From a4af91d5b9b31b802683ee8432859afd0b52827e Mon Sep 17 00:00:00 2001 From: Tim Ruffing Date: Thu, 5 Mar 2026 09:16:36 +0100 Subject: [PATCH 1/6] ecdsa_adaptor: Add test case for R1==infinity in DLEQ proof --- src/modules/ecdsa_adaptor/tests_impl.h | 57 ++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/src/modules/ecdsa_adaptor/tests_impl.h b/src/modules/ecdsa_adaptor/tests_impl.h index 3abc8127..c9bf0dac 100644 --- a/src/modules/ecdsa_adaptor/tests_impl.h +++ b/src/modules/ecdsa_adaptor/tests_impl.h @@ -1114,6 +1114,62 @@ static void multi_hop_lock_tests_internal(void) { CHECK(secp256k1_memcmp_var(buf, pop, 32) == 0); } +static void adaptor_test_issue335(void) { + /* Inputs that will trigger R1==infinity in secp256k1_dleq_verify. */ + unsigned char adaptor_sig[162] = { + 0x03, 0x63, 0x3D, 0x56, 0xAB, 0xEE, 0x6F, 0x36, 0xE6, 0x07, 0xC6, 0x04, + 0x2C, 0x68, 0xB4, 0x09, 0xBE, 0x4F, 0x3D, 0x56, 0x3A, 0x51, 0x7B, 0xCA, + 0x95, 0xE6, 0xD9, 0x48, 0x1E, 0x95, 0xD0, 0xD6, 0xC6, 0x03, 0x91, 0x66, + 0xC2, 0x89, 0xB9, 0xF9, 0x05, 0xE5, 0x5F, 0x9E, 0x3D, 0xF9, 0xF6, 0x9D, + 0x7F, 0x35, 0x6B, 0x4A, 0x22, 0x09, 0x5F, 0x89, 0x4F, 0x47, 0x15, 0x71, + 0x4A, 0xA4, 0xB5, 0x66, 0x06, 0xAF, 0x84, 0x40, 0xB2, 0x83, 0x34, 0xF6, + 0x74, 0x18, 0xD8, 0x3D, 0x5C, 0xDC, 0x14, 0x0A, 0xAB, 0x22, 0x2B, 0x19, + 0x15, 0x13, 0xC3, 0x5D, 0x9C, 0xBC, 0x6D, 0x89, 0x1C, 0xB5, 0x38, 0x74, + 0xB0, 0xCE, 0x5F, 0x34, 0xD7, 0xA0, 0xA9, 0x89, 0x7A, 0x19, 0x45, 0x77, + 0xBD, 0x5F, 0x0F, 0x31, 0xD8, 0x3B, 0x50, 0xC6, 0x2A, 0x4D, 0xCF, 0x4D, + 0xCB, 0x91, 0x71, 0x8C, 0x66, 0xAE, 0xB8, 0xE2, 0x1A, 0x01, 0x65, 0x05, + 0x2D, 0x93, 0x73, 0x97, 0xB7, 0x66, 0xC4, 0xEB, 0x23, 0x8D, 0x3B, 0x55, + 0xA2, 0x3D, 0xF8, 0x8E, 0x56, 0x84, 0x87, 0x10, 0x76, 0x18, 0xC2, 0xE8, + 0x35, 0xF9, 0x4E, 0x2A, 0x29, 0xB2 + }; + unsigned char msg[32] = { + 0x38, 0x9C, 0x43, 0x7B, 0x37, 0xBB, 0x6F, 0x74, 0x09, 0x3D, 0x69, + 0x3E, 0x3D, 0x9B, 0x4F, 0xC7, 0x9D, 0xDF, 0xA9, 0x33, 0x39, 0x8C, + 0x90, 0x03, 0x95, 0x2D, 0x67, 0xCD, 0xD9, 0x99, 0xDC, 0x55 + }; + unsigned char deckey[32] = { + 0x4A, 0x0B, 0x45, 0xA7, 0x4F, 0xBF, 0x49, 0xC3, 0x4B, 0x7C, 0xE0, + 0x8E, 0x34, 0x89, 0xFB, 0xEA, 0xD5, 0x41, 0xA1, 0x2E, 0xBE, 0x13, + 0x3F, 0xD6, 0x8E, 0x24, 0x86, 0x60, 0x1B, 0x19, 0xC1, 0xB5 + }; + unsigned char seckey[32] = { + 0x12, 0xDB, 0x27, 0x33, 0x51, 0x3D, 0xD9, 0xDF, 0x6A, 0x3C, 0x5A, + 0xEC, 0x3C, 0xA9, 0xF5, 0xDA, 0xA7, 0x3E, 0xB4, 0x61, 0xC8, 0xBB, + 0x12, 0xB7, 0xD4, 0xAA, 0xF5, 0x9A, 0xE9, 0xE5, 0x8B, 0xB7 + }; + secp256k1_pubkey pubkey; + secp256k1_pubkey enckey; + + CHECK(secp256k1_ec_pubkey_create(CTX, &pubkey, seckey) == 1); + CHECK(secp256k1_ec_pubkey_create(CTX, &enckey, deckey) == 1); + CHECK(secp256k1_ecdsa_adaptor_verify(CTX, adaptor_sig, &pubkey, msg, &enckey) == 0); + + /* This explains how the inputs were obtained. */ + { + unsigned char adaptor_sig_tmp[sizeof(adaptor_sig)]; + /* Since the same nonce function with different algo arguments is used + * both for the adaptor sig secret nonce and the dleq secret nonce, + * but ecdsa_adaptor_nonce_function_overflowing ignores the algo arg + * (in violation of the documented API contract), the resulting secret + * nonces will be the same. */ + CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig_tmp, seckey, &enckey, msg, ecdsa_adaptor_nonce_function_overflowing, NULL) == 1); + CHECK(secp256k1_ecdsa_adaptor_verify(CTX, adaptor_sig_tmp, &pubkey, msg, &enckey) == 1); + /* Increment the last least significant bit of e. */ + adaptor_sig_tmp[129] = 0x01; + CHECK(secp256k1_memcmp_var(adaptor_sig_tmp, adaptor_sig, sizeof(adaptor_sig)) == 0); + } +} + /* --- Test registry --- */ REPEAT_TEST(dleq_tests) REPEAT_TEST(adaptor_tests) @@ -1126,6 +1182,7 @@ static const struct tf_test_entry tests_ecdsa_adaptor[] = { CASE1(dleq_tests), CASE1(adaptor_tests), CASE1(multi_hop_lock_tests), + CASE1(adaptor_test_issue335), }; #endif /* SECP256K1_MODULE_ECDSA_ADAPTOR_TESTS_H */ From dd8db2ea2b37b4b20e2249b1e47dea271146f0c8 Mon Sep 17 00:00:00 2001 From: Tim Ruffing Date: Thu, 5 Mar 2026 09:34:07 +0100 Subject: [PATCH 2/6] ecdsa_adaptor: Run tests with default and overflowing nonce function --- src/modules/ecdsa_adaptor/tests_impl.h | 39 +++++++++++++++++--------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/src/modules/ecdsa_adaptor/tests_impl.h b/src/modules/ecdsa_adaptor/tests_impl.h index c9bf0dac..6176faec 100644 --- a/src/modules/ecdsa_adaptor/tests_impl.h +++ b/src/modules/ecdsa_adaptor/tests_impl.h @@ -803,6 +803,7 @@ static void test_ecdsa_adaptor_api(void) { unsigned char msg[32]; unsigned char asig[162]; unsigned char deckey[32]; + unsigned char zeros162[162] = { 0 }; /** setup **/ testrand256(sk); @@ -821,6 +822,14 @@ static void test_ecdsa_adaptor_api(void) { CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, NULL, msg, NULL, NULL)); CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &zero_pk, msg, NULL, NULL)); + /* Test bad nonce functions */ + memset(asig, 1, sizeof(asig)); + CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, msg, ecdsa_adaptor_nonce_function_failing, NULL) == 0); + CHECK(secp256k1_memcmp_var(asig, zeros162, sizeof(asig)) == 0); + memset(asig, 1, sizeof(asig)); + CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, msg, ecdsa_adaptor_nonce_function_0, NULL) == 0); + CHECK(secp256k1_memcmp_var(asig, zeros162, sizeof(asig)) == 0); + CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, msg, NULL, NULL) == 1); CHECK(secp256k1_ecdsa_adaptor_verify(CTX, asig, &pubkey, msg, &enckey) == 1); CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_verify(CTX, NULL, &pubkey, msg, &enckey)); @@ -846,7 +855,7 @@ static void test_ecdsa_adaptor_api(void) { CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_recover(CTX, deckey, &sig, asig, &zero_pk)); } -static void adaptor_tests_internal(void) { +static void adaptor_tests_internal_impl(secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void* ndata) { unsigned char seckey[32]; secp256k1_pubkey pubkey; unsigned char msg[32]; @@ -864,23 +873,15 @@ static void adaptor_tests_internal(void) { CHECK(secp256k1_ec_pubkey_create(CTX, &pubkey, seckey) == 1); CHECK(secp256k1_ec_pubkey_create(CTX, &enckey, deckey) == 1); - CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, NULL, NULL) == 1); + CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, noncefp, ndata) == 1); { + unsigned char adaptor_sig_tmp[162] = { 0 }; + /* Test overflowing seckey */ memset(big, 0xFF, 32); - CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, big, &enckey, msg, NULL, NULL) == 0); - CHECK(secp256k1_memcmp_var(adaptor_sig, zeros162, sizeof(adaptor_sig)) == 0); - - /* Test different nonce functions */ - memset(adaptor_sig, 1, sizeof(adaptor_sig)); - CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, ecdsa_adaptor_nonce_function_failing, NULL) == 0); - CHECK(secp256k1_memcmp_var(adaptor_sig, zeros162, sizeof(adaptor_sig)) == 0); - memset(&adaptor_sig, 1, sizeof(adaptor_sig)); - CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, ecdsa_adaptor_nonce_function_0, NULL) == 0); - CHECK(secp256k1_memcmp_var(adaptor_sig, zeros162, sizeof(adaptor_sig)) == 0); - CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig, seckey, &enckey, msg, ecdsa_adaptor_nonce_function_overflowing, NULL) == 1); - CHECK(secp256k1_memcmp_var(adaptor_sig, zeros162, sizeof(adaptor_sig)) != 0); + CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, adaptor_sig_tmp, big, &enckey, msg, NULL, NULL) == 0); + CHECK(secp256k1_memcmp_var(adaptor_sig_tmp, zeros162, sizeof(adaptor_sig)) == 0); } { /* Test adaptor_sig_serialize roundtrip */ @@ -1040,6 +1041,16 @@ static void adaptor_tests_internal(void) { } } +static void adaptor_tests_internal(void) { + adaptor_tests_internal_impl(NULL, NULL); + /* Since the same nonce function with different algo arguments is used + * both for the adaptor sig secret nonce and the dleq secret nonce, + * but ecdsa_adaptor_nonce_function_overflowing ignores the algo arg + * (in violation of the documented API contract), the resulting secret + * nonces will be the same. */ + adaptor_tests_internal_impl(ecdsa_adaptor_nonce_function_overflowing, NULL); +} + static void multi_hop_lock_tests_internal(void) { unsigned char seckey_a[32]; unsigned char seckey_b[32]; From 7f1c5390c2313ca103a6be0dba0e058298dd6022 Mon Sep 17 00:00:00 2001 From: Tim Ruffing Date: Thu, 5 Mar 2026 10:09:45 +0100 Subject: [PATCH 3/6] ecdsa_adaptor: Make files more self-contained --- src/modules/ecdsa_adaptor/dleq_impl.h | 10 ++++++++++ src/modules/ecdsa_adaptor/main_impl.h | 9 +++++++++ 2 files changed, 19 insertions(+) diff --git a/src/modules/ecdsa_adaptor/dleq_impl.h b/src/modules/ecdsa_adaptor/dleq_impl.h index f0f5ea21..a2f1b5ea 100644 --- a/src/modules/ecdsa_adaptor/dleq_impl.h +++ b/src/modules/ecdsa_adaptor/dleq_impl.h @@ -1,6 +1,16 @@ #ifndef SECP256K1_DLEQ_IMPL_H #define SECP256K1_DLEQ_IMPL_H +#include + +#include "../../../include/secp256k1_ecdsa_adaptor.h" + +#include "../../../src/eckey.h" +#include "../../../src/ecmult_const.h" +#include "../../../src/group.h" +#include "../../../src/hash.h" +#include "../../../src/scalar.h" + /* Initializes SHA256 with fixed midstate. This midstate was computed by applying * SHA256 to SHA256("DLEQ")||SHA256("DLEQ"). */ static void secp256k1_nonce_function_dleq_sha256_tagged(secp256k1_sha256 *sha) { diff --git a/src/modules/ecdsa_adaptor/main_impl.h b/src/modules/ecdsa_adaptor/main_impl.h index ea10207f..2fdd301c 100644 --- a/src/modules/ecdsa_adaptor/main_impl.h +++ b/src/modules/ecdsa_adaptor/main_impl.h @@ -7,9 +7,18 @@ #ifndef SECP256K1_MODULE_ECDSA_ADAPTOR_MAIN_H #define SECP256K1_MODULE_ECDSA_ADAPTOR_MAIN_H +#include + #include "../../../include/secp256k1_ecdsa_adaptor.h" #include "dleq_impl.h" +#include "../../../src/eckey.h" +#include "../../../src/ecmult.h" +#include "../../../src/ecmult_const.h" +#include "../../../src/group.h" +#include "../../../src/hash.h" +#include "../../../src/scalar.h" + /* (R, R', s', dleq_proof) */ static void secp256k1_ecdsa_adaptor_sig_serialize(unsigned char *adaptor_sig162, secp256k1_ge *r, secp256k1_ge *rp, const secp256k1_scalar *sp, const secp256k1_scalar *dleq_proof_e, const secp256k1_scalar *dleq_proof_s) { secp256k1_eckey_pubkey_serialize33(r, adaptor_sig162); From 41a8a2a65b5f11835148e904652eacb014fd27e1 Mon Sep 17 00:00:00 2001 From: Tim Ruffing Date: Thu, 5 Mar 2026 10:10:19 +0100 Subject: [PATCH 4/6] ecdsa_adaptor: Clarify identifiers --- src/modules/ecdsa_adaptor/dleq_impl.h | 2 ++ src/modules/ecdsa_adaptor/main_impl.h | 26 +++++++++++++------------- 2 files changed, 15 insertions(+), 13 deletions(-) diff --git a/src/modules/ecdsa_adaptor/dleq_impl.h b/src/modules/ecdsa_adaptor/dleq_impl.h index a2f1b5ea..f183e50a 100644 --- a/src/modules/ecdsa_adaptor/dleq_impl.h +++ b/src/modules/ecdsa_adaptor/dleq_impl.h @@ -90,6 +90,8 @@ static void secp256k1_dleq_pair(const secp256k1_ecmult_gen_context *ecmult_gen_c /* Generates a proof that the discrete logarithm of P1 to the secp256k1 base G is the * same as the discrete logarithm of P2 to the base Y */ static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *s, secp256k1_scalar *e, const secp256k1_scalar *sk, secp256k1_ge *gen2, secp256k1_ge *p1, secp256k1_ge *p2, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) { + /* Note: r[2] and k are local to the DLEQ proof, and they differ from the + * values with the same identifiers in main_impl.h. */ secp256k1_ge r[2]; secp256k1_scalar k = { 0 }; unsigned char sk32[32]; diff --git a/src/modules/ecdsa_adaptor/main_impl.h b/src/modules/ecdsa_adaptor/main_impl.h index 2fdd301c..b18b86cc 100644 --- a/src/modules/ecdsa_adaptor/main_impl.h +++ b/src/modules/ecdsa_adaptor/main_impl.h @@ -139,9 +139,9 @@ const secp256k1_nonce_function_hardened_ecdsa_adaptor secp256k1_nonce_function_e int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char *adaptor_sig162, unsigned char *seckey32, const secp256k1_pubkey *enckey, const unsigned char *msg32, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) { secp256k1_scalar k; - secp256k1_ge nonce_pts[2]; - secp256k1_gej nonce_ptj[2]; - secp256k1_ge enckey_ge; + secp256k1_ge r[2]; /* R, R' */ + secp256k1_gej rj[2]; /* R, R' */ + secp256k1_ge enckey_ge; /* Y */ secp256k1_scalar dleq_proof_s; secp256k1_scalar dleq_proof_e; secp256k1_scalar sk; @@ -177,19 +177,19 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char ret &= !secp256k1_scalar_is_zero(&k); secp256k1_scalar_cmov(&k, &secp256k1_scalar_one, !ret); - /* R' := k*G */ - secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &nonce_ptj[0], &k); /* R := k*Y */ - secp256k1_ecmult_const(&nonce_ptj[1], &enckey_ge, &k); + secp256k1_ecmult_const(&rj[0], &enckey_ge, &k); + /* R' := k*G */ + secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj[1], &k); - secp256k1_ge_set_all_gej(nonce_pts, nonce_ptj, 2); + secp256k1_ge_set_all_gej(r, rj, 2); /* We declassify the non-secret nonce values to allow using them as branch points. */ - secp256k1_declassify(ctx, &nonce_pts[0], sizeof(nonce_pts[0])); - secp256k1_declassify(ctx, &nonce_pts[1], sizeof(nonce_pts[1])); + secp256k1_declassify(ctx, &r[0], sizeof(r[0])); + secp256k1_declassify(ctx, &r[1], sizeof(r[1])); /* dleq_proof = DLEQ_prove(k, (R', Y, R)) */ - if (!secp256k1_dleq_prove(ctx, &dleq_proof_s, &dleq_proof_e, &k, &enckey_ge, &nonce_pts[0], &nonce_pts[1], noncefp, ndata)) { + if (!secp256k1_dleq_prove(ctx, &dleq_proof_s, &dleq_proof_e, &k, &enckey_ge, &r[1], &r[0], noncefp, ndata)) { memset(adaptor_sig162, 0, 162); secp256k1_memclear_explicit(nonce32, sizeof(nonce32)); secp256k1_scalar_clear(&k); @@ -198,8 +198,8 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char ret &= secp256k1_scalar_set_b32_seckey(&sk, seckey32); secp256k1_scalar_cmov(&sk, &secp256k1_scalar_one, !ret); secp256k1_scalar_set_b32(&msg, msg32, NULL); - secp256k1_fe_normalize(&nonce_pts[1].x); - secp256k1_fe_get_b32(buf33, &nonce_pts[1].x); + secp256k1_fe_normalize(&r[0].x); + secp256k1_fe_get_b32(buf33, &r[0].x); secp256k1_scalar_set_b32(&sigr, buf33, NULL); ret &= !secp256k1_scalar_is_zero(&sigr); /* s' = k⁻¹(m + R.x * x) */ @@ -210,7 +210,7 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char ret &= !secp256k1_scalar_is_zero(&sp); /* return (R, R', s', dleq_proof) */ - secp256k1_ecdsa_adaptor_sig_serialize(adaptor_sig162, &nonce_pts[1], &nonce_pts[0], &sp, &dleq_proof_e, &dleq_proof_s); + secp256k1_ecdsa_adaptor_sig_serialize(adaptor_sig162, &r[0], &r[1], &sp, &dleq_proof_e, &dleq_proof_s); secp256k1_memczero(adaptor_sig162, 162, !ret); secp256k1_memclear_explicit(nonce32, sizeof(nonce32)); From a7d0f246d7ce529508b725421dd0178fdb354bd5 Mon Sep 17 00:00:00 2001 From: Tim Ruffing Date: Thu, 5 Mar 2026 10:14:02 +0100 Subject: [PATCH 5/6] ecdsa_adaptor: Simplify code --- src/modules/ecdsa_adaptor/dleq_impl.h | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/src/modules/ecdsa_adaptor/dleq_impl.h b/src/modules/ecdsa_adaptor/dleq_impl.h index f183e50a..cb097958 100644 --- a/src/modules/ecdsa_adaptor/dleq_impl.h +++ b/src/modules/ecdsa_adaptor/dleq_impl.h @@ -26,26 +26,23 @@ static const unsigned char dleq_algo[] = {'D','L','E','Q'}; static void secp256k1_dleq_hash_point(secp256k1_sha256 *sha, secp256k1_ge *p) { unsigned char buf[33]; - size_t size = 33; secp256k1_eckey_pubkey_serialize33(p, buf); - - secp256k1_sha256_write(sha, buf, size); + secp256k1_sha256_write(sha, buf, 33); } static int secp256k1_dleq_nonce(secp256k1_scalar *k, const unsigned char *sk32, const unsigned char *gen2_33, const unsigned char *p1_33, const unsigned char *p2_33, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) { secp256k1_sha256 sha; unsigned char buf[32]; unsigned char nonce[32]; - size_t size = 33; if (noncefp == NULL) { noncefp = secp256k1_nonce_function_ecdsa_adaptor; } secp256k1_sha256_initialize(&sha); - secp256k1_sha256_write(&sha, p1_33, size); - secp256k1_sha256_write(&sha, p2_33, size); + secp256k1_sha256_write(&sha, p1_33, 33); + secp256k1_sha256_write(&sha, p2_33, 33); secp256k1_sha256_finalize(&sha, buf); secp256k1_sha256_clear(&sha); From ed985641f47caaf3836657b5d45e9ca1a7158b7c Mon Sep 17 00:00:00 2001 From: Tim Ruffing Date: Thu, 5 Mar 2026 13:28:23 +0100 Subject: [PATCH 6/6] ecdsa_adaptor: Make arg order in dleq_{prove,verify} consistent --- src/modules/ecdsa_adaptor/dleq_impl.h | 2 +- src/modules/ecdsa_adaptor/main_impl.h | 2 +- src/modules/ecdsa_adaptor/tests_impl.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/modules/ecdsa_adaptor/dleq_impl.h b/src/modules/ecdsa_adaptor/dleq_impl.h index cb097958..a117d69d 100644 --- a/src/modules/ecdsa_adaptor/dleq_impl.h +++ b/src/modules/ecdsa_adaptor/dleq_impl.h @@ -86,7 +86,7 @@ static void secp256k1_dleq_pair(const secp256k1_ecmult_gen_context *ecmult_gen_c /* Generates a proof that the discrete logarithm of P1 to the secp256k1 base G is the * same as the discrete logarithm of P2 to the base Y */ -static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *s, secp256k1_scalar *e, const secp256k1_scalar *sk, secp256k1_ge *gen2, secp256k1_ge *p1, secp256k1_ge *p2, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) { +static int secp256k1_dleq_prove(const secp256k1_context* ctx, secp256k1_scalar *s, secp256k1_scalar *e, const secp256k1_scalar *sk, secp256k1_ge *p1, secp256k1_ge *gen2, secp256k1_ge *p2, secp256k1_nonce_function_hardened_ecdsa_adaptor noncefp, void *ndata) { /* Note: r[2] and k are local to the DLEQ proof, and they differ from the * values with the same identifiers in main_impl.h. */ secp256k1_ge r[2]; diff --git a/src/modules/ecdsa_adaptor/main_impl.h b/src/modules/ecdsa_adaptor/main_impl.h index b18b86cc..0d590907 100644 --- a/src/modules/ecdsa_adaptor/main_impl.h +++ b/src/modules/ecdsa_adaptor/main_impl.h @@ -189,7 +189,7 @@ int secp256k1_ecdsa_adaptor_encrypt(const secp256k1_context* ctx, unsigned char secp256k1_declassify(ctx, &r[1], sizeof(r[1])); /* dleq_proof = DLEQ_prove(k, (R', Y, R)) */ - if (!secp256k1_dleq_prove(ctx, &dleq_proof_s, &dleq_proof_e, &k, &enckey_ge, &r[1], &r[0], noncefp, ndata)) { + if (!secp256k1_dleq_prove(ctx, &dleq_proof_s, &dleq_proof_e, &k, &r[1], &enckey_ge, &r[0], noncefp, ndata)) { memset(adaptor_sig162, 0, 162); secp256k1_memclear_explicit(nonce32, sizeof(nonce32)); secp256k1_scalar_clear(&k); diff --git a/src/modules/ecdsa_adaptor/tests_impl.h b/src/modules/ecdsa_adaptor/tests_impl.h index 6176faec..09058997 100644 --- a/src/modules/ecdsa_adaptor/tests_impl.h +++ b/src/modules/ecdsa_adaptor/tests_impl.h @@ -45,7 +45,7 @@ static void dleq_tests_internal(void) { secp256k1_dleq_pair(&CTX->ecmult_gen_ctx, p, &sk, &gen2); p1 = p[0]; p2 = p[1]; - CHECK(secp256k1_dleq_prove(CTX, &s, &e, &sk, &gen2, &p1, &p2, NULL, NULL) == 1); + CHECK(secp256k1_dleq_prove(CTX, &s, &e, &sk, &p1, &gen2, &p2, NULL, NULL) == 1); CHECK(secp256k1_dleq_verify(&s, &e, &p1, &gen2, &p2) == 1); {