Page MenuHomePhabricator

[electrum] properly handle point at infinity and point not on curve
ClosedPublic

Authored by PiRK on Mon, Aug 26, 15:08.

Details

Summary

Raise a custom error for points not on the curve. Support a special *point a inifinity* value for ECPubkey (will be needed in the next diff for Cash Fusion code)

This is a backport of https://github.com/spesmilo/electrum/commit/59c1d03f018026ac301c4e74facfc64da8ae4708

Additional tests from:

  • electrumabc_plugins/fusion/tests/test_pedersen.py

Depends on D16676

Test Plan

python test_runner.py

Diff Detail

Repository
rABC Bitcoin ABC
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

PiRK requested review of this revision.Mon, Aug 26, 15:08
PiRK planned changes to this revision.Tue, Aug 27, 08:28

point at infinity shouldn't be an error on the ECC side, this needs some more work

PiRK retitled this revision from [electrum] raise a custom error for invalid eliptic curve points to [electrum] properly handle point at infinity and point not on curve.
PiRK edited the summary of this revision. (Show Details)

properly hand point at infinity (not an error)

PiRK planned changes to this revision.Tue, Aug 27, 15:44
PiRK added inline comments.
electrum/electrumabc/ecc.py
57–62 ↗(On Diff #49370)

These two are changed from functions to simple CONSTANTs in a coming backport, so might as well do it immediately to save us from another clean-up commit.

use GENERATOR and POINT_AT_INFINITY constants. These need to be placed after the ECPubkey class is defined.

bytesofman added a subscriber: bytesofman.

like D16676, I'm not able to arc patch this diff. Looks like there is an issue with the parent / child revisions in the stack.

image.png (521×731 px, 120 KB)

This revision now requires changes to proceed.Wed, Aug 28, 21:16

I'm not sure exactly what is going on. I will try to rebase all these diffs onto D16687 when I get it sorted out. Hopefully it will fix the situation. I could just rebase everything onto master after I land any diff in the stack, but that would be tedious and noisy in the phabricator logs for a stack of 10+ commits.

still not able to arc patch this one, which could mean we see issues when it is landed. may want to wait until this is next off the rank.

did points at infinity or not on curve not being properly handled impact app performance? why was this not handled before this diff?

This revision is now accepted and ready to land.Thu, Aug 29, 14:32

still not able to arc patch this one, which could mean we see issues when it is landed. may want to wait until this is next off the rank.

did points at infinity or not on curve not being properly handled impact app performance? why was this not handled before this diff?

It wasn't properly handled in this class because the code guarding against this problem is currently still using the ecdsa.ellipticalcurve.Point objects we want to get rid of. You could for instance have a sum of elliptical curve points result in point at inifinity which would be an unsecure or unusuable key to use in the cryptography in Cash Fusion code. If we want the Cash Fusion code to not lose any security features when switching to using this ECPubkey class in D16682, I need to implement it. But it is unlikely to ever be triggered except in tests where it is done on purpose.

Wrt to points not on curve, this diff basically just catches existing exceptions that would be raised when constructing the ecdsa.ellipticcurve.Point object and raise our custom exception instead. So later when we move away from using ecdsa.ellipticcurve.Point we can maintain the same behavior by client code by manually raising that exception depending on the return value of some libsecp256k1 function. See D16689 in the _x_and_y_from_pubkey_bytes function for instance.