2015-07-07 00:54:22 +00:00
|
|
|
// Copyright 2015 The go-ethereum Authors
|
2015-07-22 16:48:40 +00:00
|
|
|
// This file is part of the go-ethereum library.
|
2015-07-07 00:54:22 +00:00
|
|
|
//
|
2015-07-23 16:35:11 +00:00
|
|
|
// The go-ethereum library is free software: you can redistribute it and/or modify
|
2015-07-07 00:54:22 +00:00
|
|
|
// it under the terms of the GNU Lesser General Public License as published by
|
|
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
|
|
// (at your option) any later version.
|
|
|
|
//
|
2015-07-22 16:48:40 +00:00
|
|
|
// The go-ethereum library is distributed in the hope that it will be useful,
|
2015-07-07 00:54:22 +00:00
|
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
2015-07-22 16:48:40 +00:00
|
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
2015-07-07 00:54:22 +00:00
|
|
|
// GNU Lesser General Public License for more details.
|
|
|
|
//
|
|
|
|
// You should have received a copy of the GNU Lesser General Public License
|
2015-07-22 16:48:40 +00:00
|
|
|
// along with the go-ethereum library. If not, see <http://www.gnu.org/licenses/>.
|
2015-07-07 00:54:22 +00:00
|
|
|
|
2017-01-12 20:29:11 +00:00
|
|
|
// Package secp256k1 wraps the bitcoin secp256k1 C library.
|
2015-01-21 23:35:00 +00:00
|
|
|
package secp256k1
|
|
|
|
|
|
|
|
/*
|
2015-09-28 09:19:23 +00:00
|
|
|
#cgo CFLAGS: -I./libsecp256k1
|
2015-09-29 17:37:44 +00:00
|
|
|
#cgo CFLAGS: -I./libsecp256k1/src/
|
2015-12-03 19:04:39 +00:00
|
|
|
#define USE_NUM_NONE
|
2015-04-07 10:40:31 +00:00
|
|
|
#define USE_FIELD_10X26
|
2015-01-21 23:35:00 +00:00
|
|
|
#define USE_FIELD_INV_BUILTIN
|
2015-04-07 10:40:31 +00:00
|
|
|
#define USE_SCALAR_8X32
|
|
|
|
#define USE_SCALAR_INV_BUILTIN
|
2015-04-07 16:09:58 +00:00
|
|
|
#define NDEBUG
|
2015-09-28 09:19:23 +00:00
|
|
|
#include "./libsecp256k1/src/secp256k1.c"
|
|
|
|
#include "./libsecp256k1/src/modules/recovery/main_impl.h"
|
2017-01-12 20:29:11 +00:00
|
|
|
#include "ext.h"
|
2015-11-16 17:04:56 +00:00
|
|
|
|
|
|
|
typedef void (*callbackFunc) (const char* msg, void* data);
|
|
|
|
extern void secp256k1GoPanicIllegal(const char* msg, void* data);
|
|
|
|
extern void secp256k1GoPanicError(const char* msg, void* data);
|
2015-01-21 23:35:00 +00:00
|
|
|
*/
|
|
|
|
import "C"
|
|
|
|
|
|
|
|
import (
|
|
|
|
"errors"
|
2015-09-29 17:37:44 +00:00
|
|
|
"math/big"
|
2015-01-21 23:35:00 +00:00
|
|
|
"unsafe"
|
|
|
|
)
|
|
|
|
|
2015-09-29 17:37:44 +00:00
|
|
|
var (
|
|
|
|
context *C.secp256k1_context
|
|
|
|
N *big.Int
|
2015-11-27 14:40:29 +00:00
|
|
|
HalfN *big.Int
|
2015-09-29 17:37:44 +00:00
|
|
|
)
|
2015-01-21 23:35:00 +00:00
|
|
|
|
2015-09-28 09:19:23 +00:00
|
|
|
func init() {
|
2015-09-29 17:37:44 +00:00
|
|
|
N, _ = new(big.Int).SetString("fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141", 16)
|
2015-11-27 14:40:29 +00:00
|
|
|
// N / 2 == 57896044618658097711785492504343953926418782139537452191302581570759080747168
|
|
|
|
HalfN, _ = new(big.Int).SetString("7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0", 16)
|
|
|
|
|
2015-09-28 09:19:23 +00:00
|
|
|
// around 20 ms on a modern CPU.
|
2017-01-12 20:29:11 +00:00
|
|
|
context = C.secp256k1_context_create_sign_verify()
|
2015-11-16 17:04:56 +00:00
|
|
|
C.secp256k1_context_set_illegal_callback(context, C.callbackFunc(C.secp256k1GoPanicIllegal), nil)
|
|
|
|
C.secp256k1_context_set_error_callback(context, C.callbackFunc(C.secp256k1GoPanicError), nil)
|
2015-01-21 23:35:00 +00:00
|
|
|
}
|
|
|
|
|
2015-11-16 16:11:26 +00:00
|
|
|
var (
|
2017-01-12 20:29:11 +00:00
|
|
|
ErrInvalidMsgLen = errors.New("invalid message length, need 32 bytes")
|
2015-11-16 16:11:26 +00:00
|
|
|
ErrInvalidSignatureLen = errors.New("invalid signature length")
|
|
|
|
ErrInvalidRecoveryID = errors.New("invalid signature recovery id")
|
2017-01-12 20:29:11 +00:00
|
|
|
ErrInvalidKey = errors.New("invalid private key")
|
|
|
|
ErrSignFailed = errors.New("signing failed")
|
|
|
|
ErrRecoverFailed = errors.New("recovery failed")
|
2015-11-16 16:11:26 +00:00
|
|
|
)
|
|
|
|
|
2017-01-12 20:29:11 +00:00
|
|
|
// Sign creates a recoverable ECDSA signature.
|
|
|
|
// The produced signature is in the 65-byte [R || S || V] format where V is 0 or 1.
|
|
|
|
//
|
|
|
|
// The caller is responsible for ensuring that msg cannot be chosen
|
|
|
|
// directly by an attacker. It is usually preferable to use a cryptographic
|
|
|
|
// hash function on any input before handing it to this function.
|
|
|
|
func Sign(msg []byte, seckey []byte) ([]byte, error) {
|
|
|
|
if len(msg) != 32 {
|
|
|
|
return nil, ErrInvalidMsgLen
|
2015-02-15 01:20:31 +00:00
|
|
|
}
|
2017-01-12 20:29:11 +00:00
|
|
|
if len(seckey) != 32 {
|
|
|
|
return nil, ErrInvalidKey
|
2015-01-21 23:35:00 +00:00
|
|
|
}
|
2017-01-12 20:29:11 +00:00
|
|
|
seckeydata := (*C.uchar)(unsafe.Pointer(&seckey[0]))
|
|
|
|
if C.secp256k1_ec_seckey_verify(context, seckeydata) != 1 {
|
|
|
|
return nil, ErrInvalidKey
|
2015-01-21 23:35:00 +00:00
|
|
|
}
|
|
|
|
|
2017-01-12 20:29:11 +00:00
|
|
|
var (
|
2017-01-22 22:28:47 +00:00
|
|
|
msgdata = (*C.uchar)(unsafe.Pointer(&msg[0]))
|
|
|
|
noncefunc = C.secp256k1_nonce_function_rfc6979
|
|
|
|
sigstruct C.secp256k1_ecdsa_recoverable_signature
|
2015-09-28 09:19:23 +00:00
|
|
|
)
|
2017-01-22 22:28:47 +00:00
|
|
|
if C.secp256k1_ecdsa_sign_recoverable(context, &sigstruct, msgdata, seckeydata, noncefunc, nil) == 0 {
|
2017-01-12 20:29:11 +00:00
|
|
|
return nil, ErrSignFailed
|
2015-01-21 23:35:00 +00:00
|
|
|
}
|
|
|
|
|
2017-01-12 20:29:11 +00:00
|
|
|
var (
|
|
|
|
sig = make([]byte, 65)
|
|
|
|
sigdata = (*C.uchar)(unsafe.Pointer(&sig[0]))
|
|
|
|
recid C.int
|
2015-09-28 09:19:23 +00:00
|
|
|
)
|
2017-01-12 20:29:11 +00:00
|
|
|
C.secp256k1_ecdsa_recoverable_signature_serialize_compact(context, sigdata, &recid, &sigstruct)
|
|
|
|
sig[64] = byte(recid) // add back recid to get 65 bytes sig
|
|
|
|
return sig, nil
|
2015-01-21 23:35:00 +00:00
|
|
|
}
|
|
|
|
|
2015-11-16 16:11:26 +00:00
|
|
|
// RecoverPubkey returns the the public key of the signer.
|
|
|
|
// msg must be the 32-byte hash of the message to be signed.
|
|
|
|
// sig must be a 65-byte compact ECDSA signature containing the
|
|
|
|
// recovery id as the last element.
|
2015-01-21 23:35:00 +00:00
|
|
|
func RecoverPubkey(msg []byte, sig []byte) ([]byte, error) {
|
2015-11-16 16:11:26 +00:00
|
|
|
if len(msg) != 32 {
|
|
|
|
return nil, ErrInvalidMsgLen
|
|
|
|
}
|
|
|
|
if err := checkSignature(sig); err != nil {
|
|
|
|
return nil, err
|
2015-01-21 23:35:00 +00:00
|
|
|
}
|
|
|
|
|
2017-01-12 20:29:11 +00:00
|
|
|
var (
|
|
|
|
pubkey = make([]byte, 65)
|
|
|
|
sigdata = (*C.uchar)(unsafe.Pointer(&sig[0]))
|
|
|
|
msgdata = (*C.uchar)(unsafe.Pointer(&msg[0]))
|
2015-01-21 23:35:00 +00:00
|
|
|
)
|
2017-01-12 20:29:11 +00:00
|
|
|
if C.secp256k1_ecdsa_recover_pubkey(context, (*C.uchar)(unsafe.Pointer(&pubkey[0])), sigdata, msgdata) == 0 {
|
|
|
|
return nil, ErrRecoverFailed
|
2015-01-21 23:35:00 +00:00
|
|
|
}
|
2017-01-12 20:29:11 +00:00
|
|
|
return pubkey, nil
|
2015-11-16 16:11:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func checkSignature(sig []byte) error {
|
|
|
|
if len(sig) != 65 {
|
|
|
|
return ErrInvalidSignatureLen
|
|
|
|
}
|
|
|
|
if sig[64] >= 4 {
|
|
|
|
return ErrInvalidRecoveryID
|
|
|
|
}
|
|
|
|
return nil
|
2015-01-21 23:35:00 +00:00
|
|
|
}
|
2015-09-29 17:37:44 +00:00
|
|
|
|
|
|
|
// reads num into buf as big-endian bytes.
|
|
|
|
func readBits(buf []byte, num *big.Int) {
|
|
|
|
const wordLen = int(unsafe.Sizeof(big.Word(0)))
|
|
|
|
i := len(buf)
|
|
|
|
for _, d := range num.Bits() {
|
|
|
|
for j := 0; j < wordLen && i > 0; j++ {
|
|
|
|
i--
|
|
|
|
buf[i] = byte(d)
|
|
|
|
d >>= 8
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|