 2fdd301c..b18b86cc 100644 --- a/src/modules/ecdsa_adaptor/main_impl.h +++ b/src/modules/ecdsa_adaptor/main_impl.h @@ -139,9 +139,9 @@ const secp256k1_nonce_function_hardened_ecdsa_adaptor secp256k1_nonce_function_e int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char *adaptor_sig162, unsigned char *seckey32, const secp256k1_pubkey *enckey, const unsigned char *msg32, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) { secp256k1_scalar k; - secp256k1_ge nonce_pts[2]; - secp256k1_gej nonce_ptj[2]; - secp256k1_ge enckey_ge; + secp256k1_ge r[2]; /* R, R' */ + secp256k1_gej rj[2]; /* R, R' */ + secp256k1_ge enckey_ge; /* Y */ secp256k1_scalar dleq_proof_s; secp256k1_scalar dleq_proof_e; secp256k1_scalar sk; @@ -177,19 +177,19 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char ret &= !secp256k1_scalar_is_zero(&k); secp256k1_scalar_cmov(&k, &secp256k1_scalar_one, !ret); - /* R' := k*G */ - secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &nonce_ptj[0], &k); /* R := k*Y */ - secp256k1_ecmult_const(&nonce_ptj[1], &enckey_ge, &k); + secp256k1_ecmult_const(&rj[0], &enckey_ge, &k); + /* R' := k*G */ + secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj[1], &k); - secp256k1_ge_set_all_gej(nonce_pts, nonce_ptj, 2); + secp256k1_ge_set_all_gej(r, rj, 2); /* We declassify the non-secret nonce values to allow using them as branch points. */ - secp256k1_declassify(ctx, &nonce_pts[0], sizeof(nonce_pts[0])); - secp256k1_declassify(ctx, &nonce_pts[1], sizeof(nonce_pts[1])); + secp256k1_declassify(ctx, &r[0], sizeof(r[0])); + secp256k1_declassify(ctx, &r[1], sizeof(r[1])); /* dleq_proof = DLEQ_prove(k, (R', Y, R)) */ - if (!secp256k1_dleq_prove(ctx, &dleq_proof_s, &dleq_proof_e, &k, &enckey_ge, &nonce_pts[0], &nonce_pts[1], noncefp, ndata)) { + if (!secp256k1_dleq_prove(ctx, &dleq_proof_s, &dleq_proof_e, &k, &enckey_ge, &r[1], &r[0], noncefp, ndata)) { memset(adaptor_sig162, 0, 162); secp256k1_memclear_explicit(nonce32, sizeof(nonce32)); secp256k1_scalar_clear(&k); @@ -198,8 +198,8 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char ret &= secp256k1_scalar_set_b32_seckey(&sk, seckey32); secp256k1_scalar_cmov(&sk, &secp256k1_scalar_one, !ret); secp256k1_scalar_set_b32(&msg, msg32, NULL); - secp256k1_fe_normalize(&nonce_pts[1].x); - secp256k1_fe_get_b32(buf33, &nonce_pts[1].x); + secp256k1_fe_normalize(&r[0].x); + secp256k1_fe_get_b32(buf33, &r[0].x); secp256k1_scalar_set_b32(&sigr, buf33, NULL); ret &= !secp256k1_scalar_is_zero(&sigr); /* s' = k⁻¹(m + R.x * x) */ @@ -210,7 +210,7 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char ret &= !secp256k1_scalar_is_zero(&sp); /* return (R, R', s', dleq_proof) */ - secp256k1_ecdsa_adaptor_sig_serialize(adaptor_sig162, &nonce_pts[1], &nonce_pts[0], &sp, &dleq_proof_e, &dleq_proof_s); + secp256k1_ecdsa_adaptor_sig_serialize(adaptor_sig162, &r[0], &r[1], &sp, &dleq_proof_e, &dleq_proof_s); secp256k1_memczero(adaptor_sig162, 162, !ret); secp256k1_memclear_explicit(nonce32, sizeof(nonce32));