8#ifndef SECP256K1_ECDSA_IMPL_H
9#define SECP256K1_ECDSA_IMPL_H
32 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
33 0xBAAEDCE6UL, 0xAF48A03BUL, 0xBFD25E8CUL, 0xD0364141UL
46 0, 0, 0, 1, 0x45512319UL, 0x50B75FC4UL, 0x402DA172UL, 0x2FC9BAEEUL
49static int secp256k1_der_read_len(
size_t *
len,
const unsigned char **sigp,
const unsigned char *sigend) {
54 if (*sigp >= sigend) {
62 if ((b1 & 0x80) == 0) {
73 if (lenleft > (
size_t)(sigend - *sigp)) {
80 if (lenleft >
sizeof(
size_t)) {
87 *
len = (*
len << 8) | **sigp;
91 if (*
len > (
size_t)(sigend - *sigp)) {
102static int secp256k1_der_parse_integer(
secp256k1_scalar *
r,
const unsigned char **sig,
const unsigned char *sigend) {
104 unsigned char ra[32] = {0};
107 if (*sig == sigend || **sig != 0x02) {
112 if (secp256k1_der_read_len(&rlen, sig, sigend) == 0) {
115 if (rlen == 0 || rlen > (
size_t)(sigend - *sig)) {
119 if (**sig == 0x00 && rlen > 1 && (((*sig)[1]) & 0x80) == 0x00) {
123 if (**sig == 0xFF && rlen > 1 && (((*sig)[1]) & 0x80) == 0x80) {
127 if ((**sig & 0x80) == 0x80) {
134 if (rlen > 0 && **sig == 0) {
143 if (rlen)
memcpy(ra + 32 - rlen, *sig, rlen);
144 secp256k1_scalar_set_b32(
r, ra, &
overflow);
147 secp256k1_scalar_set_int(
r, 0);
154 const unsigned char *sigend = sig + size;
156 if (sig == sigend || *(sig++) != 0x30) {
160 if (secp256k1_der_read_len(&rlen, &sig, sigend) == 0) {
163 if (rlen != (
size_t)(sigend - sig)) {
168 if (!secp256k1_der_parse_integer(rr, &sig, sigend)) {
171 if (!secp256k1_der_parse_integer(rs, &sig, sigend)) {
184 unsigned char r[33] = {0},
s[33] = {0};
185 unsigned char *rp =
r, *
sp =
s;
186 size_t lenR = 33, lenS = 33;
187 secp256k1_scalar_get_b32(&
r[1], ar);
188 secp256k1_scalar_get_b32(&
s[1], as);
189 while (lenR > 1 && rp[0] == 0 && rp[1] < 0x80) { lenR--; rp++; }
190 while (lenS > 1 && sp[0] == 0 && sp[1] < 0x80) { lenS--;
sp++; }
191 if (*size < 6+lenS+lenR) {
192 *size = 6 + lenS + lenR;
195 *size = 6 + lenS + lenR;
197 sig[1] = 4 + lenS + lenR;
203 memcpy(sig+lenR+6, sp, lenS);
210#if !defined(EXHAUSTIVE_TEST_ORDER)
216 if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) {
220 secp256k1_scalar_inverse_var(&sn, sigs);
221 secp256k1_scalar_mul(&u1, &sn, message);
222 secp256k1_scalar_mul(&u2, &sn, sigr);
223 secp256k1_gej_set_ge(&pubkeyj,
pubkey);
224 secp256k1_ecmult(&pr, &pubkeyj, &u2, &u1);
225 if (secp256k1_gej_is_infinity(&pr)) {
229#if defined(EXHAUSTIVE_TEST_ORDER)
233 secp256k1_ge_set_gej(&pr_ge, &pr);
234 secp256k1_fe_normalize(&pr_ge.
x);
236 secp256k1_fe_get_b32(c, &pr_ge.
x);
237 secp256k1_scalar_set_b32(&computed_r, c, NULL);
238 return secp256k1_scalar_eq(sigr, &computed_r);
241 secp256k1_scalar_get_b32(c, sigr);
242 secp256k1_fe_set_b32(&xr, c);
260 if (secp256k1_gej_eq_x_var(&xr, &pr)) {
264 if (secp256k1_fe_cmp_var(&xr, &secp256k1_ecdsa_const_p_minus_order) >= 0) {
268 secp256k1_fe_add(&xr, &secp256k1_ecdsa_const_order_as_fe);
269 if (secp256k1_gej_eq_x_var(&xr, &pr)) {
285 secp256k1_ecmult_gen(ctx, &rp, nonce);
286 secp256k1_ge_set_gej(&
r, &rp);
287 secp256k1_fe_normalize(&
r.x);
288 secp256k1_fe_normalize(&
r.y);
289 secp256k1_fe_get_b32(b, &
r.x);
290 secp256k1_scalar_set_b32(sigr, b, &
overflow);
295 *recid = (
overflow << 1) | secp256k1_fe_is_odd(&
r.y);
297 secp256k1_scalar_mul(&n, sigr, seckey);
298 secp256k1_scalar_add(&n, &n, message);
299 secp256k1_scalar_inverse(sigs, nonce);
300 secp256k1_scalar_mul(sigs, sigs, &n);
301 secp256k1_scalar_clear(&n);
302 secp256k1_gej_clear(&rp);
303 secp256k1_ge_clear(&
r);
304 high = secp256k1_scalar_is_high(sigs);
305 secp256k1_scalar_cond_negate(sigs, high);
312 return (
int)(!secp256k1_scalar_is_zero(sigr)) & (
int)(!secp256k1_scalar_is_zero(sigs));
#define VERIFY_CHECK(cond)
#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0)
static const Reg16 sp(Operand::SP)
memcpy((char *) pInfo->slotDescription, s, l)