frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

ecdsa: VERIFY_CHECK result of _fe_set_b32_limit

Browse Source 
This also avoids a spurious "-Wmaybe-uninitialized" warning emitted by
gcc 16 (snapshot) when compiling with -DDETERMINISTIC.
This commit is contained in:
Tim Ruffing
2026-03-23 16:52:56 +01:00
parent ffc25a2731
commit 43fca0ff55
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/ecdsa_impl.h
View File

@@ -196,6 +196,7 @@ static int secp256k1_ecdsa_sig_verify(const secp256k1_scalar *sigr, const secp25
unsigned char c[32]; unsigned char c[32];
secp256k1_scalar sn, u1, u2; secp256k1_scalar sn, u1, u2;
#if !defined(EXHAUSTIVE_TEST_ORDER) #if !defined(EXHAUSTIVE_TEST_ORDER)
int range;
secp256k1_fe xr; secp256k1_fe xr;
#endif #endif
secp256k1_gej pubkeyj; secp256k1_gej pubkeyj;
@@ -226,9 +227,16 @@ static int secp256k1_ecdsa_sig_verify(const secp256k1_scalar *sigr, const secp25
return secp256k1_scalar_eq(sigr, &computed_r); return secp256k1_scalar_eq(sigr, &computed_r);
} }
#else #else
/* Interpret sigr as a field element xr */
secp256k1_scalar_get_b32(c, sigr); secp256k1_scalar_get_b32(c, sigr);
/* we can ignore the fe_set_b32_limit return value, because we know the input is in range */ range = secp256k1_fe_set_b32_limit(&xr, c);
(void)secp256k1_fe_set_b32_limit(&xr, c); #ifdef VERIFY
/* We know that c is in range; it comes from a scalar. */
VERIFY_CHECK(range);
#else
(void)range;
#endif
/** We now have the recomputed R point in pr, and its claimed x coordinate (modulo n) /** We now have the recomputed R point in pr, and its claimed x coordinate (modulo n)
* in xr. Naively, we would extract the x coordinate from pr (requiring a inversion modulo p), * in xr. Naively, we would extract the x coordinate from pr (requiring a inversion modulo p),