frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Merge BlockstreamResearch/secp256k1-zkp#340: ecdsa_adaptor: Improve tests and clean up a bit

Browse Source 
ed985641f4 ecdsa_adaptor: Make arg order in dleq_{prove,verify} consistent (Tim Ruffing)
a7d0f246d7 ecdsa_adaptor: Simplify code (Tim Ruffing)
41a8a2a65b ecdsa_adaptor: Clarify identifiers (Tim Ruffing)
7f1c5390c2 ecdsa_adaptor: Make files more self-contained (Tim Ruffing)
dd8db2ea2b ecdsa_adaptor: Run tests with default and overflowing nonce function (Tim Ruffing)
a4af91d5b9 ecdsa_adaptor: Add test case for R1==infinity in DLEQ proof (Tim Ruffing)

Pull request description:

  This module could get some more love, but I don't think it's a priority.

  Closes #335.

ACKs for top commit:
  mllwchrry:
    ACK ed98564

Tree-SHA512: f742e2c9536f711866a1e0c614a780866d72fdd7d721c816eaec16fa7fc67c141577c604b4d76928fb0d1ec9ad5577c2460724d5b3a919b5110490c1c5488f88
This commit is contained in:
merge-script
2026-03-05 14:43:41 +01:00
parent 5a67b63ecd ed985641f4
commit b5b7a6c648
3 changed files with 121 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/modules/ecdsa_adaptor/dleq_impl.h
View File

@@ -1,6 +1,16 @@
#ifndef SECP256K1_DLEQ_IMPL_H
#define SECP256K1_DLEQ_IMPL_H
#include <stdint.h>
#include "../../../include/secp256k1_ecdsa_adaptor.h"
#include "../../../src/eckey.h"
#include "../../../src/ecmult_const.h"
#include "../../../src/group.h"
#include "../../../src/hash.h"
#include "../../../src/scalar.h"
/* Initializes SHA256 with fixed midstate. This midstate was computed by applying
* SHA256 to SHA256("DLEQ")||SHA256("DLEQ"). */
static void secp256k1_nonce_function_dleq_sha256_tagged(secp256k1_sha256 *sha) {
@@ -16,26 +26,23 @@ static const unsigned char dleq_algo[] = {'D','L','E','Q'};
static void secp256k1_dleq_hash_point(secp256k1_sha256 *sha, secp256k1_ge *p) {
unsigned char buf[33];
size_t size = 33;
secp256k1_eckey_pubkey_serialize33(p, buf);
secp256k1_sha256_write(sha, buf, size);
secp256k1_sha256_write(sha, buf, 33);
}
static int secp256k1_dleq_nonce(secp256k1_scalar *k, const unsigned char *sk32, const unsigned char *gen2_33, const unsigned char *p1_33, const unsigned char *p2_33, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) {
secp256k1_sha256 sha;
unsigned char buf[32];
unsigned char nonce[32];
size_t size = 33;
if (noncefp == NULL) {
noncefp = secp256k1_nonce_function_ecdsa_adaptor;
}
secp256k1_sha256_initialize(&sha);
secp256k1_sha256_write(&sha, p1_33, size);
secp256k1_sha256_write(&sha, p2_33, size);
secp256k1_sha256_write(&sha, p1_33, 33);
secp256k1_sha256_write(&sha, p2_33, 33);
secp256k1_sha256_finalize(&sha, buf);
secp256k1_sha256_clear(&sha);
@@ -79,7 +86,9 @@ static void secp256k1_dleq_pair(const secp256k1_ecmult_gen_context *ecmult_gen_c
/* Generates a proof that the discrete logarithm of P1 to the secp256k1 base G is the
* same as the discrete logarithm of P2 to the base Y */
static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *s, secp256k1_scalar *e, const secp256k1_scalar *sk, secp256k1_ge *gen2, secp256k1_ge *p1, secp256k1_ge *p2, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) {
static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *s, secp256k1_scalar *e, const secp256k1_scalar *sk, secp256k1_ge *p1, secp256k1_ge *gen2, secp256k1_ge *p2, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) {
/* Note: r[2] and k are local to the DLEQ proof, and they differ from the
* values with the same identifiers in main_impl.h. */
secp256k1_ge r[2];
secp256k1_scalar k = { 0 };
unsigned char sk32[32];

35
src/modules/ecdsa_adaptor/main_impl.h
View File

@@ -7,9 +7,18 @@
#ifndef SECP256K1_MODULE_ECDSA_ADAPTOR_MAIN_H
#define SECP256K1_MODULE_ECDSA_ADAPTOR_MAIN_H
#include <stdint.h>
#include "../../../include/secp256k1_ecdsa_adaptor.h"
#include "dleq_impl.h"
#include "../../../src/eckey.h"
#include "../../../src/ecmult.h"
#include "../../../src/ecmult_const.h"
#include "../../../src/group.h"
#include "../../../src/hash.h"
#include "../../../src/scalar.h"
/* (R, R', s', dleq_proof) */
static void secp256k1_ecdsa_adaptor_sig_serialize(unsigned char *adaptor_sig162, secp256k1_ge *r, secp256k1_ge *rp, const secp256k1_scalar *sp, const secp256k1_scalar *dleq_proof_e, const secp256k1_scalar *dleq_proof_s) {
secp256k1_eckey_pubkey_serialize33(r, adaptor_sig162);
@@ -130,9 +139,9 @@ const secp256k1_nonce_function_hardened_ecdsa_adaptor secp256k1_nonce_function_e
int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char *adaptor_sig162, unsigned char *seckey32, const secp256k1_pubkey *enckey, const unsigned char *msg32, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) {
secp256k1_scalar k;
secp256k1_ge nonce_pts[2];
secp256k1_gej nonce_ptj[2];
secp256k1_ge enckey_ge;
secp256k1_ge r[2]; /* R, R' */
secp256k1_gej rj[2]; /* R, R' */
secp256k1_ge enckey_ge; /* Y */
secp256k1_scalar dleq_proof_s;
secp256k1_scalar dleq_proof_e;
secp256k1_scalar sk;
@@ -168,19 +177,19 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char
ret &= !secp256k1_scalar_is_zero(&k);
secp256k1_scalar_cmov(&k, &secp256k1_scalar_one, !ret);
/* R' := k*G */
secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &nonce_ptj[0], &k);
/* R := k*Y */
secp256k1_ecmult_const(&nonce_ptj[1], &enckey_ge, &k);
secp256k1_ecmult_const(&rj[0], &enckey_ge, &k);
/* R' := k*G */
secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj[1], &k);
secp256k1_ge_set_all_gej(nonce_pts, nonce_ptj, 2);
secp256k1_ge_set_all_gej(r, rj, 2);
/* We declassify the non-secret nonce values to allow using them as branch points. */
secp256k1_declassify(ctx, &nonce_pts[0], sizeof(nonce_pts[0]));
secp256k1_declassify(ctx, &nonce_pts[1], sizeof(nonce_pts[1]));
secp256k1_declassify(ctx, &r[0], sizeof(r[0]));
secp256k1_declassify(ctx, &r[1], sizeof(r[1]));
/* dleq_proof = DLEQ_prove(k, (R', Y, R)) */
if (!secp256k1_dleq_prove(ctx, &dleq_proof_s, &dleq_proof_e, &k, &enckey_ge, &nonce_pts[0], &nonce_pts[1], noncefp, ndata)) {
if (!secp256k1_dleq_prove(ctx, &dleq_proof_s, &dleq_proof_e, &k, &r[1], &enckey_ge, &r[0], noncefp, ndata)) {
memset(adaptor_sig162, 0, 162);
secp256k1_memclear_explicit(nonce32, sizeof(nonce32));
secp256k1_scalar_clear(&k);
@@ -189,8 +198,8 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char
ret &= secp256k1_scalar_set_b32_seckey(&sk, seckey32);
secp256k1_scalar_cmov(&sk, &secp256k1_scalar_one, !ret);
secp256k1_scalar_set_b32(&msg, msg32, NULL);
secp256k1_fe_normalize(&nonce_pts[1].x);
secp256k1_fe_get_b32(buf33, &nonce_pts[1].x);
secp256k1_fe_normalize(&r[0].x);
secp256k1_fe_get_b32(buf33, &r[0].x);
secp256k1_scalar_set_b32(&sigr, buf33, NULL);
ret &= !secp256k1_scalar_is_zero(&sigr);
/* s' = k⁻¹(m + R.x * x) */
@@ -201,7 +210,7 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char
ret &= !secp256k1_scalar_is_zero(&sp);
/* return (R, R', s', dleq_proof) */
secp256k1_ecdsa_adaptor_sig_serialize(adaptor_sig162, &nonce_pts[1], &nonce_pts[0], &sp, &dleq_proof_e, &dleq_proof_s);
secp256k1_ecdsa_adaptor_sig_serialize(adaptor_sig162, &r[0], &r[1], &sp, &dleq_proof_e, &dleq_proof_s);
secp256k1_memczero(adaptor_sig162, 162, !ret);
secp256k1_memclear_explicit(nonce32, sizeof(nonce32));

98
src/modules/ecdsa_adaptor/tests_impl.h
View File

@@ -45,7 +45,7 @@ static void dleq_tests_internal(void) {
secp256k1_dleq_pair(&CTX->ecmult_gen_ctx, p, &sk, &gen2);
p1 = p[0];
p2 = p[1];
CHECK(secp256k1_dleq_prove(CTX, &s, &e, &sk, &gen2, &p1, &p2, NULL, NULL) == 1);
CHECK(secp256k1_dleq_prove(CTX, &s, &e, &sk, &p1, &gen2, &p2, NULL, NULL) == 1);
CHECK(secp256k1_dleq_verify(&s, &e, &p1, &gen2, &p2) == 1);
{
@@ -803,6 +803,7 @@ static void test_ecdsa_adaptor_api(void) {
unsigned char msg[32];
unsigned char asig[162];
unsigned char deckey[32];
unsigned char zeros162[162] = { 0 };
/** setup **/
testrand256(sk);
@@ -821,6 +822,14 @@ static void test_ecdsa_adaptor_api(void) {
CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, NULL, msg, NULL, NULL));
CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &zero_pk, msg, NULL, NULL));
/* Test bad nonce functions */
memset(asig, 1, sizeof(asig));
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, msg, ecdsa_adaptor_nonce_function_failing, NULL) == 0);
CHECK(secp256k1_memcmp_var(asig, zeros162, sizeof(asig)) == 0);
memset(asig, 1, sizeof(asig));
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, msg, ecdsa_adaptor_nonce_function_0, NULL) == 0);
CHECK(secp256k1_memcmp_var(asig, zeros162, sizeof(asig)) == 0);
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, msg, NULL, NULL) == 1);
CHECK(secp256k1_ecdsa_adaptor_verify(CTX, asig, &pubkey, msg, &enckey) == 1);
CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_verify(CTX, NULL, &pubkey, msg, &enckey));
@@ -846,7 +855,7 @@ static void test_ecdsa_adaptor_api(void) {
CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_recover(CTX, deckey, &sig, asig, &zero_pk));
}
static void adaptor_tests_internal(void) {
static void adaptor_tests_internal_impl(secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void* ndata) {
unsigned char seckey[32];
secp256k1_pubkey pubkey;
unsigned char msg[32];
@@ -864,23 +873,15 @@ static void adaptor_tests_internal(void) {
CHECK(secp256k1_ec_pubkey_create(CTX, &pubkey, seckey) == 1);
CHECK(secp256k1_ec_pubkey_create(CTX, &enckey, deckey) == 1);
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, NULL, NULL) == 1);
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, noncefp, ndata) == 1);
{
unsigned char adaptor_sig_tmp[162] = { 0 };
/* Test overflowing seckey */
memset(big, 0xFF, 32);
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, big, &enckey, msg, NULL, NULL) == 0);
CHECK(secp256k1_memcmp_var(adaptor_sig, zeros162, sizeof(adaptor_sig)) == 0);
/* Test different nonce functions */
memset(adaptor_sig, 1, sizeof(adaptor_sig));
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, ecdsa_adaptor_nonce_function_failing, NULL) == 0);
CHECK(secp256k1_memcmp_var(adaptor_sig, zeros162, sizeof(adaptor_sig)) == 0);
memset(&adaptor_sig, 1, sizeof(adaptor_sig));
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, ecdsa_adaptor_nonce_function_0, NULL) == 0);
CHECK(secp256k1_memcmp_var(adaptor_sig, zeros162, sizeof(adaptor_sig)) == 0);
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, ecdsa_adaptor_nonce_function_overflowing, NULL) == 1);
CHECK(secp256k1_memcmp_var(adaptor_sig, zeros162, sizeof(adaptor_sig)) != 0);
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig_tmp, big, &enckey, msg, NULL, NULL) == 0);
CHECK(secp256k1_memcmp_var(adaptor_sig_tmp, zeros162, sizeof(adaptor_sig)) == 0);
}
{
/* Test adaptor_sig_serialize roundtrip */
@@ -1040,6 +1041,16 @@ static void adaptor_tests_internal(void) {
}
}
static void adaptor_tests_internal(void) {
adaptor_tests_internal_impl(NULL, NULL);
/* Since the same nonce function with different algo arguments is used
* both for the adaptor sig secret nonce and the dleq secret nonce,
* but ecdsa_adaptor_nonce_function_overflowing ignores the algo arg
* (in violation of the documented API contract), the resulting secret
* nonces will be the same. */
adaptor_tests_internal_impl(ecdsa_adaptor_nonce_function_overflowing, NULL);
}
static void multi_hop_lock_tests_internal(void) {
unsigned char seckey_a[32];
unsigned char seckey_b[32];
@@ -1114,6 +1125,62 @@ static void multi_hop_lock_tests_internal(void) {
CHECK(secp256k1_memcmp_var(buf, pop, 32) == 0);
}
static void adaptor_test_issue335(void) {
/* Inputs that will trigger R1==infinity in secp256k1_dleq_verify. */
unsigned char adaptor_sig[162] = {
0x03, 0x63, 0x3D, 0x56, 0xAB, 0xEE, 0x6F, 0x36, 0xE6, 0x07, 0xC6, 0x04,
0x2C, 0x68, 0xB4, 0x09, 0xBE, 0x4F, 0x3D, 0x56, 0x3A, 0x51, 0x7B, 0xCA,
0x95, 0xE6, 0xD9, 0x48, 0x1E, 0x95, 0xD0, 0xD6, 0xC6, 0x03, 0x91, 0x66,
0xC2, 0x89, 0xB9, 0xF9, 0x05, 0xE5, 0x5F, 0x9E, 0x3D, 0xF9, 0xF6, 0x9D,
0x7F, 0x35, 0x6B, 0x4A, 0x22, 0x09, 0x5F, 0x89, 0x4F, 0x47, 0x15, 0x71,
0x4A, 0xA4, 0xB5, 0x66, 0x06, 0xAF, 0x84, 0x40, 0xB2, 0x83, 0x34, 0xF6,
0x74, 0x18, 0xD8, 0x3D, 0x5C, 0xDC, 0x14, 0x0A, 0xAB, 0x22, 0x2B, 0x19,
0x15, 0x13, 0xC3, 0x5D, 0x9C, 0xBC, 0x6D, 0x89, 0x1C, 0xB5, 0x38, 0x74,
0xB0, 0xCE, 0x5F, 0x34, 0xD7, 0xA0, 0xA9, 0x89, 0x7A, 0x19, 0x45, 0x77,
0xBD, 0x5F, 0x0F, 0x31, 0xD8, 0x3B, 0x50, 0xC6, 0x2A, 0x4D, 0xCF, 0x4D,
0xCB, 0x91, 0x71, 0x8C, 0x66, 0xAE, 0xB8, 0xE2, 0x1A, 0x01, 0x65, 0x05,
0x2D, 0x93, 0x73, 0x97, 0xB7, 0x66, 0xC4, 0xEB, 0x23, 0x8D, 0x3B, 0x55,
0xA2, 0x3D, 0xF8, 0x8E, 0x56, 0x84, 0x87, 0x10, 0x76, 0x18, 0xC2, 0xE8,
0x35, 0xF9, 0x4E, 0x2A, 0x29, 0xB2
};
unsigned char msg[32] = {
0x38, 0x9C, 0x43, 0x7B, 0x37, 0xBB, 0x6F, 0x74, 0x09, 0x3D, 0x69,
0x3E, 0x3D, 0x9B, 0x4F, 0xC7, 0x9D, 0xDF, 0xA9, 0x33, 0x39, 0x8C,
0x90, 0x03, 0x95, 0x2D, 0x67, 0xCD, 0xD9, 0x99, 0xDC, 0x55
};
unsigned char deckey[32] = {
0x4A, 0x0B, 0x45, 0xA7, 0x4F, 0xBF, 0x49, 0xC3, 0x4B, 0x7C, 0xE0,
0x8E, 0x34, 0x89, 0xFB, 0xEA, 0xD5, 0x41, 0xA1, 0x2E, 0xBE, 0x13,
0x3F, 0xD6, 0x8E, 0x24, 0x86, 0x60, 0x1B, 0x19, 0xC1, 0xB5
};
unsigned char seckey[32] = {
0x12, 0xDB, 0x27, 0x33, 0x51, 0x3D, 0xD9, 0xDF, 0x6A, 0x3C, 0x5A,
0xEC, 0x3C, 0xA9, 0xF5, 0xDA, 0xA7, 0x3E, 0xB4, 0x61, 0xC8, 0xBB,
0x12, 0xB7, 0xD4, 0xAA, 0xF5, 0x9A, 0xE9, 0xE5, 0x8B, 0xB7
};
secp256k1_pubkey pubkey;
secp256k1_pubkey enckey;
CHECK(secp256k1_ec_pubkey_create(CTX, &pubkey, seckey) == 1);
CHECK(secp256k1_ec_pubkey_create(CTX, &enckey, deckey) == 1);
CHECK(secp256k1_ecdsa_adaptor_verify(CTX, adaptor_sig, &pubkey, msg, &enckey) == 0);
/* This explains how the inputs were obtained. */
{
unsigned char adaptor_sig_tmp[sizeof(adaptor_sig)];
/* Since the same nonce function with different algo arguments is used
* both for the adaptor sig secret nonce and the dleq secret nonce,
* but ecdsa_adaptor_nonce_function_overflowing ignores the algo arg
* (in violation of the documented API contract), the resulting secret
* nonces will be the same. */
CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig_tmp, seckey, &enckey, msg, ecdsa_adaptor_nonce_function_overflowing, NULL) == 1);
CHECK(secp256k1_ecdsa_adaptor_verify(CTX, adaptor_sig_tmp, &pubkey, msg, &enckey) == 1);
/* Increment the last least significant bit of e. */
adaptor_sig_tmp[129] = 0x01;
CHECK(secp256k1_memcmp_var(adaptor_sig_tmp, adaptor_sig, sizeof(adaptor_sig)) == 0);
}
}
/* --- Test registry --- */
REPEAT_TEST(dleq_tests)
REPEAT_TEST(adaptor_tests)
@@ -1126,6 +1193,7 @@ static const struct tf_test_entry tests_ecdsa_adaptor[] = {
CASE1(dleq_tests),
CASE1(adaptor_tests),
CASE1(multi_hop_lock_tests),
CASE1(adaptor_test_issue335),
};
#endif /* SECP256K1_MODULE_ECDSA_ADAPTOR_TESTS_H */