Browse Source
crypto: add in secp256k1 support (#5500)
Secp256k1 was removed in the protobuf migration, this pr adds it back in order to provide this functionality for users (band) Closes: #5495pull/5524/head
Marko
4 years ago
committed by
Marko
Marko
16 changed files with 711 additions and 100 deletions
Split View
Diff Options
-
+1 -0.markdownlintignore
-
+0 -1CHANGELOG.md
-
+51 -54UPGRADING.md
-
+1 -1abci/example/kvstore/persistent_kvstore.go
-
+3 -3crypto/ed25519/ed25519.go
-
+16 -0crypto/encoding/codec.go
-
+173 -0crypto/secp256k1/secp256k1.go
-
+74 -0crypto/secp256k1/secp256k1_internal_test.go
-
+75 -0crypto/secp256k1/secp256k1_nocgo.go
-
+116 -0crypto/secp256k1/secp256k1_test.go
-
+6 -1go.mod
-
+41 -24go.sum
-
+143 -10proto/tendermint/crypto/keys.pb.go
-
+2 -1proto/tendermint/crypto/keys.proto
-
+4 -3types/params_test.go
-
+5 -2types/protobuf.go
+ 1
- 0
.markdownlintignore
View File
| @ -1,5 +1,6 @@ | |||
| docs/node_modules | |||
| CHANGELOG.md | |||
| docs/architecture/* | |||
| crypto/secp256k1/** | |||
| scripts/* | |||
| .github | |||
+ 0
- 1
CHANGELOG.md
View File
+ 51
- 54
UPGRADING.md
View File
+ 1
- 1
abci/example/kvstore/persistent_kvstore.go
View File
+ 3
- 3
crypto/ed25519/ed25519.go
View File
+ 16
- 0
crypto/encoding/codec.go
View File
+ 173
- 0
crypto/secp256k1/secp256k1.go
View File
| @ -0,0 +1,173 @@ | |||
| package secp256k1 | |||
| import ( | |||
| "bytes" | |||
| "crypto/sha256" | |||
| "crypto/subtle" | |||
| "fmt" | |||
| "io" | |||
| "math/big" | |||
| secp256k1 "github.com/btcsuite/btcd/btcec" | |||
| "golang.org/x/crypto/ripemd160" // nolint: staticcheck // necessary for Bitcoin address format | |||
| "github.com/tendermint/tendermint/crypto" | |||
| tmjson "github.com/tendermint/tendermint/libs/json" | |||
| ) | |||
| //------------------------------------- | |||
| const ( | |||
| PrivKeyName = "tendermint/PrivKeySecp256k1" | |||
| PubKeyName = "tendermint/PubKeySecp256k1" | |||
| KeyType = "secp256k1" | |||
| PrivKeySize = 32 | |||
| ) | |||
| func init() { | |||
| tmjson.RegisterType(PubKey{}, PubKeyName) | |||
| tmjson.RegisterType(PrivKey{}, PrivKeyName) | |||
| } | |||
| var _ crypto.PrivKey = PrivKey{} | |||
| // PrivKey implements PrivKey. | |||
| type PrivKey []byte | |||
| // Bytes marshalls the private key using amino encoding. | |||
| func (privKey PrivKey) Bytes() []byte { | |||
| return []byte(privKey) | |||
| } | |||
| // PubKey performs the point-scalar multiplication from the privKey on the | |||
| // generator point to get the pubkey. | |||
| func (privKey PrivKey) PubKey() crypto.PubKey { | |||
| _, pubkeyObject := secp256k1.PrivKeyFromBytes(secp256k1.S256(), privKey) | |||
| pk := pubkeyObject.SerializeCompressed() | |||
| return PubKey(pk) | |||
| } | |||
| // Equals - you probably don't need to use this. | |||
| // Runs in constant time based on length of the keys. | |||
| func (privKey PrivKey) Equals(other crypto.PrivKey) bool { | |||
| if otherSecp, ok := other.(PrivKey); ok { | |||
| return subtle.ConstantTimeCompare(privKey[:], otherSecp[:]) == 1 | |||
| } | |||
| return false | |||
| } | |||
| func (privKey PrivKey) Type() string { | |||
| return KeyType | |||
| } | |||
| // GenPrivKey generates a new ECDSA private key on curve secp256k1 private key. | |||
| // It uses OS randomness to generate the private key. | |||
| func GenPrivKey() PrivKey { | |||
| return genPrivKey(crypto.CReader()) | |||
| } | |||
| // genPrivKey generates a new secp256k1 private key using the provided reader. | |||
| func genPrivKey(rand io.Reader) PrivKey { | |||
| var privKeyBytes [PrivKeySize]byte | |||
| d := new(big.Int) | |||
| for { | |||
| privKeyBytes = [PrivKeySize]byte{} | |||
| _, err := io.ReadFull(rand, privKeyBytes[:]) | |||
| if err != nil { | |||
| panic(err) | |||
| } | |||
| d.SetBytes(privKeyBytes[:]) | |||
| // break if we found a valid point (i.e. > 0 and < N == curverOrder) | |||
| isValidFieldElement := 0 < d.Sign() && d.Cmp(secp256k1.S256().N) < 0 | |||
| if isValidFieldElement { | |||
| break | |||
| } | |||
| } | |||
| return PrivKey(privKeyBytes[:]) | |||
| } | |||
| var one = new(big.Int).SetInt64(1) | |||
| // GenPrivKeySecp256k1 hashes the secret with SHA2, and uses | |||
| // that 32 byte output to create the private key. | |||
| // | |||
| // It makes sure the private key is a valid field element by setting: | |||
| // | |||
| // c = sha256(secret) | |||
| // k = (c mod (n − 1)) + 1, where n = curve order. | |||
| // | |||
| // NOTE: secret should be the output of a KDF like bcrypt, | |||
| // if it's derived from user input. | |||
| func GenPrivKeySecp256k1(secret []byte) PrivKey { | |||
| secHash := sha256.Sum256(secret) | |||
| // to guarantee that we have a valid field element, we use the approach of: | |||
| // "Suite B Implementer’s Guide to FIPS 186-3", A.2.1 | |||
| // https://apps.nsa.gov/iaarchive/library/ia-guidance/ia-solutions-for-classified/algorithm-guidance/suite-b-implementers-guide-to-fips-186-3-ecdsa.cfm | |||
| // see also https://github.com/golang/go/blob/0380c9ad38843d523d9c9804fe300cb7edd7cd3c/src/crypto/ecdsa/ecdsa.go#L89-L101 | |||
| fe := new(big.Int).SetBytes(secHash[:]) | |||
| n := new(big.Int).Sub(secp256k1.S256().N, one) | |||
| fe.Mod(fe, n) | |||
| fe.Add(fe, one) | |||
| feB := fe.Bytes() | |||
| privKey32 := make([]byte, PrivKeySize) | |||
| // copy feB over to fixed 32 byte privKey32 and pad (if necessary) | |||
| copy(privKey32[32-len(feB):32], feB) | |||
| return PrivKey(privKey32) | |||
| } | |||
| //------------------------------------- | |||
| var _ crypto.PubKey = PubKey{} | |||
| // PubKeySize is comprised of 32 bytes for one field element | |||
| // (the x-coordinate), plus one byte for the parity of the y-coordinate. | |||
| const PubKeySize = 33 | |||
| // PubKey implements crypto.PubKey. | |||
| // It is the compressed form of the pubkey. The first byte depends is a 0x02 byte | |||
| // if the y-coordinate is the lexicographically largest of the two associated with | |||
| // the x-coordinate. Otherwise the first byte is a 0x03. | |||
| // This prefix is followed with the x-coordinate. | |||
| type PubKey []byte | |||
| // Address returns a Bitcoin style addresses: RIPEMD160(SHA256(pubkey)) | |||
| func (pubKey PubKey) Address() crypto.Address { | |||
| if len(pubKey) != PubKeySize { | |||
| panic("length of pubkey is incorrect") | |||
| } | |||
| hasherSHA256 := sha256.New() | |||
| _, _ = hasherSHA256.Write(pubKey) // does not error | |||
| sha := hasherSHA256.Sum(nil) | |||
| hasherRIPEMD160 := ripemd160.New() | |||
| _, _ = hasherRIPEMD160.Write(sha) // does not error | |||
| return crypto.Address(hasherRIPEMD160.Sum(nil)) | |||
| } | |||
| // Bytes returns the pubkey marshalled with amino encoding. | |||
| func (pubKey PubKey) Bytes() []byte { | |||
| return []byte(pubKey) | |||
| } | |||
| func (pubKey PubKey) String() string { | |||
| return fmt.Sprintf("PubKeySecp256k1{%X}", pubKey[:]) | |||
| } | |||
| func (pubKey PubKey) Equals(other crypto.PubKey) bool { | |||
| if otherSecp, ok := other.(PubKey); ok { | |||
| return bytes.Equal(pubKey[:], otherSecp[:]) | |||
| } | |||
| return false | |||
| } | |||
| func (pubKey PubKey) Type() string { | |||
| return KeyType | |||
| } | |||
+ 74
- 0
crypto/secp256k1/secp256k1_internal_test.go
View File
| @ -0,0 +1,74 @@ | |||
| package secp256k1 | |||
| import ( | |||
| "bytes" | |||
| "math/big" | |||
| "testing" | |||
| "github.com/stretchr/testify/require" | |||
| secp256k1 "github.com/btcsuite/btcd/btcec" | |||
| ) | |||
| func Test_genPrivKey(t *testing.T) { | |||
| empty := make([]byte, 32) | |||
| oneB := big.NewInt(1).Bytes() | |||
| onePadded := make([]byte, 32) | |||
| copy(onePadded[32-len(oneB):32], oneB) | |||
| t.Logf("one padded: %v, len=%v", onePadded, len(onePadded)) | |||
| validOne := append(empty, onePadded...) | |||
| tests := []struct { | |||
| name string | |||
| notSoRand []byte | |||
| shouldPanic bool | |||
| }{ | |||
| {"empty bytes (panics because 1st 32 bytes are zero and 0 is not a valid field element)", empty, true}, | |||
| {"curve order: N", secp256k1.S256().N.Bytes(), true}, | |||
| {"valid because 0 < 1 < N", validOne, false}, | |||
| } | |||
| for _, tt := range tests { | |||
| tt := tt | |||
| t.Run(tt.name, func(t *testing.T) { | |||
| if tt.shouldPanic { | |||
| require.Panics(t, func() { | |||
| genPrivKey(bytes.NewReader(tt.notSoRand)) | |||
| }) | |||
| return | |||
| } | |||
| got := genPrivKey(bytes.NewReader(tt.notSoRand)) | |||
| fe := new(big.Int).SetBytes(got[:]) | |||
| require.True(t, fe.Cmp(secp256k1.S256().N) < 0) | |||
| require.True(t, fe.Sign() > 0) | |||
| }) | |||
| } | |||
| } | |||
| // Ensure that signature verification works, and that | |||
| // non-canonical signatures fail. | |||
| // Note: run with CGO_ENABLED=0 or go test -tags !cgo. | |||
| func TestSignatureVerificationAndRejectUpperS(t *testing.T) { | |||
| msg := []byte("We have lingered long enough on the shores of the cosmic ocean.") | |||
| for i := 0; i < 500; i++ { | |||
| priv := GenPrivKey() | |||
| sigStr, err := priv.Sign(msg) | |||
| require.NoError(t, err) | |||
| sig := signatureFromBytes(sigStr) | |||
| require.False(t, sig.S.Cmp(secp256k1halfN) > 0) | |||
| pub := priv.PubKey() | |||
| require.True(t, pub.VerifySignature(msg, sigStr)) | |||
| // malleate: | |||
| sig.S.Sub(secp256k1.S256().CurveParams.N, sig.S) | |||
| require.True(t, sig.S.Cmp(secp256k1halfN) > 0) | |||
| malSigStr := serializeSig(sig) | |||
| require.False(t, pub.VerifySignature(msg, malSigStr), | |||
| "VerifyBytes incorrect with malleated & invalid S. sig=%v, key=%v", | |||
| sig, | |||
| priv, | |||
| ) | |||
| } | |||
| } | |||
+ 75
- 0
crypto/secp256k1/secp256k1_nocgo.go
View File
| @ -0,0 +1,75 @@ | |||
| // +build !libsecp256k1 | |||
| package secp256k1 | |||
| import ( | |||
| "math/big" | |||
| secp256k1 "github.com/btcsuite/btcd/btcec" | |||
| "github.com/tendermint/tendermint/crypto" | |||
| ) | |||
| // used to reject malleable signatures | |||
| // see: | |||
| // - https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/signature_nocgo.go#L90-L93 | |||
| // - https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/crypto.go#L39 | |||
| var secp256k1halfN = new(big.Int).Rsh(secp256k1.S256().N, 1) | |||
| // Sign creates an ECDSA signature on curve Secp256k1, using SHA256 on the msg. | |||
| // The returned signature will be of the form R || S (in lower-S form). | |||
| func (privKey PrivKey) Sign(msg []byte) ([]byte, error) { | |||
| priv, _ := secp256k1.PrivKeyFromBytes(secp256k1.S256(), privKey) | |||
| sig, err := priv.Sign(crypto.Sha256(msg)) | |||
| if err != nil { | |||
| return nil, err | |||
| } | |||
| sigBytes := serializeSig(sig) | |||
| return sigBytes, nil | |||
| } | |||
| // VerifySignature verifies a signature of the form R || S. | |||
| // It rejects signatures which are not in lower-S form. | |||
| func (pubKey PubKey) VerifySignature(msg []byte, sigStr []byte) bool { | |||
| if len(sigStr) != 64 { | |||
| return false | |||
| } | |||
| pub, err := secp256k1.ParsePubKey(pubKey, secp256k1.S256()) | |||
| if err != nil { | |||
| return false | |||
| } | |||
| // parse the signature: | |||
| signature := signatureFromBytes(sigStr) | |||
| // Reject malleable signatures. libsecp256k1 does this check but btcec doesn't. | |||
| // see: https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/signature_nocgo.go#L90-L93 | |||
| if signature.S.Cmp(secp256k1halfN) > 0 { | |||
| return false | |||
| } | |||
| return signature.Verify(crypto.Sha256(msg), pub) | |||
| } | |||
| // Read Signature struct from R || S. Caller needs to ensure | |||
| // that len(sigStr) == 64. | |||
| func signatureFromBytes(sigStr []byte) *secp256k1.Signature { | |||
| return &secp256k1.Signature{ | |||
| R: new(big.Int).SetBytes(sigStr[:32]), | |||
| S: new(big.Int).SetBytes(sigStr[32:64]), | |||
| } | |||
| } | |||
| // Serialize signature to R || S. | |||
| // R, S are padded to 32 bytes respectively. | |||
| func serializeSig(sig *secp256k1.Signature) []byte { | |||
| rBytes := sig.R.Bytes() | |||
| sBytes := sig.S.Bytes() | |||
| sigBytes := make([]byte, 64) | |||
| // 0 pad the byte arrays from the left if they aren't big enough. | |||
| copy(sigBytes[32-len(rBytes):32], rBytes) | |||
| copy(sigBytes[64-len(sBytes):64], sBytes) | |||
| return sigBytes | |||
| } | |||
+ 116
- 0
crypto/secp256k1/secp256k1_test.go
View File
| @ -0,0 +1,116 @@ | |||
| package secp256k1_test | |||
| import ( | |||
| "encoding/hex" | |||
| "math/big" | |||
| "testing" | |||
| "github.com/btcsuite/btcutil/base58" | |||
| "github.com/stretchr/testify/assert" | |||
| "github.com/stretchr/testify/require" | |||
| "github.com/tendermint/tendermint/crypto" | |||
| "github.com/tendermint/tendermint/crypto/secp256k1" | |||
| underlyingSecp256k1 "github.com/btcsuite/btcd/btcec" | |||
| ) | |||
| type keyData struct { | |||
| priv string | |||
| pub string | |||
| addr string | |||
| } | |||
| var secpDataTable = []keyData{ | |||
| { | |||
| priv: "a96e62ed3955e65be32703f12d87b6b5cf26039ecfa948dc5107a495418e5330", | |||
| pub: "02950e1cdfcb133d6024109fd489f734eeb4502418e538c28481f22bce276f248c", | |||
| addr: "1CKZ9Nx4zgds8tU7nJHotKSDr4a9bYJCa3", | |||
| }, | |||
| } | |||
| func TestPubKeySecp256k1Address(t *testing.T) { | |||
| for _, d := range secpDataTable { | |||
| privB, _ := hex.DecodeString(d.priv) | |||
| pubB, _ := hex.DecodeString(d.pub) | |||
| addrBbz, _, _ := base58.CheckDecode(d.addr) | |||
| addrB := crypto.Address(addrBbz) | |||
| var priv secp256k1.PrivKey = secp256k1.PrivKey(privB) | |||
| pubKey := priv.PubKey() | |||
| pubT, _ := pubKey.(secp256k1.PubKey) | |||
| pub := pubT | |||
| addr := pubKey.Address() | |||
| assert.Equal(t, pub, secp256k1.PubKey(pubB), "Expected pub keys to match") | |||
| assert.Equal(t, addr, addrB, "Expected addresses to match") | |||
| } | |||
| } | |||
| func TestSignAndValidateSecp256k1(t *testing.T) { | |||
| privKey := secp256k1.GenPrivKey() | |||
| pubKey := privKey.PubKey() | |||
| msg := crypto.CRandBytes(128) | |||
| sig, err := privKey.Sign(msg) | |||
| require.Nil(t, err) | |||
| assert.True(t, pubKey.VerifySignature(msg, sig)) | |||
| // Mutate the signature, just one bit. | |||
| sig[3] ^= byte(0x01) | |||
| assert.False(t, pubKey.VerifySignature(msg, sig)) | |||
| } | |||
| // This test is intended to justify the removal of calls to the underlying library | |||
| // in creating the privkey. | |||
| func TestSecp256k1LoadPrivkeyAndSerializeIsIdentity(t *testing.T) { | |||
| numberOfTests := 256 | |||
| for i := 0; i < numberOfTests; i++ { | |||
| // Seed the test case with some random bytes | |||
| privKeyBytes := [32]byte{} | |||
| copy(privKeyBytes[:], crypto.CRandBytes(32)) | |||
| // This function creates a private and public key in the underlying libraries format. | |||
| // The private key is basically calling new(big.Int).SetBytes(pk), which removes leading zero bytes | |||
| priv, _ := underlyingSecp256k1.PrivKeyFromBytes(underlyingSecp256k1.S256(), privKeyBytes[:]) | |||
| // this takes the bytes returned by `(big int).Bytes()`, and if the length is less than 32 bytes, | |||
| // pads the bytes from the left with zero bytes. Therefore these two functions composed | |||
| // result in the identity function on privKeyBytes, hence the following equality check | |||
| // always returning true. | |||
| serializedBytes := priv.Serialize() | |||
| require.Equal(t, privKeyBytes[:], serializedBytes) | |||
| } | |||
| } | |||
| func TestGenPrivKeySecp256k1(t *testing.T) { | |||
| // curve oder N | |||
| N := underlyingSecp256k1.S256().N | |||
| tests := []struct { | |||
| name string | |||
| secret []byte | |||
| }{ | |||
| {"empty secret", []byte{}}, | |||
| { | |||
| "some long secret", | |||
| []byte("We live in a society exquisitely dependent on science and technology, " + | |||
| "in which hardly anyone knows anything about science and technology."), | |||
| }, | |||
| {"another seed used in cosmos tests #1", []byte{0}}, | |||
| {"another seed used in cosmos tests #2", []byte("mySecret")}, | |||
| {"another seed used in cosmos tests #3", []byte("")}, | |||
| } | |||
| for _, tt := range tests { | |||
| tt := tt | |||
| t.Run(tt.name, func(t *testing.T) { | |||
| gotPrivKey := secp256k1.GenPrivKeySecp256k1(tt.secret) | |||
| require.NotNil(t, gotPrivKey) | |||
| // interpret as a big.Int and make sure it is a valid field element: | |||
| fe := new(big.Int).SetBytes(gotPrivKey[:]) | |||
| require.True(t, fe.Cmp(N) < 0) | |||
| require.True(t, fe.Sign() > 0) | |||
| }) | |||
| } | |||
| } | |||