def test_bip340_vectors() -> None:
"""BIP340 (Schnorr) test vectors.
https://github.com/bitcoin/bips/blob/master/bip-0340/test-vectors.csv
"""
fname = "bip340_test_vectors.csv"
filename = path.join(path.dirname(__file__), "test_data", fname)
with open(filename, newline="") as csvfile:
reader = csv.reader(csvfile)
# skip column headers while checking that there are 7 columns
_, _, _, _, _, _, _ = reader.__next__()
for row in reader:
(index, seckey, pubkey, m, sig, result, comment) = row
err_msg = f"Test vector #{int(index)}"
if seckey != "":
_, pubkey_actual = ssa.gen_keys(seckey)
assert pubkey == hex(pubkey_actual).upper()[2:], err_msg
sig_actual = ssa.serialize(*ssa._sign(m, seckey))
assert sig == sig_actual.hex().upper(), err_msg
if comment:
err_msg += ": " + comment
# TODO what's worng with xor-ing ?
# assert (result == "TRUE") ^ ssa._verify(m, pubkey, sig), err_msg
if result == "TRUE":
assert ssa._verify(m, pubkey, sig), err_msg
else:
assert not ssa._verify(m, pubkey, sig), err_msg
def test_ecssa(self):
"""Basic tests"""
ec = secp256k1
q = 0x1
Q = mult(ec, q, ec.G)
msg = hf('Satoshi Nakamoto'.encode()).digest()
sig = ssa.sign(ec, hf, msg, q, None)
# no source for the following... but
# https://bitcointalk.org/index.php?topic=285142.40
# same r because of rfc6979
exp_sig = (
0x934B1EA10A4B3C1757E2B0C017D0B6143CE3C9A7E6A4A49860D7A6AB210EE3D8,
0x2DF2423F70563E3C4BD0E00BDEF658081613858F110ECF937A2ED9190BF4A01A)
self.assertEqual(sig[0], exp_sig[0])
self.assertEqual(sig[1], exp_sig[1])
ssa._verify(ec, hf, msg, Q, sig)
self.assertTrue(ssa.verify(ec, hf, msg, Q, sig))
self.assertTrue(ssa._verify(ec, hf, msg, Q, sig))
fmsg = hf('Craig Wright'.encode()).digest()
self.assertFalse(ssa.verify(ec, hf, fmsg, Q, sig))
self.assertFalse(ssa._verify(ec, hf, fmsg, Q, sig))
fssasig = (sig[0], sig[1], sig[1])
self.assertFalse(ssa.verify(ec, hf, msg, Q, fssasig))
self.assertRaises(TypeError, ssa._verify, ec, hf, msg, Q, fssasig)
# y(sG - eP) is not a quadratic residue
fq = 0x2
fQ = mult(ec, fq, ec.G)
self.assertFalse(ssa.verify(ec, hf, msg, fQ, sig))
self.assertRaises(ValueError, ssa._verify, ec, hf, msg, fQ, sig)
fq = 0x4
fQ = mult(ec, fq, ec.G)
self.assertFalse(ssa.verify(ec, hf, msg, fQ, sig))
self.assertFalse(ssa._verify(ec, hf, msg, fQ, sig))
# not ec.pIsThreeModFour
self.assertFalse(ssa.verify(secp224k1, hf, msg, Q, sig))
self.assertRaises(ValueError, ssa._verify, secp224k1, hf, msg, Q, sig)
# verify: message of wrong size
wrongmsg = msg[:-1]
self.assertFalse(ssa.verify(ec, hf, wrongmsg, Q, sig))
self.assertRaises(ValueError, ssa._verify, ec, hf, wrongmsg, Q, sig)
#ssa._verify(ec, hf, wrongmsg, Q, sig)
# sign: message of wrong size
self.assertRaises(ValueError, ssa.sign, ec, hf, wrongmsg, q, None)
#ssa.sign(ec, hf, wrongmsg, q, None)
# invalid (zero) challenge e
self.assertRaises(ValueError, ssa._pubkey_recovery, ec, hf, 0, sig)
def test_signature(self):
"""Basic tests"""
q, x_Q = ssa.gen_keys()
mhd = hf(b'Satoshi Nakamoto').digest()
sig = ssa.sign(mhd, q, None)
self.assertEqual(sig, ssa.deserialize(sig))
ssa._verify(mhd, x_Q, sig, ec, hf)
self.assertTrue(ssa.verify(mhd, x_Q, sig))
fmhd = hf(b'Craig Wright').digest()
self.assertRaises(AssertionError, ssa._verify, fmhd, x_Q, sig, ec, hf)
fssasig = (sig[0], sig[1], sig[1])
self.assertRaises(ValueError, ssa._verify, mhd, x_Q, fssasig, ec, hf)
# y(sG - eP) is not a quadratic residue
_, fQ = ssa.gen_keys(0x2)
self.assertRaises(AssertionError, ssa._verify, mhd, fQ, sig, ec, hf)
_, fQ = ssa.gen_keys(0x4)
self.assertRaises(AssertionError, ssa._verify, mhd, fQ, sig, ec, hf)
# not ec.pIsThreeModFour
self.assertRaises(ValueError, ssa._verify, mhd, x_Q, sig, secp224k1,
hf)
# verify: message of wrong size
wrongmhd = mhd[:-1]
self.assertRaises(ValueError, ssa._verify, wrongmhd, x_Q, sig, ec, hf)
# ssa._verify(wrongmhd, x_Q, sig)
# sign: message of wrong size
self.assertRaises(ValueError, ssa.sign, wrongmhd, q, None)
# ssa.sign(wrongmhd, q, None)
# invalid (zero) challenge e
self.assertRaises(ValueError, ssa._recover_pubkeys, 0, sig[0], sig[1],
ec)
# ssa._recover_pubkeys(0, sig)
# not a BIP340 public key
self.assertRaises(ValueError, ssa._to_bip340_point,
["not", "a BIP340", "public key"])
def test_ecssa(self):
"""Basic tests"""
q = 0x1
Q = mult(q)
mhd = hf(b'Satoshi Nakamoto').digest()
sig = ssa.sign(mhd, q, None)
ssa._verify(mhd, Q, sig, ec, hf)
self.assertTrue(ssa.verify(mhd, Q, sig))
fmhd = hf(b'Craig Wright').digest()
self.assertRaises(AssertionError, ssa._verify, fmhd, Q, sig, ec, hf)
fssasig = (sig[0], sig[1], sig[1])
self.assertRaises(ValueError, ssa._verify, mhd, Q, fssasig, ec, hf)
# y(sG - eP) is not a quadratic residue
fq = 0x2
fQ = mult(fq)
self.assertRaises(ValueError, ssa._verify, mhd, fQ, sig, ec, hf)
fq = 0x4
fQ = mult(fq)
self.assertRaises(AssertionError, ssa._verify, mhd, fQ, sig, ec, hf)
# not ec.pIsThreeModFour
self.assertRaises(ValueError, ssa._verify, mhd, Q, sig, secp224k1, hf)
# verify: message of wrong size
wrongmhd = mhd[:-1]
self.assertRaises(ValueError, ssa._verify, wrongmhd, Q, sig, ec, hf)
#ssa._verify(wrongmhd, Q, sig)
# sign: message of wrong size
self.assertRaises(ValueError, ssa.sign, wrongmhd, q, None)
#ssa.sign(wrongmhd, q, None)
# invalid (zero) challenge e
self.assertRaises(ValueError, ssa._recover_pubkeys, 0, sig[0], sig[1],
ec)
#ssa._recover_pubkeys(0, sig)
# not a BIP340 public key
self.assertRaises(ValueError, ssa.to_bip340_pubkey_tuple,
["not", "a BIP340", "public key"])
def test_signtocontract(self):
prv = 0x1
pub = mult(prv)
m = b"to be signed"
c = b"to be committed"
dsa_sig, dsa_receipt = ecdsa_commit_sign(c, m, prv, None)
self.assertIsNone(dsa._verify(m, pub, dsa_sig, ec, sha256))
self.assertTrue(verify_commit(c, dsa_receipt))
# 32 bytes message for ECSSA
m = sha256(m).digest()
ssa_sig, ssa_receipt = ecssa_commit_sign(c, m, prv, None)
self.assertIsNone(ssa._verify(m, pub, ssa_sig, ec, sha256))
self.assertTrue(verify_commit(c, ssa_receipt))
def test_bip340_vectors() -> None:
"""BIP340 (Schnorr) test vectors.
https://github.com/bitcoin/bips/blob/master/bip-0340/test-vectors.csv
"""
fname = "bip340_test_vectors.csv"
filename = path.join(path.dirname(__file__), "test_data", fname)
with open(filename, newline="") as csvfile:
reader = csv.reader(csvfile)
# skip column headers while checking that there are 7 columns
_, _, _, _, _, _, _, _ = reader.__next__()
for row in reader:
(index, seckey, pubkey, aux_rand, m, sig, result, comment) = row
err_msg = f"Test vector #{int(index)}"
try:
if seckey != "":
_, pubkey_actual = ssa.gen_keys(seckey)
assert pubkey == hex(pubkey_actual).upper()[2:], err_msg
k = ssa._det_nonce(m, seckey, aux_rand)
sig_actual = ssa._sign(m, seckey, k)
ssa._assert_as_valid(m, pubkey, sig_actual)
assert ssa.deserialize(sig) == sig_actual, err_msg
if comment:
err_msg += ": " + comment
# TODO what's wrong with xor-ing ?
# assert (result == "TRUE") ^ ssa._verify(m, pubkey, sig), err_msg
if result == "TRUE":
ssa._assert_as_valid(m, pubkey, sig)
assert ssa._verify(m, pubkey, sig), err_msg
else:
assert not ssa._verify(m, pubkey, sig), err_msg
except Exception as e: # pragma: no cover # pylint: disable=broad-except
print(err_msg) # pragma: no cover
raise e # pragma: no cover
def test_low_cardinality(self):
"""test low-cardinality curves for all msg/key pairs."""
# ec.n has to be prime to sign
prime = [11, 13, 17, 19]
# for dsa it is possible to directy iterate on all
# possible values for e;
# for ssa we have to iterate over all possible hash values
hsize = hf().digest_size
H = [i.to_bytes(hsize, 'big') for i in range(max(prime) * 4)]
# only low card curves or it would take forever
for ec in low_card_curves:
if ec._p in prime: # only few curves or it would take too long
# BIP340 Schnorr only applies to curve whose prime p = 3 %4
if not ec.pIsThreeModFour:
self.assertRaises(ValueError, ssa.sign, H[0], 1, None, ec)
continue
for q in range(1, ec.n): # all possible private keys
Q = mult(q, ec.G, ec) # public key
if not ec.has_square_y(Q):
q = ec.n - q
for h in H: # all possible hashed messages
k = ssa.k(h, q, ec, hf)
K = mult(k, ec.G, ec)
if not ec.has_square_y(K):
k = ec.n - k
x_K = K[0]
try:
c = ssa._challenge(x_K, Q[0], h, ec, hf)
except Exception:
pass
else:
s = (k + c * q) % ec.n
sig = ssa.sign(h, q, None, ec)
self.assertEqual((x_K, s), sig)
# valid signature must validate
self.assertIsNone(ssa._verify(h, Q, sig, ec, hf))
if c != 0: # FIXME
x_Q = ssa._recover_pubkeys(c, x_K, s, ec)
self.assertEqual(Q[0], x_Q)
def test_low_cardinality(self):
"""test all msg/key pairs of low cardinality elliptic curves"""
# ec.n has to be prime to sign
prime = [11, 13, 17, 19]
# all possible hashed messages
hsize = 32
H = [i.to_bytes(hsize, 'big') for i in range(max(prime) * 2)]
# only low card curves or it would take forever
for ec in low_card_curves:
if ec._p in prime: # only few curves or it would take too long
# Schnorr-bip only applies to curve whose prime p = 3 %4
if not ec.pIsThreeModFour:
self.assertRaises(ValueError, ssa.sign, ec, hf, H[0], 1,
None)
continue
for q in range(ec.n): # all possible private keys
if q == 0: # invalid prvkey=0
self.assertRaises(ValueError, ssa.sign, ec, hf, H[0],
q, None)
self.assertRaises(ValueError, rfc6979, ec, hf, H[0], q)
continue
Q = mult(ec, q, ec.G) # public key
for h in H: # all possible hashed messages
# k = 0
self.assertRaises(ValueError, ssa.sign, ec, hf, h, q,
0)
k = rfc6979(ec, hf, h, q)
K = mult(ec, k, ec.G)
if legendre_symbol(K[1], ec._p) != 1:
k = ec.n - k
e = ssa._e(ec, hf, K[0], Q, h)
s = (k + e * q) % ec.n
# valid signature
sig = ssa.sign(ec, hf, h, q, k)
self.assertEqual((K[0], s), sig)
# valid signature must validate
self.assertTrue(ssa._verify(ec, hf, h, Q, sig))
def test_schnorr_bip_tv(self):
"""Bip-Schnorr Test Vectors
https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki
"""
hf = sha256
# test vector 1
prv = int_from_bits(b'\x00' * 31 + b'\x01')
pub = mult(prv)
msg = b'\x00' * 32
expected_sig = (
0x787A848E71043D280C50470E8E1532B2DD5D20EE912A45DBDD2BD1DFBF187EF6,
0x7031A98831859DC34DFFEEDDA86831842CCD0079E1F92AF177F7F22CC1DCED05)
eph_prv = int.from_bytes(hf(prv.to_bytes(32, byteorder='big') +
msg).digest(),
byteorder='big')
sig = ssa.sign(msg, prv, eph_prv)
self.assertTrue(ssa._verify(msg, pub, sig))
self.assertEqual(sig, expected_sig)
e = ssa._e(sig[0], pub, msg)
self.assertEqual(ssa._pubkey_recovery(e, sig), pub)
# test vector 2
prv = 0xB7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF
pub = mult(prv)
msg = bytes.fromhex(
"243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89")
expected_sig = (
0x2A298DACAE57395A15D0795DDBFD1DCB564DA82B0F269BC70A74F8220429BA1D,
0x1E51A22CCEC35599B8F266912281F8365FFC2D035A230434A1A64DC59F7013FD)
eph_prv = int.from_bytes(hf(prv.to_bytes(32, byteorder='big') +
msg).digest(),
byteorder='big')
sig = ssa.sign(msg, prv, eph_prv)
self.assertTrue(ssa._verify(msg, pub, sig))
self.assertEqual(sig, expected_sig)
e = ssa._e(sig[0], pub, msg)
self.assertEqual(ssa._pubkey_recovery(e, sig), pub)
# test vector 3
prv = 0xC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B14E5C7
pub = mult(prv)
msg = bytes.fromhex(
"5E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C")
expected_sig = (
0x00DA9B08172A9B6F0466A2DEFD817F2D7AB437E0D253CB5395A963866B3574BE,
0x00880371D01766935B92D2AB4CD5C8A2A5837EC57FED7660773A05F0DE142380)
eph_prv = int.from_bytes(hf(prv.to_bytes(32, byteorder='big') +
msg).digest(),
byteorder='big')
sig = ssa.sign(msg, prv, eph_prv)
self.assertTrue(ssa._verify(msg, pub, sig))
self.assertEqual(sig, expected_sig)
e = ssa._e(sig[0], pub, msg)
self.assertEqual(ssa._pubkey_recovery(e, sig), pub)
# test vector 4
pub = point_from_octets(
"03DEFDEA4CDB677750A420FEE807EACF21EB9898AE79B9768766E4FAA04A2D4A34"
)
msg = bytes.fromhex(
"4DF3C3F68FCC83B27E9D42C90431A72499F17875C81A599B566C9889B9696703")
sig = (
0x00000000000000000000003B78CE563F89A0ED9414F5AA28AD0D96D6795F9C63,
0x02A8DC32E64E86A333F20EF56EAC9BA30B7246D6D25E22ADB8C6BE1AEB08D49D)
self.assertTrue(ssa._verify(msg, pub, sig))
e = ssa._e(sig[0], pub, msg)
self.assertEqual(ssa._pubkey_recovery(e, sig), pub)
# test vector 5
# test would fail if jacobi symbol of x(R) instead of y(R) is used
pub = point_from_octets(
"031B84C5567B126440995D3ED5AABA0565D71E1834604819FF9C17F5E9D5DD078F"
)
msg = bytes.fromhex(
"0000000000000000000000000000000000000000000000000000000000000000")
sig = (
0x52818579ACA59767E3291D91B76B637BEF062083284992F2D95F564CA6CB4E35,
0x30B1DA849C8E8304ADC0CFE870660334B3CFC18E825EF1DB34CFAE3DFC5D8187)
self.assertTrue(ssa._verify(msg, pub, sig))
e = ssa._e(sig[0], pub, msg)
self.assertEqual(ssa._pubkey_recovery(e, sig), pub)
# test vector 6
# test would fail if msg is reduced
pub = point_from_octets(
"03FAC2114C2FBB091527EB7C64ECB11F8021CB45E8E7809D3C0938E4B8C0E5F84B"
)
msg = bytes.fromhex(
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF")
sig = (
0x570DD4CA83D4E6317B8EE6BAE83467A1BF419D0767122DE409394414B05080DC,
0xE9EE5F237CBD108EABAE1E37759AE47F8E4203DA3532EB28DB860F33D62D49BD)
self.assertTrue(ssa._verify(msg, pub, sig))
e = ssa._e(sig[0], pub, msg)
self.assertEqual(ssa._pubkey_recovery(e, sig), pub)
# new proposed test: test would fail if msg is reduced
pub = point_from_octets(
"03FAC2114C2FBB091527EB7C64ECB11F8021CB45E8E7809D3C0938E4B8C0E5F84B"
)
msg = bytes.fromhex(
"000008D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A5000000")
sig = (
0x3598678C6C661F02557E2F5614440B53156997936FE54A90961CFCC092EF789D,
0x41E4E4386E54C924251679ADD3D837367EECBFF248A3DE7C2DB4CE52A3D6192A)
self.assertTrue(ssa._verify(msg, pub, sig))
e = ssa._e(sig[0], pub, msg)
self.assertEqual(ssa._pubkey_recovery(e, sig), pub)
# new proposed test: genuine failure
pub = point_from_octets(
"03FAC2114C2FBB091527EB7C64ECB11F8021CB45E8E7809D3C0938E4B8C0E5F84B"
)
msg = bytes.fromhex(
"0000000000000000000000000000000000000000000000000000000000000000")
sig = (
0x3598678C6C661F02557E2F5614440B53156997936FE54A90961CFCC092EF789D,
0x41E4E4386E54C924251679ADD3D837367EECBFF248A3DE7C2DB4CE52A3D6192A)
self.assertFalse(ssa._verify(msg, pub, sig))
# new proposed test: P = infinite
pub = 1, 0
msg = bytes.fromhex(
"5E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C")
sig = (
0x00DA9B08172A9B6F0466A2DEFD817F2D7AB437E0D253CB5395A963866B3574BE,
0x00880371D01766935B92D2AB4CD5C8A2A5837EC57FED7660773A05F0DE142380)
self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
# test vector 7
# public key not on the curve
# impossible to verify with btclib analytics as it at Point conversion
self.assertRaises(
ValueError, point_from_octets,
"03EEFDEA4CDB677750A420FEE807EACF21EB9898AE79B9768766E4FAA04A2D4A34"
)
# msg = bytes.fromhex("4DF3C3F68FCC83B27E9D42C90431A72499F17875C81A599B566C9889B9696703")
# sig = (0x00000000000000000000003B78CE563F89A0ED9414F5AA28AD0D96D6795F9C63, 0x02A8DC32E64E86A333F20EF56EAC9BA30B7246D6D25E22ADB8C6BE1AEB08D49D)
# self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
# test vector 8
# Incorrect sig: incorrect R residuosity
pub = point_from_octets(
"02DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659"
)
msg = bytes.fromhex(
"243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89")
sig = (
0x2A298DACAE57395A15D0795DDBFD1DCB564DA82B0F269BC70A74F8220429BA1D,
0xFA16AEE06609280A19B67A24E1977E4697712B5FD2943914ECD5F730901B4AB7)
self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
# test vector 9
# Incorrect sig: negated message hash
pub = point_from_octets(
"03FAC2114C2FBB091527EB7C64ECB11F8021CB45E8E7809D3C0938E4B8C0E5F84B"
)
msg = bytes.fromhex(
"5E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C")
sig = (
0x00DA9B08172A9B6F0466A2DEFD817F2D7AB437E0D253CB5395A963866B3574BE,
0xD092F9D860F1776A1F7412AD8A1EB50DACCC222BC8C0E26B2056DF2F273EFDEC)
self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
# test vector 10
# Incorrect sig: negated s value
pub = point_from_octets(
"0279BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798"
)
msg = b'\x00' * 32
sig = (
0x787A848E71043D280C50470E8E1532B2DD5D20EE912A45DBDD2BD1DFBF187EF6,
0x8FCE5677CE7A623CB20011225797CE7A8DE1DC6CCD4F754A47DA6C600E59543C)
self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
# test vector 11
# Incorrect sig: negated public key
pub = point_from_octets(
"03DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659"
)
msg = bytes.fromhex(
"243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89")
sig = (
0x2A298DACAE57395A15D0795DDBFD1DCB564DA82B0F269BC70A74F8220429BA1D,
0x1E51A22CCEC35599B8F266912281F8365FFC2D035A230434A1A64DC59F7013FD)
self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
# test vector 12
# sG - eP is infinite.
# Test fails in single verification if jacobi(y(inf)) is defined as 1 and x(inf) as 0
pub = point_from_octets(
"02DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659"
)
msg = bytes.fromhex(
"243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89")
sig = (
0x0000000000000000000000000000000000000000000000000000000000000000,
0x9E9D01AF988B5CEDCE47221BFA9B222721F3FA408915444A4B489021DB55775F)
self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
# test vector 13
# sG - eP is infinite.
# Test fails in single verification if jacobi(y(inf)) is defined as 1 and x(inf) as 1"""
pub = point_from_octets(
"02DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659"
)
msg = bytes.fromhex(
"243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89")
sig = (
0x0000000000000000000000000000000000000000000000000000000000000001,
0xD37DDF0254351836D84B1BD6A795FD5D523048F298C4214D187FE4892947F728)
self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
# test vector 14
# sig[0:32] is not an X coordinate on the curve
pub = point_from_octets(
"02DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659"
)
msg = bytes.fromhex(
"243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89")
sig = (
0x4A298DACAE57395A15D0795DDBFD1DCB564DA82B0F269BC70A74F8220429BA1D,
0x1E51A22CCEC35599B8F266912281F8365FFC2D035A230434A1A64DC59F7013FD)
self.assertFalse(ssa._verify(msg, pub, sig))
# test vector 15
# sig[0:32] is equal to field size
pub = point_from_octets(
"02DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659"
)
msg = bytes.fromhex(
"243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89")
sig = (
0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC2F,
0x1E51A22CCEC35599B8F266912281F8365FFC2D035A230434A1A64DC59F7013FD)
#self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
self.assertFalse(ssa._verify(msg, pub, sig))
# test vector 16
# sig[32:64] is equal to curve order
pub = point_from_octets(
"02DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659"
)
msg = bytes.fromhex(
"243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89")
sig = (
0x2A298DACAE57395A15D0795DDBFD1DCB564DA82B0F269BC70A74F8220429BA1D,
0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141)
self.assertRaises(ValueError, ssa._verify, msg, pub, sig)
def test_threshold(self):
"""testing 2-of-3 threshold signature (Pedersen secret sharing)"""
ec = secp256k1
hf = sha256
# parameters
t = 2
H = second_generator(ec, hf)
msg = hf(b'message to sign').digest()
### FIRST PHASE: key pair generation ###
# signer one acting as the dealer
commits1: List[Point] = list()
q1 = (1 + random.getrandbits(ec.nlen)) % ec.n
q1_prime = (1 + random.getrandbits(ec.nlen)) % ec.n
commits1.append(double_mult(q1_prime, H, q1))
# sharing polynomials
f1: List[int] = list()
f1.append(q1)
f1_prime: List[int] = list()
f1_prime.append(q1_prime)
for i in range(1, t):
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f1.append(temp)
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f1_prime.append(temp)
commits1.append(double_mult(f1_prime[i], H, f1[i]))
# shares of the secret
alpha12 = 0 # share of q1 belonging to P2
alpha12_prime = 0
alpha13 = 0 # share of q1 belonging to P3
alpha13_prime = 0
for i in range(t):
alpha12 += (f1[i] * pow(2, i)) % ec.n
alpha12_prime += (f1_prime[i] * pow(2, i)) % ec.n
alpha13 += (f1[i] * pow(3, i)) % ec.n
alpha13_prime += (f1_prime[i] * pow(3, i)) % ec.n
# player two verifies consistency of his share
RHS = 1, 0
for i in range(t):
RHS = ec.add(RHS, mult(pow(2, i), commits1[i]))
assert double_mult(alpha12_prime, H,
alpha12) == RHS, 'player one is cheating'
# player three verifies consistency of his share
RHS = 1, 0
for i in range(t):
RHS = ec.add(RHS, mult(pow(3, i), commits1[i]))
assert double_mult(alpha13_prime, H,
alpha13) == RHS, 'player one is cheating'
# signer two acting as the dealer
commits2: List[Point] = list()
q2 = (1 + random.getrandbits(ec.nlen)) % ec.n
q2_prime = (1 + random.getrandbits(ec.nlen)) % ec.n
commits2.append(double_mult(q2_prime, H, q2))
# sharing polynomials
f2: List[int] = list()
f2.append(q2)
f2_prime: List[int] = list()
f2_prime.append(q2_prime)
for i in range(1, t):
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f2.append(temp)
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f2_prime.append(temp)
commits2.append(double_mult(f2_prime[i], H, f2[i]))
# shares of the secret
alpha21 = 0 # share of q2 belonging to P1
alpha21_prime = 0
alpha23 = 0 # share of q2 belonging to P3
alpha23_prime = 0
for i in range(t):
alpha21 += (f2[i] * pow(1, i)) % ec.n
alpha21_prime += (f2_prime[i] * pow(1, i)) % ec.n
alpha23 += (f2[i] * pow(3, i)) % ec.n
alpha23_prime += (f2_prime[i] * pow(3, i)) % ec.n
# player one verifies consistency of his share
RHS = 1, 0
for i in range(t):
RHS = ec.add(RHS, mult(pow(1, i), commits2[i]))
assert double_mult(alpha21_prime, H,
alpha21) == RHS, 'player two is cheating'
# player three verifies consistency of his share
RHS = 1, 0
for i in range(t):
RHS = ec.add(RHS, mult(pow(3, i), commits2[i]))
assert double_mult(alpha23_prime, H,
alpha23) == RHS, 'player two is cheating'
# signer three acting as the dealer
commits3: List[Point] = list()
q3 = (1 + random.getrandbits(ec.nlen)) % ec.n
q3_prime = (1 + random.getrandbits(ec.nlen)) % ec.n
commits3.append(double_mult(q3_prime, H, q3))
# sharing polynomials
f3: List[int] = list()
f3.append(q3)
f3_prime: List[int] = list()
f3_prime.append(q3_prime)
for i in range(1, t):
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f3.append(temp)
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f3_prime.append(temp)
commits3.append(double_mult(f3_prime[i], H, f3[i]))
# shares of the secret
alpha31 = 0 # share of q3 belonging to P1
alpha31_prime = 0
alpha32 = 0 # share of q3 belonging to P2
alpha32_prime = 0
for i in range(t):
alpha31 += (f3[i] * pow(1, i)) % ec.n
alpha31_prime += (f3_prime[i] * pow(1, i)) % ec.n
alpha32 += (f3[i] * pow(2, i)) % ec.n
alpha32_prime += (f3_prime[i] * pow(2, i)) % ec.n
# player one verifies consistency of his share
RHS = 1, 0
for i in range(t):
RHS = ec.add(RHS, mult(pow(1, i), commits3[i]))
assert double_mult(alpha31_prime, H,
alpha31) == RHS, 'player three is cheating'
# player two verifies consistency of his share
RHS = 1, 0
for i in range(t):
RHS = ec.add(RHS, mult(pow(2, i), commits3[i]))
assert double_mult(alpha32_prime, H,
alpha32) == RHS, 'player two is cheating'
# shares of the secret key q = q1 + q2 + q3
alpha1 = (alpha21 + alpha31) % ec.n
alpha2 = (alpha12 + alpha32) % ec.n
alpha3 = (alpha13 + alpha23) % ec.n
for i in range(t):
alpha1 += (f1[i] * pow(1, i)) % ec.n
alpha2 += (f2[i] * pow(2, i)) % ec.n
alpha3 += (f3[i] * pow(3, i)) % ec.n
# it's time to recover the public key Q = Q1 + Q2 + Q3 = (q1 + q2 + q3)G
A1: List[Point] = list()
A2: List[Point] = list()
A3: List[Point] = list()
# each participant i = 1, 2, 3 shares Qi as follows
# he broadcasts these values
for i in range(t):
A1.append(mult(f1[i]))
A2.append(mult(f2[i]))
A3.append(mult(f3[i]))
# he checks the others' values
# player one
RHS2 = 1, 0
RHS3 = 1, 0
for i in range(t):
RHS2 = ec.add(RHS2, mult(pow(1, i), A2[i]))
RHS3 = ec.add(RHS3, mult(pow(1, i), A3[i]))
assert mult(alpha21) == RHS2, 'player two is cheating'
assert mult(alpha31) == RHS3, 'player three is cheating'
# player two
RHS1 = 1, 0
RHS3 = 1, 0
for i in range(t):
RHS1 = ec.add(RHS1, mult(pow(2, i), A1[i]))
RHS3 = ec.add(RHS3, mult(pow(2, i), A3[i]))
assert mult(alpha12) == RHS1, 'player one is cheating'
assert mult(alpha32) == RHS3, 'player three is cheating'
# player three
RHS1 = 1, 0
RHS2 = 1, 0
for i in range(t):
RHS1 = ec.add(RHS1, mult(pow(3, i), A1[i]))
RHS2 = ec.add(RHS2, mult(pow(3, i), A2[i]))
assert mult(alpha13) == RHS1, 'player one is cheating'
assert mult(alpha23) == RHS2, 'player two is cheating'
A: List[Point] = list() # commitment at the global sharing polynomial
for i in range(t):
A.append(ec.add(A1[i], ec.add(A2[i], A3[i])))
Q = A[0] # aggregated public key
### SECOND PHASE: generation of the nonces' pair ###
# This phase follows exactly the key generation procedure
# suppose that player one and three want to sign
# signer one acting as the dealer
commits1: List[Point] = list()
k1 = (1 + random.getrandbits(ec.nlen)) % ec.n
k1_prime = (1 + random.getrandbits(ec.nlen)) % ec.n
commits1.append(double_mult(k1_prime, H, k1))
# sharing polynomials
f1: List[int] = list()
f1.append(k1)
f1_prime: List[int] = list()
f1_prime.append(k1_prime)
for i in range(1, t):
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f1.append(temp)
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f1_prime.append(temp)
commits1.append(double_mult(f1_prime[i], H, f1[i]))
# shares of the secret
beta13 = 0 # share of k1 belonging to P3
beta13_prime = 0
for i in range(t):
beta13 += (f1[i] * pow(3, i)) % ec.n
beta13_prime += (f1_prime[i] * pow(3, i)) % ec.n
# player three verifies consistency of his share
RHS = 1, 0
for i in range(t):
RHS = ec.add(RHS, mult(pow(3, i), commits1[i]))
assert double_mult(beta13_prime, H,
beta13) == RHS, 'player one is cheating'
# signer three acting as the dealer
commits3: List[Point] = list()
k3 = (1 + random.getrandbits(ec.nlen)) % ec.n
k3_prime = (1 + random.getrandbits(ec.nlen)) % ec.n
commits3.append(double_mult(k3_prime, H, k3))
# sharing polynomials
f3: List[int] = list()
f3.append(k3)
f3_prime: List[int] = list()
f3_prime.append(k3_prime)
for i in range(1, t):
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f3.append(temp)
temp = (1 + random.getrandbits(ec.nlen)) % ec.n
f3_prime.append(temp)
commits3.append(double_mult(f3_prime[i], H, f3[i]))
# shares of the secret
beta31 = 0 # share of k3 belonging to P1
beta31_prime = 0
for i in range(t):
beta31 += (f3[i] * pow(1, i)) % ec.n
beta31_prime += (f3_prime[i] * pow(1, i)) % ec.n
# player one verifies consistency of his share
RHS = 1, 0
for i in range(t):
RHS = ec.add(RHS, mult(pow(1, i), commits3[i]))
assert double_mult(beta31_prime, H,
beta31) == RHS, 'player three is cheating'
# shares of the secret nonce
beta1 = beta31 % ec.n
beta3 = beta13 % ec.n
for i in range(t):
beta1 += (f1[i] * pow(1, i)) % ec.n
beta3 += (f3[i] * pow(3, i)) % ec.n
# it's time to recover the public nonce
B1: List[Point] = list()
B3: List[Point] = list()
# each participant i = 1, 3 shares Qi as follows
# he broadcasts these values
for i in range(t):
B1.append(mult(f1[i]))
B3.append(mult(f3[i]))
# he checks the others' values
# player one
RHS3 = 1, 0
for i in range(t):
RHS3 = ec.add(RHS3, mult(pow(1, i), B3[i]))
assert mult(beta31) == RHS3, 'player three is cheating'
# player three
RHS1 = 1, 0
for i in range(t):
RHS1 = ec.add(RHS1, mult(pow(3, i), B1[i]))
assert mult(beta13) == RHS1, 'player one is cheating'
B: List[Point] = list() # commitment at the global sharing polynomial
for i in range(t):
B.append(ec.add(B1[i], B3[i]))
K = B[0] # aggregated public nonce
if legendre_symbol(K[1], ec._p) != 1:
beta1 = ec.n - beta1
beta3 = ec.n - beta3
### PHASE THREE: signature generation ###
# partial signatures
ebytes = K[0].to_bytes(32, byteorder='big')
ebytes += octets_from_point(Q, True, ec)
ebytes += msg
e = int_from_bits(hf(ebytes).digest(), ec)
gamma1 = (beta1 + e * alpha1) % ec.n
gamma3 = (beta3 + e * alpha3) % ec.n
# each participant verifies the other partial signatures
# player one
if legendre_symbol(K[1], ec._p) == 1:
RHS3 = ec.add(K, mult(e, Q))
for i in range(1, t):
temp = double_mult(pow(3, i), B[i], e * pow(3, i), A[i])
RHS3 = ec.add(RHS3, temp)
else:
assert legendre_symbol(K[1], ec._p) != 1
RHS3 = ec.add(ec.opposite(K), mult(e, Q))
for i in range(1, t):
temp = double_mult(pow(3, i), ec.opposite(B[i]), e * pow(3, i),
A[i])
RHS3 = ec.add(RHS3, temp)
assert mult(gamma3) == RHS3, 'player three is cheating'
# player three
if legendre_symbol(K[1], ec._p) == 1:
RHS1 = ec.add(K, mult(e, Q))
for i in range(1, t):
temp = double_mult(pow(1, i), B[i], e * pow(1, i), A[i])
RHS1 = ec.add(RHS1, temp)
else:
assert legendre_symbol(K[1], ec._p) != 1
RHS1 = ec.add(ec.opposite(K), mult(e, Q))
for i in range(1, t):
temp = double_mult(pow(1, i), ec.opposite(B[i]), e * pow(1, i),
A[i])
RHS1 = ec.add(RHS1, temp)
assert mult(gamma1) == RHS1, 'player two is cheating'
### PHASE FOUR: aggregating the signature ###
omega1 = 3 * mod_inv(3 - 1, ec.n) % ec.n
omega3 = 1 * mod_inv(1 - 3, ec.n) % ec.n
sigma = (gamma1 * omega1 + gamma3 * omega3) % ec.n
sig = K[0], sigma
self.assertTrue(ssa._verify(msg, Q, sig))
### ADDITIONAL PHASE: reconstruction of the private key ###
secret = (omega1 * alpha1 + omega3 * alpha3) % ec.n
self.assertEqual((q1 + q2 + q3) % ec.n, secret)
def _schnorr_checksig(variable, data, memory):
is_valid = ssa._verify(memory[0x100], memory[data[0]], memory[data[1]])
if is_valid:
memory[variable] = b"\x01"
else:
memory[variable] = b"\x00"
def test_musig(self):
"""testing 3-of-3 MuSig
https://github.com/ElementsProject/secp256k1-zkp/blob/secp256k1-zkp/src/modules/musig/musig.md
https://blockstream.com/2019/02/18/musig-a-new-multisignature-standard/
https://eprint.iacr.org/2018/068
https://blockstream.com/2018/01/23/musig-key-aggregation-schnorr-signatures.html
https://medium.com/@snigirev.stepan/how-schnorr-signatures-may-improve-bitcoin-91655bcb4744
"""
mhd = hf(b'message to sign').digest()
# the signers private and public keys,
# including both the curve Point and the BIP340-Schnorr public key
q1, x_Q1 = ssa.gen_keys()
x_Q1 = x_Q1.to_bytes(ec.psize, 'big')
q2, x_Q2 = ssa.gen_keys()
x_Q2 = x_Q2.to_bytes(ec.psize, 'big')
q3, x_Q3 = ssa.gen_keys()
x_Q3 = x_Q3.to_bytes(ec.psize, 'big')
# (non interactive) key setup
# this is MuSig core: the rest is just Schnorr signature additivity
# 1. lexicographic sorting of public keys
keys: List[bytes] = list()
keys.append(x_Q1)
keys.append(x_Q2)
keys.append(x_Q3)
keys.sort()
# 2. coefficients
prefix = b''.join(keys)
a1 = int_from_bits(hf(prefix + x_Q1).digest(), ec.nlen) % ec.n
a2 = int_from_bits(hf(prefix + x_Q2).digest(), ec.nlen) % ec.n
a3 = int_from_bits(hf(prefix + x_Q3).digest(), ec.nlen) % ec.n
# 3. aggregated public key
Q1 = mult(q1)
Q2 = mult(q2)
Q3 = mult(q3)
Q = ec.add(double_mult(a1, Q1, a2, Q2), mult(a3, Q3))
if not ec.has_square_y(Q):
# print("Q has been negated")
a1 = ec.n - a1 # pragma: no cover
a2 = ec.n - a2 # pragma: no cover
a3 = ec.n - a3 # pragma: no cover
# ready to sign: nonces and nonce commitments
k1, _ = ssa.gen_keys()
K1 = mult(k1)
k2, _ = ssa.gen_keys()
K2 = mult(k2)
k3, _ = ssa.gen_keys()
K3 = mult(k3)
# exchange {K_i} (interactive)
# computes s_i (non interactive)
# WARNING: signers must exchange the nonces commitments {K_i}
# before sharing {s_i}
# same for all signers
K = ec.add(ec.add(K1, K2), K3)
if not ec.has_square_y(K):
k1 = ec.n - k1 # pragma: no cover
k2 = ec.n - k2 # pragma: no cover
k3 = ec.n - k3 # pragma: no cover
r = K[0]
e = ssa._challenge(r, Q[0], mhd, ec, hf)
s1 = (k1 + e * a1 * q1) % ec.n
s2 = (k2 + e * a2 * q2) % ec.n
s3 = (k3 + e * a3 * q3) % ec.n
# exchange s_i (interactive)
# finalize signature (non interactive)
s = (s1 + s2 + s3) % ec.n
sig = r, s
# check signature is valid
ssa._verify(mhd, Q, sig, ec, hf)
self.assertTrue(ssa.verify(mhd, Q, sig))
hsize = hf().digest_size
hlen = hsize * 8
# n = 1 loops forever and does not really test batch verify
n_sig = [4, 8, 16, 32, 64, 128, 256, 512]
m = [
random.getrandbits(hlen).to_bytes(hsize, "big") for _ in range(max(n_sig))
]
q = [random.getrandbits(ec.nlen) % ec.n for _ in m]
sig = [_sign(msg, qq) for msg, qq in zip(m, q)]
Q = [mult(qq, ec.G)[0] for qq in q]
for n in n_sig:
# no batch
start = time.time()
for j in range(n):
assert _verify(m[j], Q[j], sig[j])
elapsed1 = time.time() - start
# batch
ms = m[:n]
Qs = Q[:n]
sigs = sig[:n]
start = time.time()
assert _batch_verify(ms, Qs, sigs), n
elapsed2 = time.time() - start
print(n, elapsed2 / elapsed1)
