authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2023-04-14 06:06:00+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-04-14 04:06:00+00:00
log9adee806e346df4513561e1b55f35ba4468cfb3b
treeccd94a355bf683c95b7484dc9fd10bc0a1e5175c
parent4a0508e56c06456c367c57a7565b9f757f2ff663
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

secp256k1: Endormorphism.splitScalar() can return an error (#15270)

Fixes #15267

2 files changed, 9 insertions(+), 9 deletions(-)

lib/std/crypto/ecdsa.zig+1-1
......@@ -249,7 +249,7 @@ pub fn Ecdsa(comptime Curve: type, comptime Hash: type) type {
249249 }
250250
251251 /// Verify that the signature is valid for the entire message.
252 pub fn verify(self: *Verifier) (IdentityElementError || SignatureVerificationError)!void {
252 pub fn verify(self: *Verifier) (IdentityElementError || NonCanonicalError || SignatureVerificationError)!void {
253253 const ht = Curve.scalar.encoded_length;
254254 const h_len = @max(Hash.digest_length, ht);
255255 var h: [h_len]u8 = [_]u8{0} ** h_len;
lib/std/crypto/pcurves/secp256k1.zig+8-8
......@@ -51,7 +51,7 @@ pub const Secp256k1 = struct {
5151 };
5252
5353 /// Compute r1 and r2 so that k = r1 + r2*lambda (mod L).
54 pub fn splitScalar(s: [32]u8, endian: std.builtin.Endian) SplitScalar {
54 pub fn splitScalar(s: [32]u8, endian: std.builtin.Endian) NonCanonicalError!SplitScalar {
5555 const b1_neg_s = comptime s: {
5656 var buf: [32]u8 = undefined;
5757 mem.writeIntLittle(u256, &buf, 303414439467246543595250775667605759171);
......@@ -73,15 +73,15 @@ pub const Secp256k1 = struct {
7373 var buf: [32]u8 = undefined;
7474
7575 mem.writeIntLittle(u256, &buf, c1);
76 const c1x = scalar.mul(buf, b1_neg_s, .Little) catch unreachable;
76 const c1x = try scalar.mul(buf, b1_neg_s, .Little);
7777
7878 mem.writeIntLittle(u256, &buf, c2);
79 const c2x = scalar.mul(buf, b2_neg_s, .Little) catch unreachable;
79 const c2x = try scalar.mul(buf, b2_neg_s, .Little);
8080
81 const r2 = scalar.add(c1x, c2x, .Little) catch unreachable;
81 const r2 = try scalar.add(c1x, c2x, .Little);
8282
83 var r1 = scalar.mul(r2, lambda_s, .Little) catch unreachable;
84 r1 = scalar.sub(s, r1, .Little) catch unreachable;
83 var r1 = try scalar.mul(r2, lambda_s, .Little);
84 r1 = try scalar.sub(s, r1, .Little);
8585
8686 return SplitScalar{ .r1 = r1, .r2 = r2 };
8787 }
......@@ -435,7 +435,7 @@ pub const Secp256k1 = struct {
435435
436436 /// Multiply an elliptic curve point by a *PUBLIC* scalar *IN VARIABLE TIME*
437437 /// This can be used for signature verification.
438 pub fn mulPublic(p: Secp256k1, s_: [32]u8, endian: std.builtin.Endian) IdentityElementError!Secp256k1 {
438 pub fn mulPublic(p: Secp256k1, s_: [32]u8, endian: std.builtin.Endian) (IdentityElementError || NonCanonicalError)!Secp256k1 {
439439 const s = if (endian == .Little) s_ else Fe.orderSwap(s_);
440440 const zero = comptime scalar.Scalar.zero.toBytes(.Little);
441441 if (mem.eql(u8, &zero, &s)) {
......@@ -443,7 +443,7 @@ pub const Secp256k1 = struct {
443443 }
444444 const pc = precompute(p, 8);
445445 var lambda_p = try pcMul(&pc, Endormorphism.lambda_s, true);
446 var split_scalar = Endormorphism.splitScalar(s, .Little);
446 var split_scalar = try Endormorphism.splitScalar(s, .Little);
447447 var px = p;
448448
449449 // If a key is negative, flip the sign to keep it half-sized,