authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2023-04-14 06:06:00+02:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-04-14 04:06:00+00:00
log9adee806e346df4513561e1b55f35ba4468cfb3b
treeccd94a355bf683c95b7484dc9fd10bc0a1e5175c
parent4a0508e56c06456c367c57a7565b9f757f2ff663
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

secp256k1: Endormorphism.splitScalar() can return an error (#15270)

Fixes #15267

2 files changed, 9 insertions(+), 9 deletions(-)

lib/std/crypto/ecdsa.zig+1-1
...@@ -249,7 +249,7 @@ pub fn Ecdsa(comptime Curve: type, comptime Hash: type) type {...@@ -249,7 +249,7 @@ pub fn Ecdsa(comptime Curve: type, comptime Hash: type) type {
249 }249 }
250250
251 /// Verify that the signature is valid for the entire message.251 /// Verify that the signature is valid for the entire message.
252 pub fn verify(self: *Verifier) (IdentityElementError || SignatureVerificationError)!void {252 pub fn verify(self: *Verifier) (IdentityElementError || NonCanonicalError || SignatureVerificationError)!void {
253 const ht = Curve.scalar.encoded_length;253 const ht = Curve.scalar.encoded_length;
254 const h_len = @max(Hash.digest_length, ht);254 const h_len = @max(Hash.digest_length, ht);
255 var h: [h_len]u8 = [_]u8{0} ** h_len;255 var h: [h_len]u8 = [_]u8{0} ** h_len;
lib/std/crypto/pcurves/secp256k1.zig+8-8
...@@ -51,7 +51,7 @@ pub const Secp256k1 = struct {...@@ -51,7 +51,7 @@ pub const Secp256k1 = struct {
51 };51 };
5252
53 /// Compute r1 and r2 so that k = r1 + r2*lambda (mod L).53 /// Compute r1 and r2 so that k = r1 + r2*lambda (mod L).
54 pub fn splitScalar(s: [32]u8, endian: std.builtin.Endian) SplitScalar {54 pub fn splitScalar(s: [32]u8, endian: std.builtin.Endian) NonCanonicalError!SplitScalar {
55 const b1_neg_s = comptime s: {55 const b1_neg_s = comptime s: {
56 var buf: [32]u8 = undefined;56 var buf: [32]u8 = undefined;
57 mem.writeIntLittle(u256, &buf, 303414439467246543595250775667605759171);57 mem.writeIntLittle(u256, &buf, 303414439467246543595250775667605759171);
...@@ -73,15 +73,15 @@ pub const Secp256k1 = struct {...@@ -73,15 +73,15 @@ pub const Secp256k1 = struct {
73 var buf: [32]u8 = undefined;73 var buf: [32]u8 = undefined;
7474
75 mem.writeIntLittle(u256, &buf, c1);75 mem.writeIntLittle(u256, &buf, c1);
76 const c1x = scalar.mul(buf, b1_neg_s, .Little) catch unreachable;76 const c1x = try scalar.mul(buf, b1_neg_s, .Little);
7777
78 mem.writeIntLittle(u256, &buf, c2);78 mem.writeIntLittle(u256, &buf, c2);
79 const c2x = scalar.mul(buf, b2_neg_s, .Little) catch unreachable;79 const c2x = try scalar.mul(buf, b2_neg_s, .Little);
8080
81 const r2 = scalar.add(c1x, c2x, .Little) catch unreachable;81 const r2 = try scalar.add(c1x, c2x, .Little);
8282
83 var r1 = scalar.mul(r2, lambda_s, .Little) catch unreachable;83 var r1 = try scalar.mul(r2, lambda_s, .Little);
84 r1 = scalar.sub(s, r1, .Little) catch unreachable;84 r1 = try scalar.sub(s, r1, .Little);
8585
86 return SplitScalar{ .r1 = r1, .r2 = r2 };86 return SplitScalar{ .r1 = r1, .r2 = r2 };
87 }87 }
...@@ -435,7 +435,7 @@ pub const Secp256k1 = struct {...@@ -435,7 +435,7 @@ pub const Secp256k1 = struct {
435435
436 /// Multiply an elliptic curve point by a *PUBLIC* scalar *IN VARIABLE TIME*436 /// Multiply an elliptic curve point by a *PUBLIC* scalar *IN VARIABLE TIME*
437 /// This can be used for signature verification.437 /// This can be used for signature verification.
438 pub fn mulPublic(p: Secp256k1, s_: [32]u8, endian: std.builtin.Endian) IdentityElementError!Secp256k1 {438 pub fn mulPublic(p: Secp256k1, s_: [32]u8, endian: std.builtin.Endian) (IdentityElementError || NonCanonicalError)!Secp256k1 {
439 const s = if (endian == .Little) s_ else Fe.orderSwap(s_);439 const s = if (endian == .Little) s_ else Fe.orderSwap(s_);
440 const zero = comptime scalar.Scalar.zero.toBytes(.Little);440 const zero = comptime scalar.Scalar.zero.toBytes(.Little);
441 if (mem.eql(u8, &zero, &s)) {441 if (mem.eql(u8, &zero, &s)) {
...@@ -443,7 +443,7 @@ pub const Secp256k1 = struct {...@@ -443,7 +443,7 @@ pub const Secp256k1 = struct {
443 }443 }
444 const pc = precompute(p, 8);444 const pc = precompute(p, 8);
445 var lambda_p = try pcMul(&pc, Endormorphism.lambda_s, true);445 var lambda_p = try pcMul(&pc, Endormorphism.lambda_s, true);
446 var split_scalar = Endormorphism.splitScalar(s, .Little);446 var split_scalar = try Endormorphism.splitScalar(s, .Little);
447 var px = p;447 var px = p;
448448
449 // If a key is negative, flip the sign to keep it half-sized,449 // If a key is negative, flip the sign to keep it half-sized,