Browse Source
Use ethereum's secp256k1 lib (#3234)
* switch from fork (tendermint/btcd) to orig package (btcsuite/btcd); also
- remove obsolete check in test `size != -1` is always true
- WIP as the serialization still needs to be wrapped
* WIP: wrap signature & privkey, pubkey needs to be wrapped as well
* wrap pubkey too
* use "github.com/ethereum/go-ethereum/crypto/secp256k1" if cgo is
available, else use "github.com/btcsuite/btcd/btcec" and take care of
lower-S when verifying
Annoyingly, had to disable pruning when importing
github.com/ethereum/go-ethereum/ :-/
* update comment
* update comment
* emulate signature_nocgo.go for additional benchmarks:
592bf6a59c/crypto/signature_nocgo.go (L60-L76)
* use our format (r || s) in lower-s form when in the non-cgo case
* remove comment about using the C library directly
* vendor github.com/btcsuite/btcd too
* Add test for the !cgo case
* update changelog pending
Closes #3162 #3163
Refs #1958, #2091, tendermint/btcd#1
pull/3252/head
Ismail Khoffi
6 years ago
committed by
Anton Kaliaev
Anton Kaliaev
9 changed files with 169 additions and 44 deletions
Split View
Diff Options
-
+2 -0CHANGELOG_PENDING.md
-
+12 -12Gopkg.lock
-
+14 -2Gopkg.toml
-
+2 -3crypto/encoding/amino/encode_test.go
-
+4 -26crypto/secp256k1/secp256k1.go
-
+24 -0crypto/secp256k1/secp256k1_cgo.go
-
+71 -0crypto/secp256k1/secp256k1_nocgo.go
-
+39 -0crypto/secp256k1/secp256k1_nocgo_test.go
-
+1 -1crypto/secp256k1/secpk256k1_test.go
+ 2
- 0
CHANGELOG_PENDING.md
View File
+ 12
- 12
Gopkg.lock
View File
+ 14
- 2
Gopkg.toml
View File
+ 2
- 3
crypto/encoding/amino/encode_test.go
View File
+ 4
- 26
crypto/secp256k1/secp256k1.go
View File
+ 24
- 0
crypto/secp256k1/secp256k1_cgo.go
View File
| @ -0,0 +1,24 @@ | |||
| // +build cgo | |||
| package secp256k1 | |||
| import ( | |||
| "github.com/ethereum/go-ethereum/crypto/secp256k1" | |||
| "github.com/tendermint/tendermint/crypto" | |||
| ) | |||
| // Sign creates an ECDSA signature on curve Secp256k1, using SHA256 on the msg. | |||
| func (privKey PrivKeySecp256k1) Sign(msg []byte) ([]byte, error) { | |||
| rsv, err := secp256k1.Sign(crypto.Sha256(msg), privKey[:]) | |||
| if err != nil { | |||
| return nil, err | |||
| } | |||
| // we do not need v in r||s||v: | |||
| rs := rsv[:len(rsv)-1] | |||
| return rs, nil | |||
| } | |||
| func (pubKey PubKeySecp256k1) VerifyBytes(msg []byte, sig []byte) bool { | |||
| return secp256k1.VerifySignature(pubKey[:], crypto.Sha256(msg), sig) | |||
| } | |||
+ 71
- 0
crypto/secp256k1/secp256k1_nocgo.go
View File
| @ -0,0 +1,71 @@ | |||
| // +build !cgo | |||
| package secp256k1 | |||
| import ( | |||
| "math/big" | |||
| secp256k1 "github.com/btcsuite/btcd/btcec" | |||
| "github.com/tendermint/tendermint/crypto" | |||
| ) | |||
| // used to reject malleable signatures | |||
| // see: | |||
| // - https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/signature_nocgo.go#L90-L93 | |||
| // - https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/crypto.go#L39 | |||
| var secp256k1N, _ = new(big.Int).SetString("fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141", 16) | |||
| var secp256k1halfN = new(big.Int).Div(secp256k1N, big.NewInt(2)) | |||
| // Sign creates an ECDSA signature on curve Secp256k1, using SHA256 on the msg. | |||
| // The returned signature will be of the form R || S (in lower-S form). | |||
| func (privKey PrivKeySecp256k1) Sign(msg []byte) ([]byte, error) { | |||
| priv, _ := secp256k1.PrivKeyFromBytes(secp256k1.S256(), privKey[:]) | |||
| sig, err := priv.Sign(crypto.Sha256(msg)) | |||
| if err != nil { | |||
| return nil, err | |||
| } | |||
| sigBytes := serializeSig(sig) | |||
| return sigBytes, nil | |||
| } | |||
| // VerifyBytes verifies a signature of the form R || S. | |||
| // It rejects signatures which are not in lower-S form. | |||
| func (pubKey PubKeySecp256k1) VerifyBytes(msg []byte, sigStr []byte) bool { | |||
| if len(sigStr) != 64 { | |||
| return false | |||
| } | |||
| pub, err := secp256k1.ParsePubKey(pubKey[:], secp256k1.S256()) | |||
| if err != nil { | |||
| return false | |||
| } | |||
| // parse the signature: | |||
| signature := signatureFromBytes(sigStr) | |||
| // Reject malleable signatures. libsecp256k1 does this check but btcec doesn't. | |||
| // see: https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/signature_nocgo.go#L90-L93 | |||
| if signature.S.Cmp(secp256k1halfN) > 0 { | |||
| return false | |||
| } | |||
| return signature.Verify(crypto.Sha256(msg), pub) | |||
| } | |||
| // Read Signature struct from R || S. Caller needs to ensure | |||
| // that len(sigStr) == 64. | |||
| func signatureFromBytes(sigStr []byte) *secp256k1.Signature { | |||
| return &secp256k1.Signature{ | |||
| new(big.Int).SetBytes(sigStr[:32]), | |||
| new(big.Int).SetBytes(sigStr[32:64]), | |||
| } | |||
| } | |||
| // Serialize signature to R || S. | |||
| // R, S are padded to 32 bytes respectively. | |||
| func serializeSig(sig *secp256k1.Signature) []byte { | |||
| rBytes := sig.R.Bytes() | |||
| sBytes := sig.S.Bytes() | |||
| sigBytes := make([]byte, 64) | |||
| // 0 pad the byte arrays from the left if they aren't big enough. | |||
| copy(sigBytes[32-len(rBytes):32], rBytes) | |||
| copy(sigBytes[64-len(sBytes):64], sBytes) | |||
| return sigBytes | |||
| } | |||
+ 39
- 0
crypto/secp256k1/secp256k1_nocgo_test.go
View File
| @ -0,0 +1,39 @@ | |||
| // +build !cgo | |||
| package secp256k1 | |||
| import ( | |||
| "testing" | |||
| secp256k1 "github.com/btcsuite/btcd/btcec" | |||
| "github.com/stretchr/testify/require" | |||
| ) | |||
| // Ensure that signature verification works, and that | |||
| // non-canonical signatures fail. | |||
| // Note: run with CGO_ENABLED=0 or go test -tags !cgo. | |||
| func TestSignatureVerificationAndRejectUpperS(t *testing.T) { | |||
| msg := []byte("We have lingered long enough on the shores of the cosmic ocean.") | |||
| for i := 0; i < 500; i++ { | |||
| priv := GenPrivKey() | |||
| sigStr, err := priv.Sign(msg) | |||
| require.NoError(t, err) | |||
| sig := signatureFromBytes(sigStr) | |||
| require.False(t, sig.S.Cmp(secp256k1halfN) > 0) | |||
| pub := priv.PubKey() | |||
| require.True(t, pub.VerifyBytes(msg, sigStr)) | |||
| // malleate: | |||
| sig.S.Sub(secp256k1.S256().CurveParams.N, sig.S) | |||
| require.True(t, sig.S.Cmp(secp256k1halfN) > 0) | |||
| malSigStr := serializeSig(sig) | |||
| require.False(t, pub.VerifyBytes(msg, malSigStr), | |||
| "VerifyBytes incorrect with malleated & invalid S. sig=%v, key=%v", | |||
| sig, | |||
| priv, | |||
| ) | |||
| } | |||
| } | |||