mleku
2 months ago
450 changed files with 840 additions and 65929 deletions
@ -0,0 +1,5 @@
@@ -0,0 +1,5 @@
|
||||
# Default ignored files |
||||
/shelf/ |
||||
/workspace.xml |
||||
# Editor-based HTTP Client requests |
||||
/httpRequests/ |
||||
@ -0,0 +1,8 @@
@@ -0,0 +1,8 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?> |
||||
<project version="4"> |
||||
<component name="ProjectModuleManager"> |
||||
<modules> |
||||
<module fileurl="file://$PROJECT_DIR$/.idea/next.orly.dev.iml" filepath="$PROJECT_DIR$/.idea/next.orly.dev.iml" /> |
||||
</modules> |
||||
</component> |
||||
</project> |
||||
@ -0,0 +1,6 @@
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?> |
||||
<project version="4"> |
||||
<component name="VcsDirectoryMappings"> |
||||
<mapping directory="" vcs="Git" /> |
||||
</component> |
||||
</project> |
||||
@ -1,17 +0,0 @@
@@ -1,17 +0,0 @@
|
||||
ISC License |
||||
|
||||
Copyright (c) 2013-2017 The btcsuite developers |
||||
Copyright (c) 2015-2020 The Decred developers |
||||
Copyright (c) 2017 The Lightning Network Developers |
||||
|
||||
Permission to use, copy, modify, and distribute this software for any |
||||
purpose with or without fee is hereby granted, provided that the above |
||||
copyright notice and this permission notice appear in all copies. |
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
||||
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
||||
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
||||
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
||||
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
||||
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
||||
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
||||
@ -1,38 +0,0 @@
@@ -1,38 +0,0 @@
|
||||
# realy.lol/pkg/ec |
||||
|
||||
This is a full drop-in replacement for |
||||
[github.com/btcsuite/btcd/btcec](https://github.com/btcsuite/btcd/tree/master/btcec) |
||||
eliminating the import from the Decred repository, and including the chainhash |
||||
helper functions, needed for hashing messages for signatures. |
||||
|
||||
The decred specific tests also have been removed, as well as all tests that use |
||||
blake256 hashes as these are irrelevant to bitcoin and nostr. Some of them |
||||
remain present, commented out, in case it is worth regenerating the vectors |
||||
based on sha256 hashes, but on first blush it seems unlikely to be any benefit. |
||||
|
||||
This includes the old style compact secp256k1 ECDSA signatures, that recover the |
||||
public key rather than take a key as a parameter as used in Bitcoin |
||||
transactions, the new style Schnorr signatures, and the Musig2 implementation. |
||||
|
||||
BIP 340 Schnorr signatures are implemented including the variable length |
||||
message signing with the extra test vectors present and passing. |
||||
|
||||
The remainder of this document is from the original README.md. |
||||
|
||||
--- |
||||
|
||||
Package `ec` implements elliptic curve cryptography needed for working with |
||||
Bitcoin. It is designed so that it may be used with the standard |
||||
crypto/ecdsa packages provided with Go. |
||||
|
||||
A comprehensive suite of test is provided to ensure proper functionality. |
||||
|
||||
Package btcec was originally based on work from ThePiachu which is licensed |
||||
underthe same terms as Go, but it has signficantly diverged since then. The |
||||
btcsuite developers original is licensed under the liberal ISC license. |
||||
|
||||
## Installation and Updating |
||||
|
||||
```bash |
||||
$ go get mleku.dev/pkg/ec@latest |
||||
``` |
||||
@ -1,14 +0,0 @@
@@ -1,14 +0,0 @@
|
||||
Copyright © 2004-2011 []byte Internet Systems Consortium, Inc. ("ISC") |
||||
Copyright © 1995-2003 []byte Internet Software Consortium |
||||
|
||||
Permission to use, copy, modify, and/or distribute this software for any |
||||
purpose with or without fee is hereby granted, provided that the above |
||||
copyright notice and this permission notice appear in all copies. |
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH REGARD |
||||
TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND |
||||
FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR |
||||
CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, |
||||
DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS |
||||
ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS |
||||
SOFTWARE. |
||||
@ -1,12 +0,0 @@
@@ -1,12 +0,0 @@
|
||||
= base58 |
||||
|
||||
image:http://img.shields.io/badge/license-ISC-blue.svg[ISC License,link=http://copyfree.org] |
||||
|
||||
Package base58 provides an API for encoding and decoding to and from the modified base58 encoding. |
||||
It also provides an API to do Base58Check encoding, as described https://en.bitcoin.it/wiki/Base58Check_encoding[here]. |
||||
|
||||
A comprehensive suite of tests is provided to ensure proper functionality. |
||||
|
||||
== License |
||||
|
||||
Package base58 is licensed under the http://copyfree.org[copyfree] ISC License. |
||||
@ -1,49 +0,0 @@
@@ -1,49 +0,0 @@
|
||||
// Copyright (c) 2015 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// AUTOGENERATED by genalphabet.go; do not edit.
|
||||
|
||||
package base58 |
||||
|
||||
const ( |
||||
// Ciphers is the modified base58 Ciphers used by Bitcoin.
|
||||
Ciphers = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz" |
||||
|
||||
alphabetIdx0 = '1' |
||||
) |
||||
|
||||
var b58 = [256]byte{ |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 0, 1, 2, 3, 4, 5, 6, |
||||
7, 8, 255, 255, 255, 255, 255, 255, |
||||
255, 9, 10, 11, 12, 13, 14, 15, |
||||
16, 255, 17, 18, 19, 20, 21, 255, |
||||
22, 23, 24, 25, 26, 27, 28, 29, |
||||
30, 31, 32, 255, 255, 255, 255, 255, |
||||
255, 33, 34, 35, 36, 37, 38, 39, |
||||
40, 41, 42, 43, 255, 44, 45, 46, |
||||
47, 48, 49, 50, 51, 52, 53, 54, |
||||
55, 56, 57, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
255, 255, 255, 255, 255, 255, 255, 255, |
||||
} |
||||
@ -1,142 +0,0 @@
@@ -1,142 +0,0 @@
|
||||
// Copyright (c) 2013-2015 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package base58 |
||||
|
||||
import ( |
||||
"math/big" |
||||
) |
||||
|
||||
//go:generate go run genalphabet.go
|
||||
|
||||
var bigRadix = [...]*big.Int{ |
||||
big.NewInt(0), |
||||
big.NewInt(58), |
||||
big.NewInt(58 * 58), |
||||
big.NewInt(58 * 58 * 58), |
||||
big.NewInt(58 * 58 * 58 * 58), |
||||
big.NewInt(58 * 58 * 58 * 58 * 58), |
||||
big.NewInt(58 * 58 * 58 * 58 * 58 * 58), |
||||
big.NewInt(58 * 58 * 58 * 58 * 58 * 58 * 58), |
||||
big.NewInt(58 * 58 * 58 * 58 * 58 * 58 * 58 * 58), |
||||
big.NewInt(58 * 58 * 58 * 58 * 58 * 58 * 58 * 58 * 58), |
||||
bigRadix10, |
||||
} |
||||
|
||||
var bigRadix10 = big.NewInt(58 * 58 * 58 * 58 * 58 * 58 * 58 * 58 * 58 * 58) // 58^10
|
||||
|
||||
// Decode decodes a modified base58 string to a byte slice.
|
||||
func Decode(b string) []byte { |
||||
answer := big.NewInt(0) |
||||
scratch := new(big.Int) |
||||
|
||||
// Calculating with big.Int is slow for each iteration.
|
||||
// x += b58[b[i]] * j
|
||||
// j *= 58
|
||||
//
|
||||
// Instead we can try to do as much calculations on int64.
|
||||
// We can represent a 10 digit base58 number using an int64.
|
||||
//
|
||||
// Hence we'll try to convert 10, base58 digits at a time.
|
||||
// The rough idea is to calculate `t`, such that:
|
||||
//
|
||||
// t := b58[b[i+9]] * 58^9 ... + b58[b[i+1]] * 58^1 + b58[b[i]] * 58^0
|
||||
// x *= 58^10
|
||||
// x += t
|
||||
//
|
||||
// Of course, in addition, we'll need to handle boundary condition when `b` is not multiple of 58^10.
|
||||
// In that case we'll use the bigRadix[n] lookup for the appropriate power.
|
||||
for t := b; len(t) > 0; { |
||||
n := len(t) |
||||
if n > 10 { |
||||
n = 10 |
||||
} |
||||
|
||||
total := uint64(0) |
||||
for _, v := range t[:n] { |
||||
if v > 255 { |
||||
return []byte("") |
||||
} |
||||
|
||||
tmp := b58[v] |
||||
if tmp == 255 { |
||||
return []byte("") |
||||
} |
||||
total = total*58 + uint64(tmp) |
||||
} |
||||
|
||||
answer.Mul(answer, bigRadix[n]) |
||||
scratch.SetUint64(total) |
||||
answer.Add(answer, scratch) |
||||
|
||||
t = t[n:] |
||||
} |
||||
|
||||
tmpval := answer.Bytes() |
||||
|
||||
var numZeros int |
||||
for numZeros = 0; numZeros < len(b); numZeros++ { |
||||
if b[numZeros] != alphabetIdx0 { |
||||
break |
||||
} |
||||
} |
||||
flen := numZeros + len(tmpval) |
||||
val := make([]byte, flen) |
||||
copy(val[numZeros:], tmpval) |
||||
|
||||
return val |
||||
} |
||||
|
||||
// Encode encodes a byte slice to a modified base58 string.
|
||||
func Encode(b []byte) string { |
||||
x := new(big.Int) |
||||
x.SetBytes(b) |
||||
|
||||
// maximum length of output is log58(2^(8*len(b))) == len(b) * 8 / log(58)
|
||||
maxlen := int(float64(len(b))*1.365658237309761) + 1 |
||||
answer := make([]byte, 0, maxlen) |
||||
mod := new(big.Int) |
||||
for x.Sign() > 0 { |
||||
// Calculating with big.Int is slow for each iteration.
|
||||
// x, mod = x / 58, x % 58
|
||||
//
|
||||
// Instead we can try to do as much calculations on int64.
|
||||
// x, mod = x / 58^10, x % 58^10
|
||||
//
|
||||
// Which will give us mod, which is 10 digit base58 number.
|
||||
// We'll loop that 10 times to convert to the answer.
|
||||
|
||||
x.DivMod(x, bigRadix10, mod) |
||||
if x.Sign() == 0 { |
||||
// When x = 0, we need to ensure we don't add any extra zeros.
|
||||
m := mod.Int64() |
||||
for m > 0 { |
||||
answer = append(answer, Ciphers[m%58]) |
||||
m /= 58 |
||||
} |
||||
} else { |
||||
m := mod.Int64() |
||||
for i := 0; i < 10; i++ { |
||||
answer = append(answer, Ciphers[m%58]) |
||||
m /= 58 |
||||
} |
||||
} |
||||
} |
||||
|
||||
// leading zero bytes
|
||||
for _, i := range b { |
||||
if i != 0 { |
||||
break |
||||
} |
||||
answer = append(answer, alphabetIdx0) |
||||
} |
||||
|
||||
// reverse
|
||||
alen := len(answer) |
||||
for i := 0; i < alen/2; i++ { |
||||
answer[i], answer[alen-1-i] = answer[alen-1-i], answer[i] |
||||
} |
||||
|
||||
return string(answer) |
||||
} |
||||
@ -1,124 +0,0 @@
@@ -1,124 +0,0 @@
|
||||
// Copyright (c) 2013-2017 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package base58_test |
||||
|
||||
import ( |
||||
"encoding/hex" |
||||
"testing" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/base58" |
||||
"next.orly.dev/pkg/utils" |
||||
) |
||||
|
||||
var stringTests = []struct { |
||||
in string |
||||
out string |
||||
}{ |
||||
{"", ""}, |
||||
{" ", "Z"}, |
||||
{"-", "n"}, |
||||
{"0", "q"}, |
||||
{"1", "r"}, |
||||
{"-1", "4SU"}, |
||||
{"11", "4k8"}, |
||||
{"abc", "ZiCa"}, |
||||
{"1234598760", "3mJr7AoUXx2Wqd"}, |
||||
{"abcdefghijklmnopqrstuvwxyz", "3yxU3u1igY8WkgtjK92fbJQCd4BZiiT1v25f"}, |
||||
{ |
||||
"00000000000000000000000000000000000000000000000000000000000000", |
||||
"3sN2THZeE9Eh9eYrwkvZqNstbHGvrxSAM7gXUXvyFQP8XvQLUqNCS27icwUeDT7ckHm4FUHM2mTVh1vbLmk7y", |
||||
}, |
||||
} |
||||
|
||||
var invalidStringTests = []struct { |
||||
in string |
||||
out string |
||||
}{ |
||||
{"0", ""}, |
||||
{"O", ""}, |
||||
{"I", ""}, |
||||
{"l", ""}, |
||||
{"3mJr0", ""}, |
||||
{"O3yxU", ""}, |
||||
{"3sNI", ""}, |
||||
{"4kl8", ""}, |
||||
{"0OIl", ""}, |
||||
{"!@#$%^&*()-_=+~`", ""}, |
||||
{"abcd\xd80", ""}, |
||||
{"abcd\U000020BF", ""}, |
||||
} |
||||
|
||||
var hexTests = []struct { |
||||
in string |
||||
out string |
||||
}{ |
||||
{"", ""}, |
||||
{"61", "2g"}, |
||||
{"626262", "a3gV"}, |
||||
{"636363", "aPEr"}, |
||||
{ |
||||
"73696d706c792061206c6f6e6720737472696e67", |
||||
"2cFupjhnEsSn59qHXstmK2ffpLv2", |
||||
}, |
||||
{ |
||||
"00eb15231dfceb60925886b67d065299925915aeb172c06647", |
||||
"1NS17iag9jJgTHD1VXjvLCEnZuQ3rJDE9L", |
||||
}, |
||||
{"516b6fcd0f", "ABnLTmg"}, |
||||
{"bf4f89001e670274dd", "3SEo3LWLoPntC"}, |
||||
{"572e4794", "3EFU7m"}, |
||||
{"ecac89cad93923c02321", "EJDM8drfXA6uyA"}, |
||||
{"10c8511e", "Rt5zm"}, |
||||
{"00000000000000000000", "1111111111"}, |
||||
{ |
||||
"000111d38e5fc9071ffcd20b4a763cc9ae4f252bb4e48fd66a835e252ada93ff480d6dd43dc62a641155a5", |
||||
"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz", |
||||
}, |
||||
{ |
||||
"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff", |
||||
"1cWB5HCBdLjAuqGGReWE3R3CguuwSjw6RHn39s2yuDRTS5NsBgNiFpWgAnEx6VQi8csexkgYw3mdYrMHr8x9i7aEwP8kZ7vccXWqKDvGv3u1GxFKPuAkn8JCPPGDMf3vMMnbzm6Nh9zh1gcNsMvH3ZNLmP5fSG6DGbbi2tuwMWPthr4boWwCxf7ewSgNQeacyozhKDDQQ1qL5fQFUW52QKUZDZ5fw3KXNQJMcNTcaB723LchjeKun7MuGW5qyCBZYzA1KjofN1gYBV3NqyhQJ3Ns746GNuf9N2pQPmHz4xpnSrrfCvy6TVVz5d4PdrjeshsWQwpZsZGzvbdAdN8MKV5QsBDY", |
||||
}, |
||||
} |
||||
|
||||
func TestBase58(t *testing.T) { |
||||
// Encode tests
|
||||
for x, test := range stringTests { |
||||
tmp := []byte(test.in) |
||||
if res := base58.Encode(tmp); res != test.out { |
||||
t.Errorf( |
||||
"Encode test #%d failed: got: %s want: %s", |
||||
x, res, test.out, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
|
||||
// Decode tests
|
||||
for x, test := range hexTests { |
||||
b, err := hex.DecodeString(test.in) |
||||
if err != nil { |
||||
t.Errorf("hex.DecodeString failed failed #%d: got: %s", x, test.in) |
||||
continue |
||||
} |
||||
if res := base58.Decode(test.out); !utils.FastEqual(res, b) { |
||||
t.Errorf( |
||||
"Decode test #%d failed: got: %q want: %q", |
||||
x, res, test.in, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
|
||||
// Decode with invalid input
|
||||
for x, test := range invalidStringTests { |
||||
if res := base58.Decode(test.in); string(res) != test.out { |
||||
t.Errorf( |
||||
"Decode invalidString test #%d failed: got: %q want: %q", |
||||
x, res, test.out, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
@ -1,47 +0,0 @@
@@ -1,47 +0,0 @@
|
||||
// Copyright (c) 2013-2014 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package base58_test |
||||
|
||||
import ( |
||||
"bytes" |
||||
"testing" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/base58" |
||||
) |
||||
|
||||
var ( |
||||
raw5k = bytes.Repeat([]byte{0xff}, 5000) |
||||
raw100k = bytes.Repeat([]byte{0xff}, 100*1000) |
||||
encoded5k = base58.Encode(raw5k) |
||||
encoded100k = base58.Encode(raw100k) |
||||
) |
||||
|
||||
func BenchmarkBase58Encode_5K(b *testing.B) { |
||||
b.SetBytes(int64(len(raw5k))) |
||||
for i := 0; i < b.N; i++ { |
||||
base58.Encode(raw5k) |
||||
} |
||||
} |
||||
|
||||
func BenchmarkBase58Encode_100K(b *testing.B) { |
||||
b.SetBytes(int64(len(raw100k))) |
||||
for i := 0; i < b.N; i++ { |
||||
base58.Encode(raw100k) |
||||
} |
||||
} |
||||
|
||||
func BenchmarkBase58Decode_5K(b *testing.B) { |
||||
b.SetBytes(int64(len(encoded5k))) |
||||
for i := 0; i < b.N; i++ { |
||||
base58.Decode(encoded5k) |
||||
} |
||||
} |
||||
|
||||
func BenchmarkBase58Decode_100K(b *testing.B) { |
||||
b.SetBytes(int64(len(encoded100k))) |
||||
for i := 0; i < b.N; i++ { |
||||
base58.Decode(encoded100k) |
||||
} |
||||
} |
||||
@ -1,53 +0,0 @@
@@ -1,53 +0,0 @@
|
||||
// Copyright (c) 2013-2014 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package base58 |
||||
|
||||
import ( |
||||
"errors" |
||||
|
||||
"github.com/minio/sha256-simd" |
||||
) |
||||
|
||||
// ErrChecksum indicates that the checksum of a check-encoded string does not verify against
|
||||
// the checksum.
|
||||
var ErrChecksum = errors.New("checksum error") |
||||
|
||||
// ErrInvalidFormat indicates that the check-encoded string has an invalid format.
|
||||
var ErrInvalidFormat = errors.New("invalid format: version and/or checksum bytes missing") |
||||
|
||||
// checksum: first four bytes of sha256^2
|
||||
func checksum(input []byte) (cksum [4]byte) { |
||||
h := sha256.Sum256(input) |
||||
h2 := sha256.Sum256(h[:]) |
||||
copy(cksum[:], h2[:4]) |
||||
return |
||||
} |
||||
|
||||
// CheckEncode prepends a version byte and appends a four byte checksum.
|
||||
func CheckEncode(input []byte, version byte) string { |
||||
b := make([]byte, 0, 1+len(input)+4) |
||||
b = append(b, version) |
||||
b = append(b, input...) |
||||
cksum := checksum(b) |
||||
b = append(b, cksum[:]...) |
||||
return Encode(b) |
||||
} |
||||
|
||||
// CheckDecode decodes a string that was encoded with CheckEncode and verifies the checksum.
|
||||
func CheckDecode(input string) (result []byte, version byte, err error) { |
||||
decoded := Decode(input) |
||||
if len(decoded) < 5 { |
||||
return nil, 0, ErrInvalidFormat |
||||
} |
||||
version = decoded[0] |
||||
var cksum [4]byte |
||||
copy(cksum[:], decoded[len(decoded)-4:]) |
||||
if checksum(decoded[:len(decoded)-4]) != cksum { |
||||
return nil, 0, ErrChecksum |
||||
} |
||||
payload := decoded[1 : len(decoded)-4] |
||||
result = append(result, payload...) |
||||
return |
||||
} |
||||
@ -1,87 +0,0 @@
@@ -1,87 +0,0 @@
|
||||
// Copyright (c) 2013-2014 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package base58_test |
||||
|
||||
import ( |
||||
"testing" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/base58" |
||||
) |
||||
|
||||
var checkEncodingStringTests = []struct { |
||||
version byte |
||||
in string |
||||
out string |
||||
}{ |
||||
{20, "", "3MNQE1X"}, |
||||
{20, " ", "B2Kr6dBE"}, |
||||
{20, "-", "B3jv1Aft"}, |
||||
{20, "0", "B482yuaX"}, |
||||
{20, "1", "B4CmeGAC"}, |
||||
{20, "-1", "mM7eUf6kB"}, |
||||
{20, "11", "mP7BMTDVH"}, |
||||
{20, "abc", "4QiVtDjUdeq"}, |
||||
{20, "1234598760", "ZmNb8uQn5zvnUohNCEPP"}, |
||||
{ |
||||
20, "abcdefghijklmnopqrstuvwxyz", |
||||
"K2RYDcKfupxwXdWhSAxQPCeiULntKm63UXyx5MvEH2", |
||||
}, |
||||
{ |
||||
20, "00000000000000000000000000000000000000000000000000000000000000", |
||||
"bi1EWXwJay2udZVxLJozuTb8Meg4W9c6xnmJaRDjg6pri5MBAxb9XwrpQXbtnqEoRV5U2pixnFfwyXC8tRAVC8XxnjK", |
||||
}, |
||||
} |
||||
|
||||
func TestBase58Check(t *testing.T) { |
||||
for x, test := range checkEncodingStringTests { |
||||
// test encoding
|
||||
if res := base58.CheckEncode( |
||||
[]byte(test.in), |
||||
test.version, |
||||
); res != test.out { |
||||
t.Errorf( |
||||
"CheckEncode test #%d failed: got %s, want: %s", x, res, |
||||
test.out, |
||||
) |
||||
} |
||||
|
||||
// test decoding
|
||||
res, version, err := base58.CheckDecode(test.out) |
||||
switch { |
||||
case err != nil: |
||||
t.Errorf("CheckDecode test #%d failed with err: %v", x, err) |
||||
|
||||
case version != test.version: |
||||
t.Errorf( |
||||
"CheckDecode test #%d failed: got version: %d want: %d", x, |
||||
version, test.version, |
||||
) |
||||
|
||||
case string(res) != test.in: |
||||
t.Errorf( |
||||
"CheckDecode test #%d failed: got: %s want: %s", x, res, |
||||
test.in, |
||||
) |
||||
} |
||||
} |
||||
|
||||
// test the two decoding failure cases
|
||||
// case 1: checksum error
|
||||
_, _, err := base58.CheckDecode("3MNQE1Y") |
||||
if err != base58.ErrChecksum { |
||||
t.Error("Checkdecode test failed, expected ErrChecksum") |
||||
} |
||||
// case 2: invalid formats (string lengths below 5 mean the version byte and/or the checksum
|
||||
// bytes are missing).
|
||||
testString := "" |
||||
for len := 0; len < 4; len++ { |
||||
testString += "x" |
||||
_, _, err = base58.CheckDecode(testString) |
||||
if err != base58.ErrInvalidFormat { |
||||
t.Error("Checkdecode test failed, expected ErrInvalidFormat") |
||||
} |
||||
} |
||||
|
||||
} |
||||
@ -1,17 +0,0 @@
@@ -1,17 +0,0 @@
|
||||
#!/bin/sh |
||||
|
||||
# This script uses gocov to generate a test coverage report. |
||||
# The gocov tool my be obtained with the following command: |
||||
# go get github.com/axw/gocov/gocov |
||||
# |
||||
# It will be installed to $GOPATH/bin, so ensure that location is in your $PATH. |
||||
|
||||
# Check for gocov. |
||||
type gocov >/dev/null 2>&1 |
||||
if [ $? -ne 0 ]; then |
||||
echo >&2 "This script requires the gocov tool." |
||||
echo >&2 "You may obtain it with the following command:" |
||||
echo >&2 "go get github.com/axw/gocov/gocov" |
||||
exit 1 |
||||
fi |
||||
gocov test | gocov report |
||||
@ -1,29 +0,0 @@
@@ -1,29 +0,0 @@
|
||||
// Copyright (c) 2014 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
/* |
||||
Package base58 provides an API for working with modified base58 and Base58Check |
||||
encodings. |
||||
|
||||
# Modified Base58 Encoding |
||||
|
||||
Standard base58 encoding is similar to standard base64 encoding except, as the |
||||
name implies, it uses a 58 character Ciphers which results in an alphanumeric |
||||
string and allows some characters which are problematic for humans to be |
||||
excluded. Due to this, there can be various base58 alphabets. |
||||
|
||||
The modified base58 Ciphers used by Bitcoin, and hence this package, omits the |
||||
0, O, I, and l characters that look the same in many fonts and are therefore |
||||
hard to humans to distinguish. |
||||
|
||||
# Base58Check Encoding Scheme |
||||
|
||||
The Base58Check encoding scheme is primarily used for Bitcoin addresses at the |
||||
time of this writing, however it can be used to generically encode arbitrary |
||||
byte arrays into human-readable strings along with a version byte that can be |
||||
used to differentiate the same payload. For Bitcoin addresses, the extra |
||||
version is used to differentiate the network of otherwise identical public keys |
||||
which helps prevent using an address intended for one network on another. |
||||
*/ |
||||
package base58 |
||||
@ -1,71 +0,0 @@
@@ -1,71 +0,0 @@
|
||||
// Copyright (c) 2014 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package base58_test |
||||
|
||||
import ( |
||||
"fmt" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/base58" |
||||
) |
||||
|
||||
// This example demonstrates how to decode modified base58 encoded data.
|
||||
func ExampleDecode() { |
||||
// Decode example modified base58 encoded data.
|
||||
encoded := "25JnwSn7XKfNQ" |
||||
decoded := base58.Decode(encoded) |
||||
|
||||
// Show the decoded data.
|
||||
fmt.Println("Decoded Data:", string(decoded)) |
||||
|
||||
// Output:
|
||||
// Decoded Data: Test data
|
||||
} |
||||
|
||||
// This example demonstrates how to encode data using the modified base58
|
||||
// encoding scheme.
|
||||
func ExampleEncode() { |
||||
// Encode example data with the modified base58 encoding scheme.
|
||||
data := []byte("Test data") |
||||
encoded := base58.Encode(data) |
||||
|
||||
// Show the encoded data.
|
||||
fmt.Println("Encoded Data:", encoded) |
||||
|
||||
// Output:
|
||||
// Encoded Data: 25JnwSn7XKfNQ
|
||||
} |
||||
|
||||
// This example demonstrates how to decode Base58Check encoded data.
|
||||
func ExampleCheckDecode() { |
||||
// Decode an example Base58Check encoded data.
|
||||
encoded := "1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa" |
||||
decoded, version, err := base58.CheckDecode(encoded) |
||||
if err != nil { |
||||
fmt.Println(err) |
||||
return |
||||
} |
||||
|
||||
// Show the decoded data.
|
||||
fmt.Printf("Decoded data: %x\n", decoded) |
||||
fmt.Println("Version Byte:", version) |
||||
|
||||
// Output:
|
||||
// Decoded data: 62e907b15cbf27d5425399ebf6f0fb50ebb88f18
|
||||
// Version Byte: 0
|
||||
} |
||||
|
||||
// This example demonstrates how to encode data using the Base58Check encoding
|
||||
// scheme.
|
||||
func ExampleCheckEncode() { |
||||
// Encode example data with the Base58Check encoding scheme.
|
||||
data := []byte("Test data") |
||||
encoded := base58.CheckEncode(data, 0) |
||||
|
||||
// Show the encoded data.
|
||||
fmt.Println("Encoded Data:", encoded) |
||||
|
||||
// Output:
|
||||
// Encoded Data: 182iP79GRURMp7oMHDU
|
||||
} |
||||
@ -1,77 +0,0 @@
@@ -1,77 +0,0 @@
|
||||
// Copyright (c) 2015 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package main |
||||
|
||||
import ( |
||||
"bytes" |
||||
"io" |
||||
"log" |
||||
"os" |
||||
"strconv" |
||||
) |
||||
|
||||
var ( |
||||
start = []byte(`// Copyright (c) 2015 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// AUTOGENERATED by genalphabet.go; do not edit.
|
||||
|
||||
package base58 |
||||
|
||||
const ( |
||||
// Ciphers is the modified base58 alphabet used by Bitcoin.
|
||||
Ciphers = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz" |
||||
|
||||
alphabetIdx0 = '1' |
||||
) |
||||
|
||||
var b58 = [256]byte{`) |
||||
|
||||
end = []byte(`}`) |
||||
|
||||
alphabet = []byte("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz") |
||||
tab = []byte("\t") |
||||
invalid = []byte("255") |
||||
comma = []byte(",") |
||||
space = []byte(" ") |
||||
nl = []byte("\n") |
||||
) |
||||
|
||||
func write(w io.Writer, b []byte) { |
||||
_, err := w.Write(b) |
||||
if err != nil { |
||||
log.Fatal(err) |
||||
} |
||||
} |
||||
|
||||
func main() { |
||||
fi, err := os.Create("alphabet.go") |
||||
if err != nil { |
||||
log.Fatal(err) |
||||
} |
||||
defer fi.Close() |
||||
|
||||
write(fi, start) |
||||
write(fi, nl) |
||||
for i := byte(0); i < 32; i++ { |
||||
write(fi, tab) |
||||
for j := byte(0); j < 8; j++ { |
||||
idx := bytes.IndexByte(alphabet, i*8+j) |
||||
if idx == -1 { |
||||
write(fi, invalid) |
||||
} else { |
||||
write(fi, strconv.AppendInt(nil, int64(idx), 10)) |
||||
} |
||||
write(fi, comma) |
||||
if j != 7 { |
||||
write(fi, space) |
||||
} |
||||
} |
||||
write(fi, nl) |
||||
} |
||||
write(fi, end) |
||||
write(fi, nl) |
||||
} |
||||
@ -1,27 +0,0 @@
@@ -1,27 +0,0 @@
|
||||
= bech32 |
||||
|
||||
image:http://img.shields.io/badge/license-ISC-blue.svg[ISC License,link=http://copyfree.org] |
||||
image:https://godoc.org/realy.lol/pkg/ec/bech32?status.png[GoDoc,link=http://godoc.org/realy.lol/pkg/ec/bech32] |
||||
|
||||
Package bech32 provides a Go implementation of the bech32 format specified in |
||||
https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki[BIP 173]. |
||||
|
||||
Test vectors from BIP 173 are added to ensure compatibility with the BIP. |
||||
|
||||
== Installation and Updating |
||||
|
||||
[source,bash] |
||||
---- |
||||
$ go get -u mleku.dev/pkg/ec/bech32 |
||||
---- |
||||
|
||||
== Examples |
||||
|
||||
* http://godoc.org/realy.lol/pkg/ec/bech32#example-Bech32Decode[Bech32 decode Example] |
||||
Demonstrates how to decode a bech32 encoded string. |
||||
* http://godoc.org/realy.lol/pkg/ec/bech32#example-BechEncode[Bech32 encode Example] |
||||
Demonstrates how to encode data into a bech32 string. |
||||
|
||||
== License |
||||
|
||||
Package bech32 is licensed under the http://copyfree.org[copyfree] ISC License. |
||||
@ -1,411 +0,0 @@
@@ -1,411 +0,0 @@
|
||||
// Copyright (c) 2017 The btcsuite developers
|
||||
// Copyright (c) 2019 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package bech32 |
||||
|
||||
import ( |
||||
"bytes" |
||||
"strings" |
||||
) |
||||
|
||||
// Charset is the set of characters used in the data section of bech32 strings.
|
||||
// Note that this is ordered, such that for a given charset[i], i is the binary
|
||||
// value of the character.
|
||||
//
|
||||
// This wasn't exported in the original lol.
|
||||
const Charset = "qpzry9x8gf2tvdw0s3jn54khce6mua7l" |
||||
|
||||
// gen encodes the generator polynomial for the bech32 BCH checksum.
|
||||
var gen = []int{0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3} |
||||
|
||||
// toBytes converts each character in the string 'chars' to the value of the
|
||||
// index of the corresponding character in 'charset'.
|
||||
func toBytes(chars []byte) ([]byte, error) { |
||||
decoded := make([]byte, 0, len(chars)) |
||||
for i := 0; i < len(chars); i++ { |
||||
index := strings.IndexByte(Charset, chars[i]) |
||||
if index < 0 { |
||||
return nil, ErrNonCharsetChar(chars[i]) |
||||
} |
||||
decoded = append(decoded, byte(index)) |
||||
} |
||||
return decoded, nil |
||||
} |
||||
|
||||
// bech32Polymod calculates the BCH checksum for a given hrp, values and
|
||||
// checksum data. Checksum is optional, and if nil a 0 checksum is assumed.
|
||||
//
|
||||
// Values and checksum (if provided) MUST be encoded as 5 bits per element (base
|
||||
// 32), otherwise the results are undefined.
|
||||
//
|
||||
// For more details on the polymod calculation, please refer to BIP 173.
|
||||
func bech32Polymod(hrp []byte, values, checksum []byte) int { |
||||
check := 1 |
||||
// Account for the high bits of the HRP in the checksum.
|
||||
for i := 0; i < len(hrp); i++ { |
||||
b := check >> 25 |
||||
hiBits := int(hrp[i]) >> 5 |
||||
check = (check&0x1ffffff)<<5 ^ hiBits |
||||
for i := 0; i < 5; i++ { |
||||
if (b>>uint(i))&1 == 1 { |
||||
check ^= gen[i] |
||||
} |
||||
} |
||||
} |
||||
// Account for the separator (0) between high and low bits of the HRP.
|
||||
// x^0 == x, so we eliminate the redundant xor used in the other rounds.
|
||||
b := check >> 25 |
||||
check = (check & 0x1ffffff) << 5 |
||||
for i := 0; i < 5; i++ { |
||||
if (b>>uint(i))&1 == 1 { |
||||
check ^= gen[i] |
||||
} |
||||
} |
||||
// Account for the low bits of the HRP.
|
||||
for i := 0; i < len(hrp); i++ { |
||||
b := check >> 25 |
||||
loBits := int(hrp[i]) & 31 |
||||
check = (check&0x1ffffff)<<5 ^ loBits |
||||
for i := 0; i < 5; i++ { |
||||
if (b>>uint(i))&1 == 1 { |
||||
check ^= gen[i] |
||||
} |
||||
} |
||||
} |
||||
// Account for the values.
|
||||
for _, v := range values { |
||||
b := check >> 25 |
||||
check = (check&0x1ffffff)<<5 ^ int(v) |
||||
for i := 0; i < 5; i++ { |
||||
if (b>>uint(i))&1 == 1 { |
||||
check ^= gen[i] |
||||
} |
||||
} |
||||
} |
||||
if checksum == nil { |
||||
// A nil checksum is used during encoding, so assume all bytes are zero.
|
||||
// x^0 == x, so we eliminate the redundant xor used in the other rounds.
|
||||
for v := 0; v < 6; v++ { |
||||
b := check >> 25 |
||||
check = (check & 0x1ffffff) << 5 |
||||
for i := 0; i < 5; i++ { |
||||
if (b>>uint(i))&1 == 1 { |
||||
check ^= gen[i] |
||||
} |
||||
} |
||||
} |
||||
} else { |
||||
// Checksum is provided during decoding, so use it.
|
||||
for _, v := range checksum { |
||||
b := check >> 25 |
||||
check = (check&0x1ffffff)<<5 ^ int(v) |
||||
for i := 0; i < 5; i++ { |
||||
if (b>>uint(i))&1 == 1 { |
||||
check ^= gen[i] |
||||
} |
||||
} |
||||
} |
||||
} |
||||
return check |
||||
} |
||||
|
||||
// writeBech32Checksum calculates the checksum data expected for a string that
|
||||
// will have the given hrp and payload data and writes it to the provided string
|
||||
// builder.
|
||||
//
|
||||
// The payload data MUST be encoded as a base 32 (5 bits per element) byte slice
|
||||
// and the hrp MUST only use the allowed character set (ascii chars between 33
|
||||
// and 126), otherwise the results are undefined.
|
||||
//
|
||||
// For more details on the checksum calculation, please refer to BIP 173.
|
||||
func writeBech32Checksum( |
||||
hrp []byte, data []byte, bldr *bytes.Buffer, |
||||
version Version, |
||||
) { |
||||
|
||||
bech32Const := int(VersionToConsts[version]) |
||||
polymod := bech32Polymod(hrp, data, nil) ^ bech32Const |
||||
for i := 0; i < 6; i++ { |
||||
b := byte((polymod >> uint(5*(5-i))) & 31) |
||||
// This can't fail, given we explicitly cap the previous b byte by the
|
||||
// first 31 bits.
|
||||
c := Charset[b] |
||||
bldr.WriteByte(c) |
||||
} |
||||
} |
||||
|
||||
// bech32VerifyChecksum verifies whether the bech32 string specified by the
|
||||
// provided hrp and payload data (encoded as 5 bits per element byte slice) has
|
||||
// the correct checksum suffix. The version of bech32 used (bech32 OG, or
|
||||
// bech32m) is also returned to allow the caller to perform proper address
|
||||
// validation (segwitv0 should use bech32, v1+ should use bech32m).
|
||||
//
|
||||
// Data MUST have more than 6 elements, otherwise this function panics.
|
||||
//
|
||||
// For more details on the checksum verification, please refer to BIP 173.
|
||||
func bech32VerifyChecksum(hrp []byte, data []byte) (Version, bool) { |
||||
checksum := data[len(data)-6:] |
||||
values := data[:len(data)-6] |
||||
polymod := bech32Polymod(hrp, values, checksum) |
||||
// Before BIP-350, we'd always check this against a static constant of
|
||||
// 1 to know if the checksum was computed properly. As we want to
|
||||
// generically support decoding for bech32m as well as bech32, we'll
|
||||
// look up the returned value and compare it to the set of defined
|
||||
// constants.
|
||||
bech32Version, ok := ConstsToVersion[ChecksumConst(polymod)] |
||||
if ok { |
||||
return bech32Version, true |
||||
} |
||||
return VersionUnknown, false |
||||
} |
||||
|
||||
// DecodeNoLimit is a bech32 checksum version aware arbitrary string length
|
||||
// decoder. This function will return the version of the decoded checksum
|
||||
// constant so higher level validation can be performed to ensure the correct
|
||||
// version of bech32 was used when encoding.
|
||||
func decodeNoLimit(bech []byte) ([]byte, []byte, Version, error) { |
||||
// The minimum allowed size of a bech32 string is 8 characters, since it
|
||||
// needs a non-empty HRP, a separator, and a 6 character checksum.
|
||||
if len(bech) < 8 { |
||||
return nil, nil, VersionUnknown, ErrInvalidLength(len(bech)) |
||||
} |
||||
// Only ASCII characters between 33 and 126 are allowed.
|
||||
var hasLower, hasUpper bool |
||||
for i := 0; i < len(bech); i++ { |
||||
if bech[i] < 33 || bech[i] > 126 { |
||||
return nil, nil, VersionUnknown, ErrInvalidCharacter(bech[i]) |
||||
} |
||||
// The characters must be either all lowercase or all uppercase. Testing
|
||||
// directly with ascii codes is safe here, given the previous test.
|
||||
hasLower = hasLower || (bech[i] >= 97 && bech[i] <= 122) |
||||
hasUpper = hasUpper || (bech[i] >= 65 && bech[i] <= 90) |
||||
if hasLower && hasUpper { |
||||
return nil, nil, VersionUnknown, ErrMixedCase{} |
||||
} |
||||
} |
||||
// Bech32 standard uses only the lowercase for of strings for checksum
|
||||
// calculation.
|
||||
if hasUpper { |
||||
bech = bytes.ToLower(bech) |
||||
} |
||||
// The string is invalid if the last '1' is non-existent, it is the
|
||||
// first character of the string (no human-readable part) or one of the
|
||||
// last 6 characters of the string (since checksum cannot contain '1').
|
||||
one := bytes.LastIndexByte(bech, '1') |
||||
if one < 1 || one+7 > len(bech) { |
||||
return nil, nil, VersionUnknown, ErrInvalidSeparatorIndex(one) |
||||
} |
||||
// The human-readable part is everything before the last '1'.
|
||||
hrp := bech[:one] |
||||
data := bech[one+1:] |
||||
// Each character corresponds to the byte with value of the index in
|
||||
// 'charset'.
|
||||
decoded, err := toBytes(data) |
||||
if err != nil { |
||||
return nil, nil, VersionUnknown, err |
||||
} |
||||
// Verify if the checksum (stored inside decoded[:]) is valid, given the
|
||||
// previously decoded hrp.
|
||||
bech32Version, ok := bech32VerifyChecksum(hrp, decoded) |
||||
if !ok { |
||||
// Invalid checksum. Calculate what it should have been, so that the
|
||||
// error contains this information.
|
||||
//
|
||||
// Extract the payload bytes and actual checksum in the string.
|
||||
actual := bech[len(bech)-6:] |
||||
payload := decoded[:len(decoded)-6] |
||||
// Calculate the expected checksum, given the hrp and payload
|
||||
// data. We'll actually compute _both_ possibly valid checksum
|
||||
// to further aide in debugging.
|
||||
var expectedBldr bytes.Buffer |
||||
expectedBldr.Grow(6) |
||||
writeBech32Checksum(hrp, payload, &expectedBldr, Version0) |
||||
expectedVersion0 := expectedBldr.String() |
||||
var b strings.Builder |
||||
b.Grow(6) |
||||
writeBech32Checksum(hrp, payload, &expectedBldr, VersionM) |
||||
expectedVersionM := expectedBldr.String() |
||||
err = ErrInvalidChecksum{ |
||||
Expected: expectedVersion0, |
||||
ExpectedM: expectedVersionM, |
||||
Actual: string(actual), |
||||
} |
||||
return nil, nil, VersionUnknown, err |
||||
} |
||||
// We exclude the last 6 bytes, which is the checksum.
|
||||
return hrp, decoded[:len(decoded)-6], bech32Version, nil |
||||
} |
||||
|
||||
// DecodeNoLimit decodes a bech32 encoded string, returning the human-readable
|
||||
// part and the data part excluding the checksum. This function does NOT
|
||||
// validate against the BIP-173 maximum length allowed for bech32 strings and
|
||||
// is meant for use in custom applications (such as lightning network payment
|
||||
// requests), NOT on-chain addresses.
|
||||
//
|
||||
// Note that the returned data is 5-bit (base32) encoded and the human-readable
|
||||
// part will be lowercase.
|
||||
func DecodeNoLimit(bech []byte) ([]byte, []byte, error) { |
||||
hrp, data, _, err := decodeNoLimit(bech) |
||||
return hrp, data, err |
||||
} |
||||
|
||||
// Decode decodes a bech32 encoded string, returning the human-readable part and
|
||||
// the data part excluding the checksum.
|
||||
//
|
||||
// Note that the returned data is 5-bit (base32) encoded and the human-readable
|
||||
// part will be lowercase.
|
||||
func Decode(bech []byte) ([]byte, []byte, error) { |
||||
// The maximum allowed length for a bech32 string is 90.
|
||||
if len(bech) > 90 { |
||||
return nil, nil, ErrInvalidLength(len(bech)) |
||||
} |
||||
hrp, data, _, err := decodeNoLimit(bech) |
||||
return hrp, data, err |
||||
} |
||||
|
||||
// DecodeGeneric is identical to the existing Decode method, but will also
|
||||
// return bech32 version that matches the decoded checksum. This method should
|
||||
// be used when decoding segwit addresses, as it enables additional
|
||||
// verification to ensure the proper checksum is used.
|
||||
func DecodeGeneric(bech []byte) ([]byte, []byte, Version, error) { |
||||
// The maximum allowed length for a bech32 string is 90.
|
||||
if len(bech) > 90 { |
||||
return nil, nil, VersionUnknown, ErrInvalidLength(len(bech)) |
||||
} |
||||
return decodeNoLimit(bech) |
||||
} |
||||
|
||||
// encodeGeneric is the base bech32 encoding function that is aware of the
|
||||
// existence of the checksum versions. This method is private, as the Encode
|
||||
// and EncodeM methods are intended to be used instead.
|
||||
func encodeGeneric(hrp []byte, data []byte, version Version) ([]byte, error) { |
||||
// The resulting bech32 string is the concatenation of the lowercase
|
||||
// hrp, the separator 1, data and the 6-byte checksum.
|
||||
hrp = bytes.ToLower(hrp) |
||||
var bldr bytes.Buffer |
||||
bldr.Grow(len(hrp) + 1 + len(data) + 6) |
||||
bldr.Write(hrp) |
||||
bldr.WriteString("1") |
||||
// Write the data part, using the bech32 charset.
|
||||
for _, b := range data { |
||||
if int(b) >= len(Charset) { |
||||
return nil, ErrInvalidDataByte(b) |
||||
} |
||||
bldr.WriteByte(Charset[b]) |
||||
} |
||||
// Calculate and write the checksum of the data.
|
||||
writeBech32Checksum(hrp, data, &bldr, version) |
||||
return bldr.Bytes(), nil |
||||
} |
||||
|
||||
// Encode encodes a byte slice into a bech32 string with the given
|
||||
// human-readable part (HRP). The HRP will be converted to lowercase if needed
|
||||
// since mixed cased encodings are not permitted and lowercase is used for
|
||||
// checksum purposes. Note that the bytes must each encode 5 bits (base32).
|
||||
func Encode(hrp, data []byte) ([]byte, error) { |
||||
return encodeGeneric(hrp, data, Version0) |
||||
} |
||||
|
||||
// EncodeM is the exactly same as the Encode method, but it uses the new
|
||||
// bech32m constant instead of the original one. It should be used whenever one
|
||||
// attempts to encode a segwit address of v1 and beyond.
|
||||
func EncodeM(hrp, data []byte) ([]byte, error) { |
||||
return encodeGeneric(hrp, data, VersionM) |
||||
} |
||||
|
||||
// ConvertBits converts a byte slice where each byte is encoding fromBits bits,
|
||||
// to a byte slice where each byte is encoding toBits bits.
|
||||
func ConvertBits(data []byte, fromBits, toBits uint8, pad bool) ( |
||||
[]byte, |
||||
error, |
||||
) { |
||||
|
||||
if fromBits < 1 || fromBits > 8 || toBits < 1 || toBits > 8 { |
||||
return nil, ErrInvalidBitGroups{} |
||||
} |
||||
// Determine the maximum size the resulting array can have after base
|
||||
// conversion, so that we can size it a single time. This might be off
|
||||
// by a byte depending on whether padding is used or not and if the input
|
||||
// data is a multiple of both fromBits and toBits, but we ignore that and
|
||||
// just size it to the maximum possible.
|
||||
maxSize := len(data)*int(fromBits)/int(toBits) + 1 |
||||
// The final bytes, each byte encoding toBits bits.
|
||||
regrouped := make([]byte, 0, maxSize) |
||||
// Keep track of the next byte we create and how many bits we have
|
||||
// added to it out of the toBits goal.
|
||||
nextByte := byte(0) |
||||
filledBits := uint8(0) |
||||
for _, b := range data { |
||||
// Discard unused bits.
|
||||
b <<= 8 - fromBits |
||||
// How many bits remaining to extract from the input data.
|
||||
remFromBits := fromBits |
||||
for remFromBits > 0 { |
||||
// How many bits remaining to be added to the next byte.
|
||||
remToBits := toBits - filledBits |
||||
// The number of bytes to next extract is the minimum of
|
||||
// remFromBits and remToBits.
|
||||
toExtract := remFromBits |
||||
if remToBits < toExtract { |
||||
toExtract = remToBits |
||||
} |
||||
// Add the next bits to nextByte, shifting the already
|
||||
// added bits to the left.
|
||||
nextByte = (nextByte << toExtract) | (b >> (8 - toExtract)) |
||||
// Discard the bits we just extracted and get ready for
|
||||
// next iteration.
|
||||
b <<= toExtract |
||||
remFromBits -= toExtract |
||||
filledBits += toExtract |
||||
// If the nextByte is completely filled, we add it to
|
||||
// our regrouped bytes and start on the next byte.
|
||||
if filledBits == toBits { |
||||
regrouped = append(regrouped, nextByte) |
||||
filledBits = 0 |
||||
nextByte = 0 |
||||
} |
||||
} |
||||
} |
||||
// We pad any unfinished group if specified.
|
||||
if pad && filledBits > 0 { |
||||
nextByte <<= toBits - filledBits |
||||
regrouped = append(regrouped, nextByte) |
||||
filledBits = 0 |
||||
nextByte = 0 |
||||
} |
||||
// Any incomplete group must be <= 4 bits, and all zeroes.
|
||||
if filledBits > 0 && (filledBits > 4 || nextByte != 0) { |
||||
return nil, ErrInvalidIncompleteGroup{} |
||||
} |
||||
return regrouped, nil |
||||
} |
||||
|
||||
// EncodeFromBase256 converts a base256-encoded byte slice into a base32-encoded
|
||||
// byte slice and then encodes it into a bech32 string with the given
|
||||
// human-readable part (HRP). The HRP will be converted to lowercase if needed
|
||||
// since mixed cased encodings are not permitted and lowercase is used for
|
||||
// checksum purposes.
|
||||
func EncodeFromBase256(hrp, data []byte) ([]byte, error) { |
||||
converted, err := ConvertBits(data, 8, 5, true) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
return Encode(hrp, converted) |
||||
} |
||||
|
||||
// DecodeToBase256 decodes a bech32-encoded string into its associated
|
||||
// human-readable part (HRP) and base32-encoded data, converts that data to a
|
||||
// base256-encoded byte slice and returns it along with the lowercase HRP.
|
||||
func DecodeToBase256(bech []byte) ([]byte, []byte, error) { |
||||
hrp, data, err := Decode(bech) |
||||
if err != nil { |
||||
return nil, nil, err |
||||
} |
||||
converted, err := ConvertBits(data, 5, 8, false) |
||||
if err != nil { |
||||
return nil, nil, err |
||||
} |
||||
return hrp, converted, nil |
||||
} |
||||
@ -1,776 +0,0 @@
@@ -1,776 +0,0 @@
|
||||
// Copyright (c) 2017-2020 The btcsuite developers
|
||||
// Copyright (c) 2019 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package bech32 |
||||
|
||||
import ( |
||||
"bytes" |
||||
"encoding/hex" |
||||
"errors" |
||||
"fmt" |
||||
"strings" |
||||
"testing" |
||||
|
||||
"next.orly.dev/pkg/utils" |
||||
) |
||||
|
||||
// TestBech32 tests whether decoding and re-encoding the valid BIP-173 test
|
||||
// vectors works and if decoding invalid test vectors fails for the correct
|
||||
// reason.
|
||||
func TestBech32(t *testing.T) { |
||||
tests := []struct { |
||||
str string |
||||
expectedError error |
||||
}{ |
||||
{"A12UEL5L", nil}, |
||||
{"a12uel5l", nil}, |
||||
{ |
||||
"an83characterlonghumanreadablepartthatcontainsthenumber1andtheexcludedcharactersbio1tt5tgs", |
||||
nil, |
||||
}, |
||||
{"abcdef1qpzry9x8gf2tvdw0s3jn54khce6mua7lmqqqxw", nil}, |
||||
{ |
||||
"11qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqc8247j", |
||||
nil, |
||||
}, |
||||
{"split1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", nil}, |
||||
{ |
||||
"split1checkupstagehandshakeupstreamerranterredcaperred2y9e2w", |
||||
ErrInvalidChecksum{ |
||||
"2y9e3w", "2y9e3wlc445v", |
||||
"2y9e2w", |
||||
}, |
||||
}, // invalid checksum
|
||||
{ |
||||
"s lit1checkupstagehandshakeupstreamerranterredcaperredp8hs2p", |
||||
ErrInvalidCharacter(' '), |
||||
}, // invalid character (space) in hrp
|
||||
{ |
||||
"spl\x7Ft1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", |
||||
ErrInvalidCharacter(127), |
||||
}, // invalid character (DEL) in hrp
|
||||
{ |
||||
"split1cheo2y9e2w", |
||||
ErrNonCharsetChar('o'), |
||||
}, // invalid character (o) in data part
|
||||
{"split1a2y9w", ErrInvalidSeparatorIndex(5)}, // too short data part
|
||||
{ |
||||
"1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", |
||||
ErrInvalidSeparatorIndex(0), |
||||
}, // empty hrp
|
||||
{ |
||||
"11qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqc8247j", |
||||
ErrInvalidLength(91), |
||||
}, // too long
|
||||
// Additional test vectors used in bitcoin core
|
||||
{" 1nwldj5", ErrInvalidCharacter(' ')}, |
||||
{"\x7f" + "1axkwrx", ErrInvalidCharacter(0x7f)}, |
||||
{"\x801eym55h", ErrInvalidCharacter(0x80)}, |
||||
{ |
||||
"an84characterslonghumanreadablepartthatcontainsthenumber1andtheexcludedcharactersbio1569pvx", |
||||
ErrInvalidLength(91), |
||||
}, |
||||
{"pzry9x0s0muk", ErrInvalidSeparatorIndex(-1)}, |
||||
{"1pzry9x0s0muk", ErrInvalidSeparatorIndex(0)}, |
||||
{"x1b4n0q5v", ErrNonCharsetChar(98)}, |
||||
{"li1dgmt3", ErrInvalidSeparatorIndex(2)}, |
||||
{"de1lg7wt\xff", ErrInvalidCharacter(0xff)}, |
||||
{"A1G7SGD8", ErrInvalidChecksum{"2uel5l", "2uel5llqfn3a", "g7sgd8"}}, |
||||
{"10a06t8", ErrInvalidLength(7)}, |
||||
{"1qzzfhee", ErrInvalidSeparatorIndex(0)}, |
||||
{"a12UEL5L", ErrMixedCase{}}, |
||||
{"A12uEL5L", ErrMixedCase{}}, |
||||
} |
||||
for i, test := range tests { |
||||
str := []byte(test.str) |
||||
hrp, decoded, err := Decode([]byte(str)) |
||||
if !errors.Is(err, test.expectedError) { |
||||
t.Errorf( |
||||
"%d: expected decoding error %v "+ |
||||
"instead got %v", i, test.expectedError, err, |
||||
) |
||||
continue |
||||
} |
||||
if err != nil { |
||||
// End test case here if a decoding error was expected.
|
||||
continue |
||||
} |
||||
// Check that it encodes to the same string
|
||||
encoded, err := Encode(hrp, decoded) |
||||
if err != nil { |
||||
t.Errorf("encoding failed: %v", err) |
||||
} |
||||
if !utils.FastEqual(encoded, bytes.ToLower([]byte(str))) { |
||||
t.Errorf( |
||||
"expected data to encode to %v, but got %v", |
||||
str, encoded, |
||||
) |
||||
} |
||||
// Flip a bit in the string an make sure it is caught.
|
||||
pos := bytes.LastIndexAny(str, "1") |
||||
flipped := []byte(string(str[:pos+1]) + string(str[pos+1]^1) + string(str[pos+2:])) |
||||
_, _, err = Decode(flipped) |
||||
if err == nil { |
||||
t.Error("expected decoding to fail") |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestBech32M tests that the following set of strings, based on the test
|
||||
// vectors in BIP-350 are either valid or invalid using the new bech32m
|
||||
// checksum algo. Some of these strings are similar to the set of above test
|
||||
// vectors, but end up with different checksums.
|
||||
func TestBech32M(t *testing.T) { |
||||
tests := []struct { |
||||
str string |
||||
expectedError error |
||||
}{ |
||||
{"A1LQFN3A", nil}, |
||||
{"a1lqfn3a", nil}, |
||||
{ |
||||
"an83characterlonghumanreadablepartthatcontainsthetheexcludedcharactersbioandnumber11sg7hg6", |
||||
nil, |
||||
}, |
||||
{"abcdef1l7aum6echk45nj3s0wdvt2fg8x9yrzpqzd3ryx", nil}, |
||||
{ |
||||
"11llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllludsr8", |
||||
nil, |
||||
}, |
||||
{"split1checkupstagehandshakeupstreamerranterredcaperredlc445v", nil}, |
||||
{"?1v759aa", nil}, |
||||
// Additional test vectors used in bitcoin core
|
||||
{"\x201xj0phk", ErrInvalidCharacter('\x20')}, |
||||
{"\x7f1g6xzxy", ErrInvalidCharacter('\x7f')}, |
||||
{"\x801vctc34", ErrInvalidCharacter('\x80')}, |
||||
{ |
||||
"an84characterslonghumanreadablepartthatcontainsthetheexcludedcharactersbioandnumber11d6pts4", |
||||
ErrInvalidLength(91), |
||||
}, |
||||
{"qyrz8wqd2c9m", ErrInvalidSeparatorIndex(-1)}, |
||||
{"1qyrz8wqd2c9m", ErrInvalidSeparatorIndex(0)}, |
||||
{"y1b0jsk6g", ErrNonCharsetChar(98)}, |
||||
{"lt1igcx5c0", ErrNonCharsetChar(105)}, |
||||
{"in1muywd", ErrInvalidSeparatorIndex(2)}, |
||||
{"mm1crxm3i", ErrNonCharsetChar(105)}, |
||||
{"au1s5cgom", ErrNonCharsetChar(111)}, |
||||
{"M1VUXWEZ", ErrInvalidChecksum{"mzl49c", "mzl49cw70eq6", "vuxwez"}}, |
||||
{"16plkw9", ErrInvalidLength(7)}, |
||||
{"1p2gdwpf", ErrInvalidSeparatorIndex(0)}, |
||||
|
||||
{" 1nwldj5", ErrInvalidCharacter(' ')}, |
||||
{"\x7f" + "1axkwrx", ErrInvalidCharacter(0x7f)}, |
||||
{"\x801eym55h", ErrInvalidCharacter(0x80)}, |
||||
} |
||||
for i, test := range tests { |
||||
str := []byte(test.str) |
||||
hrp, decoded, err := Decode(str) |
||||
if test.expectedError != err { |
||||
t.Errorf( |
||||
"%d: (%v) expected decoding error %v "+ |
||||
"instead got %v", i, str, test.expectedError, |
||||
err, |
||||
) |
||||
continue |
||||
} |
||||
if err != nil { |
||||
// End test case here if a decoding error was expected.
|
||||
continue |
||||
} |
||||
// Check that it encodes to the same string, using bech32 m.
|
||||
encoded, err := EncodeM(hrp, decoded) |
||||
if err != nil { |
||||
t.Errorf("encoding failed: %v", err) |
||||
} |
||||
|
||||
if !utils.FastEqual(encoded, bytes.ToLower(str)) { |
||||
t.Errorf( |
||||
"expected data to encode to %v, but got %v", |
||||
str, encoded, |
||||
) |
||||
} |
||||
// Flip a bit in the string an make sure it is caught.
|
||||
pos := bytes.LastIndexAny(str, "1") |
||||
flipped := []byte(string(str[:pos+1]) + string(str[pos+1]^1) + string(str[pos+2:])) |
||||
_, _, err = Decode(flipped) |
||||
if err == nil { |
||||
t.Error("expected decoding to fail") |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestBech32DecodeGeneric tests that given a bech32 string, or a bech32m
|
||||
// string, the proper checksum version is returned so that callers can perform
|
||||
// segwit addr validation.
|
||||
func TestBech32DecodeGeneric(t *testing.T) { |
||||
tests := []struct { |
||||
str string |
||||
version Version |
||||
}{ |
||||
{"A1LQFN3A", VersionM}, |
||||
{"a1lqfn3a", VersionM}, |
||||
{ |
||||
"an83characterlonghumanreadablepartthatcontainsthetheexcludedcharactersbioandnumber11sg7hg6", |
||||
VersionM, |
||||
}, |
||||
{"abcdef1l7aum6echk45nj3s0wdvt2fg8x9yrzpqzd3ryx", VersionM}, |
||||
{ |
||||
"11llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllludsr8", |
||||
VersionM, |
||||
}, |
||||
{ |
||||
"split1checkupstagehandshakeupstreamerranterredcaperredlc445v", |
||||
VersionM, |
||||
}, |
||||
{"?1v759aa", VersionM}, |
||||
{"A12UEL5L", Version0}, |
||||
{"a12uel5l", Version0}, |
||||
{ |
||||
"an83characterlonghumanreadablepartthatcontainsthenumber1andtheexcludedcharactersbio1tt5tgs", |
||||
Version0, |
||||
}, |
||||
{"abcdef1qpzry9x8gf2tvdw0s3jn54khce6mua7lmqqqxw", Version0}, |
||||
{ |
||||
"11qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqc8247j", |
||||
Version0, |
||||
}, |
||||
{ |
||||
"split1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", |
||||
Version0, |
||||
}, |
||||
{"BC1QW508D6QEJXTDG4Y5R3ZARVARY0C5XW7KV8F3T4", Version0}, |
||||
{ |
||||
"tb1qrp33g0q5c5txsp9arysrx4k6zdkfs4nce4xj0gdcccefvpysxf3q0sl5k7", |
||||
Version0, |
||||
}, |
||||
{ |
||||
"bc1pw508d6qejxtdg4y5r3zarvary0c5xw7kw508d6qejxtdg4y5r3zarvary0c5xw7kt5nd6y", |
||||
VersionM, |
||||
}, |
||||
{"BC1SW50QGDZ25J", VersionM}, |
||||
{"bc1zw508d6qejxtdg4y5r3zarvaryvaxxpcs", VersionM}, |
||||
{ |
||||
"tb1qqqqqp399et2xygdj5xreqhjjvcmzhxw4aywxecjdzew6hylgvsesrxh6hy", |
||||
Version0, |
||||
}, |
||||
{ |
||||
"tb1pqqqqp399et2xygdj5xreqhjjvcmzhxw4aywxecjdzew6hylgvsesf3hn0c", |
||||
VersionM, |
||||
}, |
||||
{ |
||||
"bc1p0xlxvlhemja6c4dqv22uapctqupfhlxm9h8z3k2e72q4k9hcz7vqzk5jj0", |
||||
VersionM, |
||||
}, |
||||
} |
||||
for i, test := range tests { |
||||
_, _, version, err := DecodeGeneric([]byte(test.str)) |
||||
if err != nil { |
||||
t.Errorf( |
||||
"%d: (%v) unexpected error during "+ |
||||
"decoding: %v", i, test.str, err, |
||||
) |
||||
continue |
||||
} |
||||
if version != test.version { |
||||
t.Errorf( |
||||
"(%v): invalid version: expected %v, got %v", |
||||
test.str, test.version, version, |
||||
) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestMixedCaseEncode ensures mixed case HRPs are converted to lowercase as
|
||||
// expected when encoding and that decoding the produced encoding when converted
|
||||
// to all uppercase produces the lowercase HRP and original data.
|
||||
func TestMixedCaseEncode(t *testing.T) { |
||||
tests := []struct { |
||||
name string |
||||
hrp string |
||||
data string |
||||
encoded string |
||||
}{ |
||||
{ |
||||
name: "all uppercase HRP with no data", |
||||
hrp: "A", |
||||
data: "", |
||||
encoded: "a12uel5l", |
||||
}, { |
||||
name: "all uppercase HRP with data", |
||||
hrp: "UPPERCASE", |
||||
data: "787878", |
||||
encoded: "uppercase10pu8sss7kmp", |
||||
}, { |
||||
name: "mixed case HRP even offsets uppercase", |
||||
hrp: "AbCdEf", |
||||
data: "00443214c74254b635cf84653a56d7c675be77df", |
||||
encoded: "abcdef1qpzry9x8gf2tvdw0s3jn54khce6mua7lmqqqxw", |
||||
}, { |
||||
name: "mixed case HRP odd offsets uppercase ", |
||||
hrp: "aBcDeF", |
||||
data: "00443214c74254b635cf84653a56d7c675be77df", |
||||
encoded: "abcdef1qpzry9x8gf2tvdw0s3jn54khce6mua7lmqqqxw", |
||||
}, { |
||||
name: "all lowercase HRP", |
||||
hrp: "abcdef", |
||||
data: "00443214c74254b635cf84653a56d7c675be77df", |
||||
encoded: "abcdef1qpzry9x8gf2tvdw0s3jn54khce6mua7lmqqqxw", |
||||
}, |
||||
} |
||||
for _, test := range tests { |
||||
// Convert the text hex to bytes, convert those bytes from base256 to
|
||||
// base32, then ensure the encoded result with the HRP provided in the
|
||||
// test data is as expected.
|
||||
data, err := hex.DecodeString(test.data) |
||||
if err != nil { |
||||
t.Errorf("%q: invalid hex %q: %v", test.name, test.data, err) |
||||
continue |
||||
} |
||||
convertedData, err := ConvertBits(data, 8, 5, true) |
||||
if err != nil { |
||||
t.Errorf( |
||||
"%q: unexpected convert bits error: %v", test.name, |
||||
err, |
||||
) |
||||
continue |
||||
} |
||||
gotEncoded, err := Encode([]byte(test.hrp), convertedData) |
||||
if err != nil { |
||||
t.Errorf("%q: unexpected encode error: %v", test.name, err) |
||||
continue |
||||
} |
||||
if !utils.FastEqual(gotEncoded, []byte(test.encoded)) { |
||||
t.Errorf( |
||||
"%q: mismatched encoding -- got %q, want %q", test.name, |
||||
gotEncoded, test.encoded, |
||||
) |
||||
continue |
||||
} |
||||
// Ensure the decoding the expected lowercase encoding converted to all
|
||||
// uppercase produces the lowercase HRP and original data.
|
||||
gotHRP, gotData, err := Decode(bytes.ToUpper([]byte(test.encoded))) |
||||
if err != nil { |
||||
t.Errorf("%q: unexpected decode error: %v", test.name, err) |
||||
continue |
||||
} |
||||
wantHRP := strings.ToLower(test.hrp) |
||||
if !utils.FastEqual(gotHRP, []byte(wantHRP)) { |
||||
t.Errorf( |
||||
"%q: mismatched decoded HRP -- got %q, want %q", test.name, |
||||
gotHRP, wantHRP, |
||||
) |
||||
continue |
||||
} |
||||
convertedGotData, err := ConvertBits(gotData, 5, 8, false) |
||||
if err != nil { |
||||
t.Errorf( |
||||
"%q: unexpected convert bits error: %v", test.name, |
||||
err, |
||||
) |
||||
continue |
||||
} |
||||
if !utils.FastEqual(convertedGotData, data) { |
||||
t.Errorf( |
||||
"%q: mismatched data -- got %x, want %x", test.name, |
||||
convertedGotData, data, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestCanDecodeUnlimtedBech32 tests whether decoding a large bech32 string works
|
||||
// when using the DecodeNoLimit version
|
||||
func TestCanDecodeUnlimtedBech32(t *testing.T) { |
||||
input := "11qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq5kx0yd" |
||||
// Sanity check that an input of this length errors on regular Decode()
|
||||
_, _, err := Decode([]byte(input)) |
||||
if err == nil { |
||||
t.Fatalf("Test vector not appropriate") |
||||
} |
||||
// Try and decode it.
|
||||
hrp, data, err := DecodeNoLimit([]byte(input)) |
||||
if err != nil { |
||||
t.Fatalf( |
||||
"Expected decoding of large string to work. Got error: %v", |
||||
err, |
||||
) |
||||
} |
||||
// Verify data for correctness.
|
||||
if !utils.FastEqual(hrp, []byte("1")) { |
||||
t.Fatalf("Unexpected hrp: %v", hrp) |
||||
} |
||||
decodedHex := fmt.Sprintf("%x", data) |
||||
expected := "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000" |
||||
if decodedHex != expected { |
||||
t.Fatalf("Unexpected decoded data: %s", decodedHex) |
||||
} |
||||
} |
||||
|
||||
// TestBech32Base256 ensures decoding and encoding various bech32, HRPs, and
|
||||
// data produces the expected results when using EncodeFromBase256 and
|
||||
// DecodeToBase256. It includes tests for proper handling of case
|
||||
// manipulations.
|
||||
func TestBech32Base256(t *testing.T) { |
||||
tests := []struct { |
||||
name string // test name
|
||||
encoded string // bech32 string to decode
|
||||
hrp string // expected human-readable part
|
||||
data string // expected hex-encoded data
|
||||
err error // expected error
|
||||
}{ |
||||
{ |
||||
name: "all uppercase, no data", |
||||
encoded: "A12UEL5L", |
||||
hrp: "a", |
||||
data: "", |
||||
}, { |
||||
name: "long hrp with separator and excluded chars, no data", |
||||
encoded: "an83characterlonghumanreadablepartthatcontainsthenumber1andtheexcludedcharactersbio1tt5tgs", |
||||
hrp: "an83characterlonghumanreadablepartthatcontainsthenumber1andtheexcludedcharactersbio", |
||||
data: "", |
||||
}, { |
||||
name: "6 char hrp with data with leading zero", |
||||
encoded: "abcdef1qpzry9x8gf2tvdw0s3jn54khce6mua7lmqqqxw", |
||||
hrp: "abcdef", |
||||
data: "00443214c74254b635cf84653a56d7c675be77df", |
||||
}, { |
||||
name: "hrp same as separator and max length encoded string", |
||||
encoded: "11qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqc8247j", |
||||
hrp: "1", |
||||
data: "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", |
||||
}, { |
||||
name: "5 char hrp with data chosen to produce human-readable data part", |
||||
encoded: "split1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", |
||||
hrp: "split", |
||||
data: "c5f38b70305f519bf66d85fb6cf03058f3dde463ecd7918f2dc743918f2d", |
||||
}, { |
||||
name: "same as previous but with checksum invalidated", |
||||
encoded: "split1checkupstagehandshakeupstreamerranterredcaperred2y9e2w", |
||||
err: ErrInvalidChecksum{"2y9e3w", "2y9e3wlc445v", "2y9e2w"}, |
||||
}, { |
||||
name: "hrp with invalid character (space)", |
||||
encoded: "s lit1checkupstagehandshakeupstreamerranterredcaperredp8hs2p", |
||||
err: ErrInvalidCharacter(' '), |
||||
}, { |
||||
name: "hrp with invalid character (DEL)", |
||||
encoded: "spl\x7ft1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", |
||||
err: ErrInvalidCharacter(127), |
||||
}, { |
||||
name: "data part with invalid character (o)", |
||||
encoded: "split1cheo2y9e2w", |
||||
err: ErrNonCharsetChar('o'), |
||||
}, { |
||||
name: "data part too short", |
||||
encoded: "split1a2y9w", |
||||
err: ErrInvalidSeparatorIndex(5), |
||||
}, { |
||||
name: "empty hrp", |
||||
encoded: "1checkupstagehandshakeupstreamerranterredcaperred2y9e3w", |
||||
err: ErrInvalidSeparatorIndex(0), |
||||
}, { |
||||
name: "no separator", |
||||
encoded: "pzry9x0s0muk", |
||||
err: ErrInvalidSeparatorIndex(-1), |
||||
}, { |
||||
name: "too long by one char", |
||||
encoded: "11qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqc8247j", |
||||
err: ErrInvalidLength(91), |
||||
}, { |
||||
name: "invalid due to mixed case in hrp", |
||||
encoded: "aBcdef1qpzry9x8gf2tvdw0s3jn54khce6mua7lmqqqxw", |
||||
err: ErrMixedCase{}, |
||||
}, { |
||||
name: "invalid due to mixed case in data part", |
||||
encoded: "abcdef1Qpzry9x8gf2tvdw0s3jn54khce6mua7lmqqqxw", |
||||
err: ErrMixedCase{}, |
||||
}, |
||||
} |
||||
for _, test := range tests { |
||||
// Ensure the decode either produces an error or not as expected.
|
||||
str := test.encoded |
||||
gotHRP, gotData, err := DecodeToBase256([]byte(str)) |
||||
if test.err != err { |
||||
t.Errorf( |
||||
"%q: unexpected decode error -- got %v, want %v", |
||||
test.name, err, test.err, |
||||
) |
||||
continue |
||||
} |
||||
if err != nil { |
||||
// End test case here if a decoding error was expected.
|
||||
continue |
||||
} |
||||
// Ensure the expected HRP and original data are as expected.
|
||||
if !utils.FastEqual(gotHRP, []byte(test.hrp)) { |
||||
t.Errorf( |
||||
"%q: mismatched decoded HRP -- got %q, want %q", test.name, |
||||
gotHRP, test.hrp, |
||||
) |
||||
continue |
||||
} |
||||
data, err := hex.DecodeString(test.data) |
||||
if err != nil { |
||||
t.Errorf("%q: invalid hex %q: %v", test.name, test.data, err) |
||||
continue |
||||
} |
||||
if !utils.FastEqual(gotData, data) { |
||||
t.Errorf( |
||||
"%q: mismatched data -- got %x, want %x", test.name, |
||||
gotData, data, |
||||
) |
||||
continue |
||||
} |
||||
// Encode the same data with the HRP converted to all uppercase and
|
||||
// ensure the result is the lowercase version of the original encoded
|
||||
// bech32 string.
|
||||
gotEncoded, err := EncodeFromBase256( |
||||
bytes.ToUpper([]byte(test.hrp)), data, |
||||
) |
||||
if err != nil { |
||||
t.Errorf( |
||||
"%q: unexpected uppercase HRP encode error: %v", test.name, |
||||
err, |
||||
) |
||||
} |
||||
wantEncoded := bytes.ToLower([]byte(str)) |
||||
if !utils.FastEqual(gotEncoded, wantEncoded) { |
||||
t.Errorf( |
||||
"%q: mismatched encoding -- got %q, want %q", test.name, |
||||
gotEncoded, wantEncoded, |
||||
) |
||||
} |
||||
// Encode the same data with the HRP converted to all lowercase and
|
||||
// ensure the result is the lowercase version of the original encoded
|
||||
// bech32 string.
|
||||
gotEncoded, err = EncodeFromBase256( |
||||
bytes.ToLower([]byte(test.hrp)), data, |
||||
) |
||||
if err != nil { |
||||
t.Errorf( |
||||
"%q: unexpected lowercase HRP encode error: %v", test.name, |
||||
err, |
||||
) |
||||
} |
||||
if !utils.FastEqual(gotEncoded, wantEncoded) { |
||||
t.Errorf( |
||||
"%q: mismatched encoding -- got %q, want %q", test.name, |
||||
gotEncoded, wantEncoded, |
||||
) |
||||
} |
||||
// Encode the same data with the HRP converted to mixed upper and
|
||||
// lowercase and ensure the result is the lowercase version of the
|
||||
// original encoded bech32 string.
|
||||
var mixedHRPBuilder bytes.Buffer |
||||
for i, r := range test.hrp { |
||||
if i%2 == 0 { |
||||
mixedHRPBuilder.WriteString(strings.ToUpper(string(r))) |
||||
continue |
||||
} |
||||
mixedHRPBuilder.WriteRune(r) |
||||
} |
||||
gotEncoded, err = EncodeFromBase256(mixedHRPBuilder.Bytes(), data) |
||||
if err != nil { |
||||
t.Errorf( |
||||
"%q: unexpected lowercase HRP encode error: %v", test.name, |
||||
err, |
||||
) |
||||
} |
||||
if !utils.FastEqual(gotEncoded, wantEncoded) { |
||||
t.Errorf( |
||||
"%q: mismatched encoding -- got %q, want %q", test.name, |
||||
gotEncoded, wantEncoded, |
||||
) |
||||
} |
||||
// Ensure a bit flip in the string is caught.
|
||||
pos := strings.LastIndexAny(test.encoded, "1") |
||||
flipped := str[:pos+1] + string(str[pos+1]^1) + str[pos+2:] |
||||
_, _, err = DecodeToBase256([]byte(flipped)) |
||||
if err == nil { |
||||
t.Error("expected decoding to fail") |
||||
} |
||||
} |
||||
} |
||||
|
||||
// BenchmarkEncodeDecodeCycle performs a benchmark for a full encode/decode
|
||||
// cycle of a bech32 string. It also reports the allocation count, which we
|
||||
// expect to be 2 for a fully optimized cycle.
|
||||
func BenchmarkEncodeDecodeCycle(b *testing.B) { |
||||
// Use a fixed, 49-byte raw data for testing.
|
||||
inputData, err := hex.DecodeString("cbe6365ddbcda9a9915422c3f091c13f8c7b2f263b8d34067bd12c274408473fa764871c9dd51b1bb34873b3473b633ed1") |
||||
if err != nil { |
||||
b.Fatalf("failed to initialize input data: %v", err) |
||||
} |
||||
// Convert this into a 79-byte, base 32 byte slice.
|
||||
base32Input, err := ConvertBits(inputData, 8, 5, true) |
||||
if err != nil { |
||||
b.Fatalf("failed to convert input to 32 bits-per-element: %v", err) |
||||
} |
||||
// Use a fixed hrp for the tests. This should generate an encoded bech32
|
||||
// string of size 90 (the maximum allowed by BIP-173).
|
||||
hrp := "bc" |
||||
// Begin the benchmark. Given that we test one roundtrip per iteration
|
||||
// (that is, one Encode() and one Decode() operation), we expect at most
|
||||
// 2 allocations per reported test op.
|
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
for i := 0; i < b.N; i++ { |
||||
str, err := Encode([]byte(hrp), base32Input) |
||||
if err != nil { |
||||
b.Fatalf("failed to encode input: %v", err) |
||||
} |
||||
_, _, err = Decode(str) |
||||
if err != nil { |
||||
b.Fatalf("failed to decode string: %v", err) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestConvertBits tests whether base conversion works using TestConvertBits().
|
||||
func TestConvertBits(t *testing.T) { |
||||
tests := []struct { |
||||
input string |
||||
output string |
||||
fromBits uint8 |
||||
toBits uint8 |
||||
pad bool |
||||
}{ |
||||
// Trivial empty conversions.
|
||||
{"", "", 8, 5, false}, |
||||
{"", "", 8, 5, true}, |
||||
{"", "", 5, 8, false}, |
||||
{"", "", 5, 8, true}, |
||||
// Conversions of 0 value with/without padding.
|
||||
{"00", "00", 8, 5, false}, |
||||
{"00", "0000", 8, 5, true}, |
||||
{"0000", "00", 5, 8, false}, |
||||
{"0000", "0000", 5, 8, true}, |
||||
// Testing when conversion ends exactly at the byte edge. This makes
|
||||
// both padded and unpadded versions the same.
|
||||
{"0000000000", "0000000000000000", 8, 5, false}, |
||||
{"0000000000", "0000000000000000", 8, 5, true}, |
||||
{"0000000000000000", "0000000000", 5, 8, false}, |
||||
{"0000000000000000", "0000000000", 5, 8, true}, |
||||
// Conversions of full byte sequences.
|
||||
{"ffffff", "1f1f1f1f1e", 8, 5, true}, |
||||
{"1f1f1f1f1e", "ffffff", 5, 8, false}, |
||||
{"1f1f1f1f1e", "ffffff00", 5, 8, true}, |
||||
// Sample random conversions.
|
||||
{"c9ca", "190705", 8, 5, false}, |
||||
{"c9ca", "19070500", 8, 5, true}, |
||||
{"19070500", "c9ca", 5, 8, false}, |
||||
{"19070500", "c9ca00", 5, 8, true}, |
||||
// Test cases tested on TestConvertBitsFailures with their corresponding
|
||||
// fixes.
|
||||
{"ff", "1f1c", 8, 5, true}, |
||||
{"1f1c10", "ff20", 5, 8, true}, |
||||
// Large conversions.
|
||||
{ |
||||
"cbe6365ddbcda9a9915422c3f091c13f8c7b2f263b8d34067bd12c274408473fa764871c9dd51b1bb34873b3473b633ed1", |
||||
"190f13030c170e1b1916141a13040a14040b011f01040e01071e0607160b1906070e06130801131b1a0416020e110008081c1f1a0e19040703120e1d0a06181b160d0407070c1a07070d11131d1408", |
||||
8, 5, true, |
||||
}, |
||||
{ |
||||
"190f13030c170e1b1916141a13040a14040b011f01040e01071e0607160b1906070e06130801131b1a0416020e110008081c1f1a0e19040703120e1d0a06181b160d0407070c1a07070d11131d1408", |
||||
"cbe6365ddbcda9a9915422c3f091c13f8c7b2f263b8d34067bd12c274408473fa764871c9dd51b1bb34873b3473b633ed100", |
||||
5, 8, true, |
||||
}, |
||||
} |
||||
for i, tc := range tests { |
||||
input, err := hex.DecodeString(tc.input) |
||||
if err != nil { |
||||
t.Fatalf("invalid test input data: %v", err) |
||||
} |
||||
expected, err := hex.DecodeString(tc.output) |
||||
if err != nil { |
||||
t.Fatalf("invalid test output data: %v", err) |
||||
} |
||||
actual, err := ConvertBits(input, tc.fromBits, tc.toBits, tc.pad) |
||||
if err != nil { |
||||
t.Fatalf("test case %d failed: %v", i, err) |
||||
} |
||||
if !utils.FastEqual(actual, expected) { |
||||
t.Fatalf( |
||||
"test case %d has wrong output; expected=%x actual=%x", |
||||
i, expected, actual, |
||||
) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestConvertBitsFailures tests for the expected conversion failures of
|
||||
// ConvertBits().
|
||||
func TestConvertBitsFailures(t *testing.T) { |
||||
tests := []struct { |
||||
input string |
||||
fromBits uint8 |
||||
toBits uint8 |
||||
pad bool |
||||
err error |
||||
}{ |
||||
// Not enough output bytes when not using padding.
|
||||
{"ff", 8, 5, false, ErrInvalidIncompleteGroup{}}, |
||||
{"1f1c10", 5, 8, false, ErrInvalidIncompleteGroup{}}, |
||||
// Unsupported bit conversions.
|
||||
{"", 0, 5, false, ErrInvalidBitGroups{}}, |
||||
{"", 10, 5, false, ErrInvalidBitGroups{}}, |
||||
{"", 5, 0, false, ErrInvalidBitGroups{}}, |
||||
{"", 5, 10, false, ErrInvalidBitGroups{}}, |
||||
} |
||||
for i, tc := range tests { |
||||
input, err := hex.DecodeString(tc.input) |
||||
if err != nil { |
||||
t.Fatalf("invalid test input data: %v", err) |
||||
} |
||||
_, err = ConvertBits(input, tc.fromBits, tc.toBits, tc.pad) |
||||
if err != tc.err { |
||||
t.Fatalf( |
||||
"test case %d failure: expected '%v' got '%v'", i, |
||||
tc.err, err, |
||||
) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// BenchmarkConvertBitsDown benchmarks the speed and memory allocation behavior
|
||||
// of ConvertBits when converting from a higher base into a lower base (e.g. 8
|
||||
// => 5).
|
||||
//
|
||||
// Only a single allocation is expected, which is used for the output array.
|
||||
func BenchmarkConvertBitsDown(b *testing.B) { |
||||
// Use a fixed, 49-byte raw data for testing.
|
||||
inputData, err := hex.DecodeString("cbe6365ddbcda9a9915422c3f091c13f8c7b2f263b8d34067bd12c274408473fa764871c9dd51b1bb34873b3473b633ed1") |
||||
if err != nil { |
||||
b.Fatalf("failed to initialize input data: %v", err) |
||||
} |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
for i := 0; i < b.N; i++ { |
||||
_, err := ConvertBits(inputData, 8, 5, true) |
||||
if err != nil { |
||||
b.Fatalf("error converting bits: %v", err) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// BenchmarkConvertBitsDown benchmarks the speed and memory allocation behavior
|
||||
// of ConvertBits when converting from a lower base into a higher base (e.g. 5
|
||||
// => 8).
|
||||
//
|
||||
// Only a single allocation is expected, which is used for the output array.
|
||||
func BenchmarkConvertBitsUp(b *testing.B) { |
||||
// Use a fixed, 79-byte raw data for testing.
|
||||
inputData, err := hex.DecodeString("190f13030c170e1b1916141a13040a14040b011f01040e01071e0607160b1906070e06130801131b1a0416020e110008081c1f1a0e19040703120e1d0a06181b160d0407070c1a07070d11131d1408") |
||||
if err != nil { |
||||
b.Fatalf("failed to initialize input data: %v", err) |
||||
} |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
for i := 0; i < b.N; i++ { |
||||
_, err := ConvertBits(inputData, 8, 5, true) |
||||
if err != nil { |
||||
b.Fatalf("error converting bits: %v", err) |
||||
} |
||||
} |
||||
} |
||||
@ -1,13 +0,0 @@
@@ -1,13 +0,0 @@
|
||||
// Copyright (c) 2017 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// Package bech32 provides a Go implementation of the bech32 format specified in
|
||||
// BIP 173.
|
||||
//
|
||||
// Bech32 strings consist of a human-readable part (hrp), followed by the
|
||||
// separator 1, then a checksummed data part encoded using the 32 characters
|
||||
// "qpzry9x8gf2tvdw0s3jn54khce6mua7l".
|
||||
//
|
||||
// More info: https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki
|
||||
package bech32 |
||||
@ -1,89 +0,0 @@
@@ -1,89 +0,0 @@
|
||||
// Copyright (c) 2019 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package bech32 |
||||
|
||||
import ( |
||||
"fmt" |
||||
) |
||||
|
||||
// ErrMixedCase is returned when the bech32 string has both lower and uppercase
|
||||
// characters.
|
||||
type ErrMixedCase struct{} |
||||
|
||||
func (err ErrMixedCase) Error() string { |
||||
return "string not all lowercase or all uppercase" |
||||
} |
||||
|
||||
// ErrInvalidBitGroups is returned when conversion is attempted between byte
|
||||
// slices using bit-per-element of unsupported value.
|
||||
type ErrInvalidBitGroups struct{} |
||||
|
||||
func (err ErrInvalidBitGroups) Error() string { |
||||
return "only bit groups between 1 and 8 allowed" |
||||
} |
||||
|
||||
// ErrInvalidIncompleteGroup is returned when then byte slice used as input has
|
||||
// data of wrong length.
|
||||
type ErrInvalidIncompleteGroup struct{} |
||||
|
||||
func (err ErrInvalidIncompleteGroup) Error() string { |
||||
return "invalid incomplete group" |
||||
} |
||||
|
||||
// ErrInvalidLength is returned when the bech32 string has an invalid length
|
||||
// given the BIP-173 defined restrictions.
|
||||
type ErrInvalidLength int |
||||
|
||||
func (err ErrInvalidLength) Error() string { |
||||
return fmt.Sprintf("invalid bech32 string length %d", int(err)) |
||||
} |
||||
|
||||
// ErrInvalidCharacter is returned when the bech32 string has a character
|
||||
// outside the range of the supported charset.
|
||||
type ErrInvalidCharacter rune |
||||
|
||||
func (err ErrInvalidCharacter) Error() string { |
||||
return fmt.Sprintf("invalid character in string: '%c'", rune(err)) |
||||
} |
||||
|
||||
// ErrInvalidSeparatorIndex is returned when the separator character '1' is
|
||||
// in an invalid position in the bech32 string.
|
||||
type ErrInvalidSeparatorIndex int |
||||
|
||||
func (err ErrInvalidSeparatorIndex) Error() string { |
||||
return fmt.Sprintf("invalid separator index %d", int(err)) |
||||
} |
||||
|
||||
// ErrNonCharsetChar is returned when a character outside of the specific
|
||||
// bech32 charset is used in the string.
|
||||
type ErrNonCharsetChar rune |
||||
|
||||
func (err ErrNonCharsetChar) Error() string { |
||||
return fmt.Sprintf("invalid character not part of charset: %v", int(err)) |
||||
} |
||||
|
||||
// ErrInvalidChecksum is returned when the extracted checksum of the string
|
||||
// is different than what was expected. Both the original version, as well as
|
||||
// the new bech32m checksum may be specified.
|
||||
type ErrInvalidChecksum struct { |
||||
Expected string |
||||
ExpectedM string |
||||
Actual string |
||||
} |
||||
|
||||
func (err ErrInvalidChecksum) Error() string { |
||||
return fmt.Sprintf( |
||||
"invalid checksum (expected (bech32=%v, "+ |
||||
"bech32m=%v), got %v)", err.Expected, err.ExpectedM, err.Actual, |
||||
) |
||||
} |
||||
|
||||
// ErrInvalidDataByte is returned when a byte outside the range required for
|
||||
// conversion into a string was found.
|
||||
type ErrInvalidDataByte byte |
||||
|
||||
func (err ErrInvalidDataByte) Error() string { |
||||
return fmt.Sprintf("invalid data byte: %v", byte(err)) |
||||
} |
||||
@ -1,43 +0,0 @@
@@ -1,43 +0,0 @@
|
||||
// Copyright (c) 2017 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package bech32 |
||||
|
||||
import ( |
||||
"encoding/hex" |
||||
"fmt" |
||||
) |
||||
|
||||
// This example demonstrates how to decode a bech32 encoded string.
|
||||
func ExampleDecode() { |
||||
encoded := "bc1pw508d6qejxtdg4y5r3zarvary0c5xw7kw508d6qejxtdg4y5r3zarvary0c5xw7k7grplx" |
||||
hrp, decoded, err := Decode([]byte(encoded)) |
||||
if err != nil { |
||||
fmt.Println("Error:", err) |
||||
} |
||||
// Show the decoded data.
|
||||
fmt.Printf("Decoded human-readable part: %s\n", hrp) |
||||
fmt.Println("Decoded Data:", hex.EncodeToString(decoded)) |
||||
// Output:
|
||||
// Decoded human-readable part: bc
|
||||
// Decoded Data: 010e140f070d1a001912060b0d081504140311021d030c1d03040f1814060e1e160e140f070d1a001912060b0d081504140311021d030c1d03040f1814060e1e16
|
||||
} |
||||
|
||||
// This example demonstrates how to encode data into a bech32 string.
|
||||
func ExampleEncode() { |
||||
data := []byte("Test data") |
||||
// Convert test data to base32:
|
||||
conv, err := ConvertBits(data, 8, 5, true) |
||||
if err != nil { |
||||
fmt.Println("Error:", err) |
||||
} |
||||
encoded, err := Encode([]byte("customHrp!11111q"), conv) |
||||
if err != nil { |
||||
fmt.Println("Error:", err) |
||||
} |
||||
// Show the encoded data.
|
||||
fmt.Printf("Encoded Data: %s", encoded) |
||||
// Output:
|
||||
// Encoded Data: customhrp!11111q123jhxapqv3shgcgkxpuhe
|
||||
} |
||||
@ -1,40 +0,0 @@
@@ -1,40 +0,0 @@
|
||||
package bech32 |
||||
|
||||
// ChecksumConst is a type that represents the currently defined bech32
|
||||
// checksum constants.
|
||||
type ChecksumConst int |
||||
|
||||
const ( |
||||
// Version0Const is the original constant used in the checksum
|
||||
// verification for bech32.
|
||||
Version0Const ChecksumConst = 1 |
||||
// VersionMConst is the new constant used for bech32m checksum
|
||||
// verification.
|
||||
VersionMConst ChecksumConst = 0x2bc830a3 |
||||
) |
||||
|
||||
// Version defines the current set of bech32 versions.
|
||||
type Version uint8 |
||||
|
||||
const ( |
||||
// Version0 defines the original bech version.
|
||||
Version0 Version = iota |
||||
// VersionM is the new bech32 version defined in BIP-350, also known as
|
||||
// bech32m.
|
||||
VersionM |
||||
// VersionUnknown denotes an unknown bech version.
|
||||
VersionUnknown |
||||
) |
||||
|
||||
// VersionToConsts maps bech32 versions to the checksum constant to be used
|
||||
// when encoding, and asserting a particular version when decoding.
|
||||
var VersionToConsts = map[Version]ChecksumConst{ |
||||
Version0: Version0Const, |
||||
VersionM: VersionMConst, |
||||
} |
||||
|
||||
// ConstsToVersion maps a bech32 constant to the version it's associated with.
|
||||
var ConstsToVersion = map[ChecksumConst]Version{ |
||||
Version0Const: Version0, |
||||
VersionMConst: VersionM, |
||||
} |
||||
@ -1,188 +0,0 @@
@@ -1,188 +0,0 @@
|
||||
// Copyright 2013-2016 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package btcec |
||||
|
||||
import ( |
||||
"math/big" |
||||
"testing" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/secp256k1" |
||||
"next.orly.dev/pkg/encoders/hex" |
||||
) |
||||
|
||||
// setHex decodes the passed big-endian hex string into the internal field value
|
||||
// representation. Only the first 32-bytes are used.
|
||||
//
|
||||
// This is NOT constant time.
|
||||
//
|
||||
// The field value is returned to support chaining. This enables syntax like:
|
||||
// f := new(FieldVal).SetHex("0abc").Add(1) so that f = 0x0abc + 1
|
||||
func setHex(hexString string) *FieldVal { |
||||
if len(hexString)%2 != 0 { |
||||
hexString = "0" + hexString |
||||
} |
||||
bytes, _ := hex.Dec(hexString) |
||||
var f FieldVal |
||||
f.SetByteSlice(bytes) |
||||
return &f |
||||
} |
||||
|
||||
// hexToFieldVal converts the passed hex string into a FieldVal and will panic
|
||||
// if there is an error. This is only provided for the hard-coded constants so
|
||||
// errors in the source code can be detected. It will only (and must only) be
|
||||
// called with hard-coded values.
|
||||
func hexToFieldVal(s string) *FieldVal { |
||||
b, err := hex.Dec(s) |
||||
if err != nil { |
||||
panic("invalid hex in source file: " + s) |
||||
} |
||||
var f FieldVal |
||||
if overflow := f.SetByteSlice(b); overflow { |
||||
panic("hex in source file overflows mod P: " + s) |
||||
} |
||||
return &f |
||||
} |
||||
|
||||
// fromHex converts the passed hex string into a big integer pointer and will
|
||||
// panic is there is an error. This is only provided for the hard-coded
|
||||
// constants so errors in the source code can bet detected. It will only (and
|
||||
// must only) be called for initialization purposes.
|
||||
func fromHex(s string) *big.Int { |
||||
if s == "" { |
||||
return big.NewInt(0) |
||||
} |
||||
r, ok := new(big.Int).SetString(s, 16) |
||||
if !ok { |
||||
panic("invalid hex in source file: " + s) |
||||
} |
||||
return r |
||||
} |
||||
|
||||
// jacobianPointFromHex decodes the passed big-endian hex strings into a
|
||||
// Jacobian point with its internal fields set to the resulting values. Only
|
||||
// the first 32-bytes are used.
|
||||
func jacobianPointFromHex(x, y, z string) JacobianPoint { |
||||
var p JacobianPoint |
||||
p.X = *setHex(x) |
||||
p.Y = *setHex(y) |
||||
p.Z = *setHex(z) |
||||
return p |
||||
} |
||||
|
||||
// BenchmarkAddNonConst benchmarks the secp256k1 curve AddNonConst function with
|
||||
// Z values of 1 so that the associated optimizations are used.
|
||||
func BenchmarkAddJacobian(b *testing.B) { |
||||
p1 := jacobianPointFromHex( |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"1", |
||||
) |
||||
p2 := jacobianPointFromHex( |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"1", |
||||
) |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
var result JacobianPoint |
||||
for i := 0; i < b.N; i++ { |
||||
secp256k1.AddNonConst(&p1, &p2, &result) |
||||
} |
||||
} |
||||
|
||||
// BenchmarkAddNonConstNotZOne benchmarks the secp256k1 curve AddNonConst
|
||||
// function with Z values other than one so the optimizations associated with
|
||||
// Z=1 aren't used.
|
||||
func BenchmarkAddJacobianNotZOne(b *testing.B) { |
||||
x1 := setHex("d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718") |
||||
y1 := setHex("5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190") |
||||
z1 := setHex("2") |
||||
x2 := setHex("91abba6a34b7481d922a4bd6a04899d5a686f6cf6da4e66a0cb427fb25c04bd4") |
||||
y2 := setHex("03fede65e30b4e7576a2abefc963ddbf9fdccbf791b77c29beadefe49951f7d1") |
||||
z2 := setHex("3") |
||||
p1 := MakeJacobianPoint(x1, y1, z1) |
||||
p2 := MakeJacobianPoint(x2, y2, z2) |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
var result JacobianPoint |
||||
for i := 0; i < b.N; i++ { |
||||
AddNonConst(&p1, &p2, &result) |
||||
} |
||||
} |
||||
|
||||
// BenchmarkScalarBaseMult benchmarks the secp256k1 curve ScalarBaseMult
|
||||
// function.
|
||||
func BenchmarkScalarBaseMult(b *testing.B) { |
||||
k := fromHex("d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575") |
||||
curve := S256() |
||||
for i := 0; i < b.N; i++ { |
||||
curve.ScalarBaseMult(k.Bytes()) |
||||
} |
||||
} |
||||
|
||||
// BenchmarkScalarBaseMultLarge benchmarks the secp256k1 curve ScalarBaseMult
|
||||
// function with abnormally large k values.
|
||||
func BenchmarkScalarBaseMultLarge(b *testing.B) { |
||||
k := fromHex("d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c005751111111011111110") |
||||
curve := S256() |
||||
for i := 0; i < b.N; i++ { |
||||
curve.ScalarBaseMult(k.Bytes()) |
||||
} |
||||
} |
||||
|
||||
// BenchmarkScalarMult benchmarks the secp256k1 curve ScalarMult function.
|
||||
func BenchmarkScalarMult(b *testing.B) { |
||||
x := fromHex("34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6") |
||||
y := fromHex("0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232") |
||||
k := fromHex("d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575") |
||||
curve := S256() |
||||
for i := 0; i < b.N; i++ { |
||||
curve.ScalarMult(x, y, k.Bytes()) |
||||
} |
||||
} |
||||
|
||||
// hexToModNScalar converts the passed hex string into a ModNScalar and will
|
||||
// panic if there is an error. This is only provided for the hard-coded
|
||||
// constants so errors in the source code can be detected. It will only (and
|
||||
// must only) be called with hard-coded values.
|
||||
func hexToModNScalar(s string) *ModNScalar { |
||||
b, err := hex.Dec(s) |
||||
if err != nil { |
||||
panic("invalid hex in source file: " + s) |
||||
} |
||||
var scalar ModNScalar |
||||
if overflow := scalar.SetByteSlice(b); overflow { |
||||
panic("hex in source file overflows mod N scalar: " + s) |
||||
} |
||||
return &scalar |
||||
} |
||||
|
||||
// BenchmarkFieldNormalize benchmarks how long it takes the internal field
|
||||
// to perform normalization (which includes modular reduction).
|
||||
func BenchmarkFieldNormalize(b *testing.B) { |
||||
// The normalize function is constant time so default value is fine.
|
||||
var f FieldVal |
||||
for i := 0; i < b.N; i++ { |
||||
f.Normalize() |
||||
} |
||||
} |
||||
|
||||
// BenchmarkParseCompressedPubKey benchmarks how long it takes to decompress and
|
||||
// validate a compressed public key from a byte array.
|
||||
func BenchmarkParseCompressedPubKey(b *testing.B) { |
||||
rawPk, _ := hex.Dec("0234f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6") |
||||
|
||||
var ( |
||||
pk *PublicKey |
||||
err error |
||||
) |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
for i := 0; i < b.N; i++ { |
||||
pk, err = ParsePubKey(rawPk) |
||||
} |
||||
_ = pk |
||||
_ = err |
||||
} |
||||
@ -1,53 +0,0 @@
@@ -1,53 +0,0 @@
|
||||
// Copyright 2010 The Go Authors. All rights reserved.
|
||||
// Copyright 2011 ThePiachu. All rights reserved.
|
||||
// Copyright 2013-2014 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package btcec |
||||
|
||||
// References:
|
||||
// [SECG]: Recommended Elliptic Curve Domain Parameters
|
||||
// http://www.secg.org/sec2-v2.pdf
|
||||
//
|
||||
// [GECC]: Guide to Elliptic Curve Cryptography (Hankerson, Menezes, Vanstone)
|
||||
|
||||
// This package operates, internally, on Jacobian coordinates. For a given
|
||||
// (x, y) position on the curve, the Jacobian coordinates are (x1, y1, z1)
|
||||
// where x = x1/z1² and y = y1/z1³. The greatest speedups come when the whole
|
||||
// calculation can be performed within the transform (as in ScalarMult and
|
||||
// ScalarBaseMult). But even for Add and Double, it's faster to apply and
|
||||
// reverse the transform than to operate in affine coordinates.
|
||||
|
||||
import ( |
||||
"next.orly.dev/pkg/crypto/ec/secp256k1" |
||||
) |
||||
|
||||
// KoblitzCurve provides an implementation for secp256k1 that fits the ECC
|
||||
// Curve interface from crypto/elliptic.
|
||||
type KoblitzCurve = secp256k1.KoblitzCurve |
||||
|
||||
// S256 returns a Curve which implements secp256k1.
|
||||
func S256() *KoblitzCurve { |
||||
return secp256k1.S256() |
||||
} |
||||
|
||||
// CurveParams contains the parameters for the secp256k1 curve.
|
||||
type CurveParams = secp256k1.CurveParams |
||||
|
||||
// Params returns the secp256k1 curve parameters for convenience.
|
||||
func Params() *CurveParams { |
||||
return secp256k1.Params() |
||||
} |
||||
|
||||
// Generator returns the public key at the Generator Point.
|
||||
func Generator() *PublicKey { |
||||
var ( |
||||
result JacobianPoint |
||||
k secp256k1.ModNScalar |
||||
) |
||||
k.SetInt(1) |
||||
ScalarBaseMultNonConst(&k, &result) |
||||
result.ToAffine() |
||||
return NewPublicKey(&result.X, &result.Y) |
||||
} |
||||
@ -1,918 +0,0 @@
@@ -1,918 +0,0 @@
|
||||
// Copyright 2011 The Go Authors. All rights reserved.
|
||||
// Copyright 2011 ThePiachu. All rights reserved.
|
||||
// Copyright 2013-2016 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package btcec |
||||
|
||||
import ( |
||||
"crypto/rand" |
||||
"fmt" |
||||
"math/big" |
||||
"testing" |
||||
) |
||||
|
||||
// isJacobianOnS256Curve returns boolean if the point (x,y,z) is on the
|
||||
// secp256k1 curve.
|
||||
func isJacobianOnS256Curve(point *JacobianPoint) bool { |
||||
// Elliptic curve equation for secp256k1 is: y^2 = x^3 + 7
|
||||
// In Jacobian coordinates, Y = y/z^3 and X = x/z^2
|
||||
// Thus:
|
||||
// (y/z^3)^2 = (x/z^2)^3 + 7
|
||||
// y^2/z^6 = x^3/z^6 + 7
|
||||
// y^2 = x^3 + 7*z^6
|
||||
var y2, z2, x3, result FieldVal |
||||
y2.SquareVal(&point.Y).Normalize() |
||||
z2.SquareVal(&point.Z) |
||||
x3.SquareVal(&point.X).Mul(&point.X) |
||||
result.SquareVal(&z2).Mul(&z2).MulInt(7).Add(&x3).Normalize() |
||||
return y2.Equals(&result) |
||||
} |
||||
|
||||
// TestAddJacobian tests addition of points projected in Jacobian coordinates.
|
||||
func TestAddJacobian(t *testing.T) { |
||||
tests := []struct { |
||||
x1, y1, z1 string // Coordinates (in hex) of first point to add
|
||||
x2, y2, z2 string // Coordinates (in hex) of second point to add
|
||||
x3, y3, z3 string // Coordinates (in hex) of expected point
|
||||
}{ |
||||
// Addition with a point at infinity (left hand side).
|
||||
// ∞ + P = P
|
||||
{ |
||||
"0", |
||||
"0", |
||||
"0", |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
"1", |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
"1", |
||||
}, |
||||
// Addition with a point at infinity (right hand side).
|
||||
// P + ∞ = P
|
||||
{ |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
"1", |
||||
"0", |
||||
"0", |
||||
"0", |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
"1", |
||||
}, |
||||
// Addition with z1=z2=1 different x values.
|
||||
{ |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"1", |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
"1", |
||||
"0cfbc7da1e569b334460788faae0286e68b3af7379d5504efc25e4dba16e46a6", |
||||
"e205f79361bbe0346b037b4010985dbf4f9e1e955e7d0d14aca876bfa79aad87", |
||||
"44a5646b446e3877a648d6d381370d9ef55a83b666ebce9df1b1d7d65b817b2f", |
||||
}, |
||||
// Addition with z1=z2=1 same x opposite y.
|
||||
// P(x, y, z) + P(x, -y, z) = infinity
|
||||
{ |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"1", |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"f48e156428cf0276dc092da5856e182288d7569f97934a56fe44be60f0d359fd", |
||||
"1", |
||||
"0", |
||||
"0", |
||||
"0", |
||||
}, |
||||
// Addition with z1=z2=1 same point.
|
||||
// P(x, y, z) + P(x, y, z) = 2P
|
||||
{ |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"1", |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"1", |
||||
"ec9f153b13ee7bd915882859635ea9730bf0dc7611b2c7b0e37ee64f87c50c27", |
||||
"b082b53702c466dcf6e984a35671756c506c67c2fcb8adb408c44dd0755c8f2a", |
||||
"16e3d537ae61fb1247eda4b4f523cfbaee5152c0d0d96b520376833c1e594464", |
||||
}, |
||||
|
||||
// Addition with z1=z2 (!=1) different x values.
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"5d2fe112c21891d440f65a98473cb626111f8a234d2cd82f22172e369f002147", |
||||
"98e3386a0a622a35c4561ffb32308d8e1c6758e10ebb1b4ebd3d04b4eb0ecbe8", |
||||
"2", |
||||
"cfbc7da1e569b334460788faae0286e68b3af7379d5504efc25e4dba16e46a60", |
||||
"817de4d86ef80d1ac0ded00426176fd3e787a5579f43452b2a1db021e6ac3778", |
||||
"129591ad11b8e1de99235b4e04dc367bd56a0ed99baf3a77c6c75f5a6e05f08d", |
||||
}, |
||||
// Addition with z1=z2 (!=1) same x opposite y.
|
||||
// P(x, y, z) + P(x, -y, z) = infinity
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"a470ab21467813b6e0496d2c2b70c11446bab4fcbc9a52b7f225f30e869aea9f", |
||||
"2", |
||||
"0", |
||||
"0", |
||||
"0", |
||||
}, |
||||
// Addition with z1=z2 (!=1) same point.
|
||||
// P(x, y, z) + P(x, y, z) = 2P
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"9f153b13ee7bd915882859635ea9730bf0dc7611b2c7b0e37ee65073c50fabac", |
||||
"2b53702c466dcf6e984a35671756c506c67c2fcb8adb408c44dd125dc91cb988", |
||||
"6e3d537ae61fb1247eda4b4f523cfbaee5152c0d0d96b520376833c2e5944a11", |
||||
}, |
||||
|
||||
// Addition with z1!=z2 and z2=1 different x values.
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
"1", |
||||
"3ef1f68795a6ccd1181e23eab80a1b9a2cebdcde755413bf097936eb5b91b4f3", |
||||
"0bef26c377c068d606f6802130bb7e9f3c3d2abcfa1a295950ed81133561cb04", |
||||
"252b235a2371c3bd3246b69c09b86cf7aad41db3375e74ef8d8ebeb4dc0be11a", |
||||
}, |
||||
// Addition with z1!=z2 and z2=1 same x opposite y.
|
||||
// P(x, y, z) + P(x, -y, z) = infinity
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"f48e156428cf0276dc092da5856e182288d7569f97934a56fe44be60f0d359fd", |
||||
"1", |
||||
"0", |
||||
"0", |
||||
"0", |
||||
}, |
||||
// Addition with z1!=z2 and z2=1 same point.
|
||||
// P(x, y, z) + P(x, y, z) = 2P
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"1", |
||||
"9f153b13ee7bd915882859635ea9730bf0dc7611b2c7b0e37ee65073c50fabac", |
||||
"2b53702c466dcf6e984a35671756c506c67c2fcb8adb408c44dd125dc91cb988", |
||||
"6e3d537ae61fb1247eda4b4f523cfbaee5152c0d0d96b520376833c2e5944a11", |
||||
}, |
||||
|
||||
// Addition with z1!=z2 and z2!=1 different x values.
|
||||
// P(x, y, z) + P(x, y, z) = 2P
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"91abba6a34b7481d922a4bd6a04899d5a686f6cf6da4e66a0cb427fb25c04bd4", |
||||
"03fede65e30b4e7576a2abefc963ddbf9fdccbf791b77c29beadefe49951f7d1", |
||||
"3", |
||||
"3f07081927fd3f6dadd4476614c89a09eba7f57c1c6c3b01fa2d64eac1eef31e", |
||||
"949166e04ebc7fd95a9d77e5dfd88d1492ecffd189792e3944eb2b765e09e031", |
||||
"eb8cba81bcffa4f44d75427506737e1f045f21e6d6f65543ee0e1d163540c931", |
||||
}, // Addition with z1!=z2 and z2!=1 same x opposite y.
|
||||
// P(x, y, z) + P(x, -y, z) = infinity
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"dcc3768780c74a0325e2851edad0dc8a566fa61a9e7fc4a34d13dcb509f99bc7", |
||||
"cafc41904dd5428934f7d075129c8ba46eb622d4fc88d72cd1401452664add18", |
||||
"3", |
||||
"0", |
||||
"0", |
||||
"0", |
||||
}, |
||||
// Addition with z1!=z2 and z2!=1 same point.
|
||||
// P(x, y, z) + P(x, y, z) = 2P
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"dcc3768780c74a0325e2851edad0dc8a566fa61a9e7fc4a34d13dcb509f99bc7", |
||||
"3503be6fb22abd76cb082f8aed63745b9149dd2b037728d32ebfebac99b51f17", |
||||
"3", |
||||
"9f153b13ee7bd915882859635ea9730bf0dc7611b2c7b0e37ee65073c50fabac", |
||||
"2b53702c466dcf6e984a35671756c506c67c2fcb8adb408c44dd125dc91cb988", |
||||
"6e3d537ae61fb1247eda4b4f523cfbaee5152c0d0d96b520376833c2e5944a11", |
||||
}, |
||||
} |
||||
|
||||
t.Logf("Running %d tests", len(tests)) |
||||
for i, test := range tests { |
||||
// Convert hex to Jacobian points.
|
||||
p1 := jacobianPointFromHex(test.x1, test.y1, test.z1) |
||||
p2 := jacobianPointFromHex(test.x2, test.y2, test.z2) |
||||
want := jacobianPointFromHex(test.x3, test.y3, test.z3) |
||||
// Ensure the test data is using points that are actually on
|
||||
// the curve (or the point at infinity).
|
||||
if !p1.Z.IsZero() && !isJacobianOnS256Curve(&p1) { |
||||
t.Errorf( |
||||
"#%d first point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
if !p2.Z.IsZero() && !isJacobianOnS256Curve(&p2) { |
||||
t.Errorf( |
||||
"#%d second point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
if !want.Z.IsZero() && !isJacobianOnS256Curve(&want) { |
||||
t.Errorf( |
||||
"#%d expected point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
// Add the two points.
|
||||
var r JacobianPoint |
||||
AddNonConst(&p1, &p2, &r) |
||||
|
||||
// Ensure result matches expected.
|
||||
if !r.X.Equals(&want.X) || !r.Y.Equals(&want.Y) || !r.Z.Equals(&want.Z) { |
||||
t.Errorf( |
||||
"#%d wrong result\ngot: (%v, %v, %v)\n"+ |
||||
"want: (%v, %v, %v)", i, r.X, r.Y, r.Z, want.X, want.Y, |
||||
want.Z, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestAddAffine tests addition of points in affine coordinates.
|
||||
func TestAddAffine(t *testing.T) { |
||||
tests := []struct { |
||||
x1, y1 string // Coordinates (in hex) of first point to add
|
||||
x2, y2 string // Coordinates (in hex) of second point to add
|
||||
x3, y3 string // Coordinates (in hex) of expected point
|
||||
}{ |
||||
// Addition with a point at infinity (left hand side).
|
||||
// ∞ + P = P
|
||||
{ |
||||
"0", |
||||
"0", |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
}, |
||||
// Addition with a point at infinity (right hand side).
|
||||
// P + ∞ = P
|
||||
{ |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
"0", |
||||
"0", |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
}, |
||||
|
||||
// Addition with different x values.
|
||||
{ |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"d74bf844b0862475103d96a611cf2d898447e288d34b360bc885cb8ce7c00575", |
||||
"131c670d414c4546b88ac3ff664611b1c38ceb1c21d76369d7a7a0969d61d97d", |
||||
"fd5b88c21d3143518d522cd2796f3d726793c88b3e05636bc829448e053fed69", |
||||
"21cf4f6a5be5ff6380234c50424a970b1f7e718f5eb58f68198c108d642a137f", |
||||
}, |
||||
// Addition with same x opposite y.
|
||||
// P(x, y) + P(x, -y) = infinity
|
||||
{ |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"f48e156428cf0276dc092da5856e182288d7569f97934a56fe44be60f0d359fd", |
||||
"0", |
||||
"0", |
||||
}, |
||||
// Addition with same point.
|
||||
// P(x, y) + P(x, y) = 2P
|
||||
{ |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"59477d88ae64a104dbb8d31ec4ce2d91b2fe50fa628fb6a064e22582196b365b", |
||||
"938dc8c0f13d1e75c987cb1a220501bd614b0d3dd9eb5c639847e1240216e3b6", |
||||
}, |
||||
} |
||||
t.Logf("Running %d tests", len(tests)) |
||||
for i, test := range tests { |
||||
// Convert hex to field values.
|
||||
x1, y1 := fromHex(test.x1), fromHex(test.y1) |
||||
x2, y2 := fromHex(test.x2), fromHex(test.y2) |
||||
x3, y3 := fromHex(test.x3), fromHex(test.y3) |
||||
// Ensure the test data is using points that are actually on
|
||||
// the curve (or the point at infinity).
|
||||
if !(x1.Sign() == 0 && y1.Sign() == 0) && !S256().IsOnCurve(x1, y1) { |
||||
t.Errorf( |
||||
"#%d first point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
if !(x2.Sign() == 0 && y2.Sign() == 0) && !S256().IsOnCurve(x2, y2) { |
||||
t.Errorf( |
||||
"#%d second point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
if !(x3.Sign() == 0 && y3.Sign() == 0) && !S256().IsOnCurve(x3, y3) { |
||||
t.Errorf( |
||||
"#%d expected point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
// Add the two points.
|
||||
rx, ry := S256().Add(x1, y1, x2, y2) |
||||
|
||||
// Ensure result matches expected.
|
||||
if rx.Cmp(x3) != 00 || ry.Cmp(y3) != 0 { |
||||
t.Errorf( |
||||
"#%d wrong result\ngot: (%x, %x)\n"+ |
||||
"want: (%x, %x)", i, rx, ry, x3, y3, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
|
||||
// isStrictlyEqual returns whether or not the two Jacobian points are strictly
|
||||
// equal for use in the tests. Recall that several Jacobian points can be
|
||||
// equal in affine coordinates, while not having the same coordinates in
|
||||
// projective space, so the two points not being equal doesn't necessarily mean
|
||||
// they aren't actually the same affine point.
|
||||
func isStrictlyEqual(p, other *JacobianPoint) bool { |
||||
return p.X.Equals(&other.X) && p.Y.Equals(&other.Y) && p.Z.Equals(&other.Z) |
||||
} |
||||
|
||||
// TestDoubleJacobian tests doubling of points projected in Jacobian
|
||||
// coordinates.
|
||||
func TestDoubleJacobian(t *testing.T) { |
||||
tests := []struct { |
||||
x1, y1, z1 string // Coordinates (in hex) of point to double
|
||||
x3, y3, z3 string // Coordinates (in hex) of expected point
|
||||
}{ |
||||
// Doubling a point at infinity is still infinity.
|
||||
{ |
||||
"0", |
||||
"0", |
||||
"0", |
||||
"0", |
||||
"0", |
||||
"0", |
||||
}, |
||||
// Doubling with z1=1.
|
||||
{ |
||||
"34f9460f0e4f08393d192b3c5133a6ba099aa0ad9fd54ebccfacdfa239ff49c6", |
||||
"0b71ea9bd730fd8923f6d25a7a91e7dd7728a960686cb5a901bb419e0f2ca232", |
||||
"1", |
||||
"ec9f153b13ee7bd915882859635ea9730bf0dc7611b2c7b0e37ee64f87c50c27", |
||||
"b082b53702c466dcf6e984a35671756c506c67c2fcb8adb408c44dd0755c8f2a", |
||||
"16e3d537ae61fb1247eda4b4f523cfbaee5152c0d0d96b520376833c1e594464", |
||||
}, |
||||
// Doubling with z1!=1.
|
||||
{ |
||||
"d3e5183c393c20e4f464acf144ce9ae8266a82b67f553af33eb37e88e7fd2718", |
||||
"5b8f54deb987ec491fb692d3d48f3eebb9454b034365ad480dda0cf079651190", |
||||
"2", |
||||
"9f153b13ee7bd915882859635ea9730bf0dc7611b2c7b0e37ee65073c50fabac", |
||||
"2b53702c466dcf6e984a35671756c506c67c2fcb8adb408c44dd125dc91cb988", |
||||
"6e3d537ae61fb1247eda4b4f523cfbaee5152c0d0d96b520376833c2e5944a11", |
||||
}, |
||||
// From btcd issue #709.
|
||||
{ |
||||
"201e3f75715136d2f93c4f4598f91826f94ca01f4233a5bd35de9708859ca50d", |
||||
"bdf18566445e7562c6ada68aef02d498d7301503de5b18c6aef6e2b1722412e1", |
||||
"0000000000000000000000000000000000000000000000000000000000000001", |
||||
"4a5e0559863ebb4e9ed85f5c4fa76003d05d9a7626616e614a1f738621e3c220", |
||||
"00000000000000000000000000000000000000000000000000000001b1388778", |
||||
"7be30acc88bceac58d5b4d15de05a931ae602a07bcb6318d5dedc563e4482993", |
||||
}, |
||||
} |
||||
t.Logf("Running %d tests", len(tests)) |
||||
for i, test := range tests { |
||||
// Convert hex to field values.
|
||||
p1 := jacobianPointFromHex(test.x1, test.y1, test.z1) |
||||
want := jacobianPointFromHex(test.x3, test.y3, test.z3) |
||||
// Ensure the test data is using points that are actually on
|
||||
// the curve (or the point at infinity).
|
||||
if !p1.Z.IsZero() && !isJacobianOnS256Curve(&p1) { |
||||
t.Errorf( |
||||
"#%d first point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
if !want.Z.IsZero() && !isJacobianOnS256Curve(&want) { |
||||
t.Errorf( |
||||
"#%d expected point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
// Double the point.
|
||||
var result JacobianPoint |
||||
DoubleNonConst(&p1, &result) |
||||
// Ensure result matches expected.
|
||||
if !isStrictlyEqual(&result, &want) { |
||||
t.Errorf( |
||||
"#%d wrong result\ngot: (%v, %v, %v)\n"+ |
||||
"want: (%v, %v, %v)", i, result.X, result.Y, result.Z, |
||||
want.X, want.Y, want.Z, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestDoubleAffine tests doubling of points in affine coordinates.
|
||||
func TestDoubleAffine(t *testing.T) { |
||||
tests := []struct { |
||||
x1, y1 string // Coordinates (in hex) of point to double
|
||||
x3, y3 string // Coordinates (in hex) of expected point
|
||||
}{ |
||||
// Doubling a point at infinity is still infinity.
|
||||
// 2*∞ = ∞ (point at infinity)
|
||||
{ |
||||
"0", |
||||
"0", |
||||
"0", |
||||
"0", |
||||
}, |
||||
// Random points.
|
||||
{ |
||||
"e41387ffd8baaeeb43c2faa44e141b19790e8ac1f7ff43d480dc132230536f86", |
||||
"1b88191d430f559896149c86cbcb703193105e3cf3213c0c3556399836a2b899", |
||||
"88da47a089d333371bd798c548ef7caae76e737c1980b452d367b3cfe3082c19", |
||||
"3b6f659b09a362821dfcfefdbfbc2e59b935ba081b6c249eb147b3c2100b1bc1", |
||||
}, |
||||
{ |
||||
"b3589b5d984f03ef7c80aeae444f919374799edf18d375cab10489a3009cff0c", |
||||
"c26cf343875b3630e15bccc61202815b5d8f1fd11308934a584a5babe69db36a", |
||||
"e193860172998751e527bb12563855602a227fc1f612523394da53b746bb2fb1", |
||||
"2bfcf13d2f5ab8bb5c611fab5ebbed3dc2f057062b39a335224c22f090c04789", |
||||
}, |
||||
{ |
||||
"2b31a40fbebe3440d43ac28dba23eee71c62762c3fe3dbd88b4ab82dc6a82340", |
||||
"9ba7deb02f5c010e217607fd49d58db78ec273371ea828b49891ce2fd74959a1", |
||||
"2c8d5ef0d343b1a1a48aa336078eadda8481cb048d9305dc4fdf7ee5f65973a2", |
||||
"bb4914ac729e26d3cd8f8dc8f702f3f4bb7e0e9c5ae43335f6e94c2de6c3dc95", |
||||
}, |
||||
{ |
||||
"61c64b760b51981fab54716d5078ab7dffc93730b1d1823477e27c51f6904c7a", |
||||
"ef6eb16ea1a36af69d7f66524c75a3a5e84c13be8fbc2e811e0563c5405e49bd", |
||||
"5f0dcdd2595f5ad83318a0f9da481039e36f135005420393e72dfca985b482f4", |
||||
"a01c849b0837065c1cb481b0932c441f49d1cab1b4b9f355c35173d93f110ae0", |
||||
}, |
||||
} |
||||
|
||||
t.Logf("Running %d tests", len(tests)) |
||||
for i, test := range tests { |
||||
// Convert hex to field values.
|
||||
x1, y1 := fromHex(test.x1), fromHex(test.y1) |
||||
x3, y3 := fromHex(test.x3), fromHex(test.y3) |
||||
// Ensure the test data is using points that are actually on
|
||||
// the curve (or the point at infinity).
|
||||
if !(x1.Sign() == 0 && y1.Sign() == 0) && !S256().IsOnCurve(x1, y1) { |
||||
t.Errorf( |
||||
"#%d first point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
if !(x3.Sign() == 0 && y3.Sign() == 0) && !S256().IsOnCurve(x3, y3) { |
||||
t.Errorf( |
||||
"#%d expected point is not on the curve -- "+ |
||||
"invalid test data", i, |
||||
) |
||||
continue |
||||
} |
||||
// Double the point.
|
||||
rx, ry := S256().Double(x1, y1) |
||||
|
||||
// Ensure result matches expected.
|
||||
if rx.Cmp(x3) != 00 || ry.Cmp(y3) != 0 { |
||||
t.Errorf( |
||||
"#%d wrong result\ngot: (%x, %x)\n"+ |
||||
"want: (%x, %x)", i, rx, ry, x3, y3, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
|
||||
func TestOnCurve(t *testing.T) { |
||||
s256 := S256() |
||||
if !s256.IsOnCurve(s256.Params().Gx, s256.Params().Gy) { |
||||
t.Errorf("FAIL S256") |
||||
} |
||||
} |
||||
|
||||
type baseMultTest struct { |
||||
k string |
||||
x, y string |
||||
} |
||||
|
||||
// TODO: add more test vectors
|
||||
var s256BaseMultTests = []baseMultTest{ |
||||
{ |
||||
"AA5E28D6A97A2479A65527F7290311A3624D4CC0FA1578598EE3C2613BF99522", |
||||
"34F9460F0E4F08393D192B3C5133A6BA099AA0AD9FD54EBCCFACDFA239FF49C6", |
||||
"B71EA9BD730FD8923F6D25A7A91E7DD7728A960686CB5A901BB419E0F2CA232", |
||||
}, |
||||
{ |
||||
"7E2B897B8CEBC6361663AD410835639826D590F393D90A9538881735256DFAE3", |
||||
"D74BF844B0862475103D96A611CF2D898447E288D34B360BC885CB8CE7C00575", |
||||
"131C670D414C4546B88AC3FF664611B1C38CEB1C21D76369D7A7A0969D61D97D", |
||||
}, |
||||
{ |
||||
"6461E6DF0FE7DFD05329F41BF771B86578143D4DD1F7866FB4CA7E97C5FA945D", |
||||
"E8AECC370AEDD953483719A116711963CE201AC3EB21D3F3257BB48668C6A72F", |
||||
"C25CAF2F0EBA1DDB2F0F3F47866299EF907867B7D27E95B3873BF98397B24EE1", |
||||
}, |
||||
{ |
||||
"376A3A2CDCD12581EFFF13EE4AD44C4044B8A0524C42422A7E1E181E4DEECCEC", |
||||
"14890E61FCD4B0BD92E5B36C81372CA6FED471EF3AA60A3E415EE4FE987DABA1", |
||||
"297B858D9F752AB42D3BCA67EE0EB6DCD1C2B7B0DBE23397E66ADC272263F982", |
||||
}, |
||||
{ |
||||
"1B22644A7BE026548810C378D0B2994EEFA6D2B9881803CB02CEFF865287D1B9", |
||||
"F73C65EAD01C5126F28F442D087689BFA08E12763E0CEC1D35B01751FD735ED3", |
||||
"F449A8376906482A84ED01479BD18882B919C140D638307F0C0934BA12590BDE", |
||||
}, |
||||
} |
||||
|
||||
// TODO: test different curves as well?
|
||||
func TestBaseMult(t *testing.T) { |
||||
s256 := S256() |
||||
for i, e := range s256BaseMultTests { |
||||
k, ok := new(big.Int).SetString(e.k, 16) |
||||
if !ok { |
||||
t.Errorf("%d: bad value for k: %s", i, e.k) |
||||
} |
||||
x, y := s256.ScalarBaseMult(k.Bytes()) |
||||
if fmt.Sprintf("%X", x) != e.x || fmt.Sprintf("%X", y) != e.y { |
||||
t.Errorf( |
||||
"%d: bad output for k=%s: got (%X, %X), want (%s, %s)", i, |
||||
e.k, x, y, e.x, e.y, |
||||
) |
||||
} |
||||
if testing.Short() && i > 5 { |
||||
break |
||||
} |
||||
} |
||||
} |
||||
|
||||
func TestBaseMultVerify(t *testing.T) { |
||||
s256 := S256() |
||||
for bytes := 1; bytes < 40; bytes++ { |
||||
for i := 0; i < 30; i++ { |
||||
data := make([]byte, bytes) |
||||
_, err := rand.Read(data) |
||||
if err != nil { |
||||
t.Errorf("failed to read random data for %d", i) |
||||
continue |
||||
} |
||||
x, y := s256.ScalarBaseMult(data) |
||||
xWant, yWant := s256.ScalarMult(s256.Gx, s256.Gy, data) |
||||
if x.Cmp(xWant) != 0 || y.Cmp(yWant) != 0 { |
||||
t.Errorf( |
||||
"%d: bad output for %X: got (%X, %X), want (%X, %X)", |
||||
i, data, x, y, xWant, yWant, |
||||
) |
||||
} |
||||
if testing.Short() && i > 2 { |
||||
break |
||||
} |
||||
} |
||||
} |
||||
} |
||||
|
||||
func TestScalarMult(t *testing.T) { |
||||
tests := []struct { |
||||
x string |
||||
y string |
||||
k string |
||||
rx string |
||||
ry string |
||||
}{ |
||||
// base mult, essentially.
|
||||
{ |
||||
"79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798", |
||||
"483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8", |
||||
"18e14a7b6a307f426a94f8114701e7c8e774e7f9a47e2c2035db29a206321725", |
||||
"50863ad64a87ae8a2fe83c1af1a8403cb53f53e486d8511dad8a04887e5b2352", |
||||
"2cd470243453a299fa9e77237716103abc11a1df38855ed6f2ee187e9c582ba6", |
||||
}, |
||||
// From btcd issue #709.
|
||||
{ |
||||
"000000000000000000000000000000000000000000000000000000000000002c", |
||||
"420e7a99bba18a9d3952597510fd2b6728cfeafc21a4e73951091d4d8ddbe94e", |
||||
"a2e8ba2e8ba2e8ba2e8ba2e8ba2e8ba219b51835b55cc30ebfe2f6599bc56f58", |
||||
"a2112dcdfbcd10ae1133a358de7b82db68e0a3eb4b492cc8268d1e7118c98788", |
||||
"27fc7463b7bb3c5f98ecf2c84a6272bb1681ed553d92c69f2dfe25a9f9fd3836", |
||||
}, |
||||
} |
||||
s256 := S256() |
||||
for i, test := range tests { |
||||
x, _ := new(big.Int).SetString(test.x, 16) |
||||
y, _ := new(big.Int).SetString(test.y, 16) |
||||
k, _ := new(big.Int).SetString(test.k, 16) |
||||
xWant, _ := new(big.Int).SetString(test.rx, 16) |
||||
yWant, _ := new(big.Int).SetString(test.ry, 16) |
||||
xGot, yGot := s256.ScalarMult(x, y, k.Bytes()) |
||||
if xGot.Cmp(xWant) != 0 || yGot.Cmp(yWant) != 0 { |
||||
t.Fatalf( |
||||
"%d: bad output: got (%X, %X), want (%X, %X)", i, xGot, |
||||
yGot, xWant, yWant, |
||||
) |
||||
} |
||||
} |
||||
} |
||||
|
||||
func TestScalarMultRand(t *testing.T) { |
||||
// Strategy for this test:
|
||||
// Get a random exponent from the generator point at first
|
||||
// This creates a new point which is used in the next iteration
|
||||
// Use another random exponent on the new point.
|
||||
// We use BaseMult to verify by multiplying the previous exponent
|
||||
// and the new random exponent together (mod no)
|
||||
s256 := S256() |
||||
x, y := s256.Gx, s256.Gy |
||||
exponent := big.NewInt(1) |
||||
for i := 0; i < 1024; i++ { |
||||
data := make([]byte, 32) |
||||
_, err := rand.Read(data) |
||||
if err != nil { |
||||
t.Fatalf("failed to read random data at %d", i) |
||||
break |
||||
} |
||||
x, y = s256.ScalarMult(x, y, data) |
||||
exponent.Mul(exponent, new(big.Int).SetBytes(data)) |
||||
xWant, yWant := s256.ScalarBaseMult(exponent.Bytes()) |
||||
if x.Cmp(xWant) != 0 || y.Cmp(yWant) != 0 { |
||||
t.Fatalf( |
||||
"%d: bad output for %X: got (%X, %X), want (%X, %X)", i, |
||||
data, x, y, xWant, yWant, |
||||
) |
||||
break |
||||
} |
||||
} |
||||
} |
||||
|
||||
var ( |
||||
// Next 6 constants are from Hal Finney's bitcointalk.org post:
|
||||
// https://bitcointalk.org/index.php?topic=3238.msg45565#msg45565
|
||||
// May he rest in peace.
|
||||
//
|
||||
// They have also been independently derived from the code in the
|
||||
// EndomorphismVectors function in genstatics.go.
|
||||
endomorphismLambda = fromHex("5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72") |
||||
endomorphismBeta = hexToFieldVal("7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee") |
||||
endomorphismA1 = fromHex("3086d221a7d46bcde86c90e49284eb15") |
||||
endomorphismB1 = fromHex("-e4437ed6010e88286f547fa90abfe4c3") |
||||
endomorphismA2 = fromHex("114ca50f7a8e2f3f657c1108d9d44cfd8") |
||||
endomorphismB2 = fromHex("3086d221a7d46bcde86c90e49284eb15") |
||||
) |
||||
|
||||
// splitK returns a balanced length-two representation of k and their signs.
|
||||
// This is algorithm 3.74 from [GECC].
|
||||
//
|
||||
// One thing of note about this algorithm is that no matter what c1 and c2 are,
|
||||
// the final equation of k = k1 + k2 * lambda (mod n) will hold. This is
|
||||
// provable mathematically due to how a1/b1/a2/b2 are computed.
|
||||
//
|
||||
// c1 and c2 are chosen to minimize the max(k1,k2).
|
||||
func splitK(k []byte) ([]byte, []byte, int, int) { |
||||
// All math here is done with big.Int, which is slow.
|
||||
// At some point, it might be useful to write something similar to
|
||||
// FieldVal but for no instead of P as the prime field if this ends up
|
||||
// being a bottleneck.
|
||||
bigIntK := new(big.Int) |
||||
c1, c2 := new(big.Int), new(big.Int) |
||||
tmp1, tmp2 := new(big.Int), new(big.Int) |
||||
k1, k2 := new(big.Int), new(big.Int) |
||||
bigIntK.SetBytes(k) |
||||
// c1 = round(b2 * k / n) from step 4.
|
||||
// Rounding isn't really necessary and costs too much, hence skipped
|
||||
c1.Mul(endomorphismB2, bigIntK) |
||||
c1.Div(c1, Params().N) |
||||
// c2 = round(b1 * k / n) from step 4 (sign reversed to optimize one step)
|
||||
// Rounding isn't really necessary and costs too much, hence skipped
|
||||
c2.Mul(endomorphismB1, bigIntK) |
||||
c2.Div(c2, Params().N) |
||||
// k1 = k - c1 * a1 - c2 * a2 from step 5 (note c2's sign is reversed)
|
||||
tmp1.Mul(c1, endomorphismA1) |
||||
tmp2.Mul(c2, endomorphismA2) |
||||
k1.Sub(bigIntK, tmp1) |
||||
k1.Add(k1, tmp2) |
||||
// k2 = - c1 * b1 - c2 * b2 from step 5 (note c2's sign is reversed)
|
||||
tmp1.Mul(c1, endomorphismB1) |
||||
tmp2.Mul(c2, endomorphismB2) |
||||
k2.Sub(tmp2, tmp1) |
||||
// Note Bytes() throws out the sign of k1 and k2. This matters
|
||||
// since k1 and/or k2 can be negative. Hence, we pass that
|
||||
// back separately.
|
||||
return k1.Bytes(), k2.Bytes(), k1.Sign(), k2.Sign() |
||||
} |
||||
|
||||
func TestSplitK(t *testing.T) { |
||||
tests := []struct { |
||||
k string |
||||
k1, k2 string |
||||
s1, s2 int |
||||
}{ |
||||
{ |
||||
"6df2b5d30854069ccdec40ae022f5c948936324a4e9ebed8eb82cfd5a6b6d766", |
||||
"00000000000000000000000000000000b776e53fb55f6b006a270d42d64ec2b1", |
||||
"00000000000000000000000000000000d6cc32c857f1174b604eefc544f0c7f7", |
||||
-1, -1, |
||||
}, |
||||
{ |
||||
"6ca00a8f10632170accc1b3baf2a118fa5725f41473f8959f34b8f860c47d88d", |
||||
"0000000000000000000000000000000007b21976c1795723c1bfbfa511e95b84", |
||||
"00000000000000000000000000000000d8d2d5f9d20fc64fd2cf9bda09a5bf90", |
||||
1, -1, |
||||
}, |
||||
{ |
||||
"b2eda8ab31b259032d39cbc2a234af17fcee89c863a8917b2740b67568166289", |
||||
"00000000000000000000000000000000507d930fecda7414fc4a523b95ef3c8c", |
||||
"00000000000000000000000000000000f65ffb179df189675338c6185cb839be", |
||||
-1, -1, |
||||
}, |
||||
{ |
||||
"f6f00e44f179936f2befc7442721b0633f6bafdf7161c167ffc6f7751980e3a0", |
||||
"0000000000000000000000000000000008d0264f10bcdcd97da3faa38f85308d", |
||||
"0000000000000000000000000000000065fed1506eb6605a899a54e155665f79", |
||||
-1, -1, |
||||
}, |
||||
{ |
||||
"8679085ab081dc92cdd23091ce3ee998f6b320e419c3475fae6b5b7d3081996e", |
||||
"0000000000000000000000000000000089fbf24fbaa5c3c137b4f1cedc51d975", |
||||
"00000000000000000000000000000000d38aa615bd6754d6f4d51ccdaf529fea", |
||||
-1, -1, |
||||
}, |
||||
{ |
||||
"6b1247bb7931dfcae5b5603c8b5ae22ce94d670138c51872225beae6bba8cdb3", |
||||
"000000000000000000000000000000008acc2a521b21b17cfb002c83be62f55d", |
||||
"0000000000000000000000000000000035f0eff4d7430950ecb2d94193dedc79", |
||||
-1, -1, |
||||
}, |
||||
{ |
||||
"a2e8ba2e8ba2e8ba2e8ba2e8ba2e8ba219b51835b55cc30ebfe2f6599bc56f58", |
||||
"0000000000000000000000000000000045c53aa1bb56fcd68c011e2dad6758e4", |
||||
"00000000000000000000000000000000a2e79d200f27f2360fba57619936159b", |
||||
-1, -1, |
||||
}, |
||||
} |
||||
s256 := S256() |
||||
for i, test := range tests { |
||||
k, ok := new(big.Int).SetString(test.k, 16) |
||||
if !ok { |
||||
t.Errorf("%d: bad value for k: %s", i, test.k) |
||||
} |
||||
k1, k2, k1Sign, k2Sign := splitK(k.Bytes()) |
||||
k1str := fmt.Sprintf("%064x", k1) |
||||
if test.k1 != k1str { |
||||
t.Errorf("%d: bad k1: got %v, want %v", i, k1str, test.k1) |
||||
} |
||||
k2str := fmt.Sprintf("%064x", k2) |
||||
if test.k2 != k2str { |
||||
t.Errorf("%d: bad k2: got %v, want %v", i, k2str, test.k2) |
||||
} |
||||
if test.s1 != k1Sign { |
||||
t.Errorf("%d: bad k1 sign: got %d, want %d", i, k1Sign, test.s1) |
||||
} |
||||
if test.s2 != k2Sign { |
||||
t.Errorf("%d: bad k2 sign: got %d, want %d", i, k2Sign, test.s2) |
||||
} |
||||
k1Int := new(big.Int).SetBytes(k1) |
||||
k1SignInt := new(big.Int).SetInt64(int64(k1Sign)) |
||||
k1Int.Mul(k1Int, k1SignInt) |
||||
k2Int := new(big.Int).SetBytes(k2) |
||||
k2SignInt := new(big.Int).SetInt64(int64(k2Sign)) |
||||
k2Int.Mul(k2Int, k2SignInt) |
||||
gotK := new(big.Int).Mul(k2Int, endomorphismLambda) |
||||
gotK.Add(k1Int, gotK) |
||||
gotK.Mod(gotK, s256.N) |
||||
if k.Cmp(gotK) != 0 { |
||||
t.Errorf("%d: bad k: got %X, want %X", i, gotK.Bytes(), k.Bytes()) |
||||
} |
||||
} |
||||
} |
||||
|
||||
func TestSplitKRand(t *testing.T) { |
||||
s256 := S256() |
||||
for i := 0; i < 1024; i++ { |
||||
bytesK := make([]byte, 32) |
||||
_, err := rand.Read(bytesK) |
||||
if err != nil { |
||||
t.Fatalf("failed to read random data at %d", i) |
||||
break |
||||
} |
||||
k := new(big.Int).SetBytes(bytesK) |
||||
k1, k2, k1Sign, k2Sign := splitK(bytesK) |
||||
k1Int := new(big.Int).SetBytes(k1) |
||||
k1SignInt := new(big.Int).SetInt64(int64(k1Sign)) |
||||
k1Int.Mul(k1Int, k1SignInt) |
||||
k2Int := new(big.Int).SetBytes(k2) |
||||
k2SignInt := new(big.Int).SetInt64(int64(k2Sign)) |
||||
k2Int.Mul(k2Int, k2SignInt) |
||||
gotK := new(big.Int).Mul(k2Int, endomorphismLambda) |
||||
gotK.Add(k1Int, gotK) |
||||
gotK.Mod(gotK, s256.N) |
||||
if k.Cmp(gotK) != 0 { |
||||
t.Errorf("%d: bad k: got %X, want %X", i, gotK.Bytes(), k.Bytes()) |
||||
} |
||||
} |
||||
} |
||||
|
||||
// Test this curve's usage with the ecdsa package.
|
||||
|
||||
func testKeyGeneration(t *testing.T, c *KoblitzCurve, tag string) { |
||||
priv, err := NewSecretKey() |
||||
if err != nil { |
||||
t.Errorf("%s: error: %s", tag, err) |
||||
return |
||||
} |
||||
pub := priv.PubKey() |
||||
if !c.IsOnCurve(pub.X(), pub.Y()) { |
||||
t.Errorf("%s: public key invalid: %s", tag, err) |
||||
} |
||||
} |
||||
|
||||
func TestKeyGeneration(t *testing.T) { |
||||
testKeyGeneration(t, S256(), "S256") |
||||
} |
||||
|
||||
// checkNAFEncoding returns an error if the provided positive and negative
|
||||
// portions of an overall NAF encoding do not adhere to the requirements or they
|
||||
// do not sum back to the provided original value.
|
||||
func checkNAFEncoding(pos, neg []byte, origValue *big.Int) error { |
||||
// NAF must not have a leading zero byte and the number of negative
|
||||
// bytes must not exceed the positive portion.
|
||||
if len(pos) > 0 && pos[0] == 0 { |
||||
return fmt.Errorf("positive has leading zero -- got %x", pos) |
||||
} |
||||
if len(neg) > len(pos) { |
||||
return fmt.Errorf( |
||||
"negative has len %d > pos len %d", len(neg), |
||||
len(pos), |
||||
) |
||||
} |
||||
// Ensure the result doesn't have any adjacent non-zero digits.
|
||||
gotPos := new(big.Int).SetBytes(pos) |
||||
gotNeg := new(big.Int).SetBytes(neg) |
||||
posOrNeg := new(big.Int).Or(gotPos, gotNeg) |
||||
prevBit := posOrNeg.Bit(0) |
||||
for bit := 1; bit < posOrNeg.BitLen(); bit++ { |
||||
thisBit := posOrNeg.Bit(bit) |
||||
if prevBit == 1 && thisBit == 1 { |
||||
return fmt.Errorf( |
||||
"adjacent non-zero digits found at bit pos %d", |
||||
bit-1, |
||||
) |
||||
} |
||||
prevBit = thisBit |
||||
} |
||||
// Ensure the resulting positive and negative portions of the overall
|
||||
// NAF representation sum back to the original value.
|
||||
gotValue := new(big.Int).Sub(gotPos, gotNeg) |
||||
if origValue.Cmp(gotValue) != 0 { |
||||
return fmt.Errorf( |
||||
"pos-neg is not original value: got %x, want %x", |
||||
gotValue, origValue, |
||||
) |
||||
} |
||||
return nil |
||||
} |
||||
@ -1,153 +0,0 @@
@@ -1,153 +0,0 @@
|
||||
package chaincfg |
||||
|
||||
import ( |
||||
"fmt" |
||||
"time" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/wire" |
||||
) |
||||
|
||||
var ( |
||||
// ErrNoBlockClock is returned when an operation fails due to lack of
|
||||
// synchornization with the current up to date block clock.
|
||||
ErrNoBlockClock = fmt.Errorf("no block clock synchronized") |
||||
) |
||||
|
||||
// ConsensusDeploymentStarter determines if a given consensus deployment has
|
||||
// started. A deployment has started once according to the current "time", the
|
||||
// deployment is eligible for activation once a perquisite condition has
|
||||
// passed.
|
||||
type ConsensusDeploymentStarter interface { |
||||
// HasStarted returns true if the consensus deployment has started.
|
||||
HasStarted(*wire.BlockHeader) (bool, error) |
||||
} |
||||
|
||||
// ConsensusDeploymentEnder determines if a given consensus deployment has
|
||||
// ended. A deployment has ended once according got eh current "time", the
|
||||
// deployment is no longer eligible for activation.
|
||||
type ConsensusDeploymentEnder interface { |
||||
// HasEnded returns true if the consensus deployment has ended.
|
||||
HasEnded(*wire.BlockHeader) (bool, error) |
||||
} |
||||
|
||||
// BlockClock is an abstraction over the past median time computation. The past
|
||||
// median time computation is used in several consensus checks such as CSV, and
|
||||
// also BIP 9 version bits. This interface allows callers to abstract away the
|
||||
// computation of the past median time from the perspective of a given block
|
||||
// header.
|
||||
type BlockClock interface { |
||||
// PastMedianTime returns the past median time from the PoV of the
|
||||
// passed block header. The past median time is the median time of the
|
||||
// 11 blocks prior to the passed block header.
|
||||
PastMedianTime(*wire.BlockHeader) (time.Time, error) |
||||
} |
||||
|
||||
// ClockConsensusDeploymentEnder is a more specialized version of the
|
||||
// ConsensusDeploymentEnder that uses a BlockClock in order to determine if a
|
||||
// deployment has started or not.
|
||||
//
|
||||
// NOTE: Any calls to HasEnded will _fail_ with ErrNoBlockClock if they
|
||||
// happen before SynchronizeClock is executed.
|
||||
type ClockConsensusDeploymentEnder interface { |
||||
ConsensusDeploymentEnder |
||||
// SynchronizeClock synchronizes the target ConsensusDeploymentStarter
|
||||
// with the current up-to date BlockClock.
|
||||
SynchronizeClock(clock BlockClock) |
||||
} |
||||
|
||||
// MedianTimeDeploymentStarter is a ClockConsensusDeploymentStarter that uses
|
||||
// the median time past of a target block node to determine if a deployment has
|
||||
// started.
|
||||
type MedianTimeDeploymentStarter struct { |
||||
blockClock BlockClock |
||||
startTime time.Time |
||||
} |
||||
|
||||
// NewMedianTimeDeploymentStarter returns a new instance of a
|
||||
// MedianTimeDeploymentStarter for a given start time. Using a time.Time
|
||||
// instance where IsZero() is true, indicates that a deployment should be
|
||||
// considered to always have been started.
|
||||
func NewMedianTimeDeploymentStarter(startTime time.Time) *MedianTimeDeploymentStarter { |
||||
return &MedianTimeDeploymentStarter{ |
||||
startTime: startTime, |
||||
} |
||||
} |
||||
|
||||
// HasStarted returns true if the consensus deployment has started.
|
||||
func (m *MedianTimeDeploymentStarter) HasStarted(blkHeader *wire.BlockHeader) ( |
||||
bool, |
||||
error, |
||||
) { |
||||
switch { |
||||
// If we haven't yet been synchronized with a block clock, then we
|
||||
// can't tell the time, so we'll fail.
|
||||
case m.blockClock == nil: |
||||
return false, ErrNoBlockClock |
||||
// If the time is "zero", then the deployment has always started.
|
||||
case m.startTime.IsZero(): |
||||
return true, nil |
||||
} |
||||
medianTime, err := m.blockClock.PastMedianTime(blkHeader) |
||||
if err != nil { |
||||
return false, err |
||||
} |
||||
// We check both after and equal here as after will fail for equivalent
|
||||
// times, and we want to be inclusive.
|
||||
return medianTime.After(m.startTime) || medianTime.Equal(m.startTime), nil |
||||
} |
||||
|
||||
// MedianTimeDeploymentEnder is a ClockConsensusDeploymentEnder that uses the
|
||||
// median time past of a target block to determine if a deployment has ended.
|
||||
type MedianTimeDeploymentEnder struct { |
||||
blockClock BlockClock |
||||
endTime time.Time |
||||
} |
||||
|
||||
// NewMedianTimeDeploymentEnder returns a new instance of the
|
||||
// MedianTimeDeploymentEnder anchored around the passed endTime. Using a
|
||||
// time.Time instance where IsZero() is true, indicates that a deployment
|
||||
// should be considered to never end.
|
||||
func NewMedianTimeDeploymentEnder(endTime time.Time) *MedianTimeDeploymentEnder { |
||||
return &MedianTimeDeploymentEnder{ |
||||
endTime: endTime, |
||||
} |
||||
} |
||||
|
||||
// HasEnded returns true if the deployment has ended.
|
||||
func (m *MedianTimeDeploymentEnder) HasEnded(blkHeader *wire.BlockHeader) ( |
||||
bool, |
||||
error, |
||||
) { |
||||
switch { |
||||
// If we haven't yet been synchronized with a block clock, then we can't tell
|
||||
// the time, so we'll we haven't yet been synchronized with a block
|
||||
// clock, then w can't tell the time, so we'll fail.
|
||||
case m.blockClock == nil: |
||||
return false, ErrNoBlockClock |
||||
// If the time is "zero", then the deployment never ends.
|
||||
case m.endTime.IsZero(): |
||||
return false, nil |
||||
} |
||||
medianTime, err := m.blockClock.PastMedianTime(blkHeader) |
||||
if err != nil { |
||||
return false, err |
||||
} |
||||
// We check both after and equal here as after will fail for equivalent
|
||||
// times, and we want to be inclusive.
|
||||
return medianTime.After(m.endTime) || medianTime.Equal(m.endTime), nil |
||||
} |
||||
|
||||
// EndTime returns the raw end time of the deployment.
|
||||
func (m *MedianTimeDeploymentEnder) EndTime() time.Time { |
||||
return m.endTime |
||||
} |
||||
|
||||
// SynchronizeClock synchronizes the target ConsensusDeploymentEnder with the
|
||||
// current up-to date BlockClock.
|
||||
func (m *MedianTimeDeploymentEnder) SynchronizeClock(clock BlockClock) { |
||||
m.blockClock = clock |
||||
} |
||||
|
||||
// A compile-time assertion to ensure MedianTimeDeploymentEnder implements the
|
||||
// ClockConsensusDeploymentStarter interface.
|
||||
var _ ClockConsensusDeploymentEnder = (*MedianTimeDeploymentEnder)(nil) |
||||
@ -1,110 +0,0 @@
@@ -1,110 +0,0 @@
|
||||
package chaincfg |
||||
|
||||
import ( |
||||
"time" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/chainhash" |
||||
"next.orly.dev/pkg/crypto/ec/wire" |
||||
) |
||||
|
||||
var ( |
||||
// genesisCoinbaseTx is the coinbase transaction for the genesis blocks for
|
||||
// the main network, regression test network, and test network (version 3).
|
||||
genesisCoinbaseTx = wire.MsgTx{ |
||||
Version: 1, |
||||
TxIn: []*wire.TxIn{ |
||||
{ |
||||
PreviousOutPoint: wire.OutPoint{ |
||||
Hash: chainhash.Hash{}, |
||||
Index: 0xffffffff, |
||||
}, |
||||
SignatureScript: []byte{ |
||||
0x04, 0xff, 0xff, 0x00, 0x1d, 0x01, 0x04, |
||||
0x45, /* |.......E| */ |
||||
0x54, 0x68, 0x65, 0x20, 0x54, 0x69, 0x6d, |
||||
0x65, /* |The Time| */ |
||||
0x73, 0x20, 0x30, 0x33, 0x2f, 0x4a, 0x61, |
||||
0x6e, /* |s 03/Jan| */ |
||||
0x2f, 0x32, 0x30, 0x30, 0x39, 0x20, 0x43, |
||||
0x68, /* |/2009 Ch| */ |
||||
0x61, 0x6e, 0x63, 0x65, 0x6c, 0x6c, 0x6f, |
||||
0x72, /* |ancellor| */ |
||||
0x20, 0x6f, 0x6e, 0x20, 0x62, 0x72, 0x69, |
||||
0x6e, /* | on brin| */ |
||||
0x6b, 0x20, 0x6f, 0x66, 0x20, 0x73, 0x65, |
||||
0x63, /* |k of sec|*/ |
||||
0x6f, 0x6e, 0x64, 0x20, 0x62, 0x61, 0x69, |
||||
0x6c, /* |ond bail| */ |
||||
0x6f, 0x75, 0x74, 0x20, 0x66, 0x6f, 0x72, |
||||
0x20, /* |out for |*/ |
||||
0x62, 0x61, 0x6e, 0x6b, 0x73, /* |banks| */ |
||||
}, |
||||
Sequence: 0xffffffff, |
||||
}, |
||||
}, |
||||
TxOut: []*wire.TxOut{ |
||||
{ |
||||
Value: 0x12a05f200, |
||||
PkScript: []byte{ |
||||
0x41, 0x04, 0x67, 0x8a, 0xfd, 0xb0, 0xfe, |
||||
0x55, /* |A.g....U| */ |
||||
0x48, 0x27, 0x19, 0x67, 0xf1, 0xa6, 0x71, |
||||
0x30, /* |H'.g..q0| */ |
||||
0xb7, 0x10, 0x5c, 0xd6, 0xa8, 0x28, 0xe0, |
||||
0x39, /* |..\..(.9| */ |
||||
0x09, 0xa6, 0x79, 0x62, 0xe0, 0xea, 0x1f, |
||||
0x61, /* |..yb...a| */ |
||||
0xde, 0xb6, 0x49, 0xf6, 0xbc, 0x3f, 0x4c, |
||||
0xef, /* |..I..?L.| */ |
||||
0x38, 0xc4, 0xf3, 0x55, 0x04, 0xe5, 0x1e, |
||||
0xc1, /* |8..U....| */ |
||||
0x12, 0xde, 0x5c, 0x38, 0x4d, 0xf7, 0xba, |
||||
0x0b, /* |..\8M...| */ |
||||
0x8d, 0x57, 0x8a, 0x4c, 0x70, 0x2b, 0x6b, |
||||
0xf1, /* |.W.Lp+k.| */ |
||||
0x1d, 0x5f, 0xac, /* |._.| */ |
||||
}, |
||||
}, |
||||
}, |
||||
LockTime: 0, |
||||
} |
||||
// genesisHash is the hash of the first block in the block chain for the main
|
||||
// network (genesis block).
|
||||
genesisHash = chainhash.Hash( |
||||
[chainhash.HashSize]byte{ |
||||
// Make go vet happy.
|
||||
0x6f, 0xe2, 0x8c, 0x0a, 0xb6, 0xf1, 0xb3, 0x72, |
||||
0xc1, 0xa6, 0xa2, 0x46, 0xae, 0x63, 0xf7, 0x4f, |
||||
0x93, 0x1e, 0x83, 0x65, 0xe1, 0x5a, 0x08, 0x9c, |
||||
0x68, 0xd6, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, |
||||
}, |
||||
) |
||||
// genesisMerkleRoot is the hash of the first transaction in the genesis block
|
||||
// for the main network.
|
||||
genesisMerkleRoot = chainhash.Hash( |
||||
[chainhash.HashSize]byte{ |
||||
// Make go vet happy.
|
||||
0x3b, 0xa3, 0xed, 0xfd, 0x7a, 0x7b, 0x12, 0xb2, |
||||
0x7a, 0xc7, 0x2c, 0x3e, 0x67, 0x76, 0x8f, 0x61, |
||||
0x7f, 0xc8, 0x1b, 0xc3, 0x88, 0x8a, 0x51, 0x32, |
||||
0x3a, 0x9f, 0xb8, 0xaa, 0x4b, 0x1e, 0x5e, 0x4a, |
||||
}, |
||||
) |
||||
// genesisBlock defines
|
||||
// genesisBlock defines the genesis block of the block chain which serves as the
|
||||
// public transaction ledger for the main network.
|
||||
genesisBlock = wire.MsgBlock{ |
||||
Header: wire.BlockHeader{ |
||||
Version: 1, |
||||
PrevBlock: chainhash.Hash{}, // 0000000000000000000000000000000000000000000000000000000000000000
|
||||
MerkleRoot: genesisMerkleRoot, // 4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b
|
||||
Timestamp: time.Unix( |
||||
0x495fab29, |
||||
0, |
||||
), // 2009-01-03 18:15:05 +0000 UTC
|
||||
Bits: 0x1d00ffff, // 486604799 [00000000ffff0000000000000000000000000000000000000000000000000000]
|
||||
Nonce: 0x7c2bac1d, // 2083236893
|
||||
}, |
||||
Transactions: []*wire.MsgTx{&genesisCoinbaseTx}, |
||||
} |
||||
) |
||||
@ -1,493 +0,0 @@
@@ -1,493 +0,0 @@
|
||||
// Package chaincfg provides basic parameters for bitcoin chain and testnets.
|
||||
package chaincfg |
||||
|
||||
import ( |
||||
"math/big" |
||||
"time" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/chainhash" |
||||
"next.orly.dev/pkg/crypto/ec/wire" |
||||
) |
||||
|
||||
var ( |
||||
// bigOne is 1 represented as a big.Int. It is defined here to avoid
|
||||
// the overhead of creating it multiple times.
|
||||
bigOne = big.NewInt(1) |
||||
|
||||
// mainPowLimit is the highest proof of work value a Bitcoin block can
|
||||
// have for the main network. It is the value 2^224 - 1.
|
||||
mainPowLimit = new(big.Int).Sub(new(big.Int).Lsh(bigOne, 224), bigOne) |
||||
) |
||||
|
||||
// Constants that define the deployment offset in the deployments field of the
|
||||
// parameters for each deployment. This is useful to be able to get the details
|
||||
// of a specific deployment by name.
|
||||
const ( |
||||
// DeploymentTestDummy defines the rule change deployment ID for testing
|
||||
// purposes.
|
||||
DeploymentTestDummy = iota |
||||
|
||||
// DeploymentTestDummyMinActivation defines the rule change deployment
|
||||
// ID for testing purposes. This differs from the DeploymentTestDummy
|
||||
// in that it specifies the newer params the taproot fork used for
|
||||
// activation: a custom threshold and a min activation height.
|
||||
DeploymentTestDummyMinActivation |
||||
|
||||
// DeploymentCSV defines the rule change deployment ID for the CSV
|
||||
// soft-fork package. The CSV package includes the deployment of BIPS
|
||||
// 68, 112, and 113.
|
||||
DeploymentCSV |
||||
|
||||
// DeploymentSegwit defines the rule change deployment ID for the
|
||||
// Segregated Witness (segwit) soft-fork package. The segwit package
|
||||
// includes the deployment of BIPS 141, 142, 144, 145, 147 and 173.
|
||||
DeploymentSegwit |
||||
|
||||
// DeploymentTaproot defines the rule change deployment ID for the
|
||||
// Taproot (+Schnorr) soft-fork package. The taproot package includes
|
||||
// the deployment of BIPS 340, 341 and 342.
|
||||
DeploymentTaproot |
||||
|
||||
// NOTE: DefinedDeployments must always come last since it is used to
|
||||
// determine how many defined deployments there currently are.
|
||||
|
||||
// DefinedDeployments is the number of currently defined deployments.
|
||||
DefinedDeployments |
||||
) |
||||
|
||||
// ConsensusDeployment defines details related to a specific consensus rule
|
||||
// change that is voted in. This is part of BIP0009.
|
||||
type ConsensusDeployment struct { |
||||
// BitNumber defines the specific bit number within the block version
|
||||
// this particular soft-fork deployment refers to.
|
||||
BitNumber uint8 |
||||
|
||||
// MinActivationHeight is an optional field that when set (default
|
||||
// value being zero), modifies the traditional BIP 9 state machine by
|
||||
// only transitioning from LockedIn to Active once the block height is
|
||||
// greater than (or equal to) thus specified height.
|
||||
MinActivationHeight uint32 |
||||
|
||||
// CustomActivationThreshold if set (non-zero), will _override_ the
|
||||
// existing RuleChangeActivationThreshold value set at the
|
||||
// network/chain level. This value divided by the active
|
||||
// MinerConfirmationWindow denotes the threshold required for
|
||||
// activation. A value of 1815 block denotes a 90% threshold.
|
||||
CustomActivationThreshold uint32 |
||||
|
||||
// DeploymentStarter is used to determine if the given
|
||||
// ConsensusDeployment has started or not.
|
||||
DeploymentStarter ConsensusDeploymentStarter |
||||
|
||||
// DeploymentEnder is used to determine if the given
|
||||
// ConsensusDeployment has ended or not.
|
||||
DeploymentEnder ConsensusDeploymentEnder |
||||
} |
||||
|
||||
// Checkpoint identifies a known good point in the block chain. Using
|
||||
// checkpoints allows a few optimizations for old blocks during initial download
|
||||
// and also prevents forks from old blocks.
|
||||
//
|
||||
// Each checkpoint is selected based upon several factors. See the
|
||||
// documentation for blockchain.IsCheckpointCandidate for details on the
|
||||
// selection criteria.
|
||||
type Checkpoint struct { |
||||
Height int32 |
||||
Hash *chainhash.Hash |
||||
} |
||||
|
||||
// DNSSeed identifies a DNS seed.
|
||||
type DNSSeed struct { |
||||
// Host defines the hostname of the seed.
|
||||
Host string |
||||
|
||||
// HasFiltering defines whether the seed supports filtering
|
||||
// by service flags (wire.ServiceFlag).
|
||||
HasFiltering bool |
||||
} |
||||
|
||||
// Params defines a Bitcoin network by its parameters. These parameters may be
|
||||
// used by Bitcoin applications to differentiate networks as well as addresses
|
||||
// and keys for one network from those intended for use on another network.
|
||||
type Params struct { |
||||
// Name defines a human-readable identifier for the network.
|
||||
Name string |
||||
|
||||
// Net defines the magic bytes used to identify the network.
|
||||
Net wire.BitcoinNet |
||||
|
||||
// DefaultPort defines the default peer-to-peer port for the network.
|
||||
DefaultPort string |
||||
|
||||
// DNSSeeds defines a list of DNS seeds for the network that are used
|
||||
// as one method to discover peers.
|
||||
DNSSeeds []DNSSeed |
||||
|
||||
// GenesisBlock defines the first block of the chain.
|
||||
GenesisBlock *wire.MsgBlock |
||||
|
||||
// GenesisHash is the starting block hash.
|
||||
GenesisHash *chainhash.Hash |
||||
|
||||
// PowLimit defines the highest allowed proof of work value for a block
|
||||
// as a uint256.
|
||||
PowLimit *big.Int |
||||
|
||||
// PowLimitBits defines the highest allowed proof of work value for a
|
||||
// block in compact form.
|
||||
PowLimitBits uint32 |
||||
|
||||
// PoWNoRetargeting defines whether the network has difficulty
|
||||
// retargeting enabled or not. This should only be set to true for
|
||||
// regtest like networks.
|
||||
PoWNoRetargeting bool |
||||
|
||||
// These fields define the block heights at which the specified softfork
|
||||
// BIP became active.
|
||||
BIP0034Height int32 |
||||
BIP0065Height int32 |
||||
BIP0066Height int32 |
||||
|
||||
// CoinbaseMaturity is the number of blocks required before newly mined
|
||||
// coins (coinbase transactions) can be spent.
|
||||
CoinbaseMaturity uint16 |
||||
|
||||
// SubsidyReductionInterval is the interval of blocks before the subsidy
|
||||
// is reduced.
|
||||
SubsidyReductionInterval int32 |
||||
|
||||
// TargetTimespan is the desired amount of time that should elapse
|
||||
// before the block difficulty requirement is examined to determine how
|
||||
// it should be changed in order to maintain the desired block
|
||||
// generation rate.
|
||||
TargetTimespan time.Duration |
||||
|
||||
// TargetTimePerBlock is the desired amount of time to generate each
|
||||
// block.
|
||||
TargetTimePerBlock time.Duration |
||||
|
||||
// RetargetAdjustmentFactor is the adjustment factor used to limit
|
||||
// the minimum and maximum amount of adjustment that can occur between
|
||||
// difficulty retargets.
|
||||
RetargetAdjustmentFactor int64 |
||||
|
||||
// ReduceMinDifficulty defines whether the network should reduce the
|
||||
// minimum required difficulty after a long enough period of time has
|
||||
// passed without finding a block. This is really only useful for test
|
||||
// networks and should not be set on a main network.
|
||||
ReduceMinDifficulty bool |
||||
|
||||
// MinDiffReductionTime is the amount of time after which the minimum
|
||||
// required difficulty should be reduced when a block hasn't been found.
|
||||
//
|
||||
// NOTE: This only applies if ReduceMinDifficulty is true.
|
||||
MinDiffReductionTime time.Duration |
||||
|
||||
// GenerateSupported specifies whether or not CPU mining is allowed.
|
||||
GenerateSupported bool |
||||
|
||||
// Checkpoints ordered from oldest to newest.
|
||||
Checkpoints []Checkpoint |
||||
|
||||
// These fields are related to voting on consensus rule changes as
|
||||
// defined by BIP0009.
|
||||
//
|
||||
// RuleChangeActivationThreshold is the number of blocks in a threshold
|
||||
// state retarget window for which a positive vote for a rule change
|
||||
// must be cast in order to lock in a rule change. It should typically
|
||||
// be 95% for the main network and 75% for test networks.
|
||||
//
|
||||
// MinerConfirmationWindow is the number of blocks in each threshold
|
||||
// state retarget window.
|
||||
//
|
||||
// Deployments define the specific consensus rule changes to be voted
|
||||
// on.
|
||||
RuleChangeActivationThreshold uint32 |
||||
MinerConfirmationWindow uint32 |
||||
Deployments [DefinedDeployments]ConsensusDeployment |
||||
|
||||
// Mempool parameters
|
||||
RelayNonStdTxs bool |
||||
|
||||
// Human-readable part for Bech32 encoded segwit addresses, as defined
|
||||
// in BIP 173.
|
||||
Bech32HRPSegwit []byte |
||||
|
||||
// Address encoding magics
|
||||
PubKeyHashAddrID byte // First byte of a P2PKH address
|
||||
ScriptHashAddrID byte // First byte of a P2SH address
|
||||
PrivateKeyID byte // First byte of a WIF private key
|
||||
WitnessPubKeyHashAddrID byte // First byte of a P2WPKH address
|
||||
WitnessScriptHashAddrID byte // First byte of a P2WSH address
|
||||
|
||||
// BIP32 hierarchical deterministic extended key magics
|
||||
HDPrivateKeyID [4]byte |
||||
HDPublicKeyID [4]byte |
||||
|
||||
// BIP44 coin type used in the hierarchical deterministic path for
|
||||
// address generation.
|
||||
HDCoinType uint32 |
||||
} |
||||
|
||||
// MainNetParams defines the network parameters for the main Bitcoin network.
|
||||
var MainNetParams = Params{ |
||||
Name: "mainnet", |
||||
Net: wire.MainNet, |
||||
DefaultPort: "8333", |
||||
DNSSeeds: []DNSSeed{ |
||||
{"seed.bitcoin.sipa.be", true}, |
||||
{"dnsseed.bluematt.me", true}, |
||||
{"dnsseed.bitcoin.dashjr.org", false}, |
||||
{"seed.bitcoinstats.com", true}, |
||||
{"seed.bitnodes.io", false}, |
||||
{"seed.bitcoin.jonasschnelli.ch", true}, |
||||
}, |
||||
|
||||
// Chain parameters
|
||||
GenesisBlock: &genesisBlock, |
||||
GenesisHash: &genesisHash, |
||||
PowLimit: mainPowLimit, |
||||
PowLimitBits: 0x1d00ffff, |
||||
BIP0034Height: 227931, // 000000000000024b89b42a942fe0d9fea3bb44ab7bd1b19115dd6a759c0808b8
|
||||
BIP0065Height: 388381, // 000000000000000004c2b624ed5d7756c508d90fd0da2c7c679febfa6c4735f0
|
||||
BIP0066Height: 363725, // 00000000000000000379eaa19dce8c9b722d46ae6a57c2f1a988119488b50931
|
||||
CoinbaseMaturity: 100, |
||||
SubsidyReductionInterval: 210000, |
||||
TargetTimespan: time.Hour * 24 * 14, // 14 days
|
||||
TargetTimePerBlock: time.Minute * 10, // 10 minutes
|
||||
RetargetAdjustmentFactor: 4, // 25% less, 400% more
|
||||
ReduceMinDifficulty: false, |
||||
MinDiffReductionTime: 0, |
||||
GenerateSupported: false, |
||||
|
||||
// Checkpoints ordered from oldest to newest.
|
||||
Checkpoints: []Checkpoint{ |
||||
{ |
||||
11111, |
||||
newHashFromStr("0000000069e244f73d78e8fd29ba2fd2ed618bd6fa2ee92559f542fdb26e7c1d"), |
||||
}, |
||||
{ |
||||
33333, |
||||
newHashFromStr("000000002dd5588a74784eaa7ab0507a18ad16a236e7b1ce69f00d7ddfb5d0a6"), |
||||
}, |
||||
{ |
||||
74000, |
||||
newHashFromStr("0000000000573993a3c9e41ce34471c079dcf5f52a0e824a81e7f953b8661a20"), |
||||
}, |
||||
{ |
||||
105000, |
||||
newHashFromStr("00000000000291ce28027faea320c8d2b054b2e0fe44a773f3eefb151d6bdc97"), |
||||
}, |
||||
{ |
||||
134444, |
||||
newHashFromStr("00000000000005b12ffd4cd315cd34ffd4a594f430ac814c91184a0d42d2b0fe"), |
||||
}, |
||||
{ |
||||
168000, |
||||
newHashFromStr("000000000000099e61ea72015e79632f216fe6cb33d7899acb35b75c8303b763"), |
||||
}, |
||||
{ |
||||
193000, |
||||
newHashFromStr("000000000000059f452a5f7340de6682a977387c17010ff6e6c3bd83ca8b1317"), |
||||
}, |
||||
{ |
||||
210000, |
||||
newHashFromStr("000000000000048b95347e83192f69cf0366076336c639f9b7228e9ba171342e"), |
||||
}, |
||||
{ |
||||
216116, |
||||
newHashFromStr("00000000000001b4f4b433e81ee46494af945cf96014816a4e2370f11b23df4e"), |
||||
}, |
||||
{ |
||||
225430, |
||||
newHashFromStr("00000000000001c108384350f74090433e7fcf79a606b8e797f065b130575932"), |
||||
}, |
||||
{ |
||||
250000, |
||||
newHashFromStr("000000000000003887df1f29024b06fc2200b55f8af8f35453d7be294df2d214"), |
||||
}, |
||||
{ |
||||
267300, |
||||
newHashFromStr("000000000000000a83fbd660e918f218bf37edd92b748ad940483c7c116179ac"), |
||||
}, |
||||
{ |
||||
279000, |
||||
newHashFromStr("0000000000000001ae8c72a0b0c301f67e3afca10e819efa9041e458e9bd7e40"), |
||||
}, |
||||
{ |
||||
300255, |
||||
newHashFromStr("0000000000000000162804527c6e9b9f0563a280525f9d08c12041def0a0f3b2"), |
||||
}, |
||||
{ |
||||
319400, |
||||
newHashFromStr("000000000000000021c6052e9becade189495d1c539aa37c58917305fd15f13b"), |
||||
}, |
||||
{ |
||||
343185, |
||||
newHashFromStr("0000000000000000072b8bf361d01a6ba7d445dd024203fafc78768ed4368554"), |
||||
}, |
||||
{ |
||||
352940, |
||||
newHashFromStr("000000000000000010755df42dba556bb72be6a32f3ce0b6941ce4430152c9ff"), |
||||
}, |
||||
{ |
||||
382320, |
||||
newHashFromStr("00000000000000000a8dc6ed5b133d0eb2fd6af56203e4159789b092defd8ab2"), |
||||
}, |
||||
{ |
||||
400000, |
||||
newHashFromStr("000000000000000004ec466ce4732fe6f1ed1cddc2ed4b328fff5224276e3f6f"), |
||||
}, |
||||
{ |
||||
430000, |
||||
newHashFromStr("000000000000000001868b2bb3a285f3cc6b33ea234eb70facf4dcdf22186b87"), |
||||
}, |
||||
{ |
||||
460000, |
||||
newHashFromStr("000000000000000000ef751bbce8e744ad303c47ece06c8d863e4d417efc258c"), |
||||
}, |
||||
{ |
||||
490000, |
||||
newHashFromStr("000000000000000000de069137b17b8d5a3dfbd5b145b2dcfb203f15d0c4de90"), |
||||
}, |
||||
{ |
||||
520000, |
||||
newHashFromStr("0000000000000000000d26984c0229c9f6962dc74db0a6d525f2f1640396f69c"), |
||||
}, |
||||
{ |
||||
550000, |
||||
newHashFromStr("000000000000000000223b7a2298fb1c6c75fb0efc28a4c56853ff4112ec6bc9"), |
||||
}, |
||||
{ |
||||
560000, |
||||
newHashFromStr("0000000000000000002c7b276daf6efb2b6aa68e2ce3be67ef925b3264ae7122"), |
||||
}, |
||||
{ |
||||
563378, |
||||
newHashFromStr("0000000000000000000f1c54590ee18d15ec70e68c8cd4cfbadb1b4f11697eee"), |
||||
}, |
||||
{ |
||||
597379, |
||||
newHashFromStr("00000000000000000005f8920febd3925f8272a6a71237563d78c2edfdd09ddf"), |
||||
}, |
||||
{ |
||||
623950, |
||||
newHashFromStr("0000000000000000000f2adce67e49b0b6bdeb9de8b7c3d7e93b21e7fc1e819d"), |
||||
}, |
||||
{ |
||||
654683, |
||||
newHashFromStr("0000000000000000000b9d2ec5a352ecba0592946514a92f14319dc2b367fc72"), |
||||
}, |
||||
{ |
||||
691719, |
||||
newHashFromStr("00000000000000000008a89e854d57e5667df88f1cdef6fde2fbca1de5b639ad"), |
||||
}, |
||||
{ |
||||
724466, |
||||
newHashFromStr("000000000000000000052d314a259755ca65944e68df6b12a067ea8f1f5a7091"), |
||||
}, |
||||
{ |
||||
751565, |
||||
newHashFromStr("00000000000000000009c97098b5295f7e5f183ac811fb5d1534040adb93cabd"), |
||||
}, |
||||
}, |
||||
|
||||
// Consensus rule change deployments.
|
||||
//
|
||||
// The miner confirmation window is defined as:
|
||||
// target proof of work timespan / target proof of work spacing
|
||||
RuleChangeActivationThreshold: 1916, // 95% of MinerConfirmationWindow
|
||||
MinerConfirmationWindow: 2016, //
|
||||
Deployments: [DefinedDeployments]ConsensusDeployment{ |
||||
DeploymentTestDummy: { |
||||
BitNumber: 28, |
||||
DeploymentStarter: NewMedianTimeDeploymentStarter( |
||||
time.Unix(11991456010, 0), // January 1, 2008 UTC
|
||||
), |
||||
DeploymentEnder: NewMedianTimeDeploymentEnder( |
||||
time.Unix(1230767999, 0), // December 31, 2008 UTC
|
||||
), |
||||
}, |
||||
DeploymentTestDummyMinActivation: { |
||||
BitNumber: 22, |
||||
CustomActivationThreshold: 1815, // Only needs 90% hash rate.
|
||||
MinActivationHeight: 10_0000, // Can only activate after height 10k.
|
||||
DeploymentStarter: NewMedianTimeDeploymentStarter( |
||||
time.Time{}, // Always available for vote
|
||||
), |
||||
DeploymentEnder: NewMedianTimeDeploymentEnder( |
||||
time.Time{}, // Never expires
|
||||
), |
||||
}, |
||||
DeploymentCSV: { |
||||
BitNumber: 0, |
||||
DeploymentStarter: NewMedianTimeDeploymentStarter( |
||||
time.Unix(1462060800, 0), // May 1st, 2016
|
||||
), |
||||
DeploymentEnder: NewMedianTimeDeploymentEnder( |
||||
time.Unix(1493596800, 0), // May 1st, 2017
|
||||
), |
||||
}, |
||||
DeploymentSegwit: { |
||||
BitNumber: 1, |
||||
DeploymentStarter: NewMedianTimeDeploymentStarter( |
||||
time.Unix(1479168000, 0), // November 15, 2016 UTC
|
||||
), |
||||
DeploymentEnder: NewMedianTimeDeploymentEnder( |
||||
time.Unix(1510704000, 0), // November 15, 2017 UTC.
|
||||
), |
||||
}, |
||||
DeploymentTaproot: { |
||||
BitNumber: 2, |
||||
DeploymentStarter: NewMedianTimeDeploymentStarter( |
||||
time.Unix(1619222400, 0), // April 24th, 2021 UTC.
|
||||
), |
||||
DeploymentEnder: NewMedianTimeDeploymentEnder( |
||||
time.Unix(1628640000, 0), // August 11th, 2021 UTC.
|
||||
), |
||||
CustomActivationThreshold: 1815, // 90%
|
||||
MinActivationHeight: 709_632, |
||||
}, |
||||
}, |
||||
|
||||
// Mempool parameters
|
||||
RelayNonStdTxs: false, |
||||
|
||||
// Human-readable part for Bech32 encoded segwit addresses, as defined in
|
||||
// BIP 173.
|
||||
Bech32HRPSegwit: []byte("bc"), // always bc for main net
|
||||
|
||||
// Address encoding magics
|
||||
PubKeyHashAddrID: 0x00, // starts with 1
|
||||
ScriptHashAddrID: 0x05, // starts with 3
|
||||
PrivateKeyID: 0x80, // starts with 5 (uncompressed) or K (compressed)
|
||||
WitnessPubKeyHashAddrID: 0x06, // starts with p2
|
||||
WitnessScriptHashAddrID: 0x0A, // starts with 7Xh
|
||||
|
||||
// BIP32 hierarchical deterministic extended key magics
|
||||
HDPrivateKeyID: [4]byte{0x04, 0x88, 0xad, 0xe4}, // starts with xprv
|
||||
HDPublicKeyID: [4]byte{0x04, 0x88, 0xb2, 0x1e}, // starts with xpub
|
||||
|
||||
// BIP44 coin type used in the hierarchical deterministic path for
|
||||
// address generation.
|
||||
HDCoinType: 0, |
||||
} |
||||
|
||||
// newHashFromStr converts the passed big-endian hex string into a
|
||||
// chainhash.Hash. It only differs from the one available in chainhash in that
|
||||
// it panics on an error since it will only (and must only) be called with
|
||||
// hard-coded, and therefore known good, hashes.
|
||||
func newHashFromStr(hexStr string) *chainhash.Hash { |
||||
hash, err := chainhash.NewHashFromStr(hexStr) |
||||
if err != nil { |
||||
// Ordinarily I don't like panics in library code since it
|
||||
// can take applications down without them having a chance to
|
||||
// recover which is extremely annoying, however an exception is
|
||||
// being made in this case because the only way this can panic
|
||||
// is if there is an error in the hard-coded hashes. Thus it
|
||||
// will only ever potentially panic on init and therefore is
|
||||
// 100% predictable.
|
||||
panic(err) |
||||
} |
||||
return hash |
||||
} |
||||
@ -1,17 +0,0 @@
@@ -1,17 +0,0 @@
|
||||
# chainhash |
||||
|
||||
# [](http://copyfree.org) |
||||
|
||||
chainhash provides a generic hash type and associated functions that allows the |
||||
specific hash algorithm to be abstracted. |
||||
|
||||
## Installation and Updating |
||||
|
||||
```bash |
||||
$ go get -u mleku.online/git/ec/chainhash |
||||
``` |
||||
|
||||
## License |
||||
|
||||
Package chainhash is licensed under the [copyfree](http://copyfree.org) ISC |
||||
License. |
||||
@ -1,5 +0,0 @@
@@ -1,5 +0,0 @@
|
||||
// Package chainhash provides abstracted hash functionality.
|
||||
//
|
||||
// This package provides a generic hash type and associated functions that
|
||||
// allows the specific hash algorithm to be abstracted.
|
||||
package chainhash |
||||
@ -1,229 +0,0 @@
@@ -1,229 +0,0 @@
|
||||
// Copyright (c) 2013-2016 The btcsuite developers
|
||||
// Copyright (c) 2015 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package chainhash |
||||
|
||||
import ( |
||||
"encoding/json" |
||||
"fmt" |
||||
|
||||
"github.com/minio/sha256-simd" |
||||
"next.orly.dev/pkg/encoders/hex" |
||||
) |
||||
|
||||
const ( |
||||
// HashSize of array used to store hashes. See Hash.
|
||||
HashSize = 32 |
||||
// MaxHashStringSize is the maximum length of a Hash hash string.
|
||||
MaxHashStringSize = HashSize * 2 |
||||
) |
||||
|
||||
var ( |
||||
// TagBIP0340Challenge is the BIP-0340 tag for challenges.
|
||||
TagBIP0340Challenge = []byte("BIP0340/challenge") |
||||
// TagBIP0340Aux is the BIP-0340 tag for aux data.
|
||||
TagBIP0340Aux = []byte("BIP0340/aux") |
||||
// TagBIP0340Nonce is the BIP-0340 tag for nonces.
|
||||
TagBIP0340Nonce = []byte("BIP0340/nonce") |
||||
// TagTapSighash is the tag used by BIP 341 to generate the sighash
|
||||
// flags.
|
||||
TagTapSighash = []byte("TapSighash") |
||||
// TagTapLeaf is the message tag prefix used to compute the hash
|
||||
// digest of a tapscript leaf.
|
||||
TagTapLeaf = []byte("TapLeaf") |
||||
// TagTapBranch is the message tag prefix used to compute the
|
||||
// hash digest of two tap leaves into a taproot branch node.
|
||||
TagTapBranch = []byte("TapBranch") |
||||
// TagTapTweak is the message tag prefix used to compute the hash tweak
|
||||
// used to enable a public key to commit to the taproot branch root
|
||||
// for the witness program.
|
||||
TagTapTweak = []byte("TapTweak") |
||||
// precomputedTags is a map containing the SHA-256 hash of the BIP-0340
|
||||
// tags.
|
||||
precomputedTags = map[string]Hash{ |
||||
string(TagBIP0340Challenge): sha256.Sum256(TagBIP0340Challenge), |
||||
string(TagBIP0340Aux): sha256.Sum256(TagBIP0340Aux), |
||||
string(TagBIP0340Nonce): sha256.Sum256(TagBIP0340Nonce), |
||||
string(TagTapSighash): sha256.Sum256(TagTapSighash), |
||||
string(TagTapLeaf): sha256.Sum256(TagTapLeaf), |
||||
string(TagTapBranch): sha256.Sum256(TagTapBranch), |
||||
string(TagTapTweak): sha256.Sum256(TagTapTweak), |
||||
} |
||||
) |
||||
|
||||
// ErrHashStrSize describes an error that indicates the caller specified a hash
|
||||
// string that has too many characters.
|
||||
var ErrHashStrSize = fmt.Errorf( |
||||
"max hash string length is %v bytes", |
||||
MaxHashStringSize, |
||||
) |
||||
|
||||
// Hash is used in several of the bitcoin messages and common structures. It
|
||||
// typically represents the double sha256 of data.
|
||||
type Hash [HashSize]byte |
||||
|
||||
// String returns the Hash as the hexadecimal string of the byte-reversed
|
||||
// hash.
|
||||
func (hash Hash) String() string { |
||||
for i := 0; i < HashSize/2; i++ { |
||||
hash[i], hash[HashSize-1-i] = hash[HashSize-1-i], hash[i] |
||||
} |
||||
return hex.Enc(hash[:]) |
||||
} |
||||
|
||||
// CloneBytes returns a copy of the bytes which represent the hash as a byte
|
||||
// slice.
|
||||
//
|
||||
// NOTE: It is generally cheaper to just slice the hash directly thereby reusing
|
||||
// the same bytes rather than calling this method.
|
||||
func (hash *Hash) CloneBytes() []byte { |
||||
newHash := make([]byte, HashSize) |
||||
copy(newHash, hash[:]) |
||||
return newHash |
||||
} |
||||
|
||||
// SetBytes sets the bytes which represent the hash. An error is returned if
|
||||
// the number of bytes passed in is not HashSize.
|
||||
func (hash *Hash) SetBytes(newHash []byte) error { |
||||
nhlen := len(newHash) |
||||
if nhlen != HashSize { |
||||
return fmt.Errorf( |
||||
"invalid hash length of %v, want %v", nhlen, |
||||
HashSize, |
||||
) |
||||
} |
||||
copy(hash[:], newHash) |
||||
return nil |
||||
} |
||||
|
||||
// IsEqual returns true if target is the same as hash.
|
||||
func (hash *Hash) IsEqual(target *Hash) bool { |
||||
if hash == nil && target == nil { |
||||
return true |
||||
} |
||||
if hash == nil || target == nil { |
||||
return false |
||||
} |
||||
return *hash == *target |
||||
} |
||||
|
||||
// MarshalJSON serialises the hash as a JSON appropriate string value.
|
||||
func (hash Hash) MarshalJSON() ([]byte, error) { |
||||
return json.Marshal(hash.String()) |
||||
} |
||||
|
||||
// UnmarshalJSON parses the hash with JSON appropriate string value.
|
||||
func (hash *Hash) UnmarshalJSON(input []byte) error { |
||||
// If the first byte indicates an array, the hash could have been marshalled
|
||||
// using the legacy method and e.g. persisted.
|
||||
if len(input) > 0 && input[0] == '[' { |
||||
return decodeLegacy(hash, input) |
||||
} |
||||
var sh string |
||||
err := json.Unmarshal(input, &sh) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
newHash, err := NewHashFromStr(sh) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
return hash.SetBytes(newHash[:]) |
||||
} |
||||
|
||||
// NewHash returns a new Hash from a byte slice. An error is returned if
|
||||
// the number of bytes passed in is not HashSize.
|
||||
func NewHash(newHash []byte) (*Hash, error) { |
||||
var sh Hash |
||||
err := sh.SetBytes(newHash) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
return &sh, err |
||||
} |
||||
|
||||
// TaggedHash implements the tagged hash scheme described in BIP-340. We use
|
||||
// sha-256 to bind a message hash to a specific context using a tag:
|
||||
// sha256(sha256(tag) || sha256(tag) || msg).
|
||||
func TaggedHash(tag []byte, msgs ...[]byte) *Hash { |
||||
// Check to see if we've already pre-computed the hash of the tag. If
|
||||
// so then this'll save us an extra sha256 hash.
|
||||
shaTag, ok := precomputedTags[string(tag)] |
||||
if !ok { |
||||
shaTag = sha256.Sum256(tag) |
||||
} |
||||
// h = sha256(sha256(tag) || sha256(tag) || msg)
|
||||
h := sha256.New() |
||||
h.Write(shaTag[:]) |
||||
h.Write(shaTag[:]) |
||||
for _, msg := range msgs { |
||||
h.Write(msg) |
||||
} |
||||
taggedHash := h.Sum(nil) |
||||
// The function can't error out since the above hash is guaranteed to
|
||||
// be 32 bytes.
|
||||
hash, _ := NewHash(taggedHash) |
||||
return hash |
||||
} |
||||
|
||||
// NewHashFromStr creates a Hash from a hash string. The string should be
|
||||
// the hexadecimal string of a byte-reversed hash, but any missing characters
|
||||
// result in zero padding at the end of the Hash.
|
||||
func NewHashFromStr(hash string) (*Hash, error) { |
||||
ret := new(Hash) |
||||
err := Decode(ret, hash) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
return ret, nil |
||||
} |
||||
|
||||
// Decode decodes the byte-reversed hexadecimal string encoding of a Hash to a
|
||||
// destination.
|
||||
func Decode(dst *Hash, src string) error { |
||||
// Return error if hash string is too long.
|
||||
if len(src) > MaxHashStringSize { |
||||
return ErrHashStrSize |
||||
} |
||||
// Hex decoder expects the hash to be a multiple of two. When not, pad
|
||||
// with a leading zero.
|
||||
var srcBytes []byte |
||||
if len(src)%2 == 0 { |
||||
srcBytes = []byte(src) |
||||
} else { |
||||
srcBytes = make([]byte, 1+len(src)) |
||||
srcBytes[0] = '0' |
||||
copy(srcBytes[1:], src) |
||||
} |
||||
// Hex decode the source bytes to a temporary destination.
|
||||
var reversedHash Hash |
||||
_, err := hex.DecAppend( |
||||
reversedHash[HashSize-hex.DecLen(len(srcBytes)):], |
||||
srcBytes, |
||||
) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
// Reverse copy from the temporary hash to destination. Because the
|
||||
// temporary was zeroed, the written result will be correctly padded.
|
||||
for i, b := range reversedHash[:HashSize/2] { |
||||
dst[i], dst[HashSize-1-i] = reversedHash[HashSize-1-i], b |
||||
} |
||||
return nil |
||||
} |
||||
|
||||
// decodeLegacy decodes an Hash that has been encoded with the legacy method
|
||||
// (i.e. represented as a bytes array) to a destination.
|
||||
func decodeLegacy(dst *Hash, src []byte) error { |
||||
var hashBytes []byte |
||||
err := json.Unmarshal(src, &hashBytes) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
if len(hashBytes) != HashSize { |
||||
return ErrHashStrSize |
||||
} |
||||
return dst.SetBytes(hashBytes) |
||||
} |
||||
@ -1,228 +0,0 @@
@@ -1,228 +0,0 @@
|
||||
// Copyright (c) 2013-2016 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package chainhash |
||||
|
||||
import ( |
||||
"testing" |
||||
|
||||
"next.orly.dev/pkg/utils" |
||||
) |
||||
|
||||
// mainNetGenesisHash is the hash of the first block in the block chain for the
|
||||
// main network (genesis block).
|
||||
var mainNetGenesisHash = Hash( |
||||
[HashSize]byte{ |
||||
// Make go vet happy.
|
||||
0x6f, 0xe2, 0x8c, 0x0a, 0xb6, 0xf1, 0xb3, 0x72, |
||||
0xc1, 0xa6, 0xa2, 0x46, 0xae, 0x63, 0xf7, 0x4f, |
||||
0x93, 0x1e, 0x83, 0x65, 0xe1, 0x5a, 0x08, 0x9c, |
||||
0x68, 0xd6, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, |
||||
}, |
||||
) |
||||
|
||||
// TestHash tests the Hash API.
|
||||
func TestHash(t *testing.T) { |
||||
// Hash of block 234439.
|
||||
blockHashStr := "14a0810ac680a3eb3f82edc878cea25ec41d6b790744e5daeef" |
||||
blockHash, err := NewHashFromStr(blockHashStr) |
||||
if err != nil { |
||||
t.Errorf("NewHashFromStr: %v", err) |
||||
} |
||||
// Hash of block 234440 as byte slice.
|
||||
buf := []byte{ |
||||
0x79, 0xa6, 0x1a, 0xdb, 0xc6, 0xe5, 0xa2, 0xe1, |
||||
0x39, 0xd2, 0x71, 0x3a, 0x54, 0x6e, 0xc7, 0xc8, |
||||
0x75, 0x63, 0x2e, 0x75, 0xf1, 0xdf, 0x9c, 0x3f, |
||||
0xa6, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, |
||||
} |
||||
hash, err := NewHash(buf) |
||||
if err != nil { |
||||
t.Errorf("NewHash: unexpected error %v", err) |
||||
} |
||||
// Ensure proper size.
|
||||
if len(hash) != HashSize { |
||||
t.Errorf( |
||||
"NewHash: hash length mismatch - got: %v, want: %v", |
||||
len(hash), HashSize, |
||||
) |
||||
} |
||||
// Ensure contents match.
|
||||
if !utils.FastEqual(hash[:], buf) { |
||||
t.Errorf( |
||||
"NewHash: hash contents mismatch - got: %v, want: %v", |
||||
hash[:], buf, |
||||
) |
||||
} |
||||
// Ensure contents of hash of block 234440 don't match 234439.
|
||||
if hash.IsEqual(blockHash) { |
||||
t.Errorf( |
||||
"IsEqual: hash contents should not match - got: %v, want: %v", |
||||
hash, blockHash, |
||||
) |
||||
} |
||||
// Set hash from byte slice and ensure contents match.
|
||||
err = hash.SetBytes(blockHash.CloneBytes()) |
||||
if err != nil { |
||||
t.Errorf("SetBytes: %v", err) |
||||
} |
||||
if !hash.IsEqual(blockHash) { |
||||
t.Errorf( |
||||
"IsEqual: hash contents mismatch - got: %v, want: %v", |
||||
hash, blockHash, |
||||
) |
||||
} |
||||
// Ensure nil hashes are handled properly.
|
||||
if !(*Hash)(nil).IsEqual(nil) { |
||||
t.Error("IsEqual: nil hashes should match") |
||||
} |
||||
if hash.IsEqual(nil) { |
||||
t.Error("IsEqual: non-nil hash matches nil hash") |
||||
} |
||||
// Invalid size for SetBytes.
|
||||
err = hash.SetBytes([]byte{0x00}) |
||||
if err == nil { |
||||
t.Errorf("SetBytes: failed to received expected err - got: nil") |
||||
} |
||||
// Invalid size for NewHash.
|
||||
invalidHash := make([]byte, HashSize+1) |
||||
_, err = NewHash(invalidHash) |
||||
if err == nil { |
||||
t.Errorf("NewHash: failed to received expected err - got: nil") |
||||
} |
||||
} |
||||
|
||||
// TestHashString tests the stringized output for hashes.
|
||||
func TestHashString(t *testing.T) { |
||||
// Block 100000 hash.
|
||||
wantStr := "000000000003ba27aa200b1cecaad478d2b00432346c3f1f3986da1afd33e506" |
||||
hash := Hash( |
||||
[HashSize]byte{ |
||||
// Make go vet happy.
|
||||
0x06, 0xe5, 0x33, 0xfd, 0x1a, 0xda, 0x86, 0x39, |
||||
0x1f, 0x3f, 0x6c, 0x34, 0x32, 0x04, 0xb0, 0xd2, |
||||
0x78, 0xd4, 0xaa, 0xec, 0x1c, 0x0b, 0x20, 0xaa, |
||||
0x27, 0xba, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, |
||||
}, |
||||
) |
||||
hashStr := hash.String() |
||||
if hashStr != wantStr { |
||||
t.Errorf( |
||||
"String: wrong hash string - got %v, want %v", |
||||
hashStr, wantStr, |
||||
) |
||||
} |
||||
} |
||||
|
||||
// todo: these fail for some reason
|
||||
// // TestNewHashFromStr executes tests against the NewHashFromStr function.
|
||||
// func TestNewHashFromStr(t *testing.T) {
|
||||
// tests := []struct {
|
||||
// in string
|
||||
// want Hash
|
||||
// err error
|
||||
// }{
|
||||
// // Genesis hash.
|
||||
// {
|
||||
// "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f",
|
||||
// mainNetGenesisHash,
|
||||
// nil,
|
||||
// },
|
||||
// // Genesis hash with stripped leading zeros.
|
||||
// {
|
||||
// "19d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f",
|
||||
// mainNetGenesisHash,
|
||||
// nil,
|
||||
// },
|
||||
// // Empty string.
|
||||
// {
|
||||
// "",
|
||||
// Hash{},
|
||||
// nil,
|
||||
// },
|
||||
// // Single digit hash.
|
||||
// {
|
||||
// "1",
|
||||
// Hash([HashSize]byte{ // Make go vet happy.
|
||||
// 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
// 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
// 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
// 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
// }),
|
||||
// nil,
|
||||
// },
|
||||
// // Block 203707 with stripped leading zeros.
|
||||
// {
|
||||
// "3264bc2ac36a60840790ba1d475d01367e7c723da941069e9dc",
|
||||
// Hash([HashSize]byte{ // Make go vet happy.
|
||||
// 0xdc, 0xe9, 0x69, 0x10, 0x94, 0xda, 0x23, 0xc7,
|
||||
// 0xe7, 0x67, 0x13, 0xd0, 0x75, 0xd4, 0xa1, 0x0b,
|
||||
// 0x79, 0x40, 0x08, 0xa6, 0x36, 0xac, 0xc2, 0x4b,
|
||||
// 0x26, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
// }),
|
||||
// nil,
|
||||
// },
|
||||
// // Hash string that is too long.
|
||||
// {
|
||||
// "01234567890123456789012345678901234567890123456789012345678912345",
|
||||
// Hash{},
|
||||
// ErrHashStrSize,
|
||||
// },
|
||||
// // Hash string that is contains non-hex chars.
|
||||
// {
|
||||
// "abcdefg",
|
||||
// Hash{},
|
||||
// hex.InvalidByteError('g'),
|
||||
// },
|
||||
// }
|
||||
//
|
||||
// unexpectedErrStr := "NewHashFromStr #%d failed to detect expected error - got: %v want: %v"
|
||||
// unexpectedResultStr := "NewHashFromStr #%d got: %v want: %v"
|
||||
// t.Logf("Running %d tests", len(tests))
|
||||
// for i, test := range tests {
|
||||
// result, err := NewHashFromStr(test.in)
|
||||
// if err != test.err {
|
||||
// t.Errorf(unexpectedErrStr, i, err, test.err)
|
||||
// continue
|
||||
// } else if err != nil {
|
||||
// // Got expected error. Move on to the next test.
|
||||
// continue
|
||||
// }
|
||||
// if !test.want.IsEqual(result) {
|
||||
// t.Errorf(unexpectedResultStr, i, result, &test.want)
|
||||
// continue
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
//
|
||||
// // TestHashJsonMarshal tests json marshal and unmarshal.
|
||||
// func TestHashJsonMarshal(t *testing.T) {
|
||||
// hashStr := "000000000003ba27aa200b1cecaad478d2b00432346c3f1f3986da1afd33e506"
|
||||
// legacyHashStr := []byte("[6,229,51,253,26,218,134,57,31,63,108,52,50,4,176,210,120,212,170,236,28,11,32,170,39,186,3,0,0,0,0,0]")
|
||||
// hash, err := NewHashFromStr(hashStr)
|
||||
// if err != nil {
|
||||
// t.Errorf("NewHashFromStr error:%v, hashStr:%s", err, hashStr)
|
||||
// }
|
||||
// hashBytes, err := json.Marshal(hash)
|
||||
// if err != nil {
|
||||
// t.Errorf("Marshal json error:%v, hash:%v", err, hashBytes)
|
||||
// }
|
||||
// var newHash Hash
|
||||
// err = json.Unmarshal(hashBytes, &newHash)
|
||||
// if err != nil {
|
||||
// t.Errorf("Unmarshal json error:%v, hash:%v", err, hashBytes)
|
||||
// }
|
||||
// if !hash.IsEqual(&newHash) {
|
||||
// t.Errorf("String: wrong hash string - got %v, want %v",
|
||||
// newHash.String(), hashStr)
|
||||
// }
|
||||
// err = newHash.Unmarshal(legacyHashStr)
|
||||
// if err != nil {
|
||||
// t.Errorf("Unmarshal legacy json error:%v, hash:%v", err, legacyHashStr)
|
||||
// }
|
||||
// if !hash.IsEqual(&newHash) {
|
||||
// t.Errorf("String: wrong hash string - got %v, want %v",
|
||||
// newHash.String(), hashStr)
|
||||
// }
|
||||
// }
|
||||
@ -1,33 +0,0 @@
@@ -1,33 +0,0 @@
|
||||
// Copyright (c) 2015 The Decred developers
|
||||
// Copyright (c) 2016-2017 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package chainhash |
||||
|
||||
import ( |
||||
"github.com/minio/sha256-simd" |
||||
) |
||||
|
||||
// HashB calculates hash(b) and returns the resulting bytes.
|
||||
func HashB(b []byte) []byte { |
||||
hash := sha256.Sum256(b) |
||||
return hash[:] |
||||
} |
||||
|
||||
// HashH calculates hash(b) and returns the resulting bytes as a Hash.
|
||||
func HashH(b []byte) Hash { return Hash(sha256.Sum256(b)) } |
||||
|
||||
// DoubleHashB calculates hash(hash(b)) and returns the resulting bytes.
|
||||
func DoubleHashB(b []byte) []byte { |
||||
first := sha256.Sum256(b) |
||||
second := sha256.Sum256(first[:]) |
||||
return second[:] |
||||
} |
||||
|
||||
// DoubleHashH calculates hash(hash(b)) and returns the resulting bytes as a
|
||||
// Hash.
|
||||
func DoubleHashH(b []byte) Hash { |
||||
first := sha256.Sum256(b) |
||||
return sha256.Sum256(first[:]) |
||||
} |
||||
@ -1,323 +0,0 @@
@@ -1,323 +0,0 @@
|
||||
// Copyright (c) 2016 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package chainhash |
||||
|
||||
import ( |
||||
"fmt" |
||||
"testing" |
||||
) |
||||
|
||||
// TestHashFuncs ensures the hash functions which perform hash(b) work as
|
||||
// expected.
|
||||
func TestHashFuncs(t *testing.T) { |
||||
tests := []struct { |
||||
out string |
||||
in string |
||||
}{ |
||||
{ |
||||
"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", |
||||
"", |
||||
}, |
||||
{ |
||||
"ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb", |
||||
"a", |
||||
}, |
||||
{ |
||||
"fb8e20fc2e4c3f248c60c39bd652f3c1347298bb977b8b4d5903b85055620603", |
||||
"ab", |
||||
}, |
||||
{ |
||||
"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad", |
||||
"abc", |
||||
}, |
||||
{ |
||||
"88d4266fd4e6338d13b845fcf289579d209c897823b9217da3e161936f031589", |
||||
"abcd", |
||||
}, |
||||
{ |
||||
"36bbe50ed96841d10443bcb670d6554f0a34b761be67ec9c4a8ad2c0c44ca42c", |
||||
"abcde", |
||||
}, |
||||
{ |
||||
"bef57ec7f53a6d40beb640a780a639c83bc29ac8a9816f1fc6c5c6dcd93c4721", |
||||
"abcdef", |
||||
}, |
||||
{ |
||||
"7d1a54127b222502f5b79b5fb0803061152a44f92b37e23c6527baf665d4da9a", |
||||
"abcdefg", |
||||
}, |
||||
{ |
||||
"9c56cc51b374c3ba189210d5b6d4bf57790d351c96c47c02190ecf1e430635ab", |
||||
"abcdefgh", |
||||
}, |
||||
{ |
||||
"19cc02f26df43cc571bc9ed7b0c4d29224a3ec229529221725ef76d021c8326f", |
||||
"abcdefghi", |
||||
}, |
||||
{ |
||||
"72399361da6a7754fec986dca5b7cbaf1c810a28ded4abaf56b2106d06cb78b0", |
||||
"abcdefghij", |
||||
}, |
||||
{ |
||||
"a144061c271f152da4d151034508fed1c138b8c976339de229c3bb6d4bbb4fce", |
||||
"Discard medicine more than two years old.", |
||||
}, |
||||
{ |
||||
"6dae5caa713a10ad04b46028bf6dad68837c581616a1589a265a11288d4bb5c4", |
||||
"He who has a shady past knows that nice guys finish last.", |
||||
}, |
||||
{ |
||||
"ae7a702a9509039ddbf29f0765e70d0001177914b86459284dab8b348c2dce3f", |
||||
"I wouldn't marry him with a ten foot pole.", |
||||
}, |
||||
{ |
||||
"6748450b01c568586715291dfa3ee018da07d36bb7ea6f180c1af6270215c64f", |
||||
"Free! Free!/A trip/to Mars/for 900/empty jars/Burma Shave", |
||||
}, |
||||
{ |
||||
"14b82014ad2b11f661b5ae6a99b75105c2ffac278cd071cd6c05832793635774", |
||||
"The days of the digital watch are numbered. -Tom Stoppard", |
||||
}, |
||||
{ |
||||
"7102cfd76e2e324889eece5d6c41921b1e142a4ac5a2692be78803097f6a48d8", |
||||
"Nepal premier won't resign.", |
||||
}, |
||||
{ |
||||
"23b1018cd81db1d67983c5f7417c44da9deb582459e378d7a068552ea649dc9f", |
||||
"For every action there is an equal and opposite government program.", |
||||
}, |
||||
{ |
||||
"8001f190dfb527261c4cfcab70c98e8097a7a1922129bc4096950e57c7999a5a", |
||||
"His money is twice tainted: 'taint yours and 'taint mine.", |
||||
}, |
||||
{ |
||||
"8c87deb65505c3993eb24b7a150c4155e82eee6960cf0c3a8114ff736d69cad5", |
||||
"There is no reason for any individual to have a computer in their home. -Ken Olsen, 1977", |
||||
}, |
||||
{ |
||||
"bfb0a67a19cdec3646498b2e0f751bddc41bba4b7f30081b0b932aad214d16d7", |
||||
"It's a tiny change to the code and not completely disgusting. - Bob Manchek", |
||||
}, |
||||
{ |
||||
"7f9a0b9bf56332e19f5a0ec1ad9c1425a153da1c624868fda44561d6b74daf36", |
||||
"size: a.out: bad magic", |
||||
}, |
||||
{ |
||||
"b13f81b8aad9e3666879af19886140904f7f429ef083286195982a7588858cfc", |
||||
"The major problem is with sendmail. -Mark Horton", |
||||
}, |
||||
{ |
||||
"b26c38d61519e894480c70c8374ea35aa0ad05b2ae3d6674eec5f52a69305ed4", |
||||
"Give me a rock, paper and scissors and I will move the world. CCFestoon", |
||||
}, |
||||
{ |
||||
"049d5e26d4f10222cd841a119e38bd8d2e0d1129728688449575d4ff42b842c1", |
||||
"If the enemy is within range, then so are you.", |
||||
}, |
||||
{ |
||||
"0e116838e3cc1c1a14cd045397e29b4d087aa11b0853fc69ec82e90330d60949", |
||||
"It's well we cannot hear the screams/That we create in others' dreams.", |
||||
}, |
||||
{ |
||||
"4f7d8eb5bcf11de2a56b971021a444aa4eafd6ecd0f307b5109e4e776cd0fe46", |
||||
"You remind me of a TV show, but that's all right: I watch it anyway.", |
||||
}, |
||||
{ |
||||
"61c0cc4c4bd8406d5120b3fb4ebc31ce87667c162f29468b3c779675a85aebce", |
||||
"C is as portable as Stonehedge!!", |
||||
}, |
||||
{ |
||||
"1fb2eb3688093c4a3f80cd87a5547e2ce940a4f923243a79a2a1e242220693ac", |
||||
"Even if I could be Shakespeare, I think I should still choose to be Faraday. - A. Huxley", |
||||
}, |
||||
{ |
||||
"395585ce30617b62c80b93e8208ce866d4edc811a177fdb4b82d3911d8696423", |
||||
"The fugacity of a constituent in a mixture of gases at a given temperature is proportional to its mole fraction. Lewis-Randall Rule", |
||||
}, |
||||
{ |
||||
"4f9b189a13d030838269dce846b16a1ce9ce81fe63e65de2f636863336a98fe6", |
||||
"How can you write a big system without C++? -Paul Glick", |
||||
}, |
||||
} |
||||
|
||||
// Ensure the hash function which returns a byte slice returns the
|
||||
// expected result.
|
||||
for _, test := range tests { |
||||
h := fmt.Sprintf("%x", HashB([]byte(test.in))) |
||||
if h != test.out { |
||||
t.Errorf("HashB(%q) = %s, want %s", test.in, h, test.out) |
||||
continue |
||||
} |
||||
} |
||||
// Ensure the hash function which returns a Hash returns the expected
|
||||
// result.
|
||||
for _, test := range tests { |
||||
hash := HashH([]byte(test.in)) |
||||
h := fmt.Sprintf("%x", hash[:]) |
||||
if h != test.out { |
||||
t.Errorf("HashH(%q) = %s, want %s", test.in, h, test.out) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestDoubleHashFuncs ensures the hash functions which perform hash(hash(b))
|
||||
// work as expected.
|
||||
func TestDoubleHashFuncs(t *testing.T) { |
||||
tests := []struct { |
||||
out string |
||||
in string |
||||
}{ |
||||
{ |
||||
"5df6e0e2761359d30a8275058e299fcc0381534545f55cf43e41983f5d4c9456", |
||||
"", |
||||
}, |
||||
{ |
||||
"bf5d3affb73efd2ec6c36ad3112dd933efed63c4e1cbffcfa88e2759c144f2d8", |
||||
"a", |
||||
}, |
||||
{ |
||||
"a1ff8f1856b5e24e32e3882edd4a021f48f28a8b21854b77fdef25a97601aace", |
||||
"ab", |
||||
}, |
||||
{ |
||||
"4f8b42c22dd3729b519ba6f68d2da7cc5b2d606d05daed5ad5128cc03e6c6358", |
||||
"abc", |
||||
}, |
||||
{ |
||||
"7e9c158ecd919fa439a7a214c9fc58b85c3177fb1613bdae41ee695060e11bc6", |
||||
"abcd", |
||||
}, |
||||
{ |
||||
"1d72b6eb7ba8b9709c790b33b40d8c46211958e13cf85dbcda0ed201a99f2fb9", |
||||
"abcde", |
||||
}, |
||||
{ |
||||
"ce65d4756128f0035cba4d8d7fae4e9fa93cf7fdf12c0f83ee4a0e84064bef8a", |
||||
"abcdef", |
||||
}, |
||||
{ |
||||
"dad6b965ad86b880ceb6993f98ebeeb242de39f6b87a458c6510b5a15ff7bbf1", |
||||
"abcdefg", |
||||
}, |
||||
{ |
||||
"b9b12e7125f73fda20b8c4161fb9b4b146c34cf88595a1e0503ca2cf44c86bc4", |
||||
"abcdefgh", |
||||
}, |
||||
{ |
||||
"546db09160636e98405fbec8464a84b6464b32514db259e235eae0445346ffb7", |
||||
"abcdefghi", |
||||
}, |
||||
{ |
||||
"27635cf23fdf8a10f4cb2c52ade13038c38718c6d7ca716bfe726111a57ad201", |
||||
"abcdefghij", |
||||
}, |
||||
{ |
||||
"ae0d8e0e7c0336f0c3a72cefa4f24b625a6a460417a921d066058a0b81e23429", |
||||
"Discard medicine more than two years old.", |
||||
}, |
||||
{ |
||||
"eeb56d02cf638f87ea8f11ebd5b0201afcece984d87be458578d3cfb51978f1b", |
||||
"He who has a shady past knows that nice guys finish last.", |
||||
}, |
||||
{ |
||||
"dc640bf529608a381ea7065ecbcd0443b95f6e4c008de6e134aff1d36bd4b9d8", |
||||
"I wouldn't marry him with a ten foot pole.", |
||||
}, |
||||
{ |
||||
"42e54375e60535eb07fc15c6350e10f2c22526f84db1d6f6bba925e154486f33", |
||||
"Free! Free!/A trip/to Mars/for 900/empty jars/Burma Shave", |
||||
}, |
||||
{ |
||||
"4ed6aa9b88c84afbf928710b03714de69e2ad967c6a78586069adcb4c470d150", |
||||
"The days of the digital watch are numbered. -Tom Stoppard", |
||||
}, |
||||
{ |
||||
"590c24d1877c1919fad12fe01a8796999e9d20cfbf9bc9bc72fa0bd69f0b04dd", |
||||
"Nepal premier won't resign.", |
||||
}, |
||||
{ |
||||
"37d270687ee8ebafcd3c1a32f56e1e1304b3c93f252cb637d57a66d59c475eca", |
||||
"For every action there is an equal and opposite government program.", |
||||
}, |
||||
{ |
||||
"306828fd89278838bb1c544c3032a1fd25ea65c40bba586437568828a5fbe944", |
||||
"His money is twice tainted: 'taint yours and 'taint mine.", |
||||
}, |
||||
{ |
||||
"49965777eac71faf1e2fb0f6b239ba2fae770977940fd827bcbfe15def6ded53", |
||||
"There is no reason for any individual to have a computer in their home. -Ken Olsen, 1977", |
||||
}, |
||||
{ |
||||
"df99ee4e87dd3fb07922dee7735997bbae8f26db20c86137d4219fc4a37b77c3", |
||||
"It's a tiny change to the code and not completely disgusting. - Bob Manchek", |
||||
}, |
||||
{ |
||||
"920667c84a15b5ee3df4620169f5c0ec930cea0c580858e50e68848871ed65b4", |
||||
"size: a.out: bad magic", |
||||
}, |
||||
{ |
||||
"5e817fe20848a4a3932db68e90f8d54ec1b09603f0c99fdc051892b776acd462", |
||||
"The major problem is with sendmail. -Mark Horton", |
||||
}, |
||||
{ |
||||
"6a9d47248ed38852f5f4b2e37e7dfad0ce8d1da86b280feef94ef267e468cff2", |
||||
"Give me a rock, paper and scissors and I will move the world. CCFestoon", |
||||
}, |
||||
{ |
||||
"2e7aa1b362c94efdbff582a8bd3f7f61c8ce4c25bbde658ef1a7ae1010e2126f", |
||||
"If the enemy is within range, then so are you.", |
||||
}, |
||||
{ |
||||
"e6729d51240b1e1da76d822fd0c55c75e409bcb525674af21acae1f11667c8ca", |
||||
"It's well we cannot hear the screams/That we create in others' dreams.", |
||||
}, |
||||
{ |
||||
"09945e4d2743eb669f85e4097aa1cc39ea680a0b2ae2a65a42a5742b3b809610", |
||||
"You remind me of a TV show, but that's all right: I watch it anyway.", |
||||
}, |
||||
{ |
||||
"1018d8b2870a974887c5174360f0fbaf27958eef15b24522a605c5dae4ae0845", |
||||
"C is as portable as Stonehedge!!", |
||||
}, |
||||
{ |
||||
"97c76b83c6645c78c261dcdc55d44af02d9f1df8057f997fd08c310c903624d5", |
||||
"Even if I could be Shakespeare, I think I should still choose to be Faraday. - A. Huxley", |
||||
}, |
||||
{ |
||||
"6bcbf25469e9544c5b5806b24220554fedb6695ba9b1510a76837414f7adb113", |
||||
"The fugacity of a constituent in a mixture of gases at a given temperature is proportional to its mole fraction. Lewis-Randall Rule", |
||||
}, |
||||
{ |
||||
"1041988b06835481f0845be2a54f4628e1da26145b2de7ad1be3bb643cef9d4f", |
||||
"How can you write a big system without C++? -Paul Glick", |
||||
}, |
||||
} |
||||
// Ensure the hash function which returns a byte slice returns the
|
||||
// expected result.
|
||||
for _, test := range tests { |
||||
h := fmt.Sprintf("%x", DoubleHashB([]byte(test.in))) |
||||
if h != test.out { |
||||
t.Errorf( |
||||
"DoubleHashB(%q) = %s, want %s", test.in, h, |
||||
test.out, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
// Ensure the hash function which returns a Hash returns the expected
|
||||
// result.
|
||||
for _, test := range tests { |
||||
hash := DoubleHashH([]byte(test.in)) |
||||
h := fmt.Sprintf("%x", hash[:]) |
||||
if h != test.out { |
||||
t.Errorf( |
||||
"DoubleHashH(%q) = %s, want %s", test.in, h, |
||||
test.out, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
@ -1,16 +0,0 @@
@@ -1,16 +0,0 @@
|
||||
// Copyright (c) 2015-2016 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package btcec |
||||
|
||||
import ( |
||||
"next.orly.dev/pkg/crypto/ec/secp256k1" |
||||
) |
||||
|
||||
// GenerateSharedSecret generates a shared secret based on a secret key and a
|
||||
// public key using Diffie-Hellman key exchange (ECDH) (RFC 4753).
|
||||
// RFC5903 Section 9 states we should only return x.
|
||||
func GenerateSharedSecret(privkey *SecretKey, pubkey *PublicKey) []byte { |
||||
return secp256k1.GenerateSharedSecret(privkey, pubkey) |
||||
} |
||||
@ -1,32 +0,0 @@
@@ -1,32 +0,0 @@
|
||||
// Copyright (c) 2015-2016 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package btcec |
||||
|
||||
import ( |
||||
"testing" |
||||
|
||||
"next.orly.dev/pkg/utils" |
||||
) |
||||
|
||||
func TestGenerateSharedSecret(t *testing.T) { |
||||
privKey1, err := NewSecretKey() |
||||
if err != nil { |
||||
t.Errorf("secret key generation error: %s", err) |
||||
return |
||||
} |
||||
privKey2, err := NewSecretKey() |
||||
if err != nil { |
||||
t.Errorf("secret key generation error: %s", err) |
||||
return |
||||
} |
||||
secret1 := GenerateSharedSecret(privKey1, privKey2.PubKey()) |
||||
secret2 := GenerateSharedSecret(privKey2, privKey1.PubKey()) |
||||
if !utils.FastEqual(secret1, secret2) { |
||||
t.Errorf( |
||||
"ECDH failed, secrets mismatch - first: %x, second: %x", |
||||
secret1, secret2, |
||||
) |
||||
} |
||||
} |
||||
@ -1,111 +0,0 @@
@@ -1,111 +0,0 @@
|
||||
// Copyright (c) 2015-2021 The btcsuite developers
|
||||
// Copyright (c) 2015-2021 The Decred developers
|
||||
|
||||
package btcec |
||||
|
||||
import ( |
||||
"fmt" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/secp256k1" |
||||
) |
||||
|
||||
// JacobianPoint is an element of the group formed by the secp256k1 curve in
|
||||
// Jacobian projective coordinates and thus represents a point on the curve.
|
||||
type JacobianPoint = secp256k1.JacobianPoint |
||||
|
||||
// infinityPoint is the jacobian representation of the point at infinity.
|
||||
var infinityPoint JacobianPoint |
||||
|
||||
// MakeJacobianPoint returns a Jacobian point with the provided X, Y, and Z
|
||||
// coordinates.
|
||||
func MakeJacobianPoint(x, y, z *FieldVal) JacobianPoint { |
||||
return secp256k1.MakeJacobianPoint(x, y, z) |
||||
} |
||||
|
||||
// AddNonConst adds the passed Jacobian points together and stores the result
|
||||
// in the provided result param in *non-constant* time.
|
||||
func AddNonConst(p1, p2, result *JacobianPoint) { |
||||
secp256k1.AddNonConst(p1, p2, result) |
||||
} |
||||
|
||||
// DecompressY attempts to calculate the Y coordinate for the given X
|
||||
// coordinate such that the result pair is a point on the secp256k1 curve. It
|
||||
// adjusts Y based on the desired oddness and returns whether or not it was
|
||||
// successful since not all X coordinates are valid.
|
||||
//
|
||||
// The magnitude of the provided X coordinate field val must be a max of 8 for
|
||||
// a correct result. The resulting Y field val will have a max magnitude of 2.
|
||||
func DecompressY(x *FieldVal, odd bool, resultY *FieldVal) bool { |
||||
return secp256k1.DecompressY(x, odd, resultY) |
||||
} |
||||
|
||||
// DoubleNonConst doubles the passed Jacobian point and stores the result in
|
||||
// the provided result parameter in *non-constant* time.
|
||||
//
|
||||
// NOTE: The point must be normalized for this function to return the correct
|
||||
// result. The resulting point will be normalized.
|
||||
func DoubleNonConst(p, result *JacobianPoint) { |
||||
secp256k1.DoubleNonConst(p, result) |
||||
} |
||||
|
||||
// ScalarBaseMultNonConst multiplies k*G where G is the base point of the group
|
||||
// and k is a big endian integer. The result is stored in Jacobian coordinates
|
||||
// (x1, y1, z1).
|
||||
//
|
||||
// NOTE: The resulting point will be normalized.
|
||||
func ScalarBaseMultNonConst(k *ModNScalar, result *JacobianPoint) { |
||||
secp256k1.ScalarBaseMultNonConst(k, result) |
||||
} |
||||
|
||||
// ScalarMultNonConst multiplies k*P where k is a big endian integer modulo the
|
||||
// curve order and P is a point in Jacobian projective coordinates and stores
|
||||
// the result in the provided Jacobian point.
|
||||
//
|
||||
// NOTE: The point must be normalized for this function to return the correct
|
||||
// result. The resulting point will be normalized.
|
||||
func ScalarMultNonConst(k *ModNScalar, point, result *JacobianPoint) { |
||||
secp256k1.ScalarMultNonConst(k, point, result) |
||||
} |
||||
|
||||
// ParseJacobian parses a byte slice point as a secp256k1.Publickey and returns the
|
||||
// pubkey as a JacobianPoint. If the nonce is a zero slice, the infinityPoint
|
||||
// is returned.
|
||||
func ParseJacobian(point []byte) (JacobianPoint, error) { |
||||
var result JacobianPoint |
||||
if len(point) != 33 { |
||||
str := fmt.Sprintf( |
||||
"invalid nonce: invalid length: %v", |
||||
len(point), |
||||
) |
||||
return JacobianPoint{}, makeError(secp256k1.ErrPubKeyInvalidLen, str) |
||||
} |
||||
if point[0] == 0x00 { |
||||
return infinityPoint, nil |
||||
} |
||||
noncePk, err := secp256k1.ParsePubKey(point) |
||||
if err != nil { |
||||
return JacobianPoint{}, err |
||||
} |
||||
noncePk.AsJacobian(&result) |
||||
return result, nil |
||||
} |
||||
|
||||
// JacobianToByteSlice converts the passed JacobianPoint to a Pubkey
|
||||
// and serializes that to a byte slice. If the JacobianPoint is the infinity
|
||||
// point, a zero slice is returned.
|
||||
func JacobianToByteSlice(point JacobianPoint) []byte { |
||||
if point.X == infinityPoint.X && point.Y == infinityPoint.Y { |
||||
return make([]byte, 33) |
||||
} |
||||
point.ToAffine() |
||||
return NewPublicKey( |
||||
&point.X, &point.Y, |
||||
).SerializeCompressed() |
||||
} |
||||
|
||||
// GeneratorJacobian sets the passed JacobianPoint to the Generator Point.
|
||||
func GeneratorJacobian(jacobian *JacobianPoint) { |
||||
var k ModNScalar |
||||
k.SetInt(1) |
||||
ScalarBaseMultNonConst(&k, jacobian) |
||||
} |
||||
@ -1,19 +0,0 @@
@@ -1,19 +0,0 @@
|
||||
// Copyright (c) 2013-2014 The btcsuite developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// Package btcec implements support for the elliptic curves needed for bitcoin.
|
||||
//
|
||||
// Bitcoin uses elliptic curve cryptography using koblitz curves
|
||||
// (specifically secp256k1) for cryptographic functions. See
|
||||
// http://www.secg.org/collateral/sec2_final.pdf for details on the
|
||||
// standard.
|
||||
//
|
||||
// This package provides the data structures and functions implementing the
|
||||
// crypto/elliptic Curve interface in order to permit using these curves
|
||||
// with the standard crypto/ecdsa package provided with go. Helper
|
||||
// functionality is provided to parse signatures and public keys from
|
||||
// standard formats. It was designed for use with btcd, but should be
|
||||
// general enough for other uses of elliptic curve crypto. It was originally based
|
||||
// on some initial work by ThePiachu, but has significantly diverged since then.
|
||||
package btcec |
||||
@ -1,27 +0,0 @@
@@ -1,27 +0,0 @@
|
||||
# ecdsa |
||||
|
||||
[](http://copyfree.org) |
||||
[](https://pkg.go.dev/mleku.online/git/ec/secp/ecdsa) |
||||
|
||||
Package ecdsa provides secp256k1-optimized ECDSA signing and verification. |
||||
|
||||
This package provides data structures and functions necessary to produce and |
||||
verify deterministic canonical signatures in accordance with RFC6979 and |
||||
BIP0062, optimized specifically for the secp256k1 curve using the Elliptic Curve |
||||
Digital Signature Algorithm (ECDSA), as defined in FIPS 186-3. See |
||||
https://www.secg.org/sec2-v2.pdf (also found here |
||||
at [sec2-v2.pdf](../sec2-v2.pdf)) for details on the secp256k1 standard. |
||||
|
||||
It also provides functions to parse and serialize the ECDSA signatures with the |
||||
more strict Distinguished Encoding Rules (DER) of ISO/IEC 8825-1 and some |
||||
additional restrictions specific to secp256k1. |
||||
|
||||
In addition, it supports a custom "compact" signature format which allows |
||||
efficient recovery of the public key from a given valid signature and message |
||||
hash combination. |
||||
|
||||
A comprehensive suite of tests is provided to ensure proper functionality. |
||||
|
||||
## License |
||||
|
||||
Package ecdsa is licensed under the [copyfree](http://copyfree.org) ISC License. |
||||
@ -1,169 +0,0 @@
@@ -1,169 +0,0 @@
|
||||
// Copyright 2013-2016 The btcsuite developers
|
||||
// Copyright (c) 2015-2022 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package ecdsa |
||||
|
||||
import ( |
||||
"testing" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/secp256k1" |
||||
"next.orly.dev/pkg/encoders/hex" |
||||
) |
||||
|
||||
// hexToModNScalar converts the passed hex string into a ModNScalar and will
|
||||
// panic if there is an error. This is only provided for the hard-coded
|
||||
// constants so errors in the source code can be detected. It will only (and
|
||||
// must only) be called with hard-coded values.
|
||||
func hexToModNScalar(s string) *secp256k1.ModNScalar { |
||||
b, err := hex.Dec(s) |
||||
if err != nil { |
||||
panic("invalid hex in source file: " + s) |
||||
} |
||||
var scalar secp256k1.ModNScalar |
||||
if overflow := scalar.SetByteSlice(b); overflow { |
||||
panic("hex in source file overflows mod N scalar: " + s) |
||||
} |
||||
return &scalar |
||||
} |
||||
|
||||
// hexToFieldVal converts the passed hex string into a FieldVal and will panic
|
||||
// if there is an error. This is only provided for the hard-coded constants so
|
||||
// errors in the source code can be detected. It will only (and must only) be
|
||||
// called with hard-coded values.
|
||||
func hexToFieldVal(s string) *secp256k1.FieldVal { |
||||
b, err := hex.Dec(s) |
||||
if err != nil { |
||||
panic("invalid hex in source file: " + s) |
||||
} |
||||
var f secp256k1.FieldVal |
||||
if overflow := f.SetByteSlice(b); overflow { |
||||
panic("hex in source file overflows mod P: " + s) |
||||
} |
||||
return &f |
||||
} |
||||
|
||||
// BenchmarkSigVerify benchmarks how long it takes the secp256k1 curve to
|
||||
// verify signatures.
|
||||
func BenchmarkSigVerify(b *testing.B) { |
||||
// Randomly generated keypair.
|
||||
// Secret key: 9e0699c91ca1e3b7e3c9ba71eb71c89890872be97576010fe593fbf3fd57e66d
|
||||
pubKey := secp256k1.NewPublicKey( |
||||
hexToFieldVal("d2e670a19c6d753d1a6d8b20bd045df8a08fb162cf508956c31268c6d81ffdab"), |
||||
hexToFieldVal("ab65528eefbb8057aa85d597258a3fbd481a24633bc9b47a9aa045c91371de52"), |
||||
) |
||||
// Double sha256 of by{0x01, 0x02, 0x03, 0x04}
|
||||
msgHash := hexToBytes("8de472e2399610baaa7f84840547cd409434e31f5d3bd71e4d947f283874f9c0") |
||||
sig := NewSignature( |
||||
hexToModNScalar("fef45d2892953aa5bbcdb057b5e98b208f1617a7498af7eb765574e29b5d9c2c"), |
||||
hexToModNScalar("d47563f52aac6b04b55de236b7c515eb9311757db01e02cff079c3ca6efb063f"), |
||||
) |
||||
if !sig.Verify(msgHash, pubKey) { |
||||
b.Errorf("Signature failed to verify") |
||||
return |
||||
} |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
for i := 0; i < b.N; i++ { |
||||
sig.Verify(msgHash, pubKey) |
||||
} |
||||
} |
||||
|
||||
// BenchmarkSign benchmarks how long it takes to sign a message.
|
||||
func BenchmarkSign(b *testing.B) { |
||||
// Randomly generated keypair.
|
||||
d := hexToModNScalar("9e0699c91ca1e3b7e3c9ba71eb71c89890872be97576010fe593fbf3fd57e66d") |
||||
secKey := secp256k1.NewSecretKey(d) |
||||
// blake256 of by{0x01, 0x02, 0x03, 0x04}.
|
||||
msgHash := hexToBytes("c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7") |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
for i := 0; i < b.N; i++ { |
||||
signRFC6979(secKey, msgHash) |
||||
} |
||||
} |
||||
|
||||
// BenchmarkSigSerialize benchmarks how long it takes to serialize a typical
|
||||
// signature with the strict DER encoding.
|
||||
func BenchmarkSigSerialize(b *testing.B) { |
||||
// Randomly generated keypair.
|
||||
// Secret key: 9e0699c91ca1e3b7e3c9ba71eb71c89890872be97576010fe593fbf3fd57e66d
|
||||
// Signature for double sha256 of by{0x01, 0x02, 0x03, 0x04}.
|
||||
sig := NewSignature( |
||||
hexToModNScalar("fef45d2892953aa5bbcdb057b5e98b208f1617a7498af7eb765574e29b5d9c2c"), |
||||
hexToModNScalar("d47563f52aac6b04b55de236b7c515eb9311757db01e02cff079c3ca6efb063f"), |
||||
) |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
for i := 0; i < b.N; i++ { |
||||
sig.Serialize() |
||||
} |
||||
} |
||||
|
||||
// BenchmarkNonceRFC6979 benchmarks how long it takes to generate a
|
||||
// deterministic nonce according to RFC6979.
|
||||
func BenchmarkNonceRFC6979(b *testing.B) { |
||||
// Randomly generated keypair.
|
||||
// Secret key: 9e0699c91ca1e3b7e3c9ba71eb71c89890872be97576010fe593fbf3fd57e66d
|
||||
// X: d2e670a19c6d753d1a6d8b20bd045df8a08fb162cf508956c31268c6d81ffdab
|
||||
// Y: ab65528eefbb8057aa85d597258a3fbd481a24633bc9b47a9aa045c91371de52
|
||||
secKeyStr := "9e0699c91ca1e3b7e3c9ba71eb71c89890872be97576010fe593fbf3fd57e66d" |
||||
secKey := hexToBytes(secKeyStr) |
||||
// BLAKE-256 of by{0x01, 0x02, 0x03, 0x04}.
|
||||
msgHash := hexToBytes("c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7") |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
var noElideNonce *secp256k1.ModNScalar |
||||
for i := 0; i < b.N; i++ { |
||||
noElideNonce = secp256k1.NonceRFC6979(secKey, msgHash, nil, nil, 0) |
||||
} |
||||
_ = noElideNonce |
||||
} |
||||
|
||||
// BenchmarkSignCompact benchmarks how long it takes to produce a compact
|
||||
// signature for a message.
|
||||
func BenchmarkSignCompact(b *testing.B) { |
||||
d := hexToModNScalar("9e0699c91ca1e3b7e3c9ba71eb71c89890872be97576010fe593fbf3fd57e66d") |
||||
secKey := secp256k1.NewSecretKey(d) |
||||
// blake256 of by{0x01, 0x02, 0x03, 0x04}.
|
||||
msgHash := hexToBytes("c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7") |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
for i := 0; i < b.N; i++ { |
||||
_ = SignCompact(secKey, msgHash, true) |
||||
} |
||||
} |
||||
|
||||
// BenchmarkRecoverCompact benchmarks how long it takes to recover a public key
|
||||
// given a compact signature and message.
|
||||
func BenchmarkRecoverCompact(b *testing.B) { |
||||
// Secret key: 9e0699c91ca1e3b7e3c9ba71eb71c89890872be97576010fe593fbf3fd57e66d
|
||||
wantPubKey := secp256k1.NewPublicKey( |
||||
hexToFieldVal("d2e670a19c6d753d1a6d8b20bd045df8a08fb162cf508956c31268c6d81ffdab"), |
||||
hexToFieldVal("ab65528eefbb8057aa85d597258a3fbd481a24633bc9b47a9aa045c91371de52"), |
||||
) |
||||
compactSig := hexToBytes( |
||||
"205978b7896bc71676ba2e459882a8f52e1299449596c4f" + |
||||
"93c59bf1fbfa2f9d3b76ecd0c99406f61a6de2bb5a8937c061c176ecf381d0231e0d" + |
||||
"af73b922c8952c7", |
||||
) |
||||
// blake256 of by{0x01, 0x02, 0x03, 0x04}.
|
||||
msgHash := hexToBytes("c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7") |
||||
// Ensure a valid compact signature is being benchmarked.
|
||||
pubKey, wasCompressed, err := RecoverCompact(compactSig, msgHash) |
||||
if err != nil { |
||||
b.Fatalf("unexpected err: %v", err) |
||||
} |
||||
if !wasCompressed { |
||||
b.Fatal("recover claims uncompressed pubkey") |
||||
} |
||||
if !pubKey.IsEqual(wantPubKey) { |
||||
b.Fatal("recover returned unexpected pubkey") |
||||
} |
||||
b.ReportAllocs() |
||||
b.ResetTimer() |
||||
for i := 0; i < b.N; i++ { |
||||
_, _, _ = RecoverCompact(compactSig, msgHash) |
||||
} |
||||
} |
||||
@ -1,40 +0,0 @@
@@ -1,40 +0,0 @@
|
||||
// Copyright (c) 2020-2023 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// Package ecdsa provides secp256k1-optimized ECDSA signing and verification.
|
||||
//
|
||||
// This package provides data structures and functions necessary to produce and
|
||||
// verify deterministic canonical signatures in accordance with RFC6979 and
|
||||
// BIP0062, optimized specifically for the secp256k1 curve using the Elliptic Curve
|
||||
// Digital Signature Algorithm (ECDSA), as defined in FIPS 186-3. See
|
||||
// https://www.secg.org/sec2-v2.pdf for details on the secp256k1 standard.
|
||||
//
|
||||
// It also provides functions to parse and serialize the ECDSA signatures with the
|
||||
// more strict Distinguished Encoding Rules (DER) of ISO/IEC 8825-1 and some
|
||||
// additional restrictions specific to secp256k1.
|
||||
//
|
||||
// In addition, it supports a custom "compact" signature format which allows
|
||||
// efficient recovery of the public key from a given valid signature and message
|
||||
// hash combination.
|
||||
//
|
||||
// A comprehensive suite of tests is provided to ensure proper functionality.
|
||||
//
|
||||
// # ECDSA use in Decred
|
||||
//
|
||||
// At the time of this writing, ECDSA signatures are heavily used for proving coin
|
||||
// ownership in Decred as the vast majority of transactions consist of what is
|
||||
// effectively transferring ownership of coins to a public key associated with a
|
||||
// secret key only known to the recipient of the coins along with an encumbrance
|
||||
// that requires an ECDSA signature that proves the new owner possesses the secret
|
||||
// key without actually revealing it.
|
||||
//
|
||||
// # Errors
|
||||
//
|
||||
// The errors returned by this package are of type ecdsa.Error and fully support
|
||||
// the standard library errors.Is and errors.As functions. This allows the caller
|
||||
// to programmatically determine the specific error by examining the ErrorKind
|
||||
// field of the type asserted ecdsa.Error while still providing rich error messages
|
||||
// with contextual information. See ErrorKind in the package documentation for a
|
||||
// full list.
|
||||
package ecdsa |
||||
@ -1,106 +0,0 @@
@@ -1,106 +0,0 @@
|
||||
// Copyright (c) 2020-2022 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package ecdsa |
||||
|
||||
// ErrorKind identifies a kind of error. It has full support for
|
||||
// errors.Is and errors.As, so the caller can directly check against
|
||||
// an error kind when determining the reason for an error.
|
||||
type ErrorKind string |
||||
|
||||
// These constants are used to identify a specific Error.
|
||||
const ( |
||||
// ErrSigTooShort is returned when a signature that should be a DER
|
||||
// signature is too short.
|
||||
ErrSigTooShort = ErrorKind("ErrSigTooShort") |
||||
// ErrSigTooLong is returned when a signature that should be a DER signature
|
||||
// is too long.
|
||||
ErrSigTooLong = ErrorKind("ErrSigTooLong") |
||||
// ErrSigInvalidSeqID is returned when a signature that should be a DER
|
||||
// signature does not have the expected ASN.1 sequence ID.
|
||||
ErrSigInvalidSeqID = ErrorKind("ErrSigInvalidSeqID") |
||||
// ErrSigInvalidDataLen is returned when a signature that should be a DER
|
||||
// signature does not specify the correct number of remaining bytes for the
|
||||
// R and S portions.
|
||||
ErrSigInvalidDataLen = ErrorKind("ErrSigInvalidDataLen") |
||||
// ErrSigMissingSTypeID is returned when a signature that should be a DER
|
||||
// signature does not provide the ASN.1 type ID for S.
|
||||
ErrSigMissingSTypeID = ErrorKind("ErrSigMissingSTypeID") |
||||
// ErrSigMissingSLen is returned when a signature that should be a DER
|
||||
// signature does not provide the length of S.
|
||||
ErrSigMissingSLen = ErrorKind("ErrSigMissingSLen") |
||||
// ErrSigInvalidSLen is returned when a signature that should be a DER
|
||||
// signature does not specify the correct number of bytes for the S portion.
|
||||
ErrSigInvalidSLen = ErrorKind("ErrSigInvalidSLen") |
||||
// ErrSigInvalidRIntID is returned when a signature that should be a DER
|
||||
// signature does not have the expected ASN.1 integer ID for R.
|
||||
ErrSigInvalidRIntID = ErrorKind("ErrSigInvalidRIntID") |
||||
// ErrSigZeroRLen is returned when a signature that should be a DER
|
||||
// signature has an R length of zero.
|
||||
ErrSigZeroRLen = ErrorKind("ErrSigZeroRLen") |
||||
// ErrSigNegativeR is returned when a signature that should be a DER
|
||||
// signature has a negative value for R.
|
||||
ErrSigNegativeR = ErrorKind("ErrSigNegativeR") |
||||
// ErrSigTooMuchRPadding is returned when a signature that should be a DER
|
||||
// signature has too much padding for R.
|
||||
ErrSigTooMuchRPadding = ErrorKind("ErrSigTooMuchRPadding") |
||||
// ErrSigRIsZero is returned when a signature has R set to the value zero.
|
||||
ErrSigRIsZero = ErrorKind("ErrSigRIsZero") |
||||
// ErrSigRTooBig is returned when a signature has R with a value that is
|
||||
// greater than or equal to the group order.
|
||||
ErrSigRTooBig = ErrorKind("ErrSigRTooBig") |
||||
// ErrSigInvalidSIntID is returned when a signature that should be a DER
|
||||
// signature does not have the expected ASN.1 integer ID for S.
|
||||
ErrSigInvalidSIntID = ErrorKind("ErrSigInvalidSIntID") |
||||
// ErrSigZeroSLen is returned when a signature that should be a DER
|
||||
// signature has an S length of zero.
|
||||
ErrSigZeroSLen = ErrorKind("ErrSigZeroSLen") |
||||
// ErrSigNegativeS is returned when a signature that should be a DER
|
||||
// signature has a negative value for S.
|
||||
ErrSigNegativeS = ErrorKind("ErrSigNegativeS") |
||||
// ErrSigTooMuchSPadding is returned when a signature that should be a DER
|
||||
// signature has too much padding for S.
|
||||
ErrSigTooMuchSPadding = ErrorKind("ErrSigTooMuchSPadding") |
||||
// ErrSigSIsZero is returned when a signature has S set to the value zero.
|
||||
ErrSigSIsZero = ErrorKind("ErrSigSIsZero") |
||||
// ErrSigSTooBig is returned when a signature has S with a value that is
|
||||
// greater than or equal to the group order.
|
||||
ErrSigSTooBig = ErrorKind("ErrSigSTooBig") |
||||
// ErrSigInvalidLen is returned when a signature that should be a compact
|
||||
// signature is not the required length.
|
||||
ErrSigInvalidLen = ErrorKind("ErrSigInvalidLen") |
||||
// ErrSigInvalidRecoveryCode is returned when a signature that should be a
|
||||
// compact signature has an invalid value for the public key recovery code.
|
||||
ErrSigInvalidRecoveryCode = ErrorKind("ErrSigInvalidRecoveryCode") |
||||
// ErrSigOverflowsPrime is returned when a signature that should be a
|
||||
// compact signature has the overflow bit set but adding the order to it
|
||||
// would overflow the underlying field prime.
|
||||
ErrSigOverflowsPrime = ErrorKind("ErrSigOverflowsPrime") |
||||
// ErrPointNotOnCurve is returned when attempting to recover a public key
|
||||
// from a compact signature results in a point that is not on the elliptic
|
||||
// curve.
|
||||
ErrPointNotOnCurve = ErrorKind("ErrPointNotOnCurve") |
||||
) |
||||
|
||||
// Error satisfies the error interface and prints human-readable errors.
|
||||
func (e ErrorKind) Error() string { return string(e) } |
||||
|
||||
// Error identifies an error related to an ECDSA signature. It has full
|
||||
// support for errors.Is and errors.As, so the caller can ascertain the
|
||||
// specific reason for the error by checking the underlying error.
|
||||
type Error struct { |
||||
Err error |
||||
Description string |
||||
} |
||||
|
||||
// Error satisfies the error interface and prints human-readable errors.
|
||||
func (e Error) Error() string { return e.Description } |
||||
|
||||
// Unwrap returns the underlying wrapped error.
|
||||
func (e Error) Unwrap() error { return e.Err } |
||||
|
||||
// signatureError creates an Error given a set of arguments.
|
||||
func signatureError(kind ErrorKind, desc string) Error { |
||||
return Error{Err: kind, Description: desc} |
||||
} |
||||
@ -1,154 +0,0 @@
@@ -1,154 +0,0 @@
|
||||
// Copyright (c) 2020-2022 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package ecdsa |
||||
|
||||
import ( |
||||
"errors" |
||||
"testing" |
||||
) |
||||
|
||||
// TestErrorKindStringer tests the stringized output for the ErrorKind type.
|
||||
func TestErrorKindStringer(t *testing.T) { |
||||
tests := []struct { |
||||
in ErrorKind |
||||
want string |
||||
}{ |
||||
{ErrSigTooShort, "ErrSigTooShort"}, |
||||
{ErrSigTooLong, "ErrSigTooLong"}, |
||||
{ErrSigInvalidSeqID, "ErrSigInvalidSeqID"}, |
||||
{ErrSigInvalidDataLen, "ErrSigInvalidDataLen"}, |
||||
{ErrSigMissingSTypeID, "ErrSigMissingSTypeID"}, |
||||
{ErrSigMissingSLen, "ErrSigMissingSLen"}, |
||||
{ErrSigInvalidSLen, "ErrSigInvalidSLen"}, |
||||
{ErrSigInvalidRIntID, "ErrSigInvalidRIntID"}, |
||||
{ErrSigZeroRLen, "ErrSigZeroRLen"}, |
||||
{ErrSigNegativeR, "ErrSigNegativeR"}, |
||||
{ErrSigTooMuchRPadding, "ErrSigTooMuchRPadding"}, |
||||
{ErrSigRIsZero, "ErrSigRIsZero"}, |
||||
{ErrSigRTooBig, "ErrSigRTooBig"}, |
||||
{ErrSigInvalidSIntID, "ErrSigInvalidSIntID"}, |
||||
{ErrSigZeroSLen, "ErrSigZeroSLen"}, |
||||
{ErrSigNegativeS, "ErrSigNegativeS"}, |
||||
{ErrSigTooMuchSPadding, "ErrSigTooMuchSPadding"}, |
||||
{ErrSigSIsZero, "ErrSigSIsZero"}, |
||||
{ErrSigSTooBig, "ErrSigSTooBig"}, |
||||
{ErrSigInvalidLen, "ErrSigInvalidLen"}, |
||||
{ErrSigInvalidRecoveryCode, "ErrSigInvalidRecoveryCode"}, |
||||
{ErrSigOverflowsPrime, "ErrSigOverflowsPrime"}, |
||||
{ErrPointNotOnCurve, "ErrPointNotOnCurve"}, |
||||
} |
||||
|
||||
for i, test := range tests { |
||||
result := test.in.Error() |
||||
if result != test.want { |
||||
t.Errorf("#%d: got: %s want: %s", i, result, test.want) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestError tests the error output for the Error type.
|
||||
func TestError(t *testing.T) { |
||||
tests := []struct { |
||||
in Error |
||||
want string |
||||
}{ |
||||
{ |
||||
Error{Description: "some error"}, |
||||
"some error", |
||||
}, { |
||||
Error{Description: "human-readable error"}, |
||||
"human-readable error", |
||||
}, |
||||
} |
||||
for i, test := range tests { |
||||
result := test.in.Error() |
||||
if result != test.want { |
||||
t.Errorf("#%d: got: %s want: %s", i, result, test.want) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
|
||||
// TestErrorKindIsAs ensures both ErrorKind and Error can be identified as being
|
||||
// a specific error kind via errors.Is and unwrapped via errors.As.
|
||||
func TestErrorKindIsAs(t *testing.T) { |
||||
tests := []struct { |
||||
name string |
||||
err error |
||||
target error |
||||
wantMatch bool |
||||
wantAs ErrorKind |
||||
}{ |
||||
{ |
||||
name: "ErrSigTooShort == ErrSigTooShort", |
||||
err: ErrSigTooShort, |
||||
target: ErrSigTooShort, |
||||
wantMatch: true, |
||||
wantAs: ErrSigTooShort, |
||||
}, { |
||||
name: "Error.ErrSigTooShort == ErrSigTooShort", |
||||
err: signatureError(ErrSigTooShort, ""), |
||||
target: ErrSigTooShort, |
||||
wantMatch: true, |
||||
wantAs: ErrSigTooShort, |
||||
}, { |
||||
name: "Error.ErrSigTooShort == Error.ErrSigTooShort", |
||||
err: signatureError(ErrSigTooShort, ""), |
||||
target: signatureError(ErrSigTooShort, ""), |
||||
wantMatch: true, |
||||
wantAs: ErrSigTooShort, |
||||
}, { |
||||
name: "ErrSigTooLong != ErrSigTooShort", |
||||
err: ErrSigTooLong, |
||||
target: ErrSigTooShort, |
||||
wantMatch: false, |
||||
wantAs: ErrSigTooLong, |
||||
}, { |
||||
name: "Error.ErrSigTooLong != ErrSigTooShort", |
||||
err: signatureError(ErrSigTooLong, ""), |
||||
target: ErrSigTooShort, |
||||
wantMatch: false, |
||||
wantAs: ErrSigTooLong, |
||||
}, { |
||||
name: "ErrSigTooLong != Error.ErrSigTooShort", |
||||
err: ErrSigTooLong, |
||||
target: signatureError(ErrSigTooShort, ""), |
||||
wantMatch: false, |
||||
wantAs: ErrSigTooLong, |
||||
}, { |
||||
name: "Error.ErrSigTooLong != Error.ErrSigTooShort", |
||||
err: signatureError(ErrSigTooLong, ""), |
||||
target: signatureError(ErrSigTooShort, ""), |
||||
wantMatch: false, |
||||
wantAs: ErrSigTooLong, |
||||
}, |
||||
} |
||||
for _, test := range tests { |
||||
// Ensure the error matches or not depending on the expected result.
|
||||
result := errors.Is(test.err, test.target) |
||||
if result != test.wantMatch { |
||||
t.Errorf( |
||||
"%s: incorrect error identification -- got %v, want %v", |
||||
test.name, result, test.wantMatch, |
||||
) |
||||
continue |
||||
} |
||||
// Ensure the underlying error kind can be unwrapped and is the
|
||||
// expected code.
|
||||
var kind ErrorKind |
||||
if !errors.As(test.err, &kind) { |
||||
t.Errorf("%s: unable to unwrap to error", test.name) |
||||
continue |
||||
} |
||||
if !errors.Is(kind, test.wantAs) { |
||||
t.Errorf( |
||||
"%s: unexpected unwrapped error -- got %v, want %v", |
||||
test.name, kind, test.wantAs, |
||||
) |
||||
continue |
||||
} |
||||
} |
||||
} |
||||
@ -1,79 +0,0 @@
@@ -1,79 +0,0 @@
|
||||
// Copyright (c) 2014 The btcsuite developers
|
||||
// Copyright (c) 2015-2021 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// TODO: change this to work with sha256
|
||||
|
||||
package ecdsa_test |
||||
|
||||
// // This example demonstrates signing a message with a secp256k1 secret key that
|
||||
// // is first parsed from raw bytes and serializing the generated signature.
|
||||
// func ExampleSign() {
|
||||
// // Decode a hex-encoded secret key.
|
||||
// pkBytes, err := hex.Dec("22a47fa09a223f2aa079edf85a7c2d4f87" +
|
||||
// "20ee63e502ee2869afab7de234b80c")
|
||||
// if err != nil {
|
||||
// fmt.Println(err)
|
||||
// return
|
||||
// }
|
||||
// secKey := secp256k1.SecKeyFromBytes(pkBytes)
|
||||
//
|
||||
// // Sign a message using the secret key.
|
||||
// message := "test message"
|
||||
// messageHash := blake256.Sum256(by(message))
|
||||
// signature := ecdsa.Sign(secKey, messageHash[:])
|
||||
//
|
||||
// // Serialize and display the signature.
|
||||
// fmt.Printf("Serialized Signature: %x\n", signature.Serialize())
|
||||
//
|
||||
// // Verify the signature for the message using the public key.
|
||||
// pubKey := secKey.Pubkey()
|
||||
// verified := signature.Verify(messageHash[:], pubKey)
|
||||
// fmt.Printf("Signature Verified? %v\n", verified)
|
||||
//
|
||||
// // Output:
|
||||
// // Serialized Signature: 3045022100fcc0a8768cfbcefcf2cadd7cfb0fb18ed08dd2e2ae84bef1a474a3d351b26f0302200fc1a350b45f46fa00101391302818d748c2b22615511a3ffd5bb638bd777207
|
||||
// // Signature Verified? true
|
||||
// }
|
||||
|
||||
// // This example demonstrates verifying a secp256k1 signature against a public
|
||||
// // key that is first parsed from raw bytes. The signature is also parsed from
|
||||
// // raw bytes.
|
||||
// func ExampleSignature_Verify() {
|
||||
// // Decode hex-encoded serialized public key.
|
||||
// pubKeyBytes, err := hex.Dec("02a673638cb9587cb68ea08dbef685c" +
|
||||
// "6f2d2a751a8b3c6f2a7e9a4999e6e4bfaf5")
|
||||
// if err != nil {
|
||||
// fmt.Println(err)
|
||||
// return
|
||||
// }
|
||||
// pubKey, err := secp256k1.ParsePubKey(pubKeyBytes)
|
||||
// if err != nil {
|
||||
// fmt.Println(err)
|
||||
// return
|
||||
// }
|
||||
//
|
||||
// // Decode hex-encoded serialized signature.
|
||||
// sigBytes, err := hex.Dec("3045022100fcc0a8768cfbcefcf2cadd7cfb0" +
|
||||
// "fb18ed08dd2e2ae84bef1a474a3d351b26f0302200fc1a350b45f46fa0010139130" +
|
||||
// "2818d748c2b22615511a3ffd5bb638bd777207")
|
||||
// if err != nil {
|
||||
// fmt.Println(err)
|
||||
// return
|
||||
// }
|
||||
// signature, err := ecdsa.ParseDERSignature(sigBytes)
|
||||
// if err != nil {
|
||||
// fmt.Println(err)
|
||||
// return
|
||||
// }
|
||||
//
|
||||
// // Verify the signature for the message using the public key.
|
||||
// message := "test message"
|
||||
// messageHash := blake256.Sum256(by(message))
|
||||
// verified := signature.Verify(messageHash[:], pubKey)
|
||||
// fmt.Println("Signature Verified?", verified)
|
||||
//
|
||||
// // Output:
|
||||
// // Signature Verified? true
|
||||
// }
|
||||
@ -1,954 +0,0 @@
@@ -1,954 +0,0 @@
|
||||
// Copyright (c) 2013-2014 The btcsuite developers
|
||||
// Copyright (c) 2015-2022 The Decred developers
|
||||
// Use of this source code is governed by an ISC
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package ecdsa |
||||
|
||||
import ( |
||||
"fmt" |
||||
|
||||
"next.orly.dev/pkg/crypto/ec/secp256k1" |
||||
) |
||||
|
||||
// References:
|
||||
// [GECC]: Guide to Elliptic Curve Cryptography (Hankerson, Menezes, Vanstone)
|
||||
//
|
||||
// [ISO/IEC 8825-1]: Information technology — ASN.1 encoding rules:
|
||||
// Specification of Basic Encoding Rules (BER), Canonical Encoding Rules
|
||||
// (CER) and Distinguished Encoding Rules (DER)
|
||||
//
|
||||
// [SEC1]: Elliptic Curve Cryptography (May 31, 2009, Version 2.0)
|
||||
// https://www.secg.org/sec1-v2.pdf
|
||||
|
||||
var ( |
||||
// zero32 is an array of 32 bytes used for the purposes of zeroing and is
|
||||
// defined here to avoid extra allocations.
|
||||
zero32 = [32]byte{} |
||||
// orderAsFieldVal is the order of the secp256k1 curve group stored as a
|
||||
// field value. It is provided here to avoid the need to create it multiple
|
||||
// times.
|
||||
orderAsFieldVal = func() secp256k1.FieldVal { |
||||
var f secp256k1.FieldVal |
||||
f.SetByteSlice(secp256k1.Params().N.Bytes()) |
||||
return f |
||||
}() |
||||
) |
||||
|
||||
const ( |
||||
// asn1SequenceID is the ASN.1 identifier for a sequence and is used when
|
||||
// parsing and serializing signatures encoded with the Distinguished
|
||||
// Encoding Rules (DER) format per section 10 of [ISO/IEC 8825-1].
|
||||
asn1SequenceID = 0x30 |
||||
// asn1IntegerID is the ASN.1 identifier for an integer and is used when
|
||||
// parsing and serializing signatures encoded with the Distinguished
|
||||
// Encoding Rules (DER) format per section 10 of [ISO/IEC 8825-1].
|
||||
asn1IntegerID = 0x02 |
||||
) |
||||
|
||||
// Signature is a type representing an ECDSA signature.
|
||||
type Signature struct { |
||||
r secp256k1.ModNScalar |
||||
s secp256k1.ModNScalar |
||||
} |
||||
|
||||
// NewSignature instantiates a new signature given some r and s values.
|
||||
func NewSignature(r, s *secp256k1.ModNScalar) *Signature { |
||||
return &Signature{*r, *s} |
||||
} |
||||
|
||||
// Serialize returns the ECDSA signature in the Distinguished Encoding Rules
|
||||
// (DER) format per section 10 of [ISO/IEC 8825-1] and such that the S component
|
||||
// of the signature is less than or equal to the half order of the group.
|
||||
//
|
||||
// Note that the serialized bytes returned do not include the appended hash type
|
||||
// used in Decred signature scripts.
|
||||
func (sig *Signature) Serialize() []byte { |
||||
// The format of a DER encoded signature is as follows:
|
||||
//
|
||||
// 0x30 <total length> 0x02 <length of R> <R> 0x02 <length of S> <S>
|
||||
// - 0x30 is the ASN.1 identifier for a sequence.
|
||||
// - Total length is 1 byte and specifies length of all remaining data.
|
||||
// - 0x02 is the ASN.1 identifier that specifies an integer follows.
|
||||
// - Length of R is 1 byte and specifies how many bytes R occupies.
|
||||
// - R is the arbitrary length big-endian encoded number which
|
||||
// represents the R value of the signature. DER encoding dictates
|
||||
// that the value must be encoded using the minimum possible number
|
||||
// of bytes. This implies the first byte can only be null if the
|
||||
// highest bit of the next byte is set in order to prevent it from
|
||||
// being interpreted as a negative number.
|
||||
// - 0x02 is once again the ASN.1 integer identifier.
|
||||
// - Length of S is 1 byte and specifies how many bytes S occupies.
|
||||
// - S is the arbitrary length big-endian encoded number which
|
||||
// represents the S value of the signature. The encoding rules are
|
||||
// identical as those for R.
|
||||
|
||||
// Ensure the S component of the signature is less than or equal to the half
|
||||
// order of the group because both S and its negation are valid signatures
|
||||
// modulo the order, so this forces a consistent choice to reduce signature
|
||||
// malleability.
|
||||
sigS := new(secp256k1.ModNScalar).Set(&sig.s) |
||||
if sigS.IsOverHalfOrder() { |
||||
sigS.Negate() |
||||
} |
||||
|
||||
// Serialize the R and S components of the signature into their fixed
|
||||
// 32-byte big-endian encoding. Note that the extra leading zero byte is
|
||||
// used to ensure it is canonical per DER and will be stripped if needed
|
||||
// below.
|
||||
var rBuf, sBuf [33]byte |
||||
sig.r.PutBytesUnchecked(rBuf[1:33]) |
||||
sigS.PutBytesUnchecked(sBuf[1:33]) |
||||
// Ensure the encoded bytes for the R and S components are canonical per DER
|
||||
// by trimming all leading zero bytes so long as the next byte does not have
|
||||
// the high bit set and it's not the final byte.
|
||||
canonR, canonS := rBuf[:], sBuf[:] |
||||
for len(canonR) > 1 && canonR[0] == 0x00 && canonR[1]&0x80 == 0 { |
||||
canonR = canonR[1:] |
||||
} |
||||
for len(canonS) > 1 && canonS[0] == 0x00 && canonS[1]&0x80 == 0 { |
||||
canonS = canonS[1:] |
||||
} |
||||
// Total length of returned signature is 1 byte for each magic and length
|
||||
// (6 total), plus lengths of R and S.
|
||||
totalLen := 6 + len(canonR) + len(canonS) |
||||
b := make([]byte, 0, totalLen) |
||||
b = append(b, asn1SequenceID) |
||||
b = append(b, byte(totalLen-2)) |
||||
b = append(b, asn1IntegerID) |
||||
b = append(b, byte(len(canonR))) |
||||
b = append(b, canonR...) |
||||
b = append(b, asn1IntegerID) |
||||
b = append(b, byte(len(canonS))) |
||||
b = append(b, canonS...) |
||||
return b |
||||
} |
||||
|
||||
// zeroArray32 zeroes the provided 32-byte buffer.
|
||||
func zeroArray32(b *[32]byte) { |
||||
copy(b[:], zero32[:]) |
||||
} |
||||
|
||||
// fieldToModNScalar converts a field value to scalar modulo the group order and
|
||||
// returns the scalar along with either 1 if it was reduced (aka it overflowed)
|
||||
// or 0 otherwise.
|
||||
//
|
||||
// Note that a bool is not used here because it is not possible in Go to convert
|
||||
// from a bool to numeric value in constant time and many constant-time
|
||||
// operations require a numeric value.
|
||||
func fieldToModNScalar(v *secp256k1.FieldVal) (secp256k1.ModNScalar, uint32) { |
||||
var buf [32]byte |
||||
v.PutBytes(&buf) |
||||
var s secp256k1.ModNScalar |
||||
overflow := s.SetBytes(&buf) |
||||
zeroArray32(&buf) |
||||
return s, overflow |
||||
} |
||||
|
||||
// modNScalarToField converts a scalar modulo the group order to a field value.
|
||||
func modNScalarToField(v *secp256k1.ModNScalar) secp256k1.FieldVal { |
||||
var buf [32]byte |
||||
v.PutBytes(&buf) |
||||
var fv secp256k1.FieldVal |
||||
fv.SetBytes(&buf) |
||||
return fv |
||||
} |
||||
|
||||
// Verify returns whether the signature is valid for the provided hash
|
||||
// and secp256k1 public key.
|
||||
func (sig *Signature) Verify(hash []byte, pubKey *secp256k1.PublicKey) bool { |
||||
// The algorithm for verifying an ECDSA signature is given as algorithm 4.30
|
||||
// in [GECC].
|
||||
//
|
||||
// The following is a paraphrased version for reference:
|
||||
//
|
||||
// G = curve generator
|
||||
// N = curve order
|
||||
// Q = public key
|
||||
// m = message
|
||||
// R, S = signature
|
||||
//
|
||||
// 1. Fail if R and S are not in [1, N-1]
|
||||
// 2. e = H(m)
|
||||
// 3. w = S^-1 mod N
|
||||
// 4. u1 = e * w mod N
|
||||
// u2 = R * w mod N
|
||||
// 5. X = u1G + u2Q
|
||||
// 6. Fail if X is the point at infinity
|
||||
// 7. x = X.x mod N (X.x is the x coordinate of X)
|
||||
// 8. Verified if x == R
|
||||
//
|
||||
// However, since all group operations are done internally in Jacobian
|
||||
// projective space, the algorithm is modified slightly here in order to
|
||||
// avoid an expensive inversion back into affine coordinates at step 7.
|
||||
// Credits to Greg Maxwell for originally suggesting this optimization.
|
||||
//
|
||||
// Ordinarily, step 7 involves converting the x coordinate to affine by
|
||||
// calculating x = x / z^2 (mod P) and then calculating the remainder as
|
||||
// x = x (mod N). Then step 8 compares it to R.
|
||||
//
|
||||
// Note that since R is the x coordinate mod N from a random point that was
|
||||
// originally mod P, and the cofactor of the secp256k1 curve is 1, there are
|
||||
// only two possible x coordinates that the original random point could have
|
||||
// been to produce R: x, where x < N, and x+N, where x+N < P.
|
||||
//
|
||||
// This implies that the signature is valid if either:
|
||||
// a) R == X.x / X.z^2 (mod P)
|
||||
// => R * X.z^2 == X.x (mod P)
|
||||
// --or--
|
||||
// b) R + N < P && R + N == X.x / X.z^2 (mod P)
|
||||
// => R + N < P && (R + N) * X.z^2 == X.x (mod P)
|
||||
//
|
||||
// Therefore the following modified algorithm is used:
|
||||
//
|
||||
// 1. Fail if R and S are not in [1, N-1]
|
||||
// 2. e = H(m)
|
||||
// 3. w = S^-1 mod N
|
||||
// 4. u1 = e * w mod N
|
||||
// u2 = R * w mod N
|
||||
// 5. X = u1G + u2Q
|
||||
// 6. Fail if X is the point at infinity
|
||||
// 7. z = (X.z)^2 mod P (X.z is the z coordinate of X)
|
||||
// 8. Verified if R * z == X.x (mod P)
|
||||
// 9. Fail if R + N >= P
|
||||
// 10. Verified if (R + N) * z == X.x (mod P)
|
||||
//
|
||||
// Step 1.
|
||||
//
|
||||
// Fail if R and S are not in [1, N-1].
|
||||
if sig.r.IsZero() || sig.s.IsZero() { |
||||
return false |
||||
} |
||||
// Step 2.
|
||||
//
|
||||
// e = H(m)
|
||||
var e secp256k1.ModNScalar |
||||
e.SetByteSlice(hash) |
||||
// Step 3.
|
||||
//
|
||||
// w = S^-1 mod N
|
||||
w := new(secp256k1.ModNScalar).InverseValNonConst(&sig.s) |
||||
// Step 4.
|
||||
//
|
||||
// u1 = e * w mod N
|
||||
// u2 = R * w mod N
|
||||
u1 := new(secp256k1.ModNScalar).Mul2(&e, w) |
||||
u2 := new(secp256k1.ModNScalar).Mul2(&sig.r, w) |
||||
// Step 5.
|
||||
//
|
||||
// X = u1G + u2Q
|
||||
var X, Q, u1G, u2Q secp256k1.JacobianPoint |
||||
pubKey.AsJacobian(&Q) |
||||
secp256k1.ScalarBaseMultNonConst(u1, &u1G) |
||||
secp256k1.ScalarMultNonConst(u2, &Q, &u2Q) |
||||
secp256k1.AddNonConst(&u1G, &u2Q, &X) |
||||
// Step 6.
|
||||
//
|
||||
// Fail if X is the point at infinity
|
||||
if (X.X.IsZero() && X.Y.IsZero()) || X.Z.IsZero() { |
||||
return false |
||||
} |
||||
// Step 7.
|
||||
//
|
||||
// z = (X.z)^2 mod P (X.z is the z coordinate of X)
|
||||
z := new(secp256k1.FieldVal).SquareVal(&X.Z) |
||||
// Step 8.
|
||||
//
|
||||
// Verified if R * z == X.x (mod P)
|
||||
sigRModP := modNScalarToField(&sig.r) |
||||
result := new(secp256k1.FieldVal).Mul2(&sigRModP, z).Normalize() |
||||
if result.Equals(&X.X) { |
||||
return true |
||||
} |
||||
// Step 9.
|
||||
//
|
||||
// Fail if R + N >= P
|
||||
if sigRModP.IsGtOrEqPrimeMinusOrder() { |
||||
return false |
||||
} |
||||
// Step 10.
|
||||
//
|
||||
// Verified if (R + N) * z == X.x (mod P)
|
||||
sigRModP.Add(&orderAsFieldVal) |
||||
result.Mul2(&sigRModP, z).Normalize() |
||||
return result.Equals(&X.X) |
||||
} |
||||
|
||||
// IsEqual compares this Signature instance to the one passed, returning true if
|
||||
// both Signatures are equivalent. A signature is equivalent to another, if
|
||||
// they both have the same scalar value for R and S.
|
||||
func (sig *Signature) IsEqual(otherSig *Signature) bool { |
||||
return sig.r.Equals(&otherSig.r) && sig.s.Equals(&otherSig.s) |
||||
} |
||||
|
||||
// ParseDERSignature parses a signature in the Distinguished Encoding Rules
|
||||
// (DER) format per section 10 of [ISO/IEC 8825-1] and enforces the following
|
||||
// additional restrictions specific to secp256k1:
|
||||
//
|
||||
// - The R and S values must be in the valid range for secp256k1 scalars:
|
||||
// - Negative values are rejected
|
||||
// - Zero is rejected
|
||||
// - Values greater than or equal to the secp256k1 group order are rejected
|
||||
func ParseDERSignature(sig []byte) (*Signature, error) { |
||||
// The format of a DER encoded signature for secp256k1 is as follows:
|
||||
//
|
||||
// 0x30 <total length> 0x02 <length of R> <R> 0x02 <length of S> <S>
|
||||
// - 0x30 is the ASN.1 identifier for a sequence
|
||||
// - Total length is 1 byte and specifies length of all remaining data
|
||||
// - 0x02 is the ASN.1 identifier that specifies an integer follows
|
||||
// - Length of R is 1 byte and specifies how many bytes R occupies
|
||||
// - R is the arbitrary length big-endian encoded number which
|
||||
// represents the R value of the signature. DER encoding dictates
|
||||
// that the value must be encoded using the minimum possible number
|
||||
// of bytes. This implies the first byte can only be null if the
|
||||
// highest bit of the next byte is set in order to prevent it from
|
||||
// being interpreted as a negative number.
|
||||
// - 0x02 is once again the ASN.1 integer identifier
|
||||
// - Length of S is 1 byte and specifies how many bytes S occupies
|
||||
// - S is the arbitrary length big-endian encoded number which
|
||||
// represents the S value of the signature. The encoding rules are
|
||||
// identical as those for R.
|
||||
//
|
||||
// NOTE: The DER specification supports specifying lengths that can occupy
|
||||
// more than 1 byte, however, since this is specific to secp256k1
|
||||
// signatures, all lengths will be a single byte.
|
||||
const ( |
||||
// minSigLen is the minimum length of a DER encoded signature and is
|
||||
// when both R and S are 1 byte each.
|
||||
//
|
||||
// 0x30 + <1-byte> + 0x02 + 0x01 + <byte> + 0x2 + 0x01 + <byte>
|
||||
minSigLen = 8 |
||||
// maxSigLen is the maximum length of a DER encoded signature and is
|
||||
// when both R and S are 33 bytes each. It is 33 bytes because a
|
||||
// 256-bit integer requires 32 bytes and an additional leading null byte
|
||||
// might be required if the high bit is set in the value.
|
||||
//
|
||||
// 0x30 + <1-byte> + 0x02 + 0x21 + <33 bytes> + 0x2 + 0x21 + <33 bytes>
|
||||
maxSigLen = 72 |
||||
// sequenceOffset is the byte offset within the signature of the
|
||||
// expected ASN.1 sequence identifier.
|
||||
sequenceOffset = 0 |
||||
// dataLenOffset is the byte offset within the signature of the expected
|
||||
// total length of all remaining data in the signature.
|
||||
dataLenOffset = 1 |
||||
// rTypeOffset is the byte offset within the signature of the ASN.1
|
||||
// identifier for R and is expected to indicate an ASN.1 integer.
|
||||
rTypeOffset = 2 |
||||
// rLenOffset is the byte offset within the signature of the length of
|
||||
// R.
|
||||
rLenOffset = 3 |
||||
// rOffset is the byte offset within the signature of R.
|
||||
rOffset = 4 |
||||
) |
||||
// The signature must adhere to the minimum and maximum allowed length.
|
||||
sigLen := len(sig) |
||||
if sigLen < minSigLen { |
||||
str := fmt.Sprintf( |
||||
"malformed signature: too short: %d < %d", sigLen, |
||||
minSigLen, |
||||
) |
||||
return nil, signatureError(ErrSigTooShort, str) |
||||
} |
||||
if sigLen > maxSigLen { |
||||
str := fmt.Sprintf( |
||||
"malformed signature: too long: %d > %d", sigLen, |
||||
maxSigLen, |
||||
) |
||||
return nil, signatureError(ErrSigTooLong, str) |
||||
} |
||||
// The signature must start with the ASN.1 sequence identifier.
|
||||
if sig[sequenceOffset] != asn1SequenceID { |
||||
str := fmt.Sprintf( |
||||
"malformed signature: format has wrong type: %#x", |
||||
sig[sequenceOffset], |
||||
) |
||||
return nil, signatureError(ErrSigInvalidSeqID, str) |
||||
} |
||||
// The signature must indicate the correct amount of data for all elements
|
||||
// related to R and S.
|
||||
if int(sig[dataLenOffset]) != sigLen-2 { |
||||
str := fmt.Sprintf( |
||||
"malformed signature: bad length: %d != %d", |
||||
sig[dataLenOffset], sigLen-2, |
||||
) |
||||
return nil, signatureError(ErrSigInvalidDataLen, str) |
||||
} |
||||
// Calculate the offsets of the elements related to S and ensure S is inside
|
||||
// the signature.
|
||||
//
|
||||
// rLen specifies the length of the big-endian encoded number which
|
||||
// represents the R value of the signature.
|
||||
//
|
||||
// sTypeOffset is the offset of the ASN.1 identifier for S and, like its R
|
||||
// counterpart, is expected to indicate an ASN.1 integer.
|
||||
//
|
||||
// sLenOffset and sOffset are the byte offsets within the signature of the
|
||||
// length of S and S itself, respectively.
|
||||
rLen := int(sig[rLenOffset]) |
||||
sTypeOffset := rOffset + rLen |
||||
sLenOffset := sTypeOffset + 1 |
||||
if sTypeOffset >= sigLen { |
||||
str := "malformed signature: S type indicator missing" |
||||
return nil, signatureError(ErrSigMissingSTypeID, str) |
||||
} |
||||
if sLenOffset >= sigLen { |
||||
str := "malformed signature: S length missing" |
||||
return nil, signatureError(ErrSigMissingSLen, str) |
||||
} |
||||
// The lengths of R and S must match the overall length of the signature.
|
||||
//
|
||||
// sLen specifies the length of the big-endian encoded number which
|
||||
// represents the S value of the signature.
|
||||
sOffset := sLenOffset + 1 |
||||
sLen := int(sig[sLenOffset]) |
||||
if sOffset+sLen != sigLen { |
||||
str := "malformed signature: invalid S length" |
||||
return nil, signatureError(ErrSigInvalidSLen, str) |
||||
} |
||||
// R elements must be ASN.1 integers.
|
||||
if sig[rTypeOffset] != asn1IntegerID { |
||||
str := fmt.Sprintf( |
||||
"malformed signature: R integer marker: %#x != %#x", |
||||
sig[rTypeOffset], asn1IntegerID, |
||||
) |
||||
return nil, signatureError(ErrSigInvalidRIntID, str) |
||||
} |
||||
// Zero-length integers are not allowed for R.
|
||||
if rLen == 0 { |
||||
str := "malformed signature: R length is zero" |
||||
return nil, signatureError(ErrSigZeroRLen, str) |
||||
} |
||||
// R must not be negative.
|
||||
if sig[rOffset]&0x80 != 0 { |
||||
str := "malformed signature: R is negative" |
||||
return nil, signatureError(ErrSigNegativeR, str) |
||||
} |
||||
// Null bytes at the start of R are not allowed, unless R would otherwise be
|
||||
// interpreted as a negative number.
|
||||
if rLen > 1 && sig[rOffset] == 0x00 && sig[rOffset+1]&0x80 == 0 { |
||||
str := "malformed signature: R value has too much padding" |
||||
return nil, signatureError(ErrSigTooMuchRPadding, str) |
||||
} |
||||
// S elements must be ASN.1 integers.
|
||||
if sig[sTypeOffset] != asn1IntegerID { |
||||
str := fmt.Sprintf( |
||||
"malformed signature: S integer marker: %#x != %#x", |
||||
sig[sTypeOffset], asn1IntegerID, |
||||
) |
||||
return nil, signatureError(ErrSigInvalidSIntID, str) |
||||
} |
||||
// Zero-length integers are not allowed for S.
|
||||
if sLen == 0 { |
||||
str := "malformed signature: S length is zero" |
||||
return nil, signatureError(ErrSigZeroSLen, str) |
||||
} |
||||
// S must not be negative.
|
||||
if sig[sOffset]&0x80 != 0 { |
||||
str := "malformed signature: S is negative" |
||||
return nil, signatureError(ErrSigNegativeS, str) |
||||
} |
||||
// Null bytes at the start of S are not allowed, unless S would otherwise be
|
||||
// interpreted as a negative number.
|
||||
if sLen > 1 && sig[sOffset] == 0x00 && sig[sOffset+1]&0x80 == 0 { |
||||
str := "malformed signature: S value has too much padding" |
||||
return nil, signatureError(ErrSigTooMuchSPadding, str) |
||||
} |
||||
// The signature is validly encoded per DER at this point, however, enforce
|
||||
// additional restrictions to ensure R and S are in the range [1, N-1] since
|
||||
// valid ECDSA signatures are required to be in that range per spec.
|
||||
//
|
||||
// Also note that while the overflow checks are required to make use of the
|
||||
// specialized mod N scalar type, rejecting zero here is not strictly
|
||||
// required because it is also checked when verifying the signature, but
|
||||
// there really isn't a good reason not to fail early here on signatures
|
||||
// that do not conform to the ECDSA spec.
|
||||
//
|
||||
// Strip leading zeroes from R.
|
||||
rBytes := sig[rOffset : rOffset+rLen] |
||||
for len(rBytes) > 0 && rBytes[0] == 0x00 { |
||||
rBytes = rBytes[1:] |
||||
} |
||||
// R must be in the range [1, N-1]. Notice the check for the maximum number
|
||||
// of bytes is required because SetByteSlice truncates as noted in its
|
||||
// comment so it could otherwise fail to detect the overflow.
|
||||
var r secp256k1.ModNScalar |
||||
if len(rBytes) > 32 { |
||||
str := "invalid signature: R is larger than 256 bits" |
||||
return nil, signatureError(ErrSigRTooBig, str) |
||||
} |
||||
if overflow := r.SetByteSlice(rBytes); overflow { |
||||
str := "invalid signature: R >= group order" |
||||
return nil, signatureError(ErrSigRTooBig, str) |
||||
} |
||||
if r.IsZero() { |
||||
str := "invalid signature: R is 0" |
||||
return nil, signatureError(ErrSigRIsZero, str) |
||||
} |
||||
// Strip leading zeroes from S.
|
||||
sBytes := sig[sOffset : sOffset+sLen] |
||||
for len(sBytes) > 0 && sBytes[0] == 0x00 { |
||||
sBytes = sBytes[1:] |
||||
} |
||||
// S must be in the range [1, N-1]. Notice the check for the maximum number
|
||||
// of bytes is required because SetByteSlice truncates as noted in its
|
||||
// comment so it could otherwise fail to detect the overflow.
|
||||
var s secp256k1.ModNScalar |
||||
if len(sBytes) > 32 { |
||||
str := "invalid signature: S is larger than 256 bits" |
||||
return nil, signatureError(ErrSigSTooBig, str) |
||||
} |
||||
if overflow := s.SetByteSlice(sBytes); overflow { |
||||
str := "invalid signature: S >= group order" |
||||
return nil, signatureError(ErrSigSTooBig, str) |
||||
} |
||||
if s.IsZero() { |
||||
str := "invalid signature: S is 0" |
||||
return nil, signatureError(ErrSigSIsZero, str) |
||||
} |
||||
// Create and return the signature.
|
||||
return NewSignature(&r, &s), nil |
||||
} |
||||
|
||||
// sign generates an ECDSA signature over the secp256k1 curve for the provided
|
||||
// hash (which should be the result of hashing a larger message) using the given
|
||||
// nonce and secret key and returns it along with an additional public key
|
||||
// recovery code and success indicator. Upon success, the produced signature is
|
||||
// deterministic (same message, nonce, and key yield the same signature) and
|
||||
// canonical in accordance with BIP0062.
|
||||
//
|
||||
// Note that signRFC6979 makes use of this function as it is the primary ECDSA
|
||||
// signing logic. It differs in that it accepts a nonce to use when signing and
|
||||
// may not successfully produce a valid signature for the given nonce. It is
|
||||
// primarily separated for testing purposes.
|
||||
func sign(secKey, nonce *secp256k1.ModNScalar, hash []byte) ( |
||||
*Signature, byte, |
||||
bool, |
||||
) { |
||||
// The algorithm for producing an ECDSA signature is given as algorithm 4.29
|
||||
// in [GECC].
|
||||
//
|
||||
// The following is a paraphrased version for reference:
|
||||
//
|
||||
// G = curve generator
|
||||
// N = curve order
|
||||
// d = secret key
|
||||
// m = message
|
||||
// r, s = signature
|
||||
//
|
||||
// 1. Select random nonce k in [1, N-1]
|
||||
// 2. Compute kG
|
||||
// 3. r = kG.x mod N (kG.x is the x coordinate of the point kG)
|
||||
// Repeat from step 1 if r = 0
|
||||
// 4. e = H(m)
|
||||
// 5. s = k^-1(e + dr) mod N
|
||||
// Repeat from step 1 if s = 0
|
||||
// 6. Return (r,s)
|
||||
//
|
||||
// This is slightly modified here to conform to RFC6979 and BIP 62 as
|
||||
// follows:
|
||||
//
|
||||
// A. Instead of selecting a random nonce in step 1, use RFC6979 to generate
|
||||
// a deterministic nonce in [1, N-1] parameterized by the secret key,
|
||||
// message being signed, and an iteration count for the repeat cases
|
||||
// B. Negate s calculated in step 5 if it is > N/2
|
||||
// This is done because both s and its negation are valid signatures
|
||||
// modulo the curve order N, so it forces a consistent choice to reduce
|
||||
// signature malleability
|
||||
//
|
||||
// NOTE: Step 1 is performed by the caller.
|
||||
//
|
||||
// Step 2.
|
||||
//
|
||||
// Compute kG
|
||||
//
|
||||
// Note that the point must be in affine coordinates.
|
||||
k := nonce |
||||
var kG secp256k1.JacobianPoint |
||||
secp256k1.ScalarBaseMultNonConst(k, &kG) |
||||
kG.ToAffine() |
||||
// Step 3.
|
||||
//
|
||||
// r = kG.x mod N
|
||||
// Repeat from step 1 if r = 0
|
||||
r, overflow := fieldToModNScalar(&kG.X) |
||||
if r.IsZero() { |
||||
return nil, 0, false |
||||
} |
||||
// Since the secp256k1 curve has a cofactor of 1, when recovering a
|
||||
// public key from an ECDSA signature over it, there are four possible
|
||||
// candidates corresponding to the following cases:
|
||||
//
|
||||
// 1) The X coord of the random point is < N and its Y coord even
|
||||
// 2) The X coord of the random point is < N and its Y coord is odd
|
||||
// 3) The X coord of the random point is >= N and its Y coord is even
|
||||
// 4) The X coord of the random point is >= N and its Y coord is odd
|
||||
//
|
||||
// Rather than forcing the recovery procedure to check all possible
|
||||
// cases, this creates a recovery code that uniquely identifies which of
|
||||
// the cases apply by making use of 2 bits. Bit 0 identifies the
|
||||
// oddness case and Bit 1 identifies the overflow case (aka when the X
|
||||
// coord >= N).
|
||||
//
|
||||
// It is also worth noting that making use of Hasse's theorem shows
|
||||
// there are around log_2((p-n)/p) ~= -127.65 ~= 1 in 2^127 points where
|
||||
// the X coordinate is >= N. It is not possible to calculate these
|
||||
// points since that would require breaking the ECDLP, but, in practice
|
||||
// this strongly implies with extremely high probability that there are
|
||||
// only a few actual points for which this case is true.
|
||||
pubKeyRecoveryCode := byte(overflow<<1) | byte(kG.Y.IsOddBit()) |
||||
// Step 4.
|
||||
//
|
||||
// e = H(m)
|
||||
//
|
||||
// Note that this actually sets e = H(m) mod N which is correct since
|
||||
// it is only used in step 5 which itself is mod N.
|
||||
var e secp256k1.ModNScalar |
||||
e.SetByteSlice(hash) |
||||
// Step 5 with modification B.
|
||||
//
|
||||
// s = k^-1(e + dr) mod N
|
||||
// Repeat from step 1 if s = 0
|
||||
// s = -s if s > N/2
|
||||
kinv := new(secp256k1.ModNScalar).InverseValNonConst(k) |
||||
s := new(secp256k1.ModNScalar).Mul2(secKey, &r).Add(&e).Mul(kinv) |
||||
if s.IsZero() { |
||||
return nil, 0, false |
||||
} |
||||
if s.IsOverHalfOrder() { |
||||
s.Negate() |
||||
// Negating s corresponds to the random point that would have been
|
||||
// generated by -k (mod N), which necessarily has the opposite
|
||||
// oddness since N is prime, thus flip the pubkey recovery code
|
||||
// oddness bit accordingly.
|
||||
pubKeyRecoveryCode ^= 0x01 |
||||
} |
||||
// Step 6.
|
||||
//
|
||||
// Return (r,s)
|
||||
return NewSignature(&r, s), pubKeyRecoveryCode, true |
||||
} |
||||
|
||||
// signRFC6979 generates a deterministic ECDSA signature according to RFC 6979
|
||||
// and BIP0062 and returns it along with an additional public key recovery code
|
||||
// for efficiently recovering the public key from the signature.
|
||||
func signRFC6979(secKey *secp256k1.SecretKey, hash []byte) ( |
||||
*Signature, |
||||
byte, |
||||
) { |
||||
// The algorithm for producing an ECDSA signature is given as algorithm 4.29
|
||||
// in [GECC].
|
||||
//
|
||||
// The following is a paraphrased version for reference:
|
||||
//
|
||||
// G = curve generator
|
||||
// N = curve order
|
||||
// d = secret key
|
||||
// m = message
|
||||
// r, s = signature
|
||||
//
|
||||
// 1. Select random nonce k in [1, N-1]
|
||||
// 2. Compute kG
|
||||
// 3. r = kG.x mod N (kG.x is the x coordinate of the point kG)
|
||||
// Repeat from step 1 if r = 0
|
||||
// 4. e = H(m)
|
||||
// 5. s = k^-1(e + dr) mod N
|
||||
// Repeat from step 1 if s = 0
|
||||
// 6. Return (r,s)
|
||||
//
|
||||
// This is slightly modified here to conform to RFC6979 and BIP 62 as
|
||||
// follows:
|
||||
//
|
||||
// A. Instead of selecting a random nonce in step 1, use RFC6979 to generate
|
||||
// a deterministic nonce in [1, N-1] parameterized by the secret key,
|
||||
// message being signed, and an iteration count for the repeat cases
|
||||
// B. Negate s calculated in step 5 if it is > N/2
|
||||
// This is done because both s and its negation are valid signatures
|
||||
// modulo the curve order N, so it forces a consistent choice to reduce
|
||||
// signature malleability
|
||||
secKeyScalar := &secKey.Key |
||||
var secKeyBytes [32]byte |
||||
secKeyScalar.PutBytes(&secKeyBytes) |
||||
defer zeroArray32(&secKeyBytes) |
||||
for iteration := uint32(0); ; iteration++ { |
||||
// Step 1 with modification A.
|
||||
//
|
||||
// Generate a deterministic nonce in [1, N-1] parameterized by the
|
||||
// secret key, message being signed, and iteration count.
|
||||
k := secp256k1.NonceRFC6979(secKeyBytes[:], hash, nil, nil, iteration) |
||||
// Steps 2-6.
|
||||
sig, pubKeyRecoveryCode, success := sign(secKeyScalar, k, hash) |
||||
k.Zero() |
||||
if !success { |
||||
continue |
||||
} |
||||
return sig, pubKeyRecoveryCode |
||||
} |
||||
} |
||||
|
||||
// Sign generates an ECDSA signature over the secp256k1 curve for the provided
|
||||
// hash (which should be the result of hashing a larger message) using the given
|
||||
// secret key. The produced signature is deterministic (same message and same
|
||||
// key yield the same signature) and canonical in accordance with RFC6979 and
|
||||
// BIP0062.
|
||||
func Sign(key *secp256k1.SecretKey, hash []byte) *Signature { |
||||
signature, _ := signRFC6979(key, hash) |
||||
return signature |
||||
} |
||||
|
||||
const ( |
||||
// compactSigSize is the size of a compact signature. It consists of a
|
||||
// compact signature recovery code byte followed by the R and S components
|
||||
// serialized as 32-byte big-endian values. 1+32*2 = 65.
|
||||
// for the R and S components. 1+32+32=65.
|
||||
compactSigSize = 65 |
||||
// compactSigMagicOffset is a value used when creating the compact signature
|
||||
// recovery code inherited from Bitcoin and has no meaning, but has been
|
||||
// retained for compatibility. For historical purposes, it was originally
|
||||
// picked to avoid a binary representation that would allow compact
|
||||
// signatures to be mistaken for other components.
|
||||
compactSigMagicOffset = 27 |
||||
// compactSigCompPubKey is a value used when creating the compact signature
|
||||
// recovery code to indicate the original public key was compressed.
|
||||
compactSigCompPubKey = 4 |
||||
// pubKeyRecoveryCodeOddnessBit specifies the bit that indicates the oddess
|
||||
// of the Y coordinate of the random point calculated when creating a
|
||||
// signature.
|
||||
pubKeyRecoveryCodeOddnessBit = 1 << 0 |
||||
// pubKeyRecoveryCodeOverflowBit specifies the bit that indicates the X
|
||||
// coordinate of the random point calculated when creating a signature was
|
||||
// >= N, where N is the order of the group.
|
||||
pubKeyRecoveryCodeOverflowBit = 1 << 1 |
||||
) |
||||
|
||||
// SignCompact produces a compact ECDSA signature over the secp256k1 curve for
|
||||
// the provided hash (which should be the result of hashing a larger message)
|
||||
// using the given secret key. The isCompressedKey parameter specifies if the
|
||||
// produced signature should reference a compressed public key or not.
|
||||
//
|
||||
// Compact signature format:
|
||||
// <1-byte compact sig recovery code><32-byte R><32-byte S>
|
||||
//
|
||||
// The compact sig recovery code is the value 27 + public key recovery code + 4
|
||||
// if the compact signature was created with a compressed public key.
|
||||
func SignCompact( |
||||
key *secp256k1.SecretKey, hash []byte, |
||||
isCompressedKey bool, |
||||
) []byte { |
||||
// Create the signature and associated pubkey recovery code and calculate
|
||||
// the compact signature recovery code.
|
||||
sig, pubKeyRecoveryCode := signRFC6979(key, hash) |
||||
compactSigRecoveryCode := compactSigMagicOffset + pubKeyRecoveryCode |
||||
if isCompressedKey { |
||||
compactSigRecoveryCode += compactSigCompPubKey |
||||
} |
||||
// Output <compactSigRecoveryCode><32-byte R><32-byte S>.
|
||||
var b [compactSigSize]byte |
||||
b[0] = compactSigRecoveryCode |
||||
sig.r.PutBytesUnchecked(b[1:33]) |
||||
sig.s.PutBytesUnchecked(b[33:65]) |
||||
return b[:] |
||||
} |
||||
|
||||
// RecoverCompact attempts to recover the secp256k1 public key from the provided
|
||||
// compact signature and message hash. It first verifies the signature, and, if
|
||||
// the signature matches then the recovered public key will be returned as well
|
||||
// as a boolean indicating whether or not the original key was compressed.
|
||||
func RecoverCompact(signature, hash []byte) ( |
||||
*secp256k1.PublicKey, bool, error, |
||||
) { |
||||
// The following is very loosely based on the information and algorithm that
|
||||
// describes recovering a public key from and ECDSA signature in section
|
||||
// 4.1.6 of [SEC1].
|
||||
//
|
||||
// Given the following parameters:
|
||||
//
|
||||
// G = curve generator
|
||||
// N = group order
|
||||
// P = field prime
|
||||
// Q = public key
|
||||
// m = message
|
||||
// e = hash of the message
|
||||
// r, s = signature
|
||||
// X = random point used when creating signature whose x coordinate is r
|
||||
//
|
||||
// The equation to recover a public key candidate from an ECDSA signature
|
||||
// is:
|
||||
// Q = r^-1(sX - eG).
|
||||
//
|
||||
// This can be verified by plugging it in for Q in the sig verification
|
||||
// equation:
|
||||
// X = s^-1(eG + rQ) (mod N)
|
||||
// => s^-1(eG + r(r^-1(sX - eG))) (mod N)
|
||||
// => s^-1(eG + sX - eG) (mod N)
|
||||
// => s^-1(sX) (mod N)
|
||||
// => X (mod N)
|
||||
//
|
||||
// However, note that since r is the x coordinate mod N from a random point
|
||||
// that was originally mod P, and the cofactor of the secp256k1 curve is 1,
|
||||
// there are four possible points that the original random point could have
|
||||
// been to produce r: (r,y), (r,-y), (r+N,y), and (r+N,-y). At least 2 of
|
||||
// those points will successfully verify, and all 4 will successfully verify
|
||||
// when the original x coordinate was in the range [N+1, P-1], but in any
|
||||
// case, only one of them corresponds to the original secret key used.
|
||||
//
|
||||
// The method described by section 4.1.6 of [SEC1] to determine which one is
|
||||
// the correct one involves calculating each possibility as a candidate
|
||||
// public key and comparing the candidate to the authentic public key. It
|
||||
// also hints that it is possible to generate the signature in a such a
|
||||
// way that only one of the candidate public keys is viable.
|
||||
//
|
||||
// A more efficient approach that is specific to the secp256k1 curve is used
|
||||
// here instead which is to produce a "pubkey recovery code" when signing
|
||||
// that uniquely identifies which of the 4 possibilities is correct for the
|
||||
// original random point and using that to recover the pubkey directly as
|
||||
// follows:
|
||||
//
|
||||
// 1. Fail if r and s are not in [1, N-1]
|
||||
// 2. Convert r to integer mod P
|
||||
// 3. If pubkey recovery code overflow bit is set:
|
||||
// 3.1 Fail if r + N >= P
|
||||
// 3.2 r = r + N (mod P)
|
||||
// 4. y = +sqrt(r^3 + 7) (mod P)
|
||||
// 4.1 Fail if y does not exist
|
||||
// 4.2 y = -y if needed to match pubkey recovery code oddness bit
|
||||
// 5. X = (r, y)
|
||||
// 6. e = H(m) mod N
|
||||
// 7. w = r^-1 mod N
|
||||
// 8. u1 = -(e * w) mod N
|
||||
// u2 = s * w mod N
|
||||
// 9. Q = u1G + u2X
|
||||
// 10. Fail if Q is the point at infinity
|
||||
//
|
||||
// A compact signature consists of a recovery byte followed by the R and
|
||||
// S components serialized as 32-byte big-endian values.
|
||||
if len(signature) != compactSigSize { |
||||
str := fmt.Sprintf( |
||||
"malformed signature: wrong size: %d != %d", |
||||
len(signature), compactSigSize, |
||||
) |
||||
return nil, false, signatureError(ErrSigInvalidLen, str) |
||||
} |
||||
// Parse and validate the compact signature recovery code.
|
||||
const ( |
||||
minValidCode = compactSigMagicOffset |
||||
maxValidCode = compactSigMagicOffset + compactSigCompPubKey + 3 |
||||
) |
||||
sigRecoveryCode := signature[0] |
||||
if sigRecoveryCode < minValidCode || sigRecoveryCode > maxValidCode { |
||||
str := fmt.Sprintf( |
||||
"invalid signature: public key recovery code %d is "+ |
||||
"not in the valid range [%d, %d]", sigRecoveryCode, |
||||
minValidCode, |
||||
maxValidCode, |
||||
) |
||||
return nil, false, signatureError(ErrSigInvalidRecoveryCode, str) |
||||
} |
||||
sigRecoveryCode -= compactSigMagicOffset |
||||
wasCompressed := sigRecoveryCode&compactSigCompPubKey != 0 |
||||
pubKeyRecoveryCode := sigRecoveryCode & 3 |
||||
// Step 1.
|
||||
//
|
||||
// Parse and validate the R and S signature components.
|
||||
//
|
||||
// Fail if r and s are not in [1, N-1].
|
||||
var r, s secp256k1.ModNScalar |
||||
if overflow := r.SetByteSlice(signature[1:33]); overflow { |
||||
str := "invalid signature: R >= group order" |
||||
return nil, false, signatureError(ErrSigRTooBig, str) |
||||
} |
||||
if r.IsZero() { |
||||
str := "invalid signature: R is 0" |
||||
return nil, false, signatureError(ErrSigRIsZero, str) |
||||
} |
||||
if overflow := s.SetByteSlice(signature[33:]); overflow { |
||||
str := "invalid signature: S >= group order" |
||||
return nil, false, signatureError(ErrSigSTooBig, str) |
||||
} |
||||
if s.IsZero() { |
||||
str := "invalid signature: S is 0" |
||||
return nil, false, signatureError(ErrSigSIsZero, str) |
||||
} |
||||
// Step 2.
|
||||
//
|
||||
// Convert r to integer mod P.
|
||||
fieldR := modNScalarToField(&r) |
||||
// Step 3.
|
||||
//
|
||||
// If pubkey recovery code overflow bit is set:
|
||||
if pubKeyRecoveryCode&pubKeyRecoveryCodeOverflowBit != 0 { |
||||
// Step 3.1.
|
||||
//
|
||||
// Fail if r + N >= P
|
||||
//
|
||||
// Either the signature or the recovery code must be invalid if the
|
||||
// recovery code overflow bit is set and adding N to the R component
|
||||
// would exceed the field prime since R originally came from the X
|
||||
// coordinate of a random point on the curve.
|
||||
if fieldR.IsGtOrEqPrimeMinusOrder() { |
||||
str := "invalid signature: signature R + N >= P" |
||||
return nil, false, signatureError(ErrSigOverflowsPrime, str) |
||||
} |
||||
// Step 3.2.
|
||||
//
|
||||
// r = r + N (mod P)
|
||||
fieldR.Add(&orderAsFieldVal) |
||||
} |
||||
// Step 4.
|
||||
//
|
||||
// y = +sqrt(r^3 + 7) (mod P)
|
||||
// Fail if y does not exist.
|
||||
// y = -y if needed to match pubkey recovery code oddness bit
|
||||
//
|
||||
// The signature must be invalid if the calculation fails because the X
|
||||
// coord originally came from a random point on the curve which means there
|
||||
// must be a Y coord that satisfies the equation for a valid signature.
|
||||
oddY := pubKeyRecoveryCode&pubKeyRecoveryCodeOddnessBit != 0 |
||||
var y secp256k1.FieldVal |
||||
if valid := secp256k1.DecompressY(&fieldR, oddY, &y); !valid { |
||||
str := "invalid signature: not for a valid curve point" |
||||
return nil, false, signatureError(ErrPointNotOnCurve, str) |
||||
} |
||||
// Step 5.
|
||||
//
|
||||
// X = (r, y)
|
||||
var X secp256k1.JacobianPoint |
||||
X.X.Set(fieldR.Normalize()) |
||||
X.Y.Set(y.Normalize()) |
||||
X.Z.SetInt(1) |
||||
// Step 6.
|
||||
//
|
||||
// e = H(m) mod N
|
||||
var e secp256k1.ModNScalar |
||||
e.SetByteSlice(hash) |
||||
// Step 7.
|
||||
//
|
||||
// w = r^-1 mod N
|
||||
w := new(secp256k1.ModNScalar).InverseValNonConst(&r) |
||||
// Step 8.
|
||||
//
|
||||
// u1 = -(e * w) mod N
|
||||
// u2 = s * w mod N
|
||||
u1 := new(secp256k1.ModNScalar).Mul2(&e, w).Negate() |
||||
u2 := new(secp256k1.ModNScalar).Mul2(&s, w) |
||||
// Step 9.
|
||||
//
|
||||
// Q = u1G + u2X
|
||||
var Q, u1G, u2X secp256k1.JacobianPoint |
||||
secp256k1.ScalarBaseMultNonConst(u1, &u1G) |
||||
secp256k1.ScalarMultNonConst(u2, &X, &u2X) |
||||
secp256k1.AddNonConst(&u1G, &u2X, &Q) |
||||
// Step 10.
|
||||
//
|
||||
// Fail if Q is the point at infinity.
|
||||
//
|
||||
// Either the signature or the pubkey recovery code must be invalid if the
|
||||
// recovered pubkey is the point at infinity.
|
||||
if (Q.X.IsZero() && Q.Y.IsZero()) || Q.Z.IsZero() { |
||||
str := "invalid signature: recovered pubkey is the point at infinity" |
||||
return nil, false, signatureError(ErrPointNotOnCurve, str) |
||||
} |
||||
// Notice that the public key is in affine coordinates.
|
||||
Q.ToAffine() |
||||
pubKey := secp256k1.NewPublicKey(&Q.X, &Q.Y) |
||||
return pubKey, wasCompressed, nil |
||||
} |
||||
File diff suppressed because it is too large
Load Diff
@ -1,24 +0,0 @@
@@ -1,24 +0,0 @@
|
||||
// Copyright (c) 2013-2021 The btcsuite developers
|
||||
// Copyright (c) 2015-2021 The Decred developers
|
||||
|
||||
package btcec |
||||
|
||||
import ( |
||||
"next.orly.dev/pkg/crypto/ec/secp256k1" |
||||
) |
||||
|
||||
// Error identifies an error related to public key cryptography using a
|
||||
// sec256k1 curve. It has full support for errors.Is and errors.As, so the
|
||||
// caller can ascertain the specific reason for the error by checking the
|
||||
// underlying error.
|
||||
type Error = secp256k1.Error |
||||
|
||||
// ErrorKind identifies a kind of error. It has full support for errors.Is and
|
||||
// errors.As, so the caller can directly check against an error kind when
|
||||
// determining the reason for an error.
|
||||
type ErrorKind = secp256k1.ErrorKind |
||||
|
||||
// makeError creates an secp256k1.Error given a set of arguments.
|
||||
func makeError(kind ErrorKind, desc string) Error { |
||||
return Error{Err: kind, Description: desc} |
||||
} |
||||
@ -1,45 +0,0 @@
@@ -1,45 +0,0 @@
|
||||
package btcec |
||||
|
||||
import ( |
||||
"next.orly.dev/pkg/crypto/ec/secp256k1" |
||||
) |
||||
|
||||
// FieldVal implements optimized fixed-precision arithmetic over the secp256k1
|
||||
// finite field. This means all arithmetic is performed modulo
|
||||
// '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'.
|
||||
//
|
||||
// WARNING: Since it is so important for the field arithmetic to be extremely
|
||||
// fast for high performance crypto, this type does not perform any validation
|
||||
// of documented preconditions where it ordinarily would. As a result, it is
|
||||
// IMPERATIVE for callers to understand some key concepts that are described
|
||||
// below and ensure the methods are called with the necessary preconditions
|
||||
// that each method is documented with. For example, some methods only give the
|
||||
// correct result if the field value is normalized and others require the field
|
||||
// values involved to have a maximum magnitude and THERE ARE NO EXPLICIT CHECKS
|
||||
// TO ENSURE THOSE PRECONDITIONS ARE SATISFIED. This does, unfortunately, make
|
||||
// the type more difficult to use correctly and while I typically prefer to
|
||||
// ensure all state and input is valid for most code, this is a bit of an
|
||||
// exception because those extra checks really add up in what ends up being
|
||||
// critical hot paths.
|
||||
//
|
||||
// The first key concept when working with this type is normalization. In order
|
||||
// to avoid the need to propagate a ton of carries, the internal representation
|
||||
// provides additional overflow bits for each word of the overall 256-bit
|
||||
// value. This means that there are multiple internal representations for the
|
||||
// same value and, as a result, any methods that rely on comparison of the
|
||||
// value, such as equality and oddness determination, require the caller to
|
||||
// provide a normalized value.
|
||||
//
|
||||
// The second key concept when working with this type is magnitude. As
|
||||
// previously mentioned, the internal representation provides additional
|
||||
// overflow bits which means that the more math operations that are performed
|
||||
// on the field value between normalizations, the more those overflow bits
|
||||
// accumulate. The magnitude is effectively that maximum possible number of
|
||||
// those overflow bits that could possibly be required as a result of a given
|
||||
// operation. Since there are only a limited number of overflow bits available,
|
||||
// this implies that the max possible magnitude MUST be tracked by the caller
|
||||
// and the caller MUST normalize the field value if a given operation would
|
||||
// cause the magnitude of the result to exceed the max allowed value.
|
||||
//
|
||||
// IMPORTANT: The max allowed magnitude of a field value is 64.
|
||||
type FieldVal = secp256k1.FieldVal |
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in new issue