Changeset View
Changeset View
Standalone View
Standalone View
src/secp256k1/src/ecdsa_impl.h
| Show First 20 Lines • Show All 274 Lines • ▼ Show 20 Lines | |||||
| } | } | ||||
| static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid) { | static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid) { | ||||
| unsigned char b[32]; | unsigned char b[32]; | ||||
| secp256k1_gej rp; | secp256k1_gej rp; | ||||
| secp256k1_ge r; | secp256k1_ge r; | ||||
| secp256k1_scalar n; | secp256k1_scalar n; | ||||
| int overflow = 0; | int overflow = 0; | ||||
| int high; | |||||
| secp256k1_ecmult_gen(ctx, &rp, nonce); | secp256k1_ecmult_gen(ctx, &rp, nonce); | ||||
| secp256k1_ge_set_gej(&r, &rp); | secp256k1_ge_set_gej(&r, &rp); | ||||
| secp256k1_fe_normalize(&r.x); | secp256k1_fe_normalize(&r.x); | ||||
| secp256k1_fe_normalize(&r.y); | secp256k1_fe_normalize(&r.y); | ||||
| secp256k1_fe_get_b32(b, &r.x); | secp256k1_fe_get_b32(b, &r.x); | ||||
| secp256k1_scalar_set_b32(sigr, b, &overflow); | secp256k1_scalar_set_b32(sigr, b, &overflow); | ||||
| /* These two conditions should be checked before calling */ | /* These two conditions should be checked before calling */ | ||||
| VERIFY_CHECK(!secp256k1_scalar_is_zero(sigr)); | VERIFY_CHECK(!secp256k1_scalar_is_zero(sigr)); | ||||
| VERIFY_CHECK(overflow == 0); | VERIFY_CHECK(overflow == 0); | ||||
| if (recid) { | if (recid) { | ||||
| /* The overflow condition is cryptographically unreachable as hitting it requires finding the discrete log | /* The overflow condition is cryptographically unreachable as hitting it requires finding the discrete log | ||||
| * of some P where P.x >= order, and only 1 in about 2^127 points meet this criteria. | * of some P where P.x >= order, and only 1 in about 2^127 points meet this criteria. | ||||
| */ | */ | ||||
| *recid = (overflow ? 2 : 0) | (secp256k1_fe_is_odd(&r.y) ? 1 : 0); | *recid = (overflow << 1) | secp256k1_fe_is_odd(&r.y); | ||||
| } | } | ||||
| secp256k1_scalar_mul(&n, sigr, seckey); | secp256k1_scalar_mul(&n, sigr, seckey); | ||||
| secp256k1_scalar_add(&n, &n, message); | secp256k1_scalar_add(&n, &n, message); | ||||
| secp256k1_scalar_inverse(sigs, nonce); | secp256k1_scalar_inverse(sigs, nonce); | ||||
| secp256k1_scalar_mul(sigs, sigs, &n); | secp256k1_scalar_mul(sigs, sigs, &n); | ||||
| secp256k1_scalar_clear(&n); | secp256k1_scalar_clear(&n); | ||||
| secp256k1_gej_clear(&rp); | secp256k1_gej_clear(&rp); | ||||
| secp256k1_ge_clear(&r); | secp256k1_ge_clear(&r); | ||||
| if (secp256k1_scalar_is_zero(sigs)) { | high = secp256k1_scalar_is_high(sigs); | ||||
| return 0; | secp256k1_scalar_cond_negate(sigs, high); | ||||
| } | |||||
| if (secp256k1_scalar_is_high(sigs)) { | |||||
| secp256k1_scalar_negate(sigs, sigs); | |||||
| if (recid) { | if (recid) { | ||||
| *recid ^= 1; | *recid ^= high; | ||||
| } | } | ||||
| } | return !secp256k1_scalar_is_zero(sigs); | ||||
| return 1; | |||||
| } | } | ||||
| #endif /* SECP256K1_ECDSA_IMPL_H */ | #endif /* SECP256K1_ECDSA_IMPL_H */ | ||||