From 555abe5a408c579545681d7f5c19adf2f2888969 Mon Sep 17 00:00:00 2001 From: ZhePang Date: Fri, 19 May 2023 11:38:59 +0800 Subject: [PATCH 01/10] Add an experimental schnorr signature adaptor module add schnorr adaptor nonce function that follows BIP-340 and also accepts the adaptor point as input add presign, extract_t, adapt, and extract_adaptor APIs add tests for schnorr adaptor nonce functions and APIs --- Makefile.am | 4 + ci/ci.sh | 1 + configure.ac | 14 + include/secp256k1_schnorr_adaptor.h | 140 +++ src/ctime_tests.c | 22 + .../schnorr_adaptor/Makefile.am.include | 3 + src/modules/schnorr_adaptor/main_impl.h | 286 +++++ src/modules/schnorr_adaptor/tests_impl.h | 981 ++++++++++++++++++ src/secp256k1.c | 4 + src/tests.c | 8 + 10 files changed, 1463 insertions(+) create mode 100644 include/secp256k1_schnorr_adaptor.h create mode 100644 src/modules/schnorr_adaptor/Makefile.am.include create mode 100644 src/modules/schnorr_adaptor/main_impl.h create mode 100644 src/modules/schnorr_adaptor/tests_impl.h diff --git a/Makefile.am b/Makefile.am index c96685623..22ef48b77 100644 --- a/Makefile.am +++ b/Makefile.am @@ -317,3 +317,7 @@ endif if ENABLE_MODULE_ECDSA_ADAPTOR include src/modules/ecdsa_adaptor/Makefile.am.include endif + +if ENABLE_MODULE_SCHNORR_ADAPTOR +include src/modules/schnorr_adaptor/Makefile.am.include +endif \ No newline at end of file diff --git a/ci/ci.sh b/ci/ci.sh index b4b67316d..81c17825d 100755 --- a/ci/ci.sh +++ b/ci/ci.sh @@ -82,6 +82,7 @@ esac --enable-module-rangeproof="$RANGEPROOF" --enable-module-whitelist="$WHITELIST" --enable-module-generator="$GENERATOR" \ --enable-module-schnorrsig="$SCHNORRSIG" --enable-module-musig="$MUSIG" --enable-module-ecdsa-adaptor="$ECDSAADAPTOR" \ --enable-module-schnorrsig="$SCHNORRSIG" \ + --enable-module-schnorr-adaptor="$SCHNORRADAPTOR" \ --enable-examples="$EXAMPLES" \ --enable-ctime-tests="$CTIMETESTS" \ --with-valgrind="$WITH_VALGRIND" \ diff --git a/configure.ac b/configure.ac index d4934d32d..a3d20804e 100644 --- a/configure.ac +++ b/configure.ac @@ -213,6 +213,10 @@ AC_ARG_ENABLE(module_ellswift, AS_HELP_STRING([--enable-module-ellswift],[enable ElligatorSwift module [default=yes]]), [], [SECP_SET_DEFAULT([enable_module_ellswift], [yes], [yes])]) +AC_ARG_ENABLE(module_schnorr_adaptor, + AS_HELP_STRING([--enable-module-schnorr-adaptor],[enable schnorr adaptor module [default=no]]), [], + [SECP_SET_DEFAULT([enable_module_schnorr_adaptor], [no], [yes])]) + AC_ARG_ENABLE(module_ecdsa_s2c, AS_HELP_STRING([--enable-module-ecdsa-s2c],[enable ECDSA sign-to-contract module [default=no]]), [], @@ -490,6 +494,11 @@ if test x"$enable_module_schnorrsig" = x"yes"; then enable_module_extrakeys=yes fi +if test x"$enable_module_schnorr_adaptor" = x"yes"; then + AC_DEFINE(ENABLE_MODULE_SCHNORR_ADAPTOR, 1, [Define thsi symbol to enable the Schnorr adaptor module]) + enable_module_extrakeys=yes +fi + if test x"$enable_module_ellswift" = x"yes"; then SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_ELLSWIFT=1" fi @@ -557,6 +566,9 @@ else if test x"$set_asm" = x"arm32"; then AC_MSG_ERROR([ARM32 assembly optimization is experimental. Use --enable-experimental to allow.]) fi + if test x"$enable_module_schnorr_adaptor" = x"yes"; then + AC_MSG_ERROR([schnorr adaptor signatures module is experimental. Use --enable-experimental to allow.]) + fi fi ### @@ -581,6 +593,7 @@ AM_CONDITIONAL([ENABLE_MODULE_RANGEPROOF], [test x"$enable_module_rangeproof" = AM_CONDITIONAL([ENABLE_MODULE_WHITELIST], [test x"$enable_module_whitelist" = x"yes"]) AM_CONDITIONAL([ENABLE_MODULE_EXTRAKEYS], [test x"$enable_module_extrakeys" = x"yes"]) AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG], [test x"$enable_module_schnorrsig" = x"yes"]) +AM_CONDITIONAL([ENABLE_MODULE_SCHNORR_ADAPTOR], [test x"$enable_module_schnorr_adaptor" = x"yes"]) AM_CONDITIONAL([ENABLE_MODULE_ELLSWIFT], [test x"$enable_module_ellswift" = x"yes"]) AM_CONDITIONAL([ENABLE_MODULE_ECDSA_S2C], [test x"$enable_module_ecdsa_s2c" = x"yes"]) AM_CONDITIONAL([ENABLE_MODULE_ECDSA_ADAPTOR], [test x"$enable_module_ecdsa_adaptor" = x"yes"]) @@ -607,6 +620,7 @@ echo " module ecdh = $enable_module_ecdh" echo " module recovery = $enable_module_recovery" echo " module extrakeys = $enable_module_extrakeys" echo " module schnorrsig = $enable_module_schnorrsig" +echo " module schnorr-adaptor = $enable_module_schnorr_adaptor" echo " module ellswift = $enable_module_ellswift" echo " module generator = $enable_module_generator" echo " module rangeproof = $enable_module_rangeproof" diff --git a/include/secp256k1_schnorr_adaptor.h b/include/secp256k1_schnorr_adaptor.h new file mode 100644 index 000000000..1f81c5b6a --- /dev/null +++ b/include/secp256k1_schnorr_adaptor.h @@ -0,0 +1,140 @@ +#ifndef SECP256K1_SCHNORR_ADAPTOR_H +#define SECP256K1_SCHNORR_ADAPTOR_H + +#include "secp256k1.h" +#include "secp256k1_extrakeys.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/** A pointer to a function to deterministically generate a nonce. + * + * Same as secp256k1_schnorrsig_nonce function with the exception of accepting an + * additional adaptor point t argument. The adaptor point argument can protect + * signature schemes with key-prefixed challenge hash inputs against reusing the + * nonce when signing with different adaptor points. + * + * Returns: 1 if a nonce was successfully generated. 0 will cause signing to + * return an error. + * Out: nonce32: pointer to a 32-byte array to be filled by the function + * In: msg32: the 32-byte message being verified (will not be NULL) + * key32: pointer to a 32-byte secret key (will not be NULL) + * xonly_t32: the 32-byte serialized xonly adaptor point (will not be NULL) + * xonly_pk32: the 32-byte serialized xonly pubkey corresponding to key32 + * (will not be NULL) + * algo: pointer to an array describing the signature + * algorithm (will not be NULL) + * algolen: the length of the algo array + * data: arbitrary data pointer that is passed through + * + * Except for test cases, this function should compute some cryptographic hash of + * the message, the key, the adaptor point, the pubkey, the algorithm description, and data. + */ +typedef int (*secp256k1_adaptor_nonce_function_hardened)( + unsigned char *nonce32, + const unsigned char *msg32, + const unsigned char *key32, + const unsigned char *xonly_t32, + const unsigned char *xonly_pk32, + const unsigned char *algo, + size_t algolen, + void *data +); + +/** An implementation of the nonce generation function as defined in Bitcoin + * Improvement Proposal 340 "Schnorr Signatures for secp256k1" + * (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki). + * + * If a data pointer is passed, it is assumed to be a pointer to 32 bytes of + * auxiliary random data as defined in BIP-340. If the data pointer is NULL, + * the nonce derivation procedure follows BIP-340 by setting the auxiliary + * random data to zero. The algo argument must be non-NULL, otherwise the + * function will fail and return 0. The hash will be tagged with algo. + * Therefore, to create BIP-340 compliant signatures, algo must be set to + * "BIP0340/nonce" and algolen to 13. + */ +SECP256K1_API const secp256k1_adaptor_nonce_function_hardened secp256k1_adaptor_nonce_function_bip340; + +/** Create a Schnorr adaptor signature. + * + * This function only signs 32-byte messages. If you have messages of a + * different size (or the same size but without a context-specific tag + * prefix), it is recommended to create a 32-byte message hash with + * secp256k1_tagged_sha256 and then sign the hash. Tagged hashing allows + * providing an context-specific tag for domain separation. This prevents + * signatures from being valid in multiple contexts by accident. + * + * Returns 1 on success, 0 on failure. + * Args: ctx: pointer to a context object (not secp256k1_context_static). + * Out: sig65: pointer to a 65-byte array to store the serialized signature. + * In: msg32: the 32-byte message being signed. + * keypair: pointer to an initialized keypair. + * t33: pointer to a 33-byte compressed adaptor point. + * aux_rand32: 32 bytes of fresh randomness. While recommended to provide + * this, it is only supplemental to security and can be NULL. A + * NULL argument is treated the same as an all-zero one. See + * BIP-340 "Default Signing" for a full explanation of this + * argument and for guidance if randomness is expensive. + */ +SECP256K1_API int secp256k1_schnorr_adaptor_presign( + const secp256k1_context *ctx, + unsigned char *sig65, + const unsigned char *msg32, + const secp256k1_keypair *keypair, + const unsigned char *t33, + const unsigned char *aux_rand32 +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); + +/** Extract an adaptor point T from the signature. + * + * Returns 1 on success, 0 on failure. + * Args: ctx: pointer to a context object. + * Out: t33: pointer to a 33-byte array to store the compressed adaptor point. + * In: sig65: pointer to a 65-byte serialized signature. + * msg32: the 32-byte message being signed. + * pubkey: pointer to an x-only public key to verify with (cannot be NULL) + */ +SECP256K1_API int secp256k1_schnorr_adaptor_extract_t( + const secp256k1_context *ctx, + unsigned char *t33, + const unsigned char *sig65, + const unsigned char *msg32, + const secp256k1_xonly_pubkey *pubkey +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); + +/** Adapt an adaptor signature to a schnorr signature. + * + * Returns 1 on success, 0 on failure. + * Args: ctx: pointer to a context object. + * Out: sig64: pointer to a 64-byte array to store the adapted schnorr signature. + * In: sig65: pointer to a 65-byte serialized adaptor signature. + * t32: pointer to a 32-byte adaptor. + */ +SECP256K1_API int secp256k1_schnorr_adaptor_adapt( + const secp256k1_context *ctx, + unsigned char *sig64, + const unsigned char *sig65, + const unsigned char *t32 +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); + +/** Extract the adaptor from an adaptor signature and a schnorr signature. + * + * Returns 1 on success, 0 on failure. + * Args: ctx: pointer to a context object. + * Out: t32: pointer to a 32-byte array to store the adaptor. + * In: sig65: pointer to a 65-byte serialized adaptor signature. + * sig64: pointer to a 64-byte adapted schnorr signature. + */ +SECP256K1_API int secp256k1_schnorr_adaptor_extract_adaptor( + const secp256k1_context *ctx, + unsigned char *t32, + const unsigned char *sig65, + const unsigned char *sig64 +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); + +#ifdef __cplusplus +} +#endif + +#endif /* SECP256K1_SCHNORR_ADAPTOR_H */ diff --git a/src/ctime_tests.c b/src/ctime_tests.c index 407d2cc6a..de607ad5b 100644 --- a/src/ctime_tests.c +++ b/src/ctime_tests.c @@ -31,6 +31,10 @@ #include "../include/secp256k1_schnorrsig.h" #endif +#ifdef ENABLE_MODULE_SCHNORR_ADAPTOR +#include "../include/secp256k1_schnorr_adaptor.h" +#endif + #ifdef ENABLE_MODULE_ELLSWIFT #include "../include/secp256k1_ellswift.h" #endif @@ -193,6 +197,24 @@ static void run_tests(secp256k1_context *ctx, unsigned char *key) { CHECK(ret == 1); #endif +#ifdef ENABLE_MODULE_SCHNORR_ADAPTOR + { + unsigned char t[33]; + + for (i = 0; i < 33; i++) { + t[i] = i + 2; + } + + SECP256K1_CHECKMEM_UNDEFINE(key, 32); + ret = secp256k1_keypair_create(ctx, &keypair, key); + SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret)); + CHECK(ret == 1); + ret = secp256k1_schnorr_adaptor_presign(ctx, sig, msg, &keypair, t, NULL); + SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret)); + CHECK(ret == 1); + } +#endif + #ifdef ENABLE_MODULE_ELLSWIFT SECP256K1_CHECKMEM_UNDEFINE(key, 32); ret = secp256k1_ellswift_create(ctx, ellswift, key, NULL); diff --git a/src/modules/schnorr_adaptor/Makefile.am.include b/src/modules/schnorr_adaptor/Makefile.am.include new file mode 100644 index 000000000..7ef16361e --- /dev/null +++ b/src/modules/schnorr_adaptor/Makefile.am.include @@ -0,0 +1,3 @@ +include_HEADERS += include/secp256k1_schnorr_adaptor.h +noinst_HEADERS += src/modules/schnorr_adaptor/main_impl.h +noinst_HEADERS += src/modules/schnorr_adaptor/tests_impl.h \ No newline at end of file diff --git a/src/modules/schnorr_adaptor/main_impl.h b/src/modules/schnorr_adaptor/main_impl.h new file mode 100644 index 000000000..d4972a2f0 --- /dev/null +++ b/src/modules/schnorr_adaptor/main_impl.h @@ -0,0 +1,286 @@ +/********************************************************************** + * Copyright (c) 2023 Zhe Pang * + * Distributed under the MIT software license, see the accompanying * + * file COPYING or http://www.opensource.org/licenses/mit-license.php.* + **********************************************************************/ + +#ifndef SECP256K1_MODULE_SCHNORR_ADAPTOR_MAIN_H +#define SECP256K1_MODULE_SCHNORR_ADAPTOR_MAIN_H + +#include "../../../include/secp256k1.h" +#include "../../../include/secp256k1_schnorr_adaptor.h" +#include "../../hash.h" + +static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *xonly_t32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) { + secp256k1_sha256 sha; + unsigned char masked_key[32]; + int i; + + if (algo == NULL) { + return 0; + } + + if (data != NULL) { + secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha); + secp256k1_sha256_write(&sha, data, 32); + secp256k1_sha256_finalize(&sha, masked_key); + for (i = 0; i < 32; i++) { + masked_key[i] ^= key32[i]; + } + } else { + /* Precomputed TaggedHash("BIP0340/aux", 0x0000...00); */ + static const unsigned char ZERO_MASK[32] = { + 84, 241, 105, 207, 201, 226, 229, 114, + 116, 128, 68, 31, 144, 186, 37, 196, + 136, 244, 97, 199, 11, 94, 165, 220, + 170, 247, 175, 105, 39, 10, 165, 20 + }; + for (i = 0; i < 32; i++) { + masked_key[i] = key32[i] ^ ZERO_MASK[i]; + } + } + + /* Tag the hash with algo which is important to avoid nonce reuse across + * algorithms. If this nonce function is used in BIP-340 signing as defined + * in the spec, an optimized tagging implementation is used. */ + if (algolen == sizeof(bip340_algo) + && secp256k1_memcmp_var(algo, bip340_algo, algolen) == 0) { + secp256k1_nonce_function_bip340_sha256_tagged(&sha); + } else { + secp256k1_sha256_initialize_tagged(&sha, algo, algolen); + } + + /* Hash masked-key||pk||msg using the tagged hash as per the spec */ + secp256k1_sha256_write(&sha, masked_key, 32); + secp256k1_sha256_write(&sha, xonly_t32, 32); + secp256k1_sha256_write(&sha, xonly_pk32, 32); + secp256k1_sha256_write(&sha, msg32, 32); + secp256k1_sha256_finalize(&sha, nonce32); + return 1; +} + +const secp256k1_adaptor_nonce_function_hardened secp256k1_adaptor_nonce_function_bip340 = adaptor_nonce_function_bip340; + +static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *ctx, unsigned char *sig65, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_adaptor_nonce_function_hardened noncefp, const unsigned char *t33, void *ndata) { + secp256k1_scalar sk; + secp256k1_scalar e; + secp256k1_scalar k; + secp256k1_gej rj; + secp256k1_gej r0j; + secp256k1_ge pk; + secp256k1_ge r; + secp256k1_ge r0; + secp256k1_ge t; + unsigned char nonce32[32] = {0}; + unsigned char pk_buf[32]; + unsigned char seckey[32]; + size_t size = 33; + size_t msglen = 32; + int ret = 1; + + VERIFY_CHECK(ctx != NULL); + ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)); + ARG_CHECK(sig65 != NULL); + ARG_CHECK(msg32 != NULL); + ARG_CHECK(keypair != NULL); + ARG_CHECK(t33 != NULL); + + if (noncefp == NULL) { + noncefp = secp256k1_adaptor_nonce_function_bip340; + } + + ret &= secp256k1_keypair_load(ctx, &sk, &pk, keypair); + + if (secp256k1_fe_is_odd(&pk.y)) { + secp256k1_scalar_negate(&sk, &sk); + } + + /* d */ + secp256k1_scalar_get_b32(seckey, &sk); + /* bytes_from_point(P) */ + secp256k1_fe_get_b32(pk_buf, &pk.x); + + ret &= !!noncefp(nonce32, msg32, seckey, &t33[1], pk_buf, bip340_algo, sizeof(bip340_algo), ndata); + /* k0 */ + secp256k1_scalar_set_b32(&k, nonce32, NULL); + ret &= !secp256k1_scalar_is_zero(&k); + secp256k1_scalar_cmov(&k, &secp256k1_scalar_one, !ret); + + /* R = k0*G */ + secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &k); + secp256k1_ge_set_gej(&r, &rj); + + /* T = cpoint(T) */ + ret &= !!secp256k1_eckey_pubkey_parse(&t, t33, 33); + + /* R' = k*G + T, can use gej_add_ge_var since r and t aren't secret */ + secp256k1_gej_add_ge_var(&r0j, &rj, &t, NULL); + secp256k1_ge_set_gej(&r0, &r0j); + + /* We declassify R' to allow using it as a branch point. This is fine + * because R' is not a secret. */ + secp256k1_declassify(ctx, &r0, sizeof(r0)); + secp256k1_fe_normalize_var(&r0.y); + if (secp256k1_fe_is_odd(&r0.y)) { + secp256k1_scalar_negate(&k, &k); + } + + ret &= !!secp256k1_eckey_pubkey_serialize(&r0, sig65, &size, 1); + + secp256k1_schnorrsig_challenge(&e, &sig65[1], msg32, msglen, pk_buf); + secp256k1_scalar_mul(&e, &e, &sk); + /* k + e * d */ + secp256k1_scalar_add(&e, &e, &k); + secp256k1_scalar_get_b32(&sig65[33], &e); + + secp256k1_memczero(sig65, 65, !ret); + secp256k1_scalar_clear(&k); + secp256k1_scalar_clear(&sk); + memset(seckey, 0, sizeof(seckey)); + + return ret; +} + +int secp256k1_schnorr_adaptor_presign(const secp256k1_context *ctx, unsigned char *sig65, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *t33, const unsigned char *aux_rand32) { + /* We cast away const from the passed aux_rand32 argument since we know the default nonce function does not modify it. */ + return secp256k1_schnorr_adaptor_presign_internal(ctx, sig65, msg32, keypair, secp256k1_adaptor_nonce_function_bip340, t33, (unsigned char*)aux_rand32); +} + +int secp256k1_schnorr_adaptor_extract_t(const secp256k1_context *ctx, unsigned char *t33, const unsigned char *sig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey) { + secp256k1_scalar s0; + secp256k1_scalar e; + secp256k1_gej rj; + secp256k1_ge r; + secp256k1_ge pk; + secp256k1_gej pkj; + secp256k1_ge r0; + secp256k1_ge t; + secp256k1_gej tj; + secp256k1_xonly_pubkey pkr0; + unsigned char buf[32]; + size_t size = 33; + size_t msglen = 32; + int overflow; + int ret = 1; + + VERIFY_CHECK(ctx != NULL); + ARG_CHECK(t33 != NULL); + ARG_CHECK(sig65 != NULL); + ARG_CHECK(msg32 != NULL); + ARG_CHECK(pubkey != NULL); + + /* P */ + ret &= !!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey); + + /* s0 */ + secp256k1_scalar_set_b32(&s0, &sig65[33], &overflow); + ret &= !overflow; + + /* R0 */ + ret &= !!secp256k1_xonly_pubkey_parse(ctx, &pkr0, &sig65[1]); + ret &= !!secp256k1_xonly_pubkey_load(ctx, &r0, &pkr0); + + /* Compute e */ + secp256k1_fe_get_b32(buf, &pk.x); + secp256k1_schnorrsig_challenge(&e, &sig65[1], msg32, msglen, buf); + + /* Compute rj = s0*G + (-e) * pkj */ + secp256k1_scalar_negate(&e, &e); + secp256k1_gej_set_ge(&pkj, &pk); + secp256k1_ecmult(&rj, &pkj, &e, &s0); + + /* R */ + secp256k1_ge_set_gej_var(&r, &rj); + ret &= !secp256k1_ge_is_infinity(&r); + + /* T = R0 + (- R) */ + secp256k1_gej_neg(&rj, &rj); + secp256k1_gej_add_ge_var(&tj, &rj, &r0, NULL); + if (sig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { + ; + } else if (sig65[0] == SECP256K1_TAG_PUBKEY_ODD) { + secp256k1_gej_neg(&tj, &tj); + } else { + ret = 0; + } + secp256k1_ge_set_gej(&t, &tj); + ret &= !!secp256k1_eckey_pubkey_serialize(&t, t33, &size, 1); + + secp256k1_memczero(t33, 33, !ret); + secp256k1_scalar_clear(&s0); + + return ret; +} + +int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *sig65, const unsigned char *t32) { + secp256k1_scalar s0; + secp256k1_scalar s; + secp256k1_scalar t; + int overflow; + int ret = 1; + + VERIFY_CHECK(ctx != NULL); + ARG_CHECK(sig64 != NULL); + ARG_CHECK(sig65 != NULL); + ARG_CHECK(t32 != NULL); + + /* s0 */ + secp256k1_scalar_set_b32(&s0, &sig65[33], &overflow); + ret &= !overflow; + + /* t */ + secp256k1_scalar_set_b32(&t, t32, &overflow); + ret &= !overflow; + + if (sig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { + secp256k1_scalar_add(&s, &s0, &t); + } else if (sig65[0] == SECP256K1_TAG_PUBKEY_ODD) { + secp256k1_scalar_negate(&t, &t); + secp256k1_scalar_add(&s, &s0, &t); + } else { + ret = 0; + } + + memset(sig64, 0, 64); + memcpy(sig64, &sig65[1], 32); + secp256k1_scalar_get_b32(&sig64[32], &s); + + return ret; +} + +int secp256k1_schnorr_adaptor_extract_adaptor(const secp256k1_context *ctx, unsigned char *t32, const unsigned char *sig65, const unsigned char *sig64) { + secp256k1_scalar s0; + secp256k1_scalar s; + secp256k1_scalar t; + int overflow; + int ret = 1; + + VERIFY_CHECK(ctx != NULL); + ARG_CHECK(t32 != NULL); + ARG_CHECK(sig65 != NULL); + ARG_CHECK(sig64 != NULL); + + /* s0 */ + secp256k1_scalar_set_b32(&s0, &sig65[33], &overflow); + ret &= !overflow; + + /* s */ + secp256k1_scalar_set_b32(&s, &sig64[32], &overflow); + ret &= !overflow; + + if (sig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { + secp256k1_scalar_negate(&s0, &s0); + secp256k1_scalar_add(&t, &s, &s0); + } else if (sig65[0] == SECP256K1_TAG_PUBKEY_ODD) { + secp256k1_scalar_negate(&s, &s); + secp256k1_scalar_add(&t, &s0, &s); + } else { + ret = 0; + } + + secp256k1_scalar_get_b32(t32, &t); + + return ret; +} + +#endif diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h new file mode 100644 index 000000000..8946e1da4 --- /dev/null +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -0,0 +1,981 @@ +/********************************************************************** + * Copyright (c) 2023 Zhe Pang * + * Distributed under the MIT software license, see the accompanying * + * file COPYING or http://www.opensource.org/licenses/mit-license.php.* + **********************************************************************/ + +#ifndef SECP256K1_MODULE_SCHNORR_ADAPTOR_TESTS_H +#define SECP256K1_MODULE_SCHNORR_ADAPTOR_TESTS_H + +#include "../../../include/secp256k1_schnorr_adaptor.h" + +/* Checks that a bit flip in the n_flip-th argument (that has n_bytes many + * bytes) changes the hash function + */ +void adaptor_nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes, size_t algolen) { + unsigned char nonces[2][32]; + CHECK(adaptor_nonce_function_bip340(nonces[0], args[0], args[1], args[2], args[3], args[4], algolen, args[5]) == 1); + secp256k1_testrand_flip(args[n_flip], n_bytes); + CHECK(adaptor_nonce_function_bip340(nonces[1], args[0], args[1], args[2], args[3], args[4], algolen, args[5]) == 1); + CHECK(secp256k1_memcmp_var(nonces[0], nonces[1], 32) != 0); +} + +void run_adaptor_nonce_function_bip340_tests(void) { + unsigned char tag[13] = "BIP0340/nonce"; + unsigned char aux_tag[11] = "BIP0340/aux"; + unsigned char algo[13] = "BIP0340/nonce"; + size_t algolen = sizeof(algo); + secp256k1_sha256 sha; + secp256k1_sha256 sha_optimized; + unsigned char nonce[32], nonce_z[32]; + unsigned char msg[32]; + unsigned char key[32]; + unsigned char t[32]; + unsigned char pk[32]; + unsigned char aux_rand[32]; + unsigned char *args[6]; + int i; + + /* Check that hash initialized by + * secp256k1_nonce_function_bip340_sha256_tagged has the expected + * state. */ + secp256k1_sha256_initialize_tagged(&sha, tag, sizeof(tag)); + secp256k1_nonce_function_bip340_sha256_tagged(&sha_optimized); + test_sha256_eq(&sha, &sha_optimized); + + /* Check that hash initialized by + * secp256k1_nonce_function_bip340_sha256_tagged_aux has the expected + * state. */ + secp256k1_sha256_initialize_tagged(&sha, aux_tag, sizeof(aux_tag)); + secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha_optimized); + test_sha256_eq(&sha, &sha_optimized); + + secp256k1_testrand256(msg); + secp256k1_testrand256(key); + secp256k1_testrand256(t); + secp256k1_testrand256(pk); + secp256k1_testrand256(aux_rand); + + /* Check that a bitflip in an argument results in different nonces. */ + args[0] = msg; + args[1] = key; + args[2] = t; + args[3] = pk; + args[4] = algo; + args[5] = aux_rand; + for (i = 0; i < COUNT; i++) { + adaptor_nonce_function_bip340_bitflip(args, 0, 32, algolen); + adaptor_nonce_function_bip340_bitflip(args, 1, 32, algolen); + adaptor_nonce_function_bip340_bitflip(args, 2, 32, algolen); + adaptor_nonce_function_bip340_bitflip(args, 3, 32, algolen); + /* Flip algo special case "BIP0340/nonce" */ + adaptor_nonce_function_bip340_bitflip(args, 4, algolen, algolen); + /* Flip algo again */ + adaptor_nonce_function_bip340_bitflip(args, 4, algolen, algolen); + adaptor_nonce_function_bip340_bitflip(args, 5, 32, algolen); + } + + /* NULL algo is disallowed */ + CHECK(adaptor_nonce_function_bip340(nonce, msg, key, t, pk, NULL, 0, NULL) == 0); + CHECK(adaptor_nonce_function_bip340(nonce, msg, key, t, pk, algo, algolen, NULL) == 1); + /* Other algo is fine */ + secp256k1_testrand_bytes_test(algo, algolen); + CHECK(adaptor_nonce_function_bip340(nonce, msg, key, t, pk, algo, algolen, NULL) == 1); + + for (i = 0; i < COUNT; i++) { + unsigned char nonce2[32]; + size_t algolen_tmp; + + /* Different algolen gives different nonce */ + uint32_t offset = secp256k1_testrand_int(algolen - 1); + algolen_tmp = (algolen + offset) % algolen; + CHECK(adaptor_nonce_function_bip340(nonce2, msg, key, t, pk, algo, algolen_tmp, NULL) == 1); + CHECK(secp256k1_memcmp_var(nonce, nonce2, 32) != 0); + } + + /* NULL aux_rand argument is allowed, and identical to passing all zero aux_rand. */ + memset(aux_rand, 0, 32); + CHECK(adaptor_nonce_function_bip340(nonce_z, msg, key, t, pk, algo, algolen, &aux_rand) == 1); + CHECK(adaptor_nonce_function_bip340(nonce, msg, key, t, pk, algo, algolen, NULL) == 1); + CHECK(secp256k1_memcmp_var(nonce_z, nonce, 32) == 0); +} + +void test_schnorr_adaptor_api(void) { + unsigned char sk1[32]; + unsigned char sk2[32]; + unsigned char sk3[32]; + unsigned char msg[32]; + unsigned char t32[32]; + unsigned char t[33] = { + 0x02, 0xC6, 0x04, 0x7F, 0x94, 0x41, 0xED, 0x7D, + 0x6D, 0x30, 0x45, 0x40, 0x6E, 0x95, 0xC0, 0x7C, + 0xD8, 0x5C, 0x77, 0x8E, 0x4B, 0x8C, 0xEF, 0x3C, + 0xA7, 0xAB, 0xAC, 0x09, 0xB9, 0x5C, 0x70, 0x9E, 0xE5 + }; + secp256k1_keypair keypairs[3]; + secp256k1_keypair invalid_keypair = {{ 0 }}; + secp256k1_xonly_pubkey pk[3]; + secp256k1_xonly_pubkey zero_pk; + unsigned char sig[65]; + unsigned char sig64[64]; + unsigned char t2[33]; + unsigned char adaptor[32]; + + /** setup **/ + int ecount; + + secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount); + secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount); + secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount); + secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount); + + secp256k1_testrand256(sk1); + secp256k1_testrand256(sk2); + secp256k1_testrand256(sk3); + secp256k1_testrand256(msg); + secp256k1_testrand256(t32); + CHECK(secp256k1_keypair_create(CTX, &keypairs[0], sk1) == 1); + CHECK(secp256k1_keypair_create(CTX, &keypairs[1], sk2) == 1); + CHECK(secp256k1_keypair_create(CTX, &keypairs[2], sk3) == 1); + CHECK(secp256k1_keypair_xonly_pub(CTX, &pk[0], NULL, &keypairs[0]) == 1); + CHECK(secp256k1_keypair_xonly_pub(CTX, &pk[1], NULL, &keypairs[1]) == 1); + CHECK(secp256k1_keypair_xonly_pub(CTX, &pk[2], NULL, &keypairs[2]) == 1); + memset(&zero_pk, 0, sizeof(zero_pk)); + + /** main test body **/ + ecount = 0; + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], t, NULL) == 1); + CHECK(ecount == 0); + CHECK(secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL) == 0); + CHECK(ecount == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, NULL, msg, &keypairs[0], t, NULL) == 0); + CHECK(ecount == 2); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, NULL, &keypairs[0], t, NULL) == 0); + CHECK(ecount == 3); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, NULL, t, NULL) == 0); + CHECK(ecount == 4); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], NULL, NULL) == 0); + CHECK(ecount == 5); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &invalid_keypair, t, NULL) == 0); + CHECK(ecount == 6); + CHECK(secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL) == 0); + CHECK(ecount == 7); + + ecount = 0; + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], t, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &pk[0]) == 1); + CHECK(ecount == 0); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, NULL, sig, msg, &pk[0]) == 0); + CHECK(ecount == 1); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, NULL, msg, &pk[0]) == 0); + CHECK(ecount == 2); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, NULL, &pk[0]) == 0); + CHECK(ecount == 3); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, NULL) == 0); + CHECK(ecount == 4); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &zero_pk) == 0); + CHECK(ecount == 5); + + ecount = 0; + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); + CHECK(ecount == 0); + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, NULL, sig, t32) == 0); + CHECK(ecount == 1); + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, NULL, t32) == 0); + CHECK(ecount == 2); + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, NULL) == 0); + CHECK(ecount == 3); + + ecount = 0; + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, sig64) == 1); + CHECK(ecount == 0); + CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, NULL, sig, sig64) == 0); + CHECK(ecount == 1); + CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, NULL, sig64) == 0); + CHECK(ecount == 2); + CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, NULL) == 0); + CHECK(ecount == 3); + + secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL); + secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL); +} + +/* Helper function for schnorr_adaptor_vectors + * Signs the message and checks that it's the same as expected_sig. */ +void test_schnorr_adaptor_vectors_check_presigning(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *t33, const unsigned char *expected_sig) { + unsigned char sig[65]; + unsigned char t[33]; + secp256k1_keypair keypair; + secp256k1_xonly_pubkey pk, pk_expected; + + CHECK(secp256k1_keypair_create(CTX, &keypair, sk)); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg32, &keypair, t33, aux_rand)); + CHECK(secp256k1_memcmp_var(sig, expected_sig, 65) == 0); + + CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk_expected, pk_serialized)); + CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair)); + CHECK(secp256k1_memcmp_var(&pk, &pk_expected, sizeof(pk)) == 0); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg32, &pk)); + CHECK(secp256k1_memcmp_var(t, t33, 33) == 0); +} + +/* Helper function for schnorr_adaptor_vectors + * Extracts the adaptor point and checks if it returns the same value as expected. */ + void test_schnorr_adaptor_vectors_check_extract_t(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, const unsigned char *expected_t, int expected) { + secp256k1_xonly_pubkey pk; + unsigned char t[33]; + + CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk, pk_serialized)); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg32, &pk)); + CHECK(expected == (secp256k1_memcmp_var(t, expected_t, 33) == 0)); + } + +/* Helper function for schnorr_adaptor_vectors + * Adapt a Schnorr adptor signature to a valid Schnorr signature + * and checks if it is the same as expected_sig64. */ +void test_schnorr_adaptor_vectors_check_adapt(const unsigned char *sig, const unsigned char *t32, const unsigned char *expected_sig64, int expected) { + unsigned char sig64[64]; + + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32)); + CHECK(expected == (secp256k1_memcmp_var(sig64, expected_sig64, 64) == 0)); +} + +/* Helper function for schnorr_adaptor_vectors + * Extract adaptor from a Schnorr adptor signature and a Schnorr signature + * and checks if it is the same as expected_t32. */ +void test_schnorr_adaptor_vectors_check_extract_adaptor(const unsigned char *sig, const unsigned char *sig64, const unsigned char *expected_t32, int expected) { + unsigned char t32[32]; + + CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, t32, sig, sig64)); + CHECK(expected == (secp256k1_memcmp_var(t32, expected_t32, 32) == 0)); +} + +/* Test vectors, see https://github.com/ZhePang/Python_Specification_for_Schnorr_Adaptor */ +void test_schnorr_adaptor_vectors(void) { + { + /* Test vector 0 */ + const unsigned char sk[32] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03 + }; + const unsigned char pk[32] = { + 0xF9, 0x30, 0x8A, 0x01, 0x92, 0x58, 0xC3, 0x10, + 0x49, 0x34, 0x4F, 0x85, 0xF8, 0x9D, 0x52, 0x29, + 0xB5, 0x31, 0xC8, 0x45, 0x83, 0x6F, 0x99, 0xB0, + 0x86, 0x01, 0xF1, 0x13, 0xBC, 0xE0, 0x36, 0xF9 + }; + unsigned char aux_rand[32] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + }; + const unsigned char msg[32] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + }; + const unsigned char t[33] = { + 0x02, 0xC6, 0x04, 0x7F, 0x94, 0x41, 0xED, 0x7D, + 0x6D, 0x30, 0x45, 0x40, 0x6E, 0x95, 0xC0, 0x7C, + 0xD8, 0x5C, 0x77, 0x8E, 0x4B, 0x8C, 0xEF, 0x3C, + 0xA7, 0xAB, 0xAC, 0x09, 0xB9, 0x5C, 0x70, 0x9E, 0xE5 + }; + const unsigned char t32[32] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 + }; + const unsigned char sig[65] = { + 0x02, 0x06, 0x09, 0x11, 0xFD, 0x59, 0x2B, 0xB8, + 0xD2, 0x66, 0x19, 0x83, 0x80, 0xE6, 0xB2, 0x80, + 0x11, 0xEC, 0xBF, 0x46, 0x17, 0xDD, 0x12, 0xBF, + 0xBF, 0xD4, 0x25, 0xFA, 0x78, 0x66, 0xF7, 0x80, + 0xC8, 0xB6, 0x52, 0xB4, 0xB9, 0x5A, 0x20, 0xA8, + 0x10, 0x51, 0xFA, 0x05, 0x09, 0x6E, 0x72, 0xD2, + 0xDF, 0x31, 0x0A, 0x74, 0x19, 0x31, 0xF7, 0xA8, + 0xFD, 0xCF, 0x5E, 0x70, 0x0E, 0x61, 0xCF, 0x6F, 0x1F + }; + const unsigned char sig64[64] = { + 0x06, 0x09, 0x11, 0xFD, 0x59, 0x2B, 0xB8, 0xD2, + 0x66, 0x19, 0x83, 0x80, 0xE6, 0xB2, 0x80, 0x11, + 0xEC, 0xBF, 0x46, 0x17, 0xDD, 0x12, 0xBF, 0xBF, + 0xD4, 0x25, 0xFA, 0x78, 0x66, 0xF7, 0x80, 0xC8, + 0xB6, 0x52, 0xB4, 0xB9, 0x5A, 0x20, 0xA8, 0x10, + 0x51, 0xFA, 0x05, 0x09, 0x6E, 0x72, 0xD2, 0xDF, + 0x31, 0x0A, 0x74, 0x19, 0x31, 0xF7, 0xA8, 0xFD, + 0xCF, 0x5E, 0x70, 0x0E, 0x61, 0xCF, 0x6F, 0x21 + }; + test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); + test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); + test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + }; + { + /* Test vector 1 */ + const unsigned char sk[32] = { + 0xB7, 0xE1, 0x51, 0x62, 0x8A, 0xED, 0x2A, 0x6A, + 0xBF, 0x71, 0x58, 0x80, 0x9C, 0xF4, 0xF3, 0xC7, + 0x62, 0xE7, 0x16, 0x0F, 0x38, 0xB4, 0xDA, 0x56, + 0xA7, 0x84, 0xD9, 0x04, 0x51, 0x90, 0xCF, 0xEF + }; + const unsigned char pk[32] = { + 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F, + 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE, + 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8, + 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59 + }; + unsigned char aux_rand[32] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 + }; + const unsigned char msg[32] = { + 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3, + 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44, + 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0, + 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89 + }; + const unsigned char t[33] = { + 0x02, 0xE4, 0x93, 0xDB, 0xF1, 0xC1, 0x0D, 0x80, + 0xF3, 0x58, 0x1E, 0x49, 0x04, 0x93, 0x0B, 0x14, + 0x04, 0xCC, 0x6C, 0x13, 0x90, 0x0E, 0xE0, 0x75, + 0x84, 0x74, 0xFA, 0x94, 0xAB, 0xE8, 0xC4, 0xCD, 0x13 + }; + const unsigned char t32[32] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04 + }; + const unsigned char sig[65] = { + 0x02, 0x9F, 0x08, 0xBE, 0x86, 0x5F, 0x69, 0x3B, + 0xDB, 0xC1, 0xAE, 0x97, 0x6D, 0xFF, 0xB8, 0xBC, + 0x88, 0x4C, 0x37, 0x20, 0x52, 0xB0, 0x92, 0x6E, + 0x49, 0xE0, 0x29, 0x8A, 0x9F, 0x2D, 0x7B, 0x48, + 0x60, 0xCB, 0xA2, 0xE9, 0xE5, 0x5F, 0xCC, 0x8B, + 0x22, 0xAE, 0x1D, 0xD3, 0xC4, 0x22, 0x4C, 0xDB, + 0x4F, 0x9B, 0xA2, 0x3B, 0x16, 0x33, 0xCA, 0xE6, + 0x85, 0x06, 0xC3, 0xD9, 0xF5, 0x8A, 0xF8, 0x87, 0x27 + }; + const unsigned char sig64[64] = { + 0x9F, 0x08, 0xBE, 0x86, 0x5F, 0x69, 0x3B, 0xDB, + 0xC1, 0xAE, 0x97, 0x6D, 0xFF, 0xB8, 0xBC, 0x88, + 0x4C, 0x37, 0x20, 0x52, 0xB0, 0x92, 0x6E, 0x49, + 0xE0, 0x29, 0x8A, 0x9F, 0x2D, 0x7B, 0x48, 0x60, + 0xCB, 0xA2, 0xE9, 0xE5, 0x5F, 0xCC, 0x8B, 0x22, + 0xAE, 0x1D, 0xD3, 0xC4, 0x22, 0x4C, 0xDB, 0x4F, + 0x9B, 0xA2, 0x3B, 0x16, 0x33, 0xCA, 0xE6, 0x85, + 0x06, 0xC3, 0xD9, 0xF5, 0x8A, 0xF8, 0x87, 0x2B + }; + test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); + test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); + test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + }; + { + /* Test vector 2 */ + const unsigned char sk[32] = { + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x14, 0xE5, 0xC9 + }; + const unsigned char pk[32] = { + 0xDD, 0x30, 0x8A, 0xFE, 0xC5, 0x77, 0x7E, 0x13, + 0x12, 0x1F, 0xA7, 0x2B, 0x9C, 0xC1, 0xB7, 0xCC, + 0x01, 0x39, 0x71, 0x53, 0x09, 0xB0, 0x86, 0xC9, + 0x60, 0xE1, 0x8F, 0xD9, 0x69, 0x77, 0x4E, 0xB8 + }; + unsigned char aux_rand[32] = { + 0xC8, 0x7A, 0xA5, 0x38, 0x24, 0xB4, 0xD7, 0xAE, + 0x2E, 0xB0, 0x35, 0xA2, 0xB5, 0xBB, 0xBC, 0xCC, + 0x08, 0x0E, 0x76, 0xCD, 0xC6, 0xD1, 0x69, 0x2C, + 0x4B, 0x0B, 0x62, 0xD7, 0x98, 0xE6, 0xD9, 0x04 + }; + const unsigned char msg[32] = { + 0x7E, 0x2D, 0x58, 0xD8, 0xB3, 0xBC, 0xDF, 0x1A, + 0xBA, 0xDE, 0xC7, 0x82, 0x90, 0x54, 0xF9, 0x0D, + 0xDA, 0x98, 0x05, 0xAA, 0xB5, 0x6C, 0x77, 0x33, + 0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C + }; + const unsigned char t[33] = { + 0x02, 0x5C, 0xBD, 0xF0, 0x64, 0x6E, 0x5D, 0xB4, + 0xEA, 0xA3, 0x98, 0xF3, 0x65, 0xF2, 0xEA, 0x7A, + 0x0E, 0x3D, 0x41, 0x9B, 0x7E, 0x03, 0x30, 0xE3, + 0x9C, 0xE9, 0x2B, 0xDD, 0xED, 0xCA, 0xC4, 0xF9, 0xBC + }; + const unsigned char t32[32] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07 + }; + const unsigned char sig[65] = { + 0x03, 0xEE, 0x01, 0x73, 0x70, 0x80, 0xBD, 0xCC, + 0x0D, 0xB6, 0x11, 0xC3, 0x0B, 0x9D, 0x29, 0x52, + 0x24, 0x5C, 0x07, 0xEA, 0x81, 0xD2, 0x00, 0x24, + 0xB4, 0x93, 0x13, 0xE2, 0x61, 0x1C, 0x20, 0xA5, + 0xE3, 0xF4, 0xE2, 0x0A, 0x0E, 0xDA, 0xE1, 0xB0, + 0xBB, 0xC7, 0x89, 0xBC, 0x55, 0xC0, 0x4E, 0x80, + 0xE7, 0x03, 0x1C, 0xAF, 0xAE, 0x50, 0x56, 0xC8, + 0x18, 0x19, 0x90, 0xC9, 0x3D, 0x3B, 0xD3, 0x7B, 0xD7 + }; + const unsigned char sig64[64] = { + 0xEE, 0x01, 0x73, 0x70, 0x80, 0xBD, 0xCC, 0x0D, + 0xB6, 0x11, 0xC3, 0x0B, 0x9D, 0x29, 0x52, 0x24, + 0x5C, 0x07, 0xEA, 0x81, 0xD2, 0x00, 0x24, 0xB4, + 0x93, 0x13, 0xE2, 0x61, 0x1C, 0x20, 0xA5, 0xE3, + 0xF4, 0xE2, 0x0A, 0x0E, 0xDA, 0xE1, 0xB0, 0xBB, + 0xC7, 0x89, 0xBC, 0x55, 0xC0, 0x4E, 0x80, 0xE7, + 0x03, 0x1C, 0xAF, 0xAE, 0x50, 0x56, 0xC8, 0x18, + 0x19, 0x90, 0xC9, 0x3D, 0x3B, 0xD3, 0x7B, 0xD0 + }; + test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); + test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); + test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + }; + { + /* Test vector 3 */ + const unsigned char sk[32] = { + 0x0B, 0x43, 0x2B, 0x26, 0x77, 0x93, 0x73, 0x81, + 0xAE, 0xF0, 0x5B, 0xB0, 0x2A, 0x66, 0xEC, 0xD0, + 0x12, 0x77, 0x30, 0x62, 0xCF, 0x3F, 0xA2, 0x54, + 0x9E, 0x44, 0xF5, 0x8E, 0xD2, 0x40, 0x17, 0x10 + }; + const unsigned char pk[32] = { + 0x25, 0xD1, 0xDF, 0xF9, 0x51, 0x05, 0xF5, 0x25, + 0x3C, 0x40, 0x22, 0xF6, 0x28, 0xA9, 0x96, 0xAD, + 0x3A, 0x0D, 0x95, 0xFB, 0xF2, 0x1D, 0x46, 0x8A, + 0x1B, 0x33, 0xF8, 0xC1, 0x60, 0xD8, 0xF5, 0x17 + }; + unsigned char aux_rand[32] = { + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF + }; + const unsigned char msg[32] = { + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF + }; + const unsigned char t[33] = { + 0x02, 0xC6, 0x04, 0x7F, 0x94, 0x41, 0xED, 0x7D, + 0x6D, 0x30, 0x45, 0x40, 0x6E, 0x95, 0xC0, 0x7C, + 0xD8, 0x5C, 0x77, 0x8E, 0x4B, 0x8C, 0xEF, 0x3C, + 0xA7, 0xAB, 0xAC, 0x09, 0xB9, 0x5C, 0x70, 0x9E, 0xE5 + }; + const unsigned char t32[32] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 + }; + const unsigned char sig[65] = { + 0x03, 0xEE, 0x14, 0xD2, 0xCA, 0x24, 0xD9, 0xD8, + 0x47, 0x47, 0xB4, 0x34, 0xE5, 0x19, 0x50, 0x4E, + 0xC9, 0xFC, 0x6A, 0xE4, 0xEE, 0xB9, 0x57, 0x81, + 0xA0, 0xAA, 0xE5, 0xF6, 0x73, 0xEC, 0x08, 0x88, + 0x37, 0xDA, 0x80, 0x25, 0x48, 0x6E, 0x62, 0x0F, + 0x86, 0x49, 0xE3, 0xB6, 0x31, 0xA1, 0x9A, 0x6E, + 0xBF, 0xE7, 0xC2, 0x73, 0xFD, 0xAC, 0xE4, 0x61, + 0x17, 0xCE, 0xB3, 0x73, 0x6C, 0x00, 0xD5, 0xA5, 0x76 + }; + const unsigned char sig64[64] = { + 0xEE, 0x14, 0xD2, 0xCA, 0x24, 0xD9, 0xD8, 0x47, + 0x47, 0xB4, 0x34, 0xE5, 0x19, 0x50, 0x4E, 0xC9, + 0xFC, 0x6A, 0xE4, 0xEE, 0xB9, 0x57, 0x81, 0xA0, + 0xAA, 0xE5, 0xF6, 0x73, 0xEC, 0x08, 0x88, 0x37, + 0xDA, 0x80, 0x25, 0x48, 0x6E, 0x62, 0x0F, 0x86, + 0x49, 0xE3, 0xB6, 0x31, 0xA1, 0x9A, 0x6E, 0xBF, + 0xE7, 0xC2, 0x73, 0xFD, 0xAC, 0xE4, 0x61, 0x17, + 0xCE, 0xB3, 0x73, 0x6C, 0x00, 0xD5, 0xA5, 0x74 + }; + test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); + test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); + test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + }; + { + /* Test vector 4 */ + const unsigned char sk[32] = { + 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, + 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, + 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, + 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x14, 0xE5, 0xC9 + }; + const unsigned char pk[32] = { + 0xDD, 0x30, 0x8A, 0xFE, 0xC5, 0x77, 0x7E, 0x13, + 0x12, 0x1F, 0xA7, 0x2B, 0x9C, 0xC1, 0xB7, 0xCC, + 0x01, 0x39, 0x71, 0x53, 0x09, 0xB0, 0x86, 0xC9, + 0x60, 0xE1, 0x8F, 0xD9, 0x69, 0x77, 0x4E, 0xB8 + }; + unsigned char aux_rand[32] = { + 0xC8, 0x7A, 0xA5, 0x38, 0x24, 0xB4, 0xD7, 0xAE, + 0x2E, 0xB0, 0x35, 0xA2, 0xB5, 0xBB, 0xBC, 0xCC, + 0x08, 0x0E, 0x76, 0xCD, 0xC6, 0xD1, 0x69, 0x2C, + 0x4B, 0x0B, 0x62, 0xD7, 0x98, 0xE6, 0xD9, 0x04 + }; + const unsigned char msg[32] = { + 0x7E, 0x2D, 0x58, 0xD8, 0xB3, 0xBC, 0xDF, 0x1A, + 0xBA, 0xDE, 0xC7, 0x82, 0x90, 0x54, 0xF9, 0x0D, + 0xDA, 0x98, 0x05, 0xAA, 0xB5, 0x6C, 0x77, 0x33, + 0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C + }; + const unsigned char t[33] = { + 0x03, 0x5C, 0xBD, 0xF0, 0x64, 0x6E, 0x5D, 0xB4, + 0xEA, 0xA3, 0x98, 0xF3, 0x65, 0xF2, 0xEA, 0x7A, + 0x0E, 0x3D, 0x41, 0x9B, 0x7E, 0x03, 0x30, 0xE3, + 0x9C, 0xE9, 0x2B, 0xDD, 0xED, 0xCA, 0xC4, 0xF9, 0xBC + }; + const unsigned char t32[32] = { + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07 + }; + const unsigned char sig[65] = { + 0x02, 0x7C, 0x03, 0x7F, 0xE8, 0xF4, 0xD6, 0x8D, + 0xFB, 0x2A, 0x0D, 0x21, 0xAB, 0x23, 0xD5, 0x9F, + 0xB4, 0xF1, 0x82, 0xC6, 0x01, 0xAB, 0x2B, 0xA1, + 0x11, 0x5C, 0x12, 0x13, 0x43, 0x01, 0x3B, 0xBA, + 0x49, 0x25, 0x60, 0x01, 0x9F, 0x96, 0x3D, 0x54, + 0x77, 0x73, 0xFF, 0x5C, 0xE1, 0xFC, 0x58, 0xF6, + 0x57, 0x76, 0x55, 0x09, 0x96, 0x26, 0x4E, 0x12, + 0xA6, 0x9E, 0x17, 0x7B, 0x43, 0x04, 0xD3, 0xCF, 0x99 + }; + const unsigned char sig64[64] = { + 0x7C, 0x03, 0x7F, 0xE8, 0xF4, 0xD6, 0x8D, 0xFB, + 0x2A, 0x0D, 0x21, 0xAB, 0x23, 0xD5, 0x9F, 0xB4, + 0xF1, 0x82, 0xC6, 0x01, 0xAB, 0x2B, 0xA1, 0x11, + 0x5C, 0x12, 0x13, 0x43, 0x01, 0x3B, 0xBA, 0x49, + 0x25, 0x60, 0x01, 0x9F, 0x96, 0x3D, 0x54, 0x77, + 0x73, 0xFF, 0x5C, 0xE1, 0xFC, 0x58, 0xF6, 0x57, + 0x76, 0x55, 0x09, 0x96, 0x26, 0x4E, 0x12, 0xA6, + 0x9E, 0x17, 0x7B, 0x43, 0x04, 0xD3, 0xCF, 0xA0 + }; + test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); + test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); + test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + }; + { + /* Test vector 5 */ + /* Verification test */ + const unsigned char pk[32] = { + 0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, 0x50, + 0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF, 0x21, + 0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76, 0x87, + 0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A, 0x34 + }; + secp256k1_xonly_pubkey pk_parsed; + CHECK(!secp256k1_xonly_pubkey_parse(CTX, &pk_parsed, pk)); + }; + { + /* Test vector 6 */ + /* Verification test */ + const unsigned char pk[32] = { + 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F, + 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE, + 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8, + 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59 + }; + const unsigned char msg[32] = { + 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3, + 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44, + 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0, + 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89 + }; + const unsigned char t[33] = { + 0x02, 0x2F, 0x8B, 0xDE, 0x4D, 0x1A, 0x07, 0x20, + 0x93, 0x55, 0xB4, 0xA7, 0x25, 0x0A, 0x5C, 0x51, + 0x28, 0xE8, 0x8B, 0x84, 0xBD, 0xDC, 0x61, 0x9A, + 0xB7, 0xCB, 0xA8, 0xD5, 0x69, 0xB2, 0x40, 0xEF, 0xE4 + }; + const unsigned char sig[65] = { + 0x02, 0xD6, 0xF0, 0x92, 0xD2, 0x38, 0xE3, 0xB2, + 0xA0, 0xB4, 0xBF, 0x3F, 0x50, 0x2E, 0x47, 0x8B, + 0xA2, 0x7C, 0x72, 0x05, 0xED, 0x4B, 0xE4, 0xEE, + 0xF0, 0xBF, 0x84, 0x36, 0xB8, 0x39, 0x33, 0x74, + 0xC9, 0xBF, 0x03, 0x4D, 0x07, 0x0F, 0x89, 0x36, + 0xEA, 0x9A, 0x2B, 0xBF, 0xA9, 0x53, 0x41, 0x65, + 0xA8, 0x9D, 0x84, 0x5B, 0x4E, 0x32, 0xFB, 0xC0, + 0x49, 0x0D, 0x13, 0xF5, 0xCE, 0xC2, 0xA9, 0x5A, 0x2D + }; + test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); + }; + { + /* Test vector 7 */ + /* Verification test */ + const unsigned char pk[32] = { + 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F, + 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE, + 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8, + 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59 + }; + const unsigned char msg[32] = { + 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3, + 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44, + 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0, + 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89 + }; + const unsigned char t[33] = { + 0x02, 0xE4, 0x93, 0xDB, 0xF1, 0xC1, 0x0D, 0x80, + 0xF3, 0x58, 0x1E, 0x49, 0x04, 0x93, 0x0B, 0x14, + 0x04, 0xCC, 0x6C, 0x13, 0x90, 0x0E, 0xE0, 0x75, + 0x84, 0x74, 0xFA, 0x94, 0xAB, 0xE8, 0xC4, 0xCD, 0x13 + }; + const unsigned char sig[65] = { + 0x03, 0xB3, 0xAE, 0x05, 0xE9, 0x63, 0x4F, 0xBF, + 0xFA, 0x48, 0x34, 0x3F, 0xBB, 0x66, 0x05, 0xDA, + 0xDE, 0xFF, 0xF7, 0x3F, 0x87, 0x5F, 0xD2, 0x2D, + 0x27, 0xB5, 0x62, 0x4C, 0x94, 0x42, 0x85, 0x69, + 0x8B, 0x72, 0x43, 0xA5, 0xA4, 0x21, 0xA1, 0x01, + 0x99, 0x44, 0x93, 0x06, 0x25, 0x17, 0x57, 0x17, + 0x40, 0xE6, 0xFA, 0x66, 0xDD, 0x57, 0xBF, 0x27, + 0x5F, 0x22, 0x34, 0xC4, 0x8D, 0x8E, 0x5A, 0xBB, 0xBB + }; + test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); + }; + { + /* Test vector 8 */ + /* Verification test */ + const unsigned char pk[32] = { + 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F, + 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE, + 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8, + 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59 + }; + const unsigned char msg[32] = { + 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3, + 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44, + 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0, + 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89 + }; + const unsigned char t[33] = { + 0x02, 0x2F, 0x8B, 0xDE, 0x4D, 0x1A, 0x07, 0x20, + 0x93, 0x55, 0xB4, 0xA7, 0x25, 0x0A, 0x5C, 0x51, + 0x28, 0xE8, 0x8B, 0x84, 0xBD, 0xDC, 0x61, 0x9A, + 0xB7, 0xCB, 0xA8, 0xD5, 0x69, 0xB2, 0x40, 0xEF, 0xE4 + }; + const unsigned char sig[65] = { + 0x03, 0xBC, 0x74, 0x65, 0x03, 0x0B, 0x34, 0x05, + 0x7C, 0x48, 0x2D, 0x7B, 0x6E, 0xAB, 0xB3, 0x92, + 0x0F, 0x30, 0x06, 0xCD, 0xC5, 0x87, 0x35, 0x99, + 0x73, 0xA6, 0xDA, 0x0A, 0x78, 0x31, 0x13, 0xD7, + 0xA5, 0xF7, 0xFF, 0xED, 0x94, 0x99, 0xA4, 0xA7, + 0xA3, 0x39, 0x79, 0x76, 0x7F, 0xCA, 0x6D, 0xDD, + 0x0D, 0xF7, 0xBD, 0x83, 0x5B, 0xFD, 0x3E, 0x8F, + 0x92, 0xE9, 0x1A, 0x6E, 0xA7, 0xBA, 0xAD, 0x1B, 0x1B + }; + test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); + }; + { + /* Test vector 9 */ + /* Verification test */ + const unsigned char sig[65] = { + 0x02, 0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, + 0x50, 0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF, + 0x21, 0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76, + 0x87, 0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A, + 0x34, 0xF7, 0xFF, 0xED, 0x94, 0x99, 0xA4, 0xA7, + 0xA3, 0x39, 0x79, 0x76, 0x7F, 0xCA, 0x6D, 0xDD, + 0x0D, 0xF7, 0xBD, 0x83, 0x5B, 0xFD, 0x3E, 0x8F, + 0x92, 0xE9, 0x1A, 0x6E, 0xA7, 0xBA, 0xAD, 0x1B, 0x1B + }; + secp256k1_ge r0; + CHECK(!secp256k1_eckey_pubkey_parse(&r0, sig, 33)); + }; + { + /* Test vector 10 */ + /* Adaptor Extraction and Adapting test */ + const unsigned char t32[32] = { + 0xA7, 0xA2, 0x48, 0x01, 0x1E, 0x72, 0x03, 0x81, + 0x68, 0xFA, 0xAB, 0x16, 0x76, 0x1A, 0xA4, 0x7E, + 0x54, 0x04, 0x0A, 0xF2, 0x0E, 0x3F, 0x36, 0xC1, + 0x6C, 0xE2, 0x73, 0x53, 0xCE, 0xAD, 0xF5, 0x11 + }; + const unsigned char sig[65] = { + 0x02, 0x60, 0xB8, 0x55, 0xD2, 0x78, 0x30, 0x24, + 0x65, 0x66, 0x5A, 0x99, 0x9F, 0xF6, 0x9A, 0x7D, + 0x59, 0x7D, 0x53, 0xD7, 0x00, 0x50, 0x20, 0xA8, + 0x54, 0x1B, 0x4F, 0xE4, 0x52, 0xAF, 0x0E, 0x4B, + 0x22, 0xAC, 0xDC, 0x3E, 0xEB, 0x25, 0x00, 0x6A, + 0xC0, 0x25, 0x67, 0x70, 0x49, 0xAB, 0x43, 0x6D, + 0x73, 0x26, 0xD4, 0x8D, 0x76, 0x21, 0xE1, 0xD8, + 0x7A, 0x58, 0xCC, 0x41, 0x71, 0xAF, 0x75, 0x59, 0xBF + }; + const unsigned char sig64[64] = { + 0x60, 0xB8, 0x55, 0xD2, 0x78, 0x30, 0x24, 0x65, + 0x66, 0x5A, 0x99, 0x9F, 0xF6, 0x9A, 0x7D, 0x59, + 0x7D, 0x53, 0xD7, 0x00, 0x50, 0x20, 0xA8, 0x54, + 0x1B, 0x4F, 0xE4, 0x52, 0xAF, 0x0E, 0x4B, 0x22, + 0x54, 0x7E, 0x86, 0xEC, 0x43, 0x72, 0x6E, 0x41, + 0x8E, 0x62, 0x1B, 0x60, 0x21, 0x5E, 0x11, 0xF2, + 0xC0, 0x29, 0xBB, 0x81, 0x80, 0xD8, 0x6F, 0x00, + 0x05, 0xDC, 0x56, 0x38, 0xAD, 0xED, 0x0D, 0x8F + }; + test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); + test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + }; + { + /* Test vector 11 */ + /* Adaptor Extraction and Adapting test */ + const unsigned char t32[32] = { + 0xE3, 0x23, 0x95, 0xDA, 0x56, 0xFB, 0x14, 0x01, + 0xB9, 0x67, 0x0B, 0x61, 0xAE, 0x56, 0x40, 0x7B, + 0x7E, 0x22, 0xEF, 0x7F, 0xAE, 0x0A, 0xE4, 0xE2, + 0x6B, 0x38, 0x80, 0xB5, 0xCC, 0xFB, 0x3C, 0x97 + }; + const unsigned char sig[65] = { + 0x03, 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, + 0xE2, 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, + 0x36, 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, + 0x5B, 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, + 0xEF, 0x0B, 0xD0, 0x43, 0x21, 0xB5, 0xD4, 0xD5, + 0xAD, 0x83, 0x9D, 0x38, 0xCC, 0xB9, 0x74, 0xAC, + 0x98, 0x7C, 0x34, 0xD4, 0x4D, 0x71, 0xCE, 0x3F, + 0x25, 0xC4, 0xB8, 0x51, 0x1F, 0x46, 0xB3, 0x61, 0x6E + }; + const unsigned char sig64[64] = { + 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, 0xE2, + 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, 0x36, + 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, 0x5B, + 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, 0xEF, + 0x11, 0x0C, 0x27, 0x03, 0xF3, 0x30, 0x16, 0x50, + 0xC2, 0xFB, 0xBB, 0xD1, 0x98, 0x35, 0x12, 0xEA, + 0xC0, 0x57, 0x19, 0x19, 0x8F, 0x6F, 0x7C, 0x33, + 0x8F, 0xE1, 0x8C, 0xB7, 0xBC, 0x87, 0xA3, 0x3C + }; + test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); + test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 0); + }; + { + /* Test vector 12 */ + /* Adaptor Extraction and Adapting test */ + const unsigned char t32[32] = { + 0xE3, 0x23, 0x95, 0xDA, 0x56, 0xFB, 0x14, 0x01, + 0xB9, 0x67, 0x0B, 0x61, 0xAE, 0x56, 0x40, 0x7B, + 0x7E, 0x22, 0xEF, 0x7F, 0xAE, 0x0A, 0xE4, 0xE2, + 0x6B, 0x38, 0x80, 0xB5, 0xCC, 0xFB, 0x3C, 0x97 + }; + const unsigned char sig[65] = { + 0x02, 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, + 0xE2, 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, + 0x36, 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, + 0x5B, 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, + 0xEF, 0xF4, 0x2F, 0xBC, 0xDE, 0x4A, 0x2B, 0x2A, + 0x52, 0x7C, 0x62, 0xC7, 0x33, 0x46, 0x8B, 0x53, + 0x66, 0x3E, 0x7A, 0x08, 0x99, 0x3D, 0x7A, 0x61, + 0x15, 0xFB, 0x1A, 0x0D, 0x6D, 0x89, 0x82, 0xDF, 0xD3 + }; + const unsigned char sig64[64] = { + 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, 0xE2, + 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, 0x36, + 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, 0x5B, + 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, 0xEF, + 0x11, 0x0C, 0x27, 0x03, 0xF3, 0x30, 0x16, 0x50, + 0xC2, 0xFB, 0xBB, 0xD1, 0x98, 0x35, 0x12, 0xEA, + 0xC0, 0x57, 0x19, 0x19, 0x8F, 0x6F, 0x7C, 0x33, + 0x8F, 0xE1, 0x8C, 0xB7, 0xBC, 0x87, 0xA3, 0x3C + }; + test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); + test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 0); + }; + { + /* Test vector 13 */ + /* Adapting test */ + const unsigned char t32[32] = { + 0xE3, 0x23, 0x95, 0xDA, 0x56, 0xFB, 0x14, 0x01, + 0xB9, 0x67, 0x0B, 0x61, 0xAE, 0x56, 0x40, 0x7B, + 0x7E, 0x22, 0xEF, 0x7F, 0xAE, 0x0A, 0xE4, 0xE2, + 0x6B, 0x38, 0x80, 0xB5, 0xCC, 0xFB, 0x3C, 0x97 + }; + const unsigned char sig[65] = { + 0x03, 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, + 0xE2, 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, + 0x36, 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, + 0x5B, 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, + 0xEF, 0xF4, 0x2F, 0xBC, 0xDE, 0x4A, 0x2B, 0x2A, + 0x52, 0x7C, 0x62, 0xC7, 0x33, 0x46, 0x8B, 0x53, + 0x66, 0x3E, 0x7A, 0x08, 0x99, 0x3D, 0x7A, 0x61, + 0x15, 0xFB, 0x1A, 0x0D, 0x6D, 0x89, 0x82, 0xDF, 0xD3 + }; + const unsigned char sig64[64] = { + 0x9F, 0x08, 0xBE, 0x86, 0x5F, 0x69, 0x3B, 0xDB, + 0xC1, 0xAE, 0x97, 0x6D, 0xFF, 0xB8, 0xBC, 0x88, + 0x4C, 0x37, 0x20, 0x52, 0xB0, 0x92, 0x6E, 0x49, + 0xE0, 0x29, 0x8A, 0x9F, 0x2D, 0x7B, 0x48, 0x60, + 0x11, 0x0C, 0x27, 0x03, 0xF3, 0x30, 0x16, 0x50, + 0xC2, 0xFB, 0xBB, 0xD1, 0x98, 0x35, 0x12, 0xEA, + 0xC0, 0x57, 0x19, 0x19, 0x8F, 0x6F, 0x7C, 0x33, + 0x8F, 0xE1, 0x8C, 0xB7, 0xBC, 0x87, 0xA3, 0x3C + }; + test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); + }; +} + +void test_schnorr_adaptor_presign(void) { + unsigned char sk[32]; + secp256k1_xonly_pubkey pk; + secp256k1_keypair keypair; + secp256k1_scalar adaptor; + secp256k1_gej tj; + secp256k1_ge tg; + const unsigned char msg[32] = "this is for the schnorr adaptor."; + unsigned char sig[65]; + unsigned char sig2[65]; + unsigned char t32[32]; + unsigned char aux_rand[32]; + unsigned char t33[33]; + unsigned char t[33]; + size_t size = 33; + + secp256k1_testrand256(sk); + secp256k1_testrand256(t32); + secp256k1_testrand256(aux_rand); + secp256k1_scalar_set_b32(&adaptor, t32, NULL); + secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor); + secp256k1_ge_set_gej(&tg, &tj); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, t33, &size, 1) == 1); + CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); + CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, t33, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg, &pk)); + CHECK(secp256k1_memcmp_var(t, t33, 33) == 0); + /* Test with aux_rand */ + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig2, msg, &keypair, t33, aux_rand) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg, &pk)); + CHECK(secp256k1_memcmp_var(t, t33, 33) == 0); +} + +#define N_SIGS 3 +/* Creates N_SIGS valid signatures and verifies them with extract_t + * Then flips some bits and checks that extract_t now fails to get the right + * adaptor point. */ +void test_schnorr_adaptor_extract_t(void) { + unsigned char sk[32]; + secp256k1_xonly_pubkey pk; + secp256k1_keypair keypair; + secp256k1_scalar adaptor; + secp256k1_gej tj; + secp256k1_ge tg; + secp256k1_scalar s; + unsigned char msg[N_SIGS][32]; + unsigned char sig[N_SIGS][65]; + unsigned char t32[N_SIGS][32]; + unsigned char t33[N_SIGS][33]; + unsigned char t[33]; + size_t size = 33; + size_t i; + + secp256k1_testrand256(sk); + CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); + CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); + + for (i = 0; i < N_SIGS; i++) { + secp256k1_testrand256(msg[i]); + secp256k1_testrand256(t32[i]); + secp256k1_scalar_set_b32(&adaptor, t32[i], NULL); + secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor); + secp256k1_ge_set_gej(&tg, &tj); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, t33[i], &size, 1) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[i], msg[i], &keypair, t33[i], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[i], msg[i], &pk)); + CHECK(secp256k1_memcmp_var(t, t33[i], 33) == 0); + } + + { + /* Flip some bits in the signature and check that extract_t fails to + * extract the correct adaptor point */ + size_t sig_idx = secp256k1_testrand_int(N_SIGS); + size_t byte_idx = secp256k1_testrand_bits(5); + unsigned char xorbyte = secp256k1_testrand_int(254)+1; + sig[sig_idx][33 + byte_idx] ^= xorbyte; + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); + CHECK(secp256k1_memcmp_var(t, t33[sig_idx], 33) != 0); + sig[sig_idx][33 + byte_idx] ^= xorbyte; + + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); + CHECK(secp256k1_memcmp_var(t, t33[sig_idx], 33) == 0); + } + + /* Test overflowing s */ + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, t33[0], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[0], msg[0], &pk)); + CHECK(secp256k1_memcmp_var(t, t33[0], 33) == 0); + memset(&sig[0][33], 0xFF, 32); + CHECK(!secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[0], msg[0], &pk)); + CHECK(secp256k1_memcmp_var(t, t33[0], 33) != 0); + + /* Test negative s */ + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, t33[0], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[0], msg[0], &pk)); + CHECK(secp256k1_memcmp_var(t, t33[0], 33) == 0); + secp256k1_scalar_set_b32(&s, &sig[0][33], NULL); + secp256k1_scalar_negate(&s, &s); + secp256k1_scalar_get_b32(&sig[0][33], &s); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[0], msg[0], &pk)); + CHECK(secp256k1_memcmp_var(t, t33[0], 33) != 0); +} +#undef N_SIGS + +void test_schnorr_adaptor_adapt_extract_adaptor(void) { + unsigned char sk[32]; + secp256k1_xonly_pubkey pk; + secp256k1_keypair keypair; + secp256k1_scalar adaptor; + secp256k1_gej tj; + secp256k1_ge tg; + unsigned char msg[32]; + unsigned char sig[65]; + unsigned char sig64[64]; + unsigned char t32[32]; + unsigned char aux_rand[32]; + unsigned char t33[33]; + unsigned char t[33]; + unsigned char t2[32]; + size_t size = 33; + + secp256k1_testrand256(sk); + secp256k1_testrand256(msg); + secp256k1_testrand256(t32); + secp256k1_testrand256(aux_rand); + secp256k1_scalar_set_b32(&adaptor, t32, NULL); + secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor); + secp256k1_ge_set_gej(&tg, &tj); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, t33, &size, 1) == 1); + CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); + CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, t33, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg, &pk)); + CHECK(secp256k1_memcmp_var(t, t33, 33) == 0); + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, t2, sig, sig64) == 1); + CHECK(secp256k1_memcmp_var(t2, t32, 32) == 0); +} + +void run_schnorr_adaptor_tests(void) { + int i; + run_nonce_function_bip340_tests(); + + test_schnorr_adaptor_api(); + test_schnorrsig_sha256_tagged(); + test_schnorr_adaptor_vectors(); + for (i = 0; i < COUNT; i++) { + test_schnorr_adaptor_presign(); + test_schnorr_adaptor_extract_t(); + test_schnorr_adaptor_adapt_extract_adaptor(); + } +} + +#endif diff --git a/src/secp256k1.c b/src/secp256k1.c index 701b436b2..71ecb6e55 100644 --- a/src/secp256k1.c +++ b/src/secp256k1.c @@ -892,6 +892,10 @@ static int secp256k1_ge_parse_ext(secp256k1_ge* ge, const unsigned char *in33) { # include "modules/schnorrsig/main_impl.h" #endif +#ifdef ENABLE_MODULE_SCHNORR_ADAPTOR +# include "modules/schnorr_adaptor/main_impl.h" +#endif + #ifdef ENABLE_MODULE_ELLSWIFT # include "modules/ellswift/main_impl.h" #endif diff --git a/src/tests.c b/src/tests.c index d092dd69a..409195ab4 100644 --- a/src/tests.c +++ b/src/tests.c @@ -7470,6 +7470,10 @@ static void run_ecdsa_wycheproof(void) { # include "modules/schnorrsig/tests_impl.h" #endif +#ifdef ENABLE_MODULE_SCHNORR_ADAPTOR +# include "modules/schnorr_adaptor/tests_impl.h" +#endif + #ifdef ENABLE_MODULE_ELLSWIFT # include "modules/ellswift/tests_impl.h" #endif @@ -7855,6 +7859,10 @@ int main(int argc, char **argv) { run_schnorrsig_tests(); #endif +#ifdef ENABLE_MODULE_SCHNORR_ADAPTOR + run_schnorr_adaptor_tests(); +#endif + #ifdef ENABLE_MODULE_ELLSWIFT run_ellswift_tests(); #endif From e0b87dbc6587208975daa411d506115170e0da2c Mon Sep 17 00:00:00 2001 From: ZhePang Date: Sun, 3 Sep 2023 20:25:16 -0400 Subject: [PATCH 02/10] updated the implementation and tests by accepting whole 33 bytes of adaptor point in the nonce function --- .cirrus.yml | 468 +++++++++++++++++++++++ include/secp256k1_schnorr_adaptor.h | 8 +- src/modules/schnorr_adaptor/main_impl.h | 14 +- src/modules/schnorr_adaptor/tests_impl.h | 360 ++++++++--------- 4 files changed, 665 insertions(+), 185 deletions(-) create mode 100644 .cirrus.yml diff --git a/.cirrus.yml b/.cirrus.yml new file mode 100644 index 000000000..fd7ae2346 --- /dev/null +++ b/.cirrus.yml @@ -0,0 +1,468 @@ +env: + ### cirrus config + CIRRUS_CLONE_DEPTH: 1 + ### compiler options + HOST: + WRAPPER_CMD: + # Specific warnings can be disabled with -Wno-error=foo. + # -pedantic-errors is not equivalent to -Werror=pedantic and thus not implied by -Werror according to the GCC manual. + WERROR_CFLAGS: -Werror -pedantic-errors + MAKEFLAGS: -j4 + BUILD: check + ### secp256k1 config + ECMULTWINDOW: auto + ECMULTGENPRECISION: auto + ASM: no + WIDEMUL: auto + WITH_VALGRIND: yes + EXTRAFLAGS: + ### secp256k1 modules + EXPERIMENTAL: no + ECDH: no + RECOVERY: no + SCHNORRSIG: no + SCHNORRADAPTOR: no + ELLSWIFT: no + ECDSA_S2C: no + GENERATOR: no + RANGEPROOF: no + WHITELIST: no + MUSIG: no + ECDSAADAPTOR: no + BPPP: no + ### test options + SECP256K1_TEST_ITERS: + BENCH: yes + SECP256K1_BENCH_ITERS: 2 + CTIMETESTS: yes + # Compile and run the tests + EXAMPLES: yes + +# https://cirrus-ci.org/pricing/#compute-credits +credits_snippet: &CREDITS + # Don't use any credits for now. + use_compute_credits: false + +cat_logs_snippet: &CAT_LOGS + always: + cat_tests_log_script: + - cat tests.log || true + cat_noverify_tests_log_script: + - cat noverify_tests.log || true + cat_exhaustive_tests_log_script: + - cat exhaustive_tests.log || true + cat_ctime_tests_log_script: + - cat ctime_tests.log || true + cat_bench_log_script: + - cat bench.log || true + cat_config_log_script: + - cat config.log || true + cat_test_env_script: + - cat test_env.log || true + cat_ci_env_script: + - env + +linux_container_snippet: &LINUX_CONTAINER + container: + dockerfile: ci/linux-debian.Dockerfile + # Reduce number of CPUs to be able to do more builds in parallel. + cpu: 1 + # Gives us more CPUs for free if they're available. + greedy: true + # More than enough for our scripts. + memory: 2G + +task: + name: "x86_64: Linux (Debian stable)" + << : *LINUX_CONTAINER + matrix: + - env: {WIDEMUL: int64, RECOVERY: yes} + - env: {WIDEMUL: int64, ECDH: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, ELLSWIFT: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes} + - env: {WIDEMUL: int128} + - env: {WIDEMUL: int128_struct} + - env: {WIDEMUL: int128, RECOVERY: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, ELLSWIFT: yes} + - env: {WIDEMUL: int128, ECDH: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes} + - env: {WIDEMUL: int128, ASM: x86_64 , ELLSWIFT: yes} + - env: { RECOVERY: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes} + - env: {CTIMETESTS: no, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes, CPPFLAGS: -DVERIFY} + - env: {BUILD: distcheck, WITH_VALGRIND: no, CTIMETESTS: no, BENCH: no} + - env: {CPPFLAGS: -DDETERMINISTIC} + - env: {CFLAGS: -O0, CTIMETESTS: no} + - env: {CFLAGS: -O1, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes} + - env: { ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 } + - env: { ECMULTGENPRECISION: 8, ECMULTWINDOW: 4 } + matrix: + - env: + CC: gcc + - env: + CC: clang + - env: + CC: gcc-snapshot + - env: + CC: clang-snapshot + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +task: + name: "i686: Linux (Debian stable)" + << : *LINUX_CONTAINER + env: + HOST: i686-linux-gnu + ECDH: yes + RECOVERY: yes + SCHNORRSIG: yes + SCHNORRADAPTOR: yes + EXPERIMENTAL: yes + ECDSA_S2C: yes + RANGEPROOF: yes + WHITELIST: yes + GENERATOR: yes + MUSIG: yes + ECDSAADAPTOR: yes + BPPP: yes + matrix: + - env: + CC: i686-linux-gnu-gcc + - env: + CC: clang --target=i686-pc-linux-gnu -isystem /usr/i686-linux-gnu/include + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +task: + name: "arm64: macOS Ventura" + macos_instance: + image: ghcr.io/cirruslabs/macos-ventura-base:latest + # tasks with valgrind enabled take about 90 minutes + timeout_in: 120m + env: + HOMEBREW_NO_AUTO_UPDATE: 1 + HOMEBREW_NO_INSTALL_CLEANUP: 1 + # Cirrus gives us a fixed number of 4 virtual CPUs. Not that we even have that many jobs at the moment... + MAKEFLAGS: -j5 + env: + ASM: no + WITH_VALGRIND: no + CTIMETESTS: no + CC: clang + matrix: + - env: {WIDEMUL: int64, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes} + - env: {WIDEMUL: int64, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, CC: gcc} + - env: {WIDEMUL: int128_struct, ECMULTGENPRECISION: 2, ECMULTWINDOW: 4} + - env: {WIDEMUL: int128, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes} + - env: {WIDEMUL: int128, RECOVERY: yes, SCHNORRSIG: yes} + - env: {WIDEMUL: int128, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, CC: gcc} + - env: {WIDEMUL: int128, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, CPPFLAGS: -DVERIFY} + - env: {BUILD: distcheck} + brew_script: + - brew install automake libtool gcc + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + << : *CREDITS + +task: + name: "s390x (big-endian): Linux (Debian stable, QEMU)" + << : *LINUX_CONTAINER + env: + WRAPPER_CMD: qemu-s390x + SECP256K1_TEST_ITERS: 16 + HOST: s390x-linux-gnu + WITH_VALGRIND: no + ECDH: yes + RECOVERY: yes + SCHNORRSIG: yes + SCHNORRADAPTOR: yes + ELLSWIFT: yes + EXPERIMENTAL: yes + ECDSA_S2C: yes + RANGEPROOF: yes + WHITELIST: yes + GENERATOR: yes + MUSIG: yes + ECDSAADAPTOR: yes + BPPP: yes + CTIMETESTS: no + test_script: + # https://sourceware.org/bugzilla/show_bug.cgi?id=27008 + - rm /etc/ld.so.cache + - ./ci/cirrus.sh + << : *CAT_LOGS + +task: + name: "ARM32: Linux (Debian stable, QEMU)" + << : *LINUX_CONTAINER + env: + WRAPPER_CMD: qemu-arm + SECP256K1_TEST_ITERS: 16 + HOST: arm-linux-gnueabihf + WITH_VALGRIND: no + ECDH: yes + RECOVERY: yes + SCHNORRSIG: yes + ELLSWIFT: yes + CTIMETESTS: no + matrix: + - env: {} + - env: {EXPERIMENTAL: yes, ASM: arm32} + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +task: + name: "ARM64: Linux (Debian stable, QEMU)" + << : *LINUX_CONTAINER + env: + WRAPPER_CMD: qemu-aarch64 + SECP256K1_TEST_ITERS: 16 + HOST: aarch64-linux-gnu + WITH_VALGRIND: no + ECDH: yes + RECOVERY: yes + SCHNORRSIG: yes + ELLSWIFT: yes + CTIMETESTS: no + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +task: + name: "ppc64le: Linux (Debian stable, QEMU)" + << : *LINUX_CONTAINER + env: + WRAPPER_CMD: qemu-ppc64le + SECP256K1_TEST_ITERS: 16 + HOST: powerpc64le-linux-gnu + WITH_VALGRIND: no + ECDH: yes + RECOVERY: yes + SCHNORRSIG: yes + ELLSWIFT: yes + CTIMETESTS: no + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +task: + << : *LINUX_CONTAINER + env: + WRAPPER_CMD: wine + WITH_VALGRIND: no + ECDH: yes + RECOVERY: yes + SCHNORRSIG: yes + CTIMETESTS: no + matrix: + - name: "x86_64 (mingw32-w64): Windows (Debian stable, Wine)" + env: + HOST: x86_64-w64-mingw32 + - name: "i686 (mingw32-w64): Windows (Debian stable, Wine)" + env: + HOST: i686-w64-mingw32 + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +task: + << : *LINUX_CONTAINER + env: + WRAPPER_CMD: wine + WERROR_CFLAGS: -WX + WITH_VALGRIND: no + ECDH: yes + RECOVERY: yes + EXPERIMENTAL: yes + SCHNORRSIG: yes + SCHNORRADAPTOR: yes + ELLSWIFT: yes + ECDSA_S2C: yes + GENERATOR: yes + RANGEPROOF: yes + WHITELIST: yes + MUSIG: yes + ECDSAADAPTOR: yes + BPPP: yes + CTIMETESTS: no + # Use a MinGW-w64 host to tell ./configure we're building for Windows. + # This will detect some MinGW-w64 tools but then make will need only + # the MSVC tools CC, AR and NM as specified below. + HOST: x86_64-w64-mingw32 + CC: /opt/msvc/bin/x64/cl + AR: /opt/msvc/bin/x64/lib + NM: /opt/msvc/bin/x64/dumpbin -symbols -headers + # Set non-essential options that affect the CLI messages here. + # (They depend on the user's taste, so we don't want to set them automatically in configure.ac.) + CFLAGS: -nologo -diagnostics:caret + LDFLAGS: -Xlinker -Xlinker -Xlinker -nologo + matrix: + - name: "x86_64 (MSVC): Windows (Debian stable, Wine)" + - name: "x86_64 (MSVC): Windows (Debian stable, Wine, int128_struct)" + env: + WIDEMUL: int128_struct + - name: "x86_64 (MSVC): Windows (Debian stable, Wine, int128_struct with __(u)mulh)" + env: + WIDEMUL: int128_struct + CPPFLAGS: -DSECP256K1_MSVC_MULH_TEST_OVERRIDE + - name: "i686 (MSVC): Windows (Debian stable, Wine)" + env: + HOST: i686-w64-mingw32 + CC: /opt/msvc/bin/x86/cl + AR: /opt/msvc/bin/x86/lib + NM: /opt/msvc/bin/x86/dumpbin -symbols -headers + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +# Sanitizers +task: + timeout_in: 120m + << : *LINUX_CONTAINER + env: + ECDH: yes + RECOVERY: yes + SCHNORRSIG: yes + SCHNORRADAPTOR: yes + ELLSWIFT: yes + EXPERIMENTAL: yes + ECDSA_S2C: yes + RANGEPROOF: yes + WHITELIST: yes + GENERATOR: yes + MUSIG: yes + ECDSAADAPTOR: yes + BPPP: yes + CTIMETESTS: no + matrix: + - name: "Valgrind (memcheck)" + container: + cpu: 2 + env: + # The `--error-exitcode` is required to make the test fail if valgrind found errors, otherwise it'll return 0 (https://www.valgrind.org/docs/manual/manual-core.html) + WRAPPER_CMD: "valgrind --error-exitcode=42" + SECP256K1_TEST_ITERS: 2 + - name: "UBSan, ASan, LSan" + container: + memory: 2G + env: + CFLAGS: "-fsanitize=undefined,address -g" + UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=1" + ASAN_OPTIONS: "strict_string_checks=1:detect_stack_use_after_return=1:detect_leaks=1" + LSAN_OPTIONS: "use_unaligned=1" + SECP256K1_TEST_ITERS: 32 + # Try to cover many configurations with just a tiny matrix. + matrix: + - env: + ASM: auto + - env: + ASM: no + ECMULTGENPRECISION: 2 + ECMULTWINDOW: 2 + matrix: + - env: + CC: clang + - env: + HOST: i686-linux-gnu + CC: i686-linux-gnu-gcc + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +# Memory sanitizers +task: + << : *LINUX_CONTAINER + name: "MSan" + env: + ECDH: yes + RECOVERY: yes + SCHNORRSIG: yes + SCHNORRADAPTOR: yes + EXPERIMENTAL: yes + ECDSA_S2C: yes + GENERATOR: yes + RANGEPROOF: yes + WHITELIST: yes + MUSIG: yes + ECDSAADAPTOR: yes + BPPP: yes + CTIMETESTS: yes + CC: clang + SECP256K1_TEST_ITERS: 32 + ASM: no + WITH_VALGRIND: no + container: + memory: 2G + matrix: + - env: + CFLAGS: "-fsanitize=memory -g" + - env: + ECMULTGENPRECISION: 2 + ECMULTWINDOW: 2 + CFLAGS: "-fsanitize=memory -g -O3" + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +task: + name: "C++ -fpermissive (entire project)" + << : *LINUX_CONTAINER + env: + CC: g++ + CFLAGS: -fpermissive -g + CPPFLAGS: -DSECP256K1_CPLUSPLUS_TEST_OVERRIDE + WERROR_CFLAGS: + ECDH: yes + RECOVERY: yes + SCHNORRSIG: yes + ELLSWIFT: yes + test_script: + - ./ci/cirrus.sh + << : *CAT_LOGS + +task: + name: "C++ (public headers)" + << : *LINUX_CONTAINER + test_script: + - g++ -Werror include/*.h + - clang -Werror -x c++-header include/*.h + - /opt/msvc/bin/x64/cl.exe -c -WX -TP include/*.h + +task: + name: "sage prover" + << : *LINUX_CONTAINER + test_script: + - cd sage + - sage prove_group_implementations.sage + +task: + name: "x86_64: Windows (VS 2022)" + windows_container: + image: cirrusci/windowsservercore:visualstudio2022 + cpu: 4 + memory: 3840MB + env: + PATH: '%CIRRUS_WORKING_DIR%\build\src\RelWithDebInfo;%PATH%' + x64_NATIVE_TOOLS: '"C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvars64.bat"' + # Ignore MSBuild warning MSB8029. + # See: https://learn.microsoft.com/en-us/visualstudio/msbuild/errors/msb8029?view=vs-2022 + IgnoreWarnIntDirInTempDetected: 'true' + matrix: + - env: + BUILD_SHARED_LIBS: ON + - env: + BUILD_SHARED_LIBS: OFF + git_show_script: + # Print commit to allow reproducing the job outside of CI. + - git show --no-patch + configure_script: + - '%x64_NATIVE_TOOLS%' + - cmake -E env CFLAGS="/WX" cmake -A x64 -B build -DSECP256K1_ENABLE_MODULE_RECOVERY=ON -DSECP256K1_BUILD_EXAMPLES=ON -DBUILD_SHARED_LIBS=%BUILD_SHARED_LIBS% + build_script: + - '%x64_NATIVE_TOOLS%' + - cmake --build build --config RelWithDebInfo -- -property:UseMultiToolTask=true;CL_MPcount=5 + check_script: + - '%x64_NATIVE_TOOLS%' + - ctest -C RelWithDebInfo --test-dir build -j 5 + - build\src\RelWithDebInfo\bench_ecmult.exe + - build\src\RelWithDebInfo\bench_internal.exe + - build\src\RelWithDebInfo\bench.exe diff --git a/include/secp256k1_schnorr_adaptor.h b/include/secp256k1_schnorr_adaptor.h index 1f81c5b6a..a3bc568ec 100644 --- a/include/secp256k1_schnorr_adaptor.h +++ b/include/secp256k1_schnorr_adaptor.h @@ -20,7 +20,7 @@ extern "C" { * Out: nonce32: pointer to a 32-byte array to be filled by the function * In: msg32: the 32-byte message being verified (will not be NULL) * key32: pointer to a 32-byte secret key (will not be NULL) - * xonly_t32: the 32-byte serialized xonly adaptor point (will not be NULL) + * t33: the 33-byte serialized adaptor point (will not be NULL) * xonly_pk32: the 32-byte serialized xonly pubkey corresponding to key32 * (will not be NULL) * algo: pointer to an array describing the signature @@ -35,16 +35,14 @@ typedef int (*secp256k1_adaptor_nonce_function_hardened)( unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, - const unsigned char *xonly_t32, + const unsigned char *t33, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data ); -/** An implementation of the nonce generation function as defined in Bitcoin - * Improvement Proposal 340 "Schnorr Signatures for secp256k1" - * (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki). +/** A modified BIP-340 nonce generation function. * * If a data pointer is passed, it is assumed to be a pointer to 32 bytes of * auxiliary random data as defined in BIP-340. If the data pointer is NULL, diff --git a/src/modules/schnorr_adaptor/main_impl.h b/src/modules/schnorr_adaptor/main_impl.h index d4972a2f0..2bc3626e9 100644 --- a/src/modules/schnorr_adaptor/main_impl.h +++ b/src/modules/schnorr_adaptor/main_impl.h @@ -11,7 +11,7 @@ #include "../../../include/secp256k1_schnorr_adaptor.h" #include "../../hash.h" -static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *xonly_t32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) { +static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *t33, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) { secp256k1_sha256 sha; unsigned char masked_key[32]; int i; @@ -52,7 +52,7 @@ static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned /* Hash masked-key||pk||msg using the tagged hash as per the spec */ secp256k1_sha256_write(&sha, masked_key, 32); - secp256k1_sha256_write(&sha, xonly_t32, 32); + secp256k1_sha256_write(&sha, t33, 33); secp256k1_sha256_write(&sha, xonly_pk32, 32); secp256k1_sha256_write(&sha, msg32, 32); secp256k1_sha256_finalize(&sha, nonce32); @@ -100,7 +100,7 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c /* bytes_from_point(P) */ secp256k1_fe_get_b32(pk_buf, &pk.x); - ret &= !!noncefp(nonce32, msg32, seckey, &t33[1], pk_buf, bip340_algo, sizeof(bip340_algo), ndata); + ret &= !!noncefp(nonce32, msg32, seckey, t33, pk_buf, bip340_algo, sizeof(bip340_algo), ndata); /* k0 */ secp256k1_scalar_set_b32(&k, nonce32, NULL); ret &= !secp256k1_scalar_is_zero(&k); @@ -207,7 +207,6 @@ int secp256k1_schnorr_adaptor_extract_t(const secp256k1_context *ctx, unsigned c ret &= !!secp256k1_eckey_pubkey_serialize(&t, t33, &size, 1); secp256k1_memczero(t33, 33, !ret); - secp256k1_scalar_clear(&s0); return ret; } @@ -241,9 +240,11 @@ int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char ret = 0; } - memset(sig64, 0, 64); memcpy(sig64, &sig65[1], 32); secp256k1_scalar_get_b32(&sig64[32], &s); + secp256k1_memczero(sig64, 64, !ret); + secp256k1_scalar_clear(&s); + secp256k1_scalar_clear(&t); return ret; } @@ -279,6 +280,9 @@ int secp256k1_schnorr_adaptor_extract_adaptor(const secp256k1_context *ctx, unsi } secp256k1_scalar_get_b32(t32, &t); + secp256k1_memczero(t32, 32, !ret); + secp256k1_scalar_clear(&s); + secp256k1_scalar_clear(&t); return ret; } diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h index 8946e1da4..bd09ad785 100644 --- a/src/modules/schnorr_adaptor/tests_impl.h +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -27,14 +27,19 @@ void run_adaptor_nonce_function_bip340_tests(void) { size_t algolen = sizeof(algo); secp256k1_sha256 sha; secp256k1_sha256 sha_optimized; + secp256k1_scalar adaptor; + secp256k1_gej tj; + secp256k1_ge tg; unsigned char nonce[32], nonce_z[32]; unsigned char msg[32]; unsigned char key[32]; unsigned char t[32]; + unsigned char t33[33]; unsigned char pk[32]; unsigned char aux_rand[32]; unsigned char *args[6]; int i; + size_t size = 33; /* Check that hash initialized by * secp256k1_nonce_function_bip340_sha256_tagged has the expected @@ -56,10 +61,15 @@ void run_adaptor_nonce_function_bip340_tests(void) { secp256k1_testrand256(pk); secp256k1_testrand256(aux_rand); + secp256k1_scalar_set_b32(&adaptor, t, NULL); + secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor); + secp256k1_ge_set_gej(&tg, &tj); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, t33, &size, 1) == 1); + /* Check that a bitflip in an argument results in different nonces. */ args[0] = msg; args[1] = key; - args[2] = t; + args[2] = t33; args[3] = pk; args[4] = algo; args[5] = aux_rand; @@ -292,24 +302,24 @@ void test_schnorr_adaptor_vectors(void) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 }; const unsigned char sig[65] = { - 0x02, 0x06, 0x09, 0x11, 0xFD, 0x59, 0x2B, 0xB8, - 0xD2, 0x66, 0x19, 0x83, 0x80, 0xE6, 0xB2, 0x80, - 0x11, 0xEC, 0xBF, 0x46, 0x17, 0xDD, 0x12, 0xBF, - 0xBF, 0xD4, 0x25, 0xFA, 0x78, 0x66, 0xF7, 0x80, - 0xC8, 0xB6, 0x52, 0xB4, 0xB9, 0x5A, 0x20, 0xA8, - 0x10, 0x51, 0xFA, 0x05, 0x09, 0x6E, 0x72, 0xD2, - 0xDF, 0x31, 0x0A, 0x74, 0x19, 0x31, 0xF7, 0xA8, - 0xFD, 0xCF, 0x5E, 0x70, 0x0E, 0x61, 0xCF, 0x6F, 0x1F + 0x02, 0x83, 0xFF, 0x39, 0x32, 0xA1, 0xBB, 0x6F, + 0xE5, 0x21, 0x64, 0x6B, 0x38, 0x17, 0xDB, 0x86, + 0x85, 0xA6, 0x8E, 0x32, 0x6D, 0x34, 0x9A, 0x98, + 0xCF, 0x33, 0x30, 0xA5, 0xAC, 0xFE, 0xF0, 0xA5, + 0xC0, 0x76, 0x27, 0x94, 0x12, 0xED, 0x02, 0x2B, + 0xEE, 0xD2, 0xAE, 0x9A, 0xCE, 0x88, 0xA1, 0x03, + 0xA8, 0x30, 0x38, 0x9E, 0x52, 0x2D, 0x77, 0x7E, + 0xED, 0x34, 0x8E, 0x91, 0xED, 0xA3, 0xC5, 0xAB, 0x1D }; const unsigned char sig64[64] = { - 0x06, 0x09, 0x11, 0xFD, 0x59, 0x2B, 0xB8, 0xD2, - 0x66, 0x19, 0x83, 0x80, 0xE6, 0xB2, 0x80, 0x11, - 0xEC, 0xBF, 0x46, 0x17, 0xDD, 0x12, 0xBF, 0xBF, - 0xD4, 0x25, 0xFA, 0x78, 0x66, 0xF7, 0x80, 0xC8, - 0xB6, 0x52, 0xB4, 0xB9, 0x5A, 0x20, 0xA8, 0x10, - 0x51, 0xFA, 0x05, 0x09, 0x6E, 0x72, 0xD2, 0xDF, - 0x31, 0x0A, 0x74, 0x19, 0x31, 0xF7, 0xA8, 0xFD, - 0xCF, 0x5E, 0x70, 0x0E, 0x61, 0xCF, 0x6F, 0x21 + 0x83, 0xFF, 0x39, 0x32, 0xA1, 0xBB, 0x6F, 0xE5, + 0x21, 0x64, 0x6B, 0x38, 0x17, 0xDB, 0x86, 0x85, + 0xA6, 0x8E, 0x32, 0x6D, 0x34, 0x9A, 0x98, 0xCF, + 0x33, 0x30, 0xA5, 0xAC, 0xFE, 0xF0, 0xA5, 0xC0, + 0x76, 0x27, 0x94, 0x12, 0xED, 0x02, 0x2B, 0xEE, + 0xD2, 0xAE, 0x9A, 0xCE, 0x88, 0xA1, 0x03, 0xA8, + 0x30, 0x38, 0x9E, 0x52, 0x2D, 0x77, 0x7E, 0xED, + 0x34, 0x8E, 0x91, 0xED, 0xA3, 0xC5, 0xAB, 0x1F }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -355,24 +365,24 @@ void test_schnorr_adaptor_vectors(void) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04 }; const unsigned char sig[65] = { - 0x02, 0x9F, 0x08, 0xBE, 0x86, 0x5F, 0x69, 0x3B, - 0xDB, 0xC1, 0xAE, 0x97, 0x6D, 0xFF, 0xB8, 0xBC, - 0x88, 0x4C, 0x37, 0x20, 0x52, 0xB0, 0x92, 0x6E, - 0x49, 0xE0, 0x29, 0x8A, 0x9F, 0x2D, 0x7B, 0x48, - 0x60, 0xCB, 0xA2, 0xE9, 0xE5, 0x5F, 0xCC, 0x8B, - 0x22, 0xAE, 0x1D, 0xD3, 0xC4, 0x22, 0x4C, 0xDB, - 0x4F, 0x9B, 0xA2, 0x3B, 0x16, 0x33, 0xCA, 0xE6, - 0x85, 0x06, 0xC3, 0xD9, 0xF5, 0x8A, 0xF8, 0x87, 0x27 + 0x03, 0x9E, 0xCF, 0x03, 0x2D, 0x29, 0x1F, 0x27, + 0x3C, 0xFC, 0xCC, 0xAA, 0xB8, 0x00, 0xD4, 0x62, + 0x3C, 0x39, 0x96, 0xAA, 0xE7, 0xB0, 0x39, 0xF8, + 0x1F, 0x35, 0x65, 0xDF, 0x24, 0xFD, 0x41, 0x9C, + 0x6C, 0x31, 0xED, 0x83, 0x87, 0x43, 0xF4, 0x2C, + 0x8F, 0x64, 0xB9, 0x2B, 0xA9, 0xD7, 0xFE, 0x52, + 0x56, 0x08, 0xB4, 0x43, 0xC7, 0xD1, 0x83, 0xA1, + 0x42, 0xDB, 0x22, 0x24, 0x2E, 0x42, 0xB5, 0x1D, 0xDF }; const unsigned char sig64[64] = { - 0x9F, 0x08, 0xBE, 0x86, 0x5F, 0x69, 0x3B, 0xDB, - 0xC1, 0xAE, 0x97, 0x6D, 0xFF, 0xB8, 0xBC, 0x88, - 0x4C, 0x37, 0x20, 0x52, 0xB0, 0x92, 0x6E, 0x49, - 0xE0, 0x29, 0x8A, 0x9F, 0x2D, 0x7B, 0x48, 0x60, - 0xCB, 0xA2, 0xE9, 0xE5, 0x5F, 0xCC, 0x8B, 0x22, - 0xAE, 0x1D, 0xD3, 0xC4, 0x22, 0x4C, 0xDB, 0x4F, - 0x9B, 0xA2, 0x3B, 0x16, 0x33, 0xCA, 0xE6, 0x85, - 0x06, 0xC3, 0xD9, 0xF5, 0x8A, 0xF8, 0x87, 0x2B + 0x9E, 0xCF, 0x03, 0x2D, 0x29, 0x1F, 0x27, 0x3C, + 0xFC, 0xCC, 0xAA, 0xB8, 0x00, 0xD4, 0x62, 0x3C, + 0x39, 0x96, 0xAA, 0xE7, 0xB0, 0x39, 0xF8, 0x1F, + 0x35, 0x65, 0xDF, 0x24, 0xFD, 0x41, 0x9C, 0x6C, + 0x31, 0xED, 0x83, 0x87, 0x43, 0xF4, 0x2C, 0x8F, + 0x64, 0xB9, 0x2B, 0xA9, 0xD7, 0xFE, 0x52, 0x56, + 0x08, 0xB4, 0x43, 0xC7, 0xD1, 0x83, 0xA1, 0x42, + 0xDB, 0x22, 0x24, 0x2E, 0x42, 0xB5, 0x1D, 0xDB }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -406,36 +416,36 @@ void test_schnorr_adaptor_vectors(void) { 0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C }; const unsigned char t[33] = { - 0x02, 0x5C, 0xBD, 0xF0, 0x64, 0x6E, 0x5D, 0xB4, - 0xEA, 0xA3, 0x98, 0xF3, 0x65, 0xF2, 0xEA, 0x7A, - 0x0E, 0x3D, 0x41, 0x9B, 0x7E, 0x03, 0x30, 0xE3, - 0x9C, 0xE9, 0x2B, 0xDD, 0xED, 0xCA, 0xC4, 0xF9, 0xBC + 0x03, 0xFF, 0xF9, 0x7B, 0xD5, 0x75, 0x5E, 0xEE, + 0xA4, 0x20, 0x45, 0x3A, 0x14, 0x35, 0x52, 0x35, + 0xD3, 0x82, 0xF6, 0x47, 0x2F, 0x85, 0x68, 0xA1, + 0x8B, 0x2F, 0x05, 0x7A, 0x14, 0x60, 0x29, 0x75, 0x56 }; const unsigned char t32[32] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07 + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06 }; const unsigned char sig[65] = { - 0x03, 0xEE, 0x01, 0x73, 0x70, 0x80, 0xBD, 0xCC, - 0x0D, 0xB6, 0x11, 0xC3, 0x0B, 0x9D, 0x29, 0x52, - 0x24, 0x5C, 0x07, 0xEA, 0x81, 0xD2, 0x00, 0x24, - 0xB4, 0x93, 0x13, 0xE2, 0x61, 0x1C, 0x20, 0xA5, - 0xE3, 0xF4, 0xE2, 0x0A, 0x0E, 0xDA, 0xE1, 0xB0, - 0xBB, 0xC7, 0x89, 0xBC, 0x55, 0xC0, 0x4E, 0x80, - 0xE7, 0x03, 0x1C, 0xAF, 0xAE, 0x50, 0x56, 0xC8, - 0x18, 0x19, 0x90, 0xC9, 0x3D, 0x3B, 0xD3, 0x7B, 0xD7 + 0x02, 0xEF, 0x1A, 0xC9, 0x81, 0x35, 0x23, 0x9B, + 0x05, 0x7D, 0xF3, 0x00, 0xD1, 0xF4, 0x43, 0x5F, + 0x3B, 0xF3, 0xB0, 0x02, 0xAD, 0x7A, 0x37, 0xFE, + 0xFE, 0x26, 0xC7, 0x3C, 0xDC, 0xA6, 0xA4, 0x9C, + 0x77, 0x7D, 0x26, 0x76, 0xF6, 0xDA, 0x76, 0x55, + 0xE8, 0xA0, 0x86, 0x20, 0x23, 0x84, 0x13, 0x10, + 0xE4, 0x36, 0x53, 0x0C, 0x97, 0x02, 0x15, 0x25, + 0x06, 0x10, 0xD6, 0x2D, 0x49, 0x75, 0xA5, 0x18, 0x3C }; const unsigned char sig64[64] = { - 0xEE, 0x01, 0x73, 0x70, 0x80, 0xBD, 0xCC, 0x0D, - 0xB6, 0x11, 0xC3, 0x0B, 0x9D, 0x29, 0x52, 0x24, - 0x5C, 0x07, 0xEA, 0x81, 0xD2, 0x00, 0x24, 0xB4, - 0x93, 0x13, 0xE2, 0x61, 0x1C, 0x20, 0xA5, 0xE3, - 0xF4, 0xE2, 0x0A, 0x0E, 0xDA, 0xE1, 0xB0, 0xBB, - 0xC7, 0x89, 0xBC, 0x55, 0xC0, 0x4E, 0x80, 0xE7, - 0x03, 0x1C, 0xAF, 0xAE, 0x50, 0x56, 0xC8, 0x18, - 0x19, 0x90, 0xC9, 0x3D, 0x3B, 0xD3, 0x7B, 0xD0 + 0xEF, 0x1A, 0xC9, 0x81, 0x35, 0x23, 0x9B, 0x05, + 0x7D, 0xF3, 0x00, 0xD1, 0xF4, 0x43, 0x5F, 0x3B, + 0xF3, 0xB0, 0x02, 0xAD, 0x7A, 0x37, 0xFE, 0xFE, + 0x26, 0xC7, 0x3C, 0xDC, 0xA6, 0xA4, 0x9C, 0x77, + 0x7D, 0x26, 0x76, 0xF6, 0xDA, 0x76, 0x55, 0xE8, + 0xA0, 0x86, 0x20, 0x23, 0x84, 0x13, 0x10, 0xE4, + 0x36, 0x53, 0x0C, 0x97, 0x02, 0x15, 0x25, 0x06, + 0x10, 0xD6, 0x2D, 0x49, 0x75, 0xA5, 0x18, 0x42 }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -481,24 +491,24 @@ void test_schnorr_adaptor_vectors(void) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 }; const unsigned char sig[65] = { - 0x03, 0xEE, 0x14, 0xD2, 0xCA, 0x24, 0xD9, 0xD8, - 0x47, 0x47, 0xB4, 0x34, 0xE5, 0x19, 0x50, 0x4E, - 0xC9, 0xFC, 0x6A, 0xE4, 0xEE, 0xB9, 0x57, 0x81, - 0xA0, 0xAA, 0xE5, 0xF6, 0x73, 0xEC, 0x08, 0x88, - 0x37, 0xDA, 0x80, 0x25, 0x48, 0x6E, 0x62, 0x0F, - 0x86, 0x49, 0xE3, 0xB6, 0x31, 0xA1, 0x9A, 0x6E, - 0xBF, 0xE7, 0xC2, 0x73, 0xFD, 0xAC, 0xE4, 0x61, - 0x17, 0xCE, 0xB3, 0x73, 0x6C, 0x00, 0xD5, 0xA5, 0x76 + 0x02, 0x80, 0xDF, 0xE8, 0x16, 0xD1, 0x07, 0xEA, + 0x18, 0x8F, 0xE3, 0xE4, 0x2D, 0x2F, 0x1F, 0xAA, + 0xD1, 0xCD, 0x60, 0x00, 0xCF, 0xAC, 0xE6, 0x34, + 0x98, 0x74, 0xB1, 0xA9, 0x1B, 0xC4, 0x88, 0x09, + 0x29, 0x16, 0xFC, 0x02, 0x35, 0x5E, 0xDB, 0xD9, + 0x2B, 0x2F, 0x86, 0xEB, 0x99, 0xED, 0x93, 0x0D, + 0x04, 0xE4, 0xEE, 0x3A, 0xA0, 0xF2, 0x30, 0x1F, + 0x35, 0x00, 0x25, 0x00, 0x97, 0xD0, 0xB9, 0xEB, 0x1F }; const unsigned char sig64[64] = { - 0xEE, 0x14, 0xD2, 0xCA, 0x24, 0xD9, 0xD8, 0x47, - 0x47, 0xB4, 0x34, 0xE5, 0x19, 0x50, 0x4E, 0xC9, - 0xFC, 0x6A, 0xE4, 0xEE, 0xB9, 0x57, 0x81, 0xA0, - 0xAA, 0xE5, 0xF6, 0x73, 0xEC, 0x08, 0x88, 0x37, - 0xDA, 0x80, 0x25, 0x48, 0x6E, 0x62, 0x0F, 0x86, - 0x49, 0xE3, 0xB6, 0x31, 0xA1, 0x9A, 0x6E, 0xBF, - 0xE7, 0xC2, 0x73, 0xFD, 0xAC, 0xE4, 0x61, 0x17, - 0xCE, 0xB3, 0x73, 0x6C, 0x00, 0xD5, 0xA5, 0x74 + 0x80, 0xDF, 0xE8, 0x16, 0xD1, 0x07, 0xEA, 0x18, + 0x8F, 0xE3, 0xE4, 0x2D, 0x2F, 0x1F, 0xAA, 0xD1, + 0xCD, 0x60, 0x00, 0xCF, 0xAC, 0xE6, 0x34, 0x98, + 0x74, 0xB1, 0xA9, 0x1B, 0xC4, 0x88, 0x09, 0x29, + 0x16, 0xFC, 0x02, 0x35, 0x5E, 0xDB, 0xD9, 0x2B, + 0x2F, 0x86, 0xEB, 0x99, 0xED, 0x93, 0x0D, 0x04, + 0xE4, 0xEE, 0x3A, 0xA0, 0xF2, 0x30, 0x1F, 0x35, + 0x00, 0x25, 0x00, 0x97, 0xD0, 0xB9, 0xEB, 0x21 }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -544,24 +554,24 @@ void test_schnorr_adaptor_vectors(void) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07 }; const unsigned char sig[65] = { - 0x02, 0x7C, 0x03, 0x7F, 0xE8, 0xF4, 0xD6, 0x8D, - 0xFB, 0x2A, 0x0D, 0x21, 0xAB, 0x23, 0xD5, 0x9F, - 0xB4, 0xF1, 0x82, 0xC6, 0x01, 0xAB, 0x2B, 0xA1, - 0x11, 0x5C, 0x12, 0x13, 0x43, 0x01, 0x3B, 0xBA, - 0x49, 0x25, 0x60, 0x01, 0x9F, 0x96, 0x3D, 0x54, - 0x77, 0x73, 0xFF, 0x5C, 0xE1, 0xFC, 0x58, 0xF6, - 0x57, 0x76, 0x55, 0x09, 0x96, 0x26, 0x4E, 0x12, - 0xA6, 0x9E, 0x17, 0x7B, 0x43, 0x04, 0xD3, 0xCF, 0x99 + 0x03, 0x7B, 0x38, 0xAD, 0xBE, 0xC1, 0xE0, 0xF4, + 0x5C, 0xB0, 0xFF, 0xD7, 0x49, 0xA9, 0x7C, 0x9A, + 0x89, 0x02, 0xBC, 0x77, 0x3A, 0xBF, 0x4D, 0x7F, + 0xA4, 0xFE, 0xD6, 0x7A, 0x13, 0x70, 0xB8, 0xE8, + 0xC0, 0x79, 0x9D, 0x6E, 0xA0, 0x0D, 0x73, 0x7D, + 0xF9, 0x1B, 0xBD, 0x74, 0x93, 0xDE, 0x25, 0x7A, + 0xE6, 0x0C, 0x18, 0xF0, 0x3B, 0x3E, 0xBE, 0x78, + 0xCD, 0xA6, 0xE9, 0x9F, 0x08, 0x74, 0x05, 0x4F, 0xB8 }; const unsigned char sig64[64] = { - 0x7C, 0x03, 0x7F, 0xE8, 0xF4, 0xD6, 0x8D, 0xFB, - 0x2A, 0x0D, 0x21, 0xAB, 0x23, 0xD5, 0x9F, 0xB4, - 0xF1, 0x82, 0xC6, 0x01, 0xAB, 0x2B, 0xA1, 0x11, - 0x5C, 0x12, 0x13, 0x43, 0x01, 0x3B, 0xBA, 0x49, - 0x25, 0x60, 0x01, 0x9F, 0x96, 0x3D, 0x54, 0x77, - 0x73, 0xFF, 0x5C, 0xE1, 0xFC, 0x58, 0xF6, 0x57, - 0x76, 0x55, 0x09, 0x96, 0x26, 0x4E, 0x12, 0xA6, - 0x9E, 0x17, 0x7B, 0x43, 0x04, 0xD3, 0xCF, 0xA0 + 0x7B, 0x38, 0xAD, 0xBE, 0xC1, 0xE0, 0xF4, 0x5C, + 0xB0, 0xFF, 0xD7, 0x49, 0xA9, 0x7C, 0x9A, 0x89, + 0x02, 0xBC, 0x77, 0x3A, 0xBF, 0x4D, 0x7F, 0xA4, + 0xFE, 0xD6, 0x7A, 0x13, 0x70, 0xB8, 0xE8, 0xC0, + 0x79, 0x9D, 0x6E, 0xA0, 0x0D, 0x73, 0x7D, 0xF9, + 0x1B, 0xBD, 0x74, 0x93, 0xDE, 0x25, 0x7A, 0xE6, + 0x0C, 0x18, 0xF0, 0x3B, 0x3E, 0xBE, 0x78, 0xCD, + 0xA6, 0xE9, 0x9F, 0x08, 0x74, 0x05, 0x4F, 0xB1 }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -602,14 +612,14 @@ void test_schnorr_adaptor_vectors(void) { 0xB7, 0xCB, 0xA8, 0xD5, 0x69, 0xB2, 0x40, 0xEF, 0xE4 }; const unsigned char sig[65] = { - 0x02, 0xD6, 0xF0, 0x92, 0xD2, 0x38, 0xE3, 0xB2, - 0xA0, 0xB4, 0xBF, 0x3F, 0x50, 0x2E, 0x47, 0x8B, - 0xA2, 0x7C, 0x72, 0x05, 0xED, 0x4B, 0xE4, 0xEE, - 0xF0, 0xBF, 0x84, 0x36, 0xB8, 0x39, 0x33, 0x74, - 0xC9, 0xBF, 0x03, 0x4D, 0x07, 0x0F, 0x89, 0x36, - 0xEA, 0x9A, 0x2B, 0xBF, 0xA9, 0x53, 0x41, 0x65, - 0xA8, 0x9D, 0x84, 0x5B, 0x4E, 0x32, 0xFB, 0xC0, - 0x49, 0x0D, 0x13, 0xF5, 0xCE, 0xC2, 0xA9, 0x5A, 0x2D + 0x02, 0x8F, 0x3F, 0xE7, 0x3C, 0x5D, 0x2E, 0xB4, + 0xAD, 0x2E, 0xA8, 0x95, 0xC7, 0xA9, 0x65, 0xA8, + 0x0B, 0x36, 0xF2, 0x8E, 0xE4, 0x36, 0xEC, 0x69, + 0x21, 0x13, 0x68, 0x4A, 0x83, 0x28, 0x31, 0x62, + 0x00, 0xAB, 0x8E, 0x73, 0xC8, 0x44, 0x38, 0xDD, + 0xA3, 0x1A, 0xD6, 0x84, 0x01, 0x51, 0x50, 0x56, + 0x33, 0x54, 0x7F, 0xBD, 0x8C, 0x07, 0xC2, 0x53, + 0x5B, 0x58, 0xF0, 0x96, 0x1B, 0x31, 0x9C, 0x4F, 0x3C }; test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); }; @@ -635,14 +645,14 @@ void test_schnorr_adaptor_vectors(void) { 0x84, 0x74, 0xFA, 0x94, 0xAB, 0xE8, 0xC4, 0xCD, 0x13 }; const unsigned char sig[65] = { - 0x03, 0xB3, 0xAE, 0x05, 0xE9, 0x63, 0x4F, 0xBF, - 0xFA, 0x48, 0x34, 0x3F, 0xBB, 0x66, 0x05, 0xDA, - 0xDE, 0xFF, 0xF7, 0x3F, 0x87, 0x5F, 0xD2, 0x2D, - 0x27, 0xB5, 0x62, 0x4C, 0x94, 0x42, 0x85, 0x69, - 0x8B, 0x72, 0x43, 0xA5, 0xA4, 0x21, 0xA1, 0x01, - 0x99, 0x44, 0x93, 0x06, 0x25, 0x17, 0x57, 0x17, - 0x40, 0xE6, 0xFA, 0x66, 0xDD, 0x57, 0xBF, 0x27, - 0x5F, 0x22, 0x34, 0xC4, 0x8D, 0x8E, 0x5A, 0xBB, 0xBB + 0x02, 0x07, 0x21, 0x04, 0x10, 0xBE, 0x6B, 0x9F, + 0xFA, 0xEE, 0x0C, 0xA3, 0x8D, 0x36, 0x5C, 0xFA, + 0xBD, 0xBE, 0x36, 0x64, 0x01, 0x49, 0xDC, 0xDE, + 0xCB, 0xB0, 0x41, 0x0A, 0xA1, 0x47, 0x9A, 0x01, + 0x8A, 0x57, 0xEE, 0x6D, 0x4B, 0x4E, 0x00, 0x4A, + 0xF7, 0x89, 0x79, 0x5E, 0xC8, 0xBE, 0xB6, 0x18, + 0x87, 0xB3, 0x43, 0x8E, 0xD9, 0x08, 0x88, 0x19, + 0x9C, 0xA4, 0xE9, 0x61, 0x37, 0x36, 0x76, 0x1A, 0x4C }; test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); }; @@ -668,14 +678,14 @@ void test_schnorr_adaptor_vectors(void) { 0xB7, 0xCB, 0xA8, 0xD5, 0x69, 0xB2, 0x40, 0xEF, 0xE4 }; const unsigned char sig[65] = { - 0x03, 0xBC, 0x74, 0x65, 0x03, 0x0B, 0x34, 0x05, - 0x7C, 0x48, 0x2D, 0x7B, 0x6E, 0xAB, 0xB3, 0x92, - 0x0F, 0x30, 0x06, 0xCD, 0xC5, 0x87, 0x35, 0x99, - 0x73, 0xA6, 0xDA, 0x0A, 0x78, 0x31, 0x13, 0xD7, - 0xA5, 0xF7, 0xFF, 0xED, 0x94, 0x99, 0xA4, 0xA7, - 0xA3, 0x39, 0x79, 0x76, 0x7F, 0xCA, 0x6D, 0xDD, - 0x0D, 0xF7, 0xBD, 0x83, 0x5B, 0xFD, 0x3E, 0x8F, - 0x92, 0xE9, 0x1A, 0x6E, 0xA7, 0xBA, 0xAD, 0x1B, 0x1B + 0x02, 0xDE, 0x06, 0x93, 0xAC, 0x8E, 0xCE, 0xA6, + 0xB8, 0x16, 0x7E, 0x7B, 0x02, 0x33, 0x97, 0x32, + 0x89, 0xAE, 0x1C, 0xFA, 0xCD, 0xDC, 0x31, 0x6A, + 0xA5, 0x1C, 0xFB, 0x49, 0x1F, 0x22, 0xB1, 0x8B, + 0xD2, 0x44, 0x74, 0x75, 0x25, 0xEC, 0x34, 0x02, + 0x27, 0x0C, 0x2C, 0x96, 0x9B, 0xAF, 0x93, 0xB1, + 0xCF, 0x0C, 0xCB, 0x41, 0x1B, 0x06, 0x88, 0x25, + 0xEE, 0x8C, 0x70, 0xEB, 0xAE, 0xD2, 0x70, 0xE4, 0xBB }; test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); }; @@ -683,14 +693,14 @@ void test_schnorr_adaptor_vectors(void) { /* Test vector 9 */ /* Verification test */ const unsigned char sig[65] = { - 0x02, 0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, + 0x03, 0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, 0x50, 0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF, 0x21, 0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76, 0x87, 0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A, - 0x34, 0xF7, 0xFF, 0xED, 0x94, 0x99, 0xA4, 0xA7, - 0xA3, 0x39, 0x79, 0x76, 0x7F, 0xCA, 0x6D, 0xDD, - 0x0D, 0xF7, 0xBD, 0x83, 0x5B, 0xFD, 0x3E, 0x8F, - 0x92, 0xE9, 0x1A, 0x6E, 0xA7, 0xBA, 0xAD, 0x1B, 0x1B + 0x34, 0x44, 0x74, 0x75, 0x25, 0xEC, 0x34, 0x02, + 0x27, 0x0C, 0x2C, 0x96, 0x9B, 0xAF, 0x93, 0xB1, + 0xCF, 0x0C, 0xCB, 0x41, 0x1B, 0x06, 0x88, 0x25, + 0xEE, 0x8C, 0x70, 0xEB, 0xAE, 0xD2, 0x70, 0xE4, 0xBB }; secp256k1_ge r0; CHECK(!secp256k1_eckey_pubkey_parse(&r0, sig, 33)); @@ -705,24 +715,24 @@ void test_schnorr_adaptor_vectors(void) { 0x6C, 0xE2, 0x73, 0x53, 0xCE, 0xAD, 0xF5, 0x11 }; const unsigned char sig[65] = { - 0x02, 0x60, 0xB8, 0x55, 0xD2, 0x78, 0x30, 0x24, - 0x65, 0x66, 0x5A, 0x99, 0x9F, 0xF6, 0x9A, 0x7D, - 0x59, 0x7D, 0x53, 0xD7, 0x00, 0x50, 0x20, 0xA8, - 0x54, 0x1B, 0x4F, 0xE4, 0x52, 0xAF, 0x0E, 0x4B, - 0x22, 0xAC, 0xDC, 0x3E, 0xEB, 0x25, 0x00, 0x6A, - 0xC0, 0x25, 0x67, 0x70, 0x49, 0xAB, 0x43, 0x6D, - 0x73, 0x26, 0xD4, 0x8D, 0x76, 0x21, 0xE1, 0xD8, - 0x7A, 0x58, 0xCC, 0x41, 0x71, 0xAF, 0x75, 0x59, 0xBF + 0x03, 0xC8, 0x73, 0xA1, 0x86, 0xE5, 0xEF, 0xFC, + 0x79, 0x30, 0xE7, 0xFA, 0xF4, 0x3E, 0x30, 0xA6, + 0xE7, 0x33, 0x04, 0x8E, 0x56, 0x54, 0xDB, 0xFA, + 0x31, 0xDE, 0xC8, 0x61, 0x61, 0xCF, 0x82, 0xA7, + 0xDF, 0x75, 0xDF, 0x7D, 0x3D, 0x21, 0xF2, 0xAC, + 0x00, 0xCA, 0x86, 0x31, 0x91, 0xF5, 0x35, 0xF6, + 0xF7, 0x8C, 0xD8, 0xD6, 0x78, 0x69, 0x88, 0xA9, + 0xE5, 0x5E, 0x81, 0x47, 0x8C, 0x50, 0xDF, 0x56, 0x55 }; const unsigned char sig64[64] = { - 0x60, 0xB8, 0x55, 0xD2, 0x78, 0x30, 0x24, 0x65, - 0x66, 0x5A, 0x99, 0x9F, 0xF6, 0x9A, 0x7D, 0x59, - 0x7D, 0x53, 0xD7, 0x00, 0x50, 0x20, 0xA8, 0x54, - 0x1B, 0x4F, 0xE4, 0x52, 0xAF, 0x0E, 0x4B, 0x22, - 0x54, 0x7E, 0x86, 0xEC, 0x43, 0x72, 0x6E, 0x41, - 0x8E, 0x62, 0x1B, 0x60, 0x21, 0x5E, 0x11, 0xF2, - 0xC0, 0x29, 0xBB, 0x81, 0x80, 0xD8, 0x6F, 0x00, - 0x05, 0xDC, 0x56, 0x38, 0xAD, 0xED, 0x0D, 0x8F + 0xC8, 0x73, 0xA1, 0x86, 0xE5, 0xEF, 0xFC, 0x79, + 0x30, 0xE7, 0xFA, 0xF4, 0x3E, 0x30, 0xA6, 0xE7, + 0x33, 0x04, 0x8E, 0x56, 0x54, 0xDB, 0xFA, 0x31, + 0xDE, 0xC8, 0x61, 0x61, 0xCF, 0x82, 0xA7, 0xDF, + 0xCE, 0x3D, 0x35, 0x3C, 0x03, 0x80, 0xA8, 0x7F, + 0x61, 0x8B, 0x86, 0x7B, 0x7F, 0x1B, 0x52, 0x77, + 0xF3, 0x83, 0xA8, 0x6D, 0x0A, 0x92, 0x13, 0x5F, + 0xB1, 0x71, 0x32, 0xC5, 0x52, 0x67, 0xA2, 0x85 }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); @@ -737,24 +747,24 @@ void test_schnorr_adaptor_vectors(void) { 0x6B, 0x38, 0x80, 0xB5, 0xCC, 0xFB, 0x3C, 0x97 }; const unsigned char sig[65] = { - 0x03, 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, - 0xE2, 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, - 0x36, 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, - 0x5B, 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, - 0xEF, 0x0B, 0xD0, 0x43, 0x21, 0xB5, 0xD4, 0xD5, - 0xAD, 0x83, 0x9D, 0x38, 0xCC, 0xB9, 0x74, 0xAC, - 0x98, 0x7C, 0x34, 0xD4, 0x4D, 0x71, 0xCE, 0x3F, - 0x25, 0xC4, 0xB8, 0x51, 0x1F, 0x46, 0xB3, 0x61, 0x6E + 0x03, 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, + 0x05, 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, + 0xDE, 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, + 0x72, 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, + 0x1D, 0x46, 0xB1, 0xB3, 0x7F, 0x4D, 0x71, 0xC1, + 0x4A, 0x19, 0x24, 0xED, 0x1D, 0x96, 0xBA, 0x61, + 0xC9, 0x73, 0xBE, 0x90, 0xF6, 0xB9, 0x83, 0x64, + 0xD6, 0xFE, 0x12, 0x10, 0x52, 0x97, 0xD3, 0x81, 0x30 }; const unsigned char sig64[64] = { - 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, 0xE2, - 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, 0x36, - 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, 0x5B, - 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, 0xEF, - 0x11, 0x0C, 0x27, 0x03, 0xF3, 0x30, 0x16, 0x50, - 0xC2, 0xFB, 0xBB, 0xD1, 0x98, 0x35, 0x12, 0xEA, - 0xC0, 0x57, 0x19, 0x19, 0x8F, 0x6F, 0x7C, 0x33, - 0x8F, 0xE1, 0x8C, 0xB7, 0xBC, 0x87, 0xA3, 0x3C + 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, 0x05, + 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, 0xDE, + 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, 0x72, + 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, 0x1D, + 0xD6, 0x2A, 0xB6, 0xA6, 0x5B, 0x93, 0x2A, 0xB4, + 0x2D, 0x74, 0x07, 0x80, 0xBA, 0xEF, 0x5D, 0xB8, + 0x83, 0x7C, 0x39, 0x56, 0xF7, 0x02, 0xF6, 0xBE, + 0x16, 0x5A, 0x2C, 0x11, 0x3B, 0x9D, 0xC4, 0xBB }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 0); @@ -769,24 +779,24 @@ void test_schnorr_adaptor_vectors(void) { 0x6B, 0x38, 0x80, 0xB5, 0xCC, 0xFB, 0x3C, 0x97 }; const unsigned char sig[65] = { - 0x02, 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, - 0xE2, 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, - 0x36, 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, - 0x5B, 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, - 0xEF, 0xF4, 0x2F, 0xBC, 0xDE, 0x4A, 0x2B, 0x2A, - 0x52, 0x7C, 0x62, 0xC7, 0x33, 0x46, 0x8B, 0x53, - 0x66, 0x3E, 0x7A, 0x08, 0x99, 0x3D, 0x7A, 0x61, - 0x15, 0xFB, 0x1A, 0x0D, 0x6D, 0x89, 0x82, 0xDF, 0xD3 + 0x02, 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, + 0x05, 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, + 0xDE, 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, + 0x72, 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, + 0x1D, 0x46, 0xB1, 0xB3, 0x7F, 0x4D, 0x71, 0xC1, + 0x4A, 0x19, 0x24, 0xED, 0x1D, 0x96, 0xBA, 0x61, + 0xC9, 0x73, 0xBE, 0x90, 0xF6, 0xB9, 0x83, 0x64, + 0xD6, 0xFE, 0x12, 0x10, 0x52, 0x97, 0xD3, 0x81, 0x30 }; const unsigned char sig64[64] = { - 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, 0xE2, - 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, 0x36, - 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, 0x5B, - 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, 0xEF, - 0x11, 0x0C, 0x27, 0x03, 0xF3, 0x30, 0x16, 0x50, - 0xC2, 0xFB, 0xBB, 0xD1, 0x98, 0x35, 0x12, 0xEA, - 0xC0, 0x57, 0x19, 0x19, 0x8F, 0x6F, 0x7C, 0x33, - 0x8F, 0xE1, 0x8C, 0xB7, 0xBC, 0x87, 0xA3, 0x3C + 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, 0x05, + 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, 0xDE, + 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, 0x72, + 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, 0x1D, + 0xD6, 0x2A, 0xB6, 0xA6, 0x5B, 0x93, 0x2A, 0xB4, + 0x2D, 0x74, 0x07, 0x80, 0xBA, 0xEF, 0x5D, 0xB8, + 0x83, 0x7C, 0x39, 0x56, 0xF7, 0x02, 0xF6, 0xBE, + 0x16, 0x5A, 0x2C, 0x11, 0x3B, 0x9D, 0xC4, 0xBB }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 0); @@ -801,24 +811,24 @@ void test_schnorr_adaptor_vectors(void) { 0x6B, 0x38, 0x80, 0xB5, 0xCC, 0xFB, 0x3C, 0x97 }; const unsigned char sig[65] = { - 0x03, 0xAB, 0x3C, 0xD5, 0xF1, 0x24, 0xD7, 0x77, - 0xE2, 0xCE, 0x79, 0xC5, 0xC0, 0x1D, 0xED, 0xC0, - 0x36, 0x54, 0x9A, 0x2E, 0x7E, 0x8E, 0x5C, 0xA5, - 0x5B, 0x25, 0xC3, 0x0C, 0x80, 0x31, 0x5D, 0xC8, - 0xEF, 0xF4, 0x2F, 0xBC, 0xDE, 0x4A, 0x2B, 0x2A, - 0x52, 0x7C, 0x62, 0xC7, 0x33, 0x46, 0x8B, 0x53, - 0x66, 0x3E, 0x7A, 0x08, 0x99, 0x3D, 0x7A, 0x61, - 0x15, 0xFB, 0x1A, 0x0D, 0x6D, 0x89, 0x82, 0xDF, 0xD3 + 0x03, 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, + 0x05, 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, + 0xDE, 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, + 0x72, 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, + 0x1D, 0x46, 0xB1, 0xB3, 0x7F, 0x4D, 0x71, 0xC1, + 0x4A, 0x19, 0x24, 0xED, 0x1D, 0x96, 0xBA, 0x61, + 0xC9, 0x73, 0xBE, 0x90, 0xF6, 0xB9, 0x83, 0x64, + 0xD6, 0xFE, 0x12, 0x10, 0x52, 0x97, 0xD3, 0x81, 0x30 }; const unsigned char sig64[64] = { 0x9F, 0x08, 0xBE, 0x86, 0x5F, 0x69, 0x3B, 0xDB, 0xC1, 0xAE, 0x97, 0x6D, 0xFF, 0xB8, 0xBC, 0x88, 0x4C, 0x37, 0x20, 0x52, 0xB0, 0x92, 0x6E, 0x49, 0xE0, 0x29, 0x8A, 0x9F, 0x2D, 0x7B, 0x48, 0x60, - 0x11, 0x0C, 0x27, 0x03, 0xF3, 0x30, 0x16, 0x50, - 0xC2, 0xFB, 0xBB, 0xD1, 0x98, 0x35, 0x12, 0xEA, - 0xC0, 0x57, 0x19, 0x19, 0x8F, 0x6F, 0x7C, 0x33, - 0x8F, 0xE1, 0x8C, 0xB7, 0xBC, 0x87, 0xA3, 0x3C + 0xD6, 0x2A, 0xB6, 0xA6, 0x5B, 0x93, 0x2A, 0xB4, + 0x2D, 0x74, 0x07, 0x80, 0xBA, 0xEF, 0x5D, 0xB8, + 0x83, 0x7C, 0x39, 0x56, 0xF7, 0x02, 0xF6, 0xBE, + 0x16, 0x5A, 0x2C, 0x11, 0x3B, 0x9D, 0xC4, 0xBB }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); }; From ed3e2aeaa6e82585dd78633a3f35a16d3a664384 Mon Sep 17 00:00:00 2001 From: ZhePang Date: Tue, 24 Oct 2023 14:18:49 -0400 Subject: [PATCH 03/10] added new hash tags specifically for schnorr adaptor added new hash tags specifically for schnorr adaptor --- .cirrus.yml | 468 ----------------------- src/modules/schnorr_adaptor/main_impl.h | 60 ++- src/modules/schnorr_adaptor/tests_impl.h | 12 +- 3 files changed, 53 insertions(+), 487 deletions(-) delete mode 100644 .cirrus.yml diff --git a/.cirrus.yml b/.cirrus.yml deleted file mode 100644 index fd7ae2346..000000000 --- a/.cirrus.yml +++ /dev/null @@ -1,468 +0,0 @@ -env: - ### cirrus config - CIRRUS_CLONE_DEPTH: 1 - ### compiler options - HOST: - WRAPPER_CMD: - # Specific warnings can be disabled with -Wno-error=foo. - # -pedantic-errors is not equivalent to -Werror=pedantic and thus not implied by -Werror according to the GCC manual. - WERROR_CFLAGS: -Werror -pedantic-errors - MAKEFLAGS: -j4 - BUILD: check - ### secp256k1 config - ECMULTWINDOW: auto - ECMULTGENPRECISION: auto - ASM: no - WIDEMUL: auto - WITH_VALGRIND: yes - EXTRAFLAGS: - ### secp256k1 modules - EXPERIMENTAL: no - ECDH: no - RECOVERY: no - SCHNORRSIG: no - SCHNORRADAPTOR: no - ELLSWIFT: no - ECDSA_S2C: no - GENERATOR: no - RANGEPROOF: no - WHITELIST: no - MUSIG: no - ECDSAADAPTOR: no - BPPP: no - ### test options - SECP256K1_TEST_ITERS: - BENCH: yes - SECP256K1_BENCH_ITERS: 2 - CTIMETESTS: yes - # Compile and run the tests - EXAMPLES: yes - -# https://cirrus-ci.org/pricing/#compute-credits -credits_snippet: &CREDITS - # Don't use any credits for now. - use_compute_credits: false - -cat_logs_snippet: &CAT_LOGS - always: - cat_tests_log_script: - - cat tests.log || true - cat_noverify_tests_log_script: - - cat noverify_tests.log || true - cat_exhaustive_tests_log_script: - - cat exhaustive_tests.log || true - cat_ctime_tests_log_script: - - cat ctime_tests.log || true - cat_bench_log_script: - - cat bench.log || true - cat_config_log_script: - - cat config.log || true - cat_test_env_script: - - cat test_env.log || true - cat_ci_env_script: - - env - -linux_container_snippet: &LINUX_CONTAINER - container: - dockerfile: ci/linux-debian.Dockerfile - # Reduce number of CPUs to be able to do more builds in parallel. - cpu: 1 - # Gives us more CPUs for free if they're available. - greedy: true - # More than enough for our scripts. - memory: 2G - -task: - name: "x86_64: Linux (Debian stable)" - << : *LINUX_CONTAINER - matrix: - - env: {WIDEMUL: int64, RECOVERY: yes} - - env: {WIDEMUL: int64, ECDH: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, ELLSWIFT: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes} - - env: {WIDEMUL: int128} - - env: {WIDEMUL: int128_struct} - - env: {WIDEMUL: int128, RECOVERY: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, ELLSWIFT: yes} - - env: {WIDEMUL: int128, ECDH: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes} - - env: {WIDEMUL: int128, ASM: x86_64 , ELLSWIFT: yes} - - env: { RECOVERY: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes} - - env: {CTIMETESTS: no, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, SCHNORRADAPTOR: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes, CPPFLAGS: -DVERIFY} - - env: {BUILD: distcheck, WITH_VALGRIND: no, CTIMETESTS: no, BENCH: no} - - env: {CPPFLAGS: -DDETERMINISTIC} - - env: {CFLAGS: -O0, CTIMETESTS: no} - - env: {CFLAGS: -O1, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes} - - env: { ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 } - - env: { ECMULTGENPRECISION: 8, ECMULTWINDOW: 4 } - matrix: - - env: - CC: gcc - - env: - CC: clang - - env: - CC: gcc-snapshot - - env: - CC: clang-snapshot - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -task: - name: "i686: Linux (Debian stable)" - << : *LINUX_CONTAINER - env: - HOST: i686-linux-gnu - ECDH: yes - RECOVERY: yes - SCHNORRSIG: yes - SCHNORRADAPTOR: yes - EXPERIMENTAL: yes - ECDSA_S2C: yes - RANGEPROOF: yes - WHITELIST: yes - GENERATOR: yes - MUSIG: yes - ECDSAADAPTOR: yes - BPPP: yes - matrix: - - env: - CC: i686-linux-gnu-gcc - - env: - CC: clang --target=i686-pc-linux-gnu -isystem /usr/i686-linux-gnu/include - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -task: - name: "arm64: macOS Ventura" - macos_instance: - image: ghcr.io/cirruslabs/macos-ventura-base:latest - # tasks with valgrind enabled take about 90 minutes - timeout_in: 120m - env: - HOMEBREW_NO_AUTO_UPDATE: 1 - HOMEBREW_NO_INSTALL_CLEANUP: 1 - # Cirrus gives us a fixed number of 4 virtual CPUs. Not that we even have that many jobs at the moment... - MAKEFLAGS: -j5 - env: - ASM: no - WITH_VALGRIND: no - CTIMETESTS: no - CC: clang - matrix: - - env: {WIDEMUL: int64, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes} - - env: {WIDEMUL: int64, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, CC: gcc} - - env: {WIDEMUL: int128_struct, ECMULTGENPRECISION: 2, ECMULTWINDOW: 4} - - env: {WIDEMUL: int128, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes} - - env: {WIDEMUL: int128, RECOVERY: yes, SCHNORRSIG: yes} - - env: {WIDEMUL: int128, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, CC: gcc} - - env: {WIDEMUL: int128, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, CPPFLAGS: -DVERIFY} - - env: {BUILD: distcheck} - brew_script: - - brew install automake libtool gcc - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - << : *CREDITS - -task: - name: "s390x (big-endian): Linux (Debian stable, QEMU)" - << : *LINUX_CONTAINER - env: - WRAPPER_CMD: qemu-s390x - SECP256K1_TEST_ITERS: 16 - HOST: s390x-linux-gnu - WITH_VALGRIND: no - ECDH: yes - RECOVERY: yes - SCHNORRSIG: yes - SCHNORRADAPTOR: yes - ELLSWIFT: yes - EXPERIMENTAL: yes - ECDSA_S2C: yes - RANGEPROOF: yes - WHITELIST: yes - GENERATOR: yes - MUSIG: yes - ECDSAADAPTOR: yes - BPPP: yes - CTIMETESTS: no - test_script: - # https://sourceware.org/bugzilla/show_bug.cgi?id=27008 - - rm /etc/ld.so.cache - - ./ci/cirrus.sh - << : *CAT_LOGS - -task: - name: "ARM32: Linux (Debian stable, QEMU)" - << : *LINUX_CONTAINER - env: - WRAPPER_CMD: qemu-arm - SECP256K1_TEST_ITERS: 16 - HOST: arm-linux-gnueabihf - WITH_VALGRIND: no - ECDH: yes - RECOVERY: yes - SCHNORRSIG: yes - ELLSWIFT: yes - CTIMETESTS: no - matrix: - - env: {} - - env: {EXPERIMENTAL: yes, ASM: arm32} - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -task: - name: "ARM64: Linux (Debian stable, QEMU)" - << : *LINUX_CONTAINER - env: - WRAPPER_CMD: qemu-aarch64 - SECP256K1_TEST_ITERS: 16 - HOST: aarch64-linux-gnu - WITH_VALGRIND: no - ECDH: yes - RECOVERY: yes - SCHNORRSIG: yes - ELLSWIFT: yes - CTIMETESTS: no - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -task: - name: "ppc64le: Linux (Debian stable, QEMU)" - << : *LINUX_CONTAINER - env: - WRAPPER_CMD: qemu-ppc64le - SECP256K1_TEST_ITERS: 16 - HOST: powerpc64le-linux-gnu - WITH_VALGRIND: no - ECDH: yes - RECOVERY: yes - SCHNORRSIG: yes - ELLSWIFT: yes - CTIMETESTS: no - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -task: - << : *LINUX_CONTAINER - env: - WRAPPER_CMD: wine - WITH_VALGRIND: no - ECDH: yes - RECOVERY: yes - SCHNORRSIG: yes - CTIMETESTS: no - matrix: - - name: "x86_64 (mingw32-w64): Windows (Debian stable, Wine)" - env: - HOST: x86_64-w64-mingw32 - - name: "i686 (mingw32-w64): Windows (Debian stable, Wine)" - env: - HOST: i686-w64-mingw32 - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -task: - << : *LINUX_CONTAINER - env: - WRAPPER_CMD: wine - WERROR_CFLAGS: -WX - WITH_VALGRIND: no - ECDH: yes - RECOVERY: yes - EXPERIMENTAL: yes - SCHNORRSIG: yes - SCHNORRADAPTOR: yes - ELLSWIFT: yes - ECDSA_S2C: yes - GENERATOR: yes - RANGEPROOF: yes - WHITELIST: yes - MUSIG: yes - ECDSAADAPTOR: yes - BPPP: yes - CTIMETESTS: no - # Use a MinGW-w64 host to tell ./configure we're building for Windows. - # This will detect some MinGW-w64 tools but then make will need only - # the MSVC tools CC, AR and NM as specified below. - HOST: x86_64-w64-mingw32 - CC: /opt/msvc/bin/x64/cl - AR: /opt/msvc/bin/x64/lib - NM: /opt/msvc/bin/x64/dumpbin -symbols -headers - # Set non-essential options that affect the CLI messages here. - # (They depend on the user's taste, so we don't want to set them automatically in configure.ac.) - CFLAGS: -nologo -diagnostics:caret - LDFLAGS: -Xlinker -Xlinker -Xlinker -nologo - matrix: - - name: "x86_64 (MSVC): Windows (Debian stable, Wine)" - - name: "x86_64 (MSVC): Windows (Debian stable, Wine, int128_struct)" - env: - WIDEMUL: int128_struct - - name: "x86_64 (MSVC): Windows (Debian stable, Wine, int128_struct with __(u)mulh)" - env: - WIDEMUL: int128_struct - CPPFLAGS: -DSECP256K1_MSVC_MULH_TEST_OVERRIDE - - name: "i686 (MSVC): Windows (Debian stable, Wine)" - env: - HOST: i686-w64-mingw32 - CC: /opt/msvc/bin/x86/cl - AR: /opt/msvc/bin/x86/lib - NM: /opt/msvc/bin/x86/dumpbin -symbols -headers - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -# Sanitizers -task: - timeout_in: 120m - << : *LINUX_CONTAINER - env: - ECDH: yes - RECOVERY: yes - SCHNORRSIG: yes - SCHNORRADAPTOR: yes - ELLSWIFT: yes - EXPERIMENTAL: yes - ECDSA_S2C: yes - RANGEPROOF: yes - WHITELIST: yes - GENERATOR: yes - MUSIG: yes - ECDSAADAPTOR: yes - BPPP: yes - CTIMETESTS: no - matrix: - - name: "Valgrind (memcheck)" - container: - cpu: 2 - env: - # The `--error-exitcode` is required to make the test fail if valgrind found errors, otherwise it'll return 0 (https://www.valgrind.org/docs/manual/manual-core.html) - WRAPPER_CMD: "valgrind --error-exitcode=42" - SECP256K1_TEST_ITERS: 2 - - name: "UBSan, ASan, LSan" - container: - memory: 2G - env: - CFLAGS: "-fsanitize=undefined,address -g" - UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=1" - ASAN_OPTIONS: "strict_string_checks=1:detect_stack_use_after_return=1:detect_leaks=1" - LSAN_OPTIONS: "use_unaligned=1" - SECP256K1_TEST_ITERS: 32 - # Try to cover many configurations with just a tiny matrix. - matrix: - - env: - ASM: auto - - env: - ASM: no - ECMULTGENPRECISION: 2 - ECMULTWINDOW: 2 - matrix: - - env: - CC: clang - - env: - HOST: i686-linux-gnu - CC: i686-linux-gnu-gcc - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -# Memory sanitizers -task: - << : *LINUX_CONTAINER - name: "MSan" - env: - ECDH: yes - RECOVERY: yes - SCHNORRSIG: yes - SCHNORRADAPTOR: yes - EXPERIMENTAL: yes - ECDSA_S2C: yes - GENERATOR: yes - RANGEPROOF: yes - WHITELIST: yes - MUSIG: yes - ECDSAADAPTOR: yes - BPPP: yes - CTIMETESTS: yes - CC: clang - SECP256K1_TEST_ITERS: 32 - ASM: no - WITH_VALGRIND: no - container: - memory: 2G - matrix: - - env: - CFLAGS: "-fsanitize=memory -g" - - env: - ECMULTGENPRECISION: 2 - ECMULTWINDOW: 2 - CFLAGS: "-fsanitize=memory -g -O3" - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -task: - name: "C++ -fpermissive (entire project)" - << : *LINUX_CONTAINER - env: - CC: g++ - CFLAGS: -fpermissive -g - CPPFLAGS: -DSECP256K1_CPLUSPLUS_TEST_OVERRIDE - WERROR_CFLAGS: - ECDH: yes - RECOVERY: yes - SCHNORRSIG: yes - ELLSWIFT: yes - test_script: - - ./ci/cirrus.sh - << : *CAT_LOGS - -task: - name: "C++ (public headers)" - << : *LINUX_CONTAINER - test_script: - - g++ -Werror include/*.h - - clang -Werror -x c++-header include/*.h - - /opt/msvc/bin/x64/cl.exe -c -WX -TP include/*.h - -task: - name: "sage prover" - << : *LINUX_CONTAINER - test_script: - - cd sage - - sage prove_group_implementations.sage - -task: - name: "x86_64: Windows (VS 2022)" - windows_container: - image: cirrusci/windowsservercore:visualstudio2022 - cpu: 4 - memory: 3840MB - env: - PATH: '%CIRRUS_WORKING_DIR%\build\src\RelWithDebInfo;%PATH%' - x64_NATIVE_TOOLS: '"C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvars64.bat"' - # Ignore MSBuild warning MSB8029. - # See: https://learn.microsoft.com/en-us/visualstudio/msbuild/errors/msb8029?view=vs-2022 - IgnoreWarnIntDirInTempDetected: 'true' - matrix: - - env: - BUILD_SHARED_LIBS: ON - - env: - BUILD_SHARED_LIBS: OFF - git_show_script: - # Print commit to allow reproducing the job outside of CI. - - git show --no-patch - configure_script: - - '%x64_NATIVE_TOOLS%' - - cmake -E env CFLAGS="/WX" cmake -A x64 -B build -DSECP256K1_ENABLE_MODULE_RECOVERY=ON -DSECP256K1_BUILD_EXAMPLES=ON -DBUILD_SHARED_LIBS=%BUILD_SHARED_LIBS% - build_script: - - '%x64_NATIVE_TOOLS%' - - cmake --build build --config RelWithDebInfo -- -property:UseMultiToolTask=true;CL_MPcount=5 - check_script: - - '%x64_NATIVE_TOOLS%' - - ctest -C RelWithDebInfo --test-dir build -j 5 - - build\src\RelWithDebInfo\bench_ecmult.exe - - build\src\RelWithDebInfo\bench_internal.exe - - build\src\RelWithDebInfo\bench.exe diff --git a/src/modules/schnorr_adaptor/main_impl.h b/src/modules/schnorr_adaptor/main_impl.h index 2bc3626e9..a1d1f713a 100644 --- a/src/modules/schnorr_adaptor/main_impl.h +++ b/src/modules/schnorr_adaptor/main_impl.h @@ -11,6 +11,42 @@ #include "../../../include/secp256k1_schnorr_adaptor.h" #include "../../hash.h" +/* Initializes SHA256 with fixed midstate. This midstate was computed by applying + * SHA256 to SHA256("SchnorrAdaptor/nonce")||SHA256("SchnorrAdaptor/nonce"). */ +static void secp256k1_adaptor_nonce_function_bip340_sha256_tagged(secp256k1_sha256 *sha) { + secp256k1_sha256_initialize(sha); + sha->s[0] = 0xe268ac2aul; + sha->s[1] = 0x3a221b84ul; + sha->s[2] = 0x69612afdul; + sha->s[3] = 0x92ce3040ul; + sha->s[4] = 0xc83ca35ful; + sha->s[5] = 0xec2ee152ul; + sha->s[6] = 0xba136ab7ul; + sha->s[7] = 0x3bf6ec7ful; + + sha->bytes = 64; +} + +/* Initializes SHA256 with fixed midstate. This midstate was computed by applying + * SHA256 to SHA256("SchnorrAdaptor/aux")||SHA256("SchnorrAdaptor/aux"). */ +static void secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(secp256k1_sha256 *sha) { + secp256k1_sha256_initialize(sha); + sha->s[0] = 0x60c4ec6dul; + sha->s[1] = 0x2fc91363ul; + sha->s[2] = 0xce54f4a5ul; + sha->s[3] = 0x962e1565ul; + sha->s[4] = 0x2b5da649ul; + sha->s[5] = 0x6ba94748ul; + sha->s[6] = 0x456c70adul; + sha->s[7] = 0x842cbaddul; + + sha->bytes = 64; +} + +/* algo argument for adaptor_nonce_function_bip340 to derive the nonce of Schnorr adaptor signature + * by using the correct tagged hash function. */ +static const unsigned char adaptor_bip340_algo[20] = "SchnorrAdaptor/nonce"; + static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *t33, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) { secp256k1_sha256 sha; unsigned char masked_key[32]; @@ -21,19 +57,19 @@ static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned } if (data != NULL) { - secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha); + secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(&sha); secp256k1_sha256_write(&sha, data, 32); secp256k1_sha256_finalize(&sha, masked_key); for (i = 0; i < 32; i++) { masked_key[i] ^= key32[i]; } } else { - /* Precomputed TaggedHash("BIP0340/aux", 0x0000...00); */ + /* Precomputed TaggedHash("SchnorrAdaptor/aux", 0x0000...00); */ static const unsigned char ZERO_MASK[32] = { - 84, 241, 105, 207, 201, 226, 229, 114, - 116, 128, 68, 31, 144, 186, 37, 196, - 136, 244, 97, 199, 11, 94, 165, 220, - 170, 247, 175, 105, 39, 10, 165, 20 + 65, 206, 231, 5, 44, 99, 30, 162, + 119, 101, 143, 108, 176, 134, 217, 23, + 54, 150, 157, 221, 198, 161, 164, 85, + 235, 82, 28, 56, 164, 220, 113, 53 }; for (i = 0; i < 32; i++) { masked_key[i] = key32[i] ^ ZERO_MASK[i]; @@ -43,9 +79,9 @@ static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned /* Tag the hash with algo which is important to avoid nonce reuse across * algorithms. If this nonce function is used in BIP-340 signing as defined * in the spec, an optimized tagging implementation is used. */ - if (algolen == sizeof(bip340_algo) - && secp256k1_memcmp_var(algo, bip340_algo, algolen) == 0) { - secp256k1_nonce_function_bip340_sha256_tagged(&sha); + if (algolen == sizeof(adaptor_bip340_algo) + && secp256k1_memcmp_var(algo, adaptor_bip340_algo, algolen) == 0) { + secp256k1_adaptor_nonce_function_bip340_sha256_tagged(&sha); } else { secp256k1_sha256_initialize_tagged(&sha, algo, algolen); } @@ -221,6 +257,7 @@ int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char VERIFY_CHECK(ctx != NULL); ARG_CHECK(sig64 != NULL); ARG_CHECK(sig65 != NULL); + ARG_CHECK(sig65[0] == SECP256K1_TAG_PUBKEY_EVEN || sig65[0] == SECP256K1_TAG_PUBKEY_ODD); ARG_CHECK(t32 != NULL); /* s0 */ @@ -236,8 +273,6 @@ int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char } else if (sig65[0] == SECP256K1_TAG_PUBKEY_ODD) { secp256k1_scalar_negate(&t, &t); secp256k1_scalar_add(&s, &s0, &t); - } else { - ret = 0; } memcpy(sig64, &sig65[1], 32); @@ -259,6 +294,7 @@ int secp256k1_schnorr_adaptor_extract_adaptor(const secp256k1_context *ctx, unsi VERIFY_CHECK(ctx != NULL); ARG_CHECK(t32 != NULL); ARG_CHECK(sig65 != NULL); + ARG_CHECK(sig65[0] == SECP256K1_TAG_PUBKEY_EVEN || sig65[0] == SECP256K1_TAG_PUBKEY_ODD); ARG_CHECK(sig64 != NULL); /* s0 */ @@ -275,8 +311,6 @@ int secp256k1_schnorr_adaptor_extract_adaptor(const secp256k1_context *ctx, unsi } else if (sig65[0] == SECP256K1_TAG_PUBKEY_ODD) { secp256k1_scalar_negate(&s, &s); secp256k1_scalar_add(&t, &s0, &s); - } else { - ret = 0; } secp256k1_scalar_get_b32(t32, &t); diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h index bd09ad785..d98c5debf 100644 --- a/src/modules/schnorr_adaptor/tests_impl.h +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -21,9 +21,9 @@ void adaptor_nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, } void run_adaptor_nonce_function_bip340_tests(void) { - unsigned char tag[13] = "BIP0340/nonce"; - unsigned char aux_tag[11] = "BIP0340/aux"; - unsigned char algo[13] = "BIP0340/nonce"; + unsigned char tag[20] = "SchnorrAdaptor/nonce"; + unsigned char aux_tag[18] = "SchnorrAdaptor/aux"; + unsigned char algo[20] = "SchnorrAdaptor/nonce"; size_t algolen = sizeof(algo); secp256k1_sha256 sha; secp256k1_sha256 sha_optimized; @@ -45,14 +45,14 @@ void run_adaptor_nonce_function_bip340_tests(void) { * secp256k1_nonce_function_bip340_sha256_tagged has the expected * state. */ secp256k1_sha256_initialize_tagged(&sha, tag, sizeof(tag)); - secp256k1_nonce_function_bip340_sha256_tagged(&sha_optimized); + secp256k1_adaptor_nonce_function_bip340_sha256_tagged(&sha_optimized); test_sha256_eq(&sha, &sha_optimized); /* Check that hash initialized by * secp256k1_nonce_function_bip340_sha256_tagged_aux has the expected * state. */ secp256k1_sha256_initialize_tagged(&sha, aux_tag, sizeof(aux_tag)); - secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha_optimized); + secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(&sha_optimized); test_sha256_eq(&sha, &sha_optimized); secp256k1_testrand256(msg); @@ -78,7 +78,7 @@ void run_adaptor_nonce_function_bip340_tests(void) { adaptor_nonce_function_bip340_bitflip(args, 1, 32, algolen); adaptor_nonce_function_bip340_bitflip(args, 2, 32, algolen); adaptor_nonce_function_bip340_bitflip(args, 3, 32, algolen); - /* Flip algo special case "BIP0340/nonce" */ + /* Flip algo special case "SchnorrAdaptor/nonce" */ adaptor_nonce_function_bip340_bitflip(args, 4, algolen, algolen); /* Flip algo again */ adaptor_nonce_function_bip340_bitflip(args, 4, algolen, algolen); From 9735b053ffbca7b32245d12498d0c11c3293bb31 Mon Sep 17 00:00:00 2001 From: ZhePang Date: Tue, 24 Oct 2023 15:15:23 -0400 Subject: [PATCH 04/10] update the test to follow the new practice --- src/modules/schnorr_adaptor/tests_impl.h | 71 +++++++----------------- 1 file changed, 19 insertions(+), 52 deletions(-) diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h index d98c5debf..6f8fe652f 100644 --- a/src/modules/schnorr_adaptor/tests_impl.h +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -132,12 +132,6 @@ void test_schnorr_adaptor_api(void) { unsigned char adaptor[32]; /** setup **/ - int ecount; - - secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount); - secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount); - secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount); - secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount); secp256k1_testrand256(sk1); secp256k1_testrand256(sk2); @@ -155,60 +149,33 @@ void test_schnorr_adaptor_api(void) { /** main test body **/ ecount = 0; CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], t, NULL) == 1); - CHECK(ecount == 0); - CHECK(secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL) == 0); - CHECK(ecount == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, NULL, msg, &keypairs[0], t, NULL) == 0); - CHECK(ecount == 2); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, NULL, &keypairs[0], t, NULL) == 0); - CHECK(ecount == 3); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, NULL, t, NULL) == 0); - CHECK(ecount == 4); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], NULL, NULL) == 0); - CHECK(ecount == 5); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &invalid_keypair, t, NULL) == 0); - CHECK(ecount == 6); - CHECK(secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL) == 0); - CHECK(ecount == 7); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, NULL, msg, &keypairs[0], t, NULL)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, sig, NULL, &keypairs[0], t, NULL)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, NULL, t, NULL)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], NULL, NULL)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &invalid_keypair, t, NULL)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL)); - ecount = 0; CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], t, NULL) == 1); CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &pk[0]) == 1); - CHECK(ecount == 0); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, NULL, sig, msg, &pk[0]) == 0); - CHECK(ecount == 1); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, NULL, msg, &pk[0]) == 0); - CHECK(ecount == 2); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, NULL, &pk[0]) == 0); - CHECK(ecount == 3); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, NULL) == 0); - CHECK(ecount == 4); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &zero_pk) == 0); - CHECK(ecount == 5); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, NULL, sig, msg, &pk[0])); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, t2, NULL, msg, &pk[0])); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, NULL, &pk[0]); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, NULL)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &zero_pk)); - ecount = 0; CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); - CHECK(ecount == 0); - CHECK(secp256k1_schnorr_adaptor_adapt(CTX, NULL, sig, t32) == 0); - CHECK(ecount == 1); - CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, NULL, t32) == 0); - CHECK(ecount == 2); - CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, NULL) == 0); - CHECK(ecount == 3); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_adapt(CTX, NULL, sig, t32)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_adapt(CTX, sig64, NULL, t32)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, NULL)); - ecount = 0; CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, sig64) == 1); - CHECK(ecount == 0); - CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, NULL, sig, sig64) == 0); - CHECK(ecount == 1); - CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, NULL, sig64) == 0); - CHECK(ecount == 2); - CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, NULL) == 0); - CHECK(ecount == 3); - - secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL); - secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_adaptor(CTX, NULL, sig, sig64)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, NULL, sig64)); + CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, NULL)); + } /* Helper function for schnorr_adaptor_vectors From 8c9e169b56cbab9a1d2a644405b3ef55b9f05f1b Mon Sep 17 00:00:00 2001 From: ZhePang Date: Tue, 7 Nov 2023 09:08:17 -0500 Subject: [PATCH 05/10] updated test vectors --- src/modules/schnorr_adaptor/tests_impl.h | 379 +++++++++++------------ 1 file changed, 189 insertions(+), 190 deletions(-) diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h index 6f8fe652f..7e4a77d5a 100644 --- a/src/modules/schnorr_adaptor/tests_impl.h +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -42,14 +42,14 @@ void run_adaptor_nonce_function_bip340_tests(void) { size_t size = 33; /* Check that hash initialized by - * secp256k1_nonce_function_bip340_sha256_tagged has the expected + * secp256k1_adaptor_nonce_function_bip340_sha256_tagged has the expected * state. */ secp256k1_sha256_initialize_tagged(&sha, tag, sizeof(tag)); secp256k1_adaptor_nonce_function_bip340_sha256_tagged(&sha_optimized); test_sha256_eq(&sha, &sha_optimized); /* Check that hash initialized by - * secp256k1_nonce_function_bip340_sha256_tagged_aux has the expected + * secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux has the expected * state. */ secp256k1_sha256_initialize_tagged(&sha, aux_tag, sizeof(aux_tag)); secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(&sha_optimized); @@ -147,34 +147,33 @@ void test_schnorr_adaptor_api(void) { memset(&zero_pk, 0, sizeof(zero_pk)); /** main test body **/ - ecount = 0; CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], t, NULL) == 1); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, NULL, msg, &keypairs[0], t, NULL)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, sig, NULL, &keypairs[0], t, NULL)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, NULL, t, NULL)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], NULL, NULL)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &invalid_keypair, t, NULL)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL)); + CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, NULL, msg, &keypairs[0], t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, NULL, &keypairs[0], t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, NULL, t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], NULL, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &invalid_keypair, t, NULL)); + CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL)); CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], t, NULL) == 1); CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &pk[0]) == 1); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, NULL, sig, msg, &pk[0])); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, t2, NULL, msg, &pk[0])); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, NULL, &pk[0]); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, NULL)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &zero_pk)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, NULL, sig, msg, &pk[0])); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, t2, NULL, msg, &pk[0])); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, NULL, &pk[0])); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &zero_pk)); CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_adapt(CTX, NULL, sig, t32)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_adapt(CTX, sig64, NULL, t32)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, NULL, sig, t32)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, sig64, NULL, t32)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, NULL)); CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, sig64) == 1); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_adaptor(CTX, NULL, sig, sig64)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, NULL, sig64)); - CHECK_ILLEGAL(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_adaptor(CTX, NULL, sig, sig64)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, NULL, sig64)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, NULL)); } @@ -269,24 +268,24 @@ void test_schnorr_adaptor_vectors(void) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 }; const unsigned char sig[65] = { - 0x02, 0x83, 0xFF, 0x39, 0x32, 0xA1, 0xBB, 0x6F, - 0xE5, 0x21, 0x64, 0x6B, 0x38, 0x17, 0xDB, 0x86, - 0x85, 0xA6, 0x8E, 0x32, 0x6D, 0x34, 0x9A, 0x98, - 0xCF, 0x33, 0x30, 0xA5, 0xAC, 0xFE, 0xF0, 0xA5, - 0xC0, 0x76, 0x27, 0x94, 0x12, 0xED, 0x02, 0x2B, - 0xEE, 0xD2, 0xAE, 0x9A, 0xCE, 0x88, 0xA1, 0x03, - 0xA8, 0x30, 0x38, 0x9E, 0x52, 0x2D, 0x77, 0x7E, - 0xED, 0x34, 0x8E, 0x91, 0xED, 0xA3, 0xC5, 0xAB, 0x1D + 0x03, 0x61, 0x79, 0xDB, 0xF3, 0xE1, 0x32, 0x07, + 0x85, 0x3F, 0x88, 0x0C, 0x7A, 0x7A, 0x85, 0xEC, + 0x67, 0x8B, 0xAD, 0x64, 0xB8, 0x97, 0xF1, 0x08, + 0xD4, 0x76, 0x43, 0x8A, 0xC4, 0xA9, 0x32, 0xEE, + 0x94, 0x97, 0xCC, 0x73, 0xB8, 0xC3, 0x51, 0xF1, + 0x89, 0xB9, 0xD4, 0xFD, 0xE8, 0x93, 0xE3, 0x82, + 0x0D, 0x4B, 0xFF, 0x7F, 0x49, 0xD4, 0xBE, 0x1F, + 0x8B, 0x02, 0xCB, 0x80, 0x8C, 0xD3, 0x19, 0x23, 0xA0 }; const unsigned char sig64[64] = { - 0x83, 0xFF, 0x39, 0x32, 0xA1, 0xBB, 0x6F, 0xE5, - 0x21, 0x64, 0x6B, 0x38, 0x17, 0xDB, 0x86, 0x85, - 0xA6, 0x8E, 0x32, 0x6D, 0x34, 0x9A, 0x98, 0xCF, - 0x33, 0x30, 0xA5, 0xAC, 0xFE, 0xF0, 0xA5, 0xC0, - 0x76, 0x27, 0x94, 0x12, 0xED, 0x02, 0x2B, 0xEE, - 0xD2, 0xAE, 0x9A, 0xCE, 0x88, 0xA1, 0x03, 0xA8, - 0x30, 0x38, 0x9E, 0x52, 0x2D, 0x77, 0x7E, 0xED, - 0x34, 0x8E, 0x91, 0xED, 0xA3, 0xC5, 0xAB, 0x1F + 0x61, 0x79, 0xDB, 0xF3, 0xE1, 0x32, 0x07, 0x85, + 0x3F, 0x88, 0x0C, 0x7A, 0x7A, 0x85, 0xEC, 0x67, + 0x8B, 0xAD, 0x64, 0xB8, 0x97, 0xF1, 0x08, 0xD4, + 0x76, 0x43, 0x8A, 0xC4, 0xA9, 0x32, 0xEE, 0x94, + 0x97, 0xCC, 0x73, 0xB8, 0xC3, 0x51, 0xF1, 0x89, + 0xB9, 0xD4, 0xFD, 0xE8, 0x93, 0xE3, 0x82, 0x0D, + 0x4B, 0xFF, 0x7F, 0x49, 0xD4, 0xBE, 0x1F, 0x8B, + 0x02, 0xCB, 0x80, 0x8C, 0xD3, 0x19, 0x23, 0x9E }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -332,24 +331,24 @@ void test_schnorr_adaptor_vectors(void) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04 }; const unsigned char sig[65] = { - 0x03, 0x9E, 0xCF, 0x03, 0x2D, 0x29, 0x1F, 0x27, - 0x3C, 0xFC, 0xCC, 0xAA, 0xB8, 0x00, 0xD4, 0x62, - 0x3C, 0x39, 0x96, 0xAA, 0xE7, 0xB0, 0x39, 0xF8, - 0x1F, 0x35, 0x65, 0xDF, 0x24, 0xFD, 0x41, 0x9C, - 0x6C, 0x31, 0xED, 0x83, 0x87, 0x43, 0xF4, 0x2C, - 0x8F, 0x64, 0xB9, 0x2B, 0xA9, 0xD7, 0xFE, 0x52, - 0x56, 0x08, 0xB4, 0x43, 0xC7, 0xD1, 0x83, 0xA1, - 0x42, 0xDB, 0x22, 0x24, 0x2E, 0x42, 0xB5, 0x1D, 0xDF + 0x02, 0x42, 0x48, 0xD2, 0xD5, 0xD2, 0xF0, 0x31, + 0xA1, 0x88, 0xD0, 0x3F, 0x1D, 0x54, 0x3F, 0x6D, + 0x73, 0x74, 0x5E, 0xB8, 0xEF, 0x20, 0x5F, 0x20, + 0xC5, 0x23, 0x4C, 0x15, 0xD0, 0x21, 0x3A, 0xD9, + 0x5E, 0xC9, 0x63, 0x5F, 0x29, 0xE7, 0x81, 0x32, + 0xEF, 0x2A, 0xA6, 0xD2, 0xFC, 0x8B, 0x4E, 0x6F, + 0x67, 0x3A, 0x2F, 0x6D, 0x52, 0x85, 0xD3, 0x31, + 0xE7, 0x99, 0x4C, 0x23, 0x24, 0xB0, 0x9C, 0xEB, 0x1D }; const unsigned char sig64[64] = { - 0x9E, 0xCF, 0x03, 0x2D, 0x29, 0x1F, 0x27, 0x3C, - 0xFC, 0xCC, 0xAA, 0xB8, 0x00, 0xD4, 0x62, 0x3C, - 0x39, 0x96, 0xAA, 0xE7, 0xB0, 0x39, 0xF8, 0x1F, - 0x35, 0x65, 0xDF, 0x24, 0xFD, 0x41, 0x9C, 0x6C, - 0x31, 0xED, 0x83, 0x87, 0x43, 0xF4, 0x2C, 0x8F, - 0x64, 0xB9, 0x2B, 0xA9, 0xD7, 0xFE, 0x52, 0x56, - 0x08, 0xB4, 0x43, 0xC7, 0xD1, 0x83, 0xA1, 0x42, - 0xDB, 0x22, 0x24, 0x2E, 0x42, 0xB5, 0x1D, 0xDB + 0x42, 0x48, 0xD2, 0xD5, 0xD2, 0xF0, 0x31, 0xA1, + 0x88, 0xD0, 0x3F, 0x1D, 0x54, 0x3F, 0x6D, 0x73, + 0x74, 0x5E, 0xB8, 0xEF, 0x20, 0x5F, 0x20, 0xC5, + 0x23, 0x4C, 0x15, 0xD0, 0x21, 0x3A, 0xD9, 0x5E, + 0xC9, 0x63, 0x5F, 0x29, 0xE7, 0x81, 0x32, 0xEF, + 0x2A, 0xA6, 0xD2, 0xFC, 0x8B, 0x4E, 0x6F, 0x67, + 0x3A, 0x2F, 0x6D, 0x52, 0x85, 0xD3, 0x31, 0xE7, + 0x99, 0x4C, 0x23, 0x24, 0xB0, 0x9C, 0xEB, 0x21 }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -395,24 +394,24 @@ void test_schnorr_adaptor_vectors(void) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06 }; const unsigned char sig[65] = { - 0x02, 0xEF, 0x1A, 0xC9, 0x81, 0x35, 0x23, 0x9B, - 0x05, 0x7D, 0xF3, 0x00, 0xD1, 0xF4, 0x43, 0x5F, - 0x3B, 0xF3, 0xB0, 0x02, 0xAD, 0x7A, 0x37, 0xFE, - 0xFE, 0x26, 0xC7, 0x3C, 0xDC, 0xA6, 0xA4, 0x9C, - 0x77, 0x7D, 0x26, 0x76, 0xF6, 0xDA, 0x76, 0x55, - 0xE8, 0xA0, 0x86, 0x20, 0x23, 0x84, 0x13, 0x10, - 0xE4, 0x36, 0x53, 0x0C, 0x97, 0x02, 0x15, 0x25, - 0x06, 0x10, 0xD6, 0x2D, 0x49, 0x75, 0xA5, 0x18, 0x3C + 0x03, 0xFC, 0xED, 0xA2, 0x9D, 0x85, 0x32, 0xD2, + 0xC1, 0x99, 0x70, 0xCC, 0x3F, 0x8C, 0x67, 0x91, + 0xCC, 0x41, 0xE3, 0x05, 0x59, 0xC6, 0xF6, 0x76, + 0x44, 0x46, 0x3B, 0x5A, 0x71, 0xC8, 0xE9, 0x9A, + 0x90, 0x5B, 0xA4, 0xDF, 0x9F, 0xA8, 0x76, 0xCC, + 0x4D, 0x1F, 0x8E, 0x5D, 0x74, 0x72, 0xED, 0x3D, + 0xB3, 0x59, 0x44, 0xD1, 0xC1, 0x6E, 0x92, 0x12, + 0xB4, 0xC4, 0x74, 0xCB, 0xDA, 0x9C, 0x1A, 0xA3, 0x22 }; const unsigned char sig64[64] = { - 0xEF, 0x1A, 0xC9, 0x81, 0x35, 0x23, 0x9B, 0x05, - 0x7D, 0xF3, 0x00, 0xD1, 0xF4, 0x43, 0x5F, 0x3B, - 0xF3, 0xB0, 0x02, 0xAD, 0x7A, 0x37, 0xFE, 0xFE, - 0x26, 0xC7, 0x3C, 0xDC, 0xA6, 0xA4, 0x9C, 0x77, - 0x7D, 0x26, 0x76, 0xF6, 0xDA, 0x76, 0x55, 0xE8, - 0xA0, 0x86, 0x20, 0x23, 0x84, 0x13, 0x10, 0xE4, - 0x36, 0x53, 0x0C, 0x97, 0x02, 0x15, 0x25, 0x06, - 0x10, 0xD6, 0x2D, 0x49, 0x75, 0xA5, 0x18, 0x42 + 0xFC, 0xED, 0xA2, 0x9D, 0x85, 0x32, 0xD2, 0xC1, + 0x99, 0x70, 0xCC, 0x3F, 0x8C, 0x67, 0x91, 0xCC, + 0x41, 0xE3, 0x05, 0x59, 0xC6, 0xF6, 0x76, 0x44, + 0x46, 0x3B, 0x5A, 0x71, 0xC8, 0xE9, 0x9A, 0x90, + 0x5B, 0xA4, 0xDF, 0x9F, 0xA8, 0x76, 0xCC, 0x4D, + 0x1F, 0x8E, 0x5D, 0x74, 0x72, 0xED, 0x3D, 0xB3, + 0x59, 0x44, 0xD1, 0xC1, 0x6E, 0x92, 0x12, 0xB4, + 0xC4, 0x74, 0xCB, 0xDA, 0x9C, 0x1A, 0xA3, 0x1C }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -458,24 +457,24 @@ void test_schnorr_adaptor_vectors(void) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 }; const unsigned char sig[65] = { - 0x02, 0x80, 0xDF, 0xE8, 0x16, 0xD1, 0x07, 0xEA, - 0x18, 0x8F, 0xE3, 0xE4, 0x2D, 0x2F, 0x1F, 0xAA, - 0xD1, 0xCD, 0x60, 0x00, 0xCF, 0xAC, 0xE6, 0x34, - 0x98, 0x74, 0xB1, 0xA9, 0x1B, 0xC4, 0x88, 0x09, - 0x29, 0x16, 0xFC, 0x02, 0x35, 0x5E, 0xDB, 0xD9, - 0x2B, 0x2F, 0x86, 0xEB, 0x99, 0xED, 0x93, 0x0D, - 0x04, 0xE4, 0xEE, 0x3A, 0xA0, 0xF2, 0x30, 0x1F, - 0x35, 0x00, 0x25, 0x00, 0x97, 0xD0, 0xB9, 0xEB, 0x1F + 0x02, 0xA3, 0x96, 0xB0, 0x57, 0x1A, 0xD6, 0xC1, + 0xBC, 0x0A, 0x06, 0xA2, 0xDA, 0xFF, 0x1F, 0xB5, + 0xAB, 0x30, 0x60, 0x11, 0x86, 0xAA, 0x70, 0xE7, + 0x50, 0x8C, 0x84, 0xC2, 0xD6, 0x5E, 0xA6, 0x91, + 0x84, 0x05, 0x86, 0x63, 0x09, 0xF7, 0x63, 0x0F, + 0xA7, 0x61, 0x5D, 0x4E, 0xD0, 0xFB, 0x44, 0x20, + 0x8F, 0x35, 0x57, 0x02, 0x53, 0x91, 0xBD, 0xB7, + 0x22, 0x99, 0x2E, 0xD5, 0x62, 0xB2, 0x72, 0xDD, 0x25 }; const unsigned char sig64[64] = { - 0x80, 0xDF, 0xE8, 0x16, 0xD1, 0x07, 0xEA, 0x18, - 0x8F, 0xE3, 0xE4, 0x2D, 0x2F, 0x1F, 0xAA, 0xD1, - 0xCD, 0x60, 0x00, 0xCF, 0xAC, 0xE6, 0x34, 0x98, - 0x74, 0xB1, 0xA9, 0x1B, 0xC4, 0x88, 0x09, 0x29, - 0x16, 0xFC, 0x02, 0x35, 0x5E, 0xDB, 0xD9, 0x2B, - 0x2F, 0x86, 0xEB, 0x99, 0xED, 0x93, 0x0D, 0x04, - 0xE4, 0xEE, 0x3A, 0xA0, 0xF2, 0x30, 0x1F, 0x35, - 0x00, 0x25, 0x00, 0x97, 0xD0, 0xB9, 0xEB, 0x21 + 0xA3, 0x96, 0xB0, 0x57, 0x1A, 0xD6, 0xC1, 0xBC, + 0x0A, 0x06, 0xA2, 0xDA, 0xFF, 0x1F, 0xB5, 0xAB, + 0x30, 0x60, 0x11, 0x86, 0xAA, 0x70, 0xE7, 0x50, + 0x8C, 0x84, 0xC2, 0xD6, 0x5E, 0xA6, 0x91, 0x84, + 0x05, 0x86, 0x63, 0x09, 0xF7, 0x63, 0x0F, 0xA7, + 0x61, 0x5D, 0x4E, 0xD0, 0xFB, 0x44, 0x20, 0x8F, + 0x35, 0x57, 0x02, 0x53, 0x91, 0xBD, 0xB7, 0x22, + 0x99, 0x2E, 0xD5, 0x62, 0xB2, 0x72, 0xDD, 0x27 }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -521,24 +520,24 @@ void test_schnorr_adaptor_vectors(void) { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07 }; const unsigned char sig[65] = { - 0x03, 0x7B, 0x38, 0xAD, 0xBE, 0xC1, 0xE0, 0xF4, - 0x5C, 0xB0, 0xFF, 0xD7, 0x49, 0xA9, 0x7C, 0x9A, - 0x89, 0x02, 0xBC, 0x77, 0x3A, 0xBF, 0x4D, 0x7F, - 0xA4, 0xFE, 0xD6, 0x7A, 0x13, 0x70, 0xB8, 0xE8, - 0xC0, 0x79, 0x9D, 0x6E, 0xA0, 0x0D, 0x73, 0x7D, - 0xF9, 0x1B, 0xBD, 0x74, 0x93, 0xDE, 0x25, 0x7A, - 0xE6, 0x0C, 0x18, 0xF0, 0x3B, 0x3E, 0xBE, 0x78, - 0xCD, 0xA6, 0xE9, 0x9F, 0x08, 0x74, 0x05, 0x4F, 0xB8 + 0x03, 0xA7, 0xFC, 0x93, 0x12, 0xDD, 0xAF, 0xF8, + 0xC9, 0x53, 0x3F, 0x9F, 0x73, 0x50, 0x04, 0x21, + 0xD4, 0xEB, 0xB7, 0x36, 0x3E, 0xFE, 0xA9, 0xE2, + 0x17, 0xCA, 0x70, 0xE5, 0xFE, 0xA1, 0xDC, 0xE4, + 0x3D, 0xC9, 0x51, 0xFE, 0x64, 0x5F, 0x33, 0x9C, + 0xC5, 0x80, 0x02, 0x0F, 0x7E, 0xFA, 0x3D, 0x04, + 0xAB, 0xBE, 0x63, 0xC9, 0x13, 0xF7, 0xD1, 0x59, + 0x66, 0x21, 0x4F, 0x63, 0x4A, 0xE0, 0x64, 0xE2, 0x21 }; const unsigned char sig64[64] = { - 0x7B, 0x38, 0xAD, 0xBE, 0xC1, 0xE0, 0xF4, 0x5C, - 0xB0, 0xFF, 0xD7, 0x49, 0xA9, 0x7C, 0x9A, 0x89, - 0x02, 0xBC, 0x77, 0x3A, 0xBF, 0x4D, 0x7F, 0xA4, - 0xFE, 0xD6, 0x7A, 0x13, 0x70, 0xB8, 0xE8, 0xC0, - 0x79, 0x9D, 0x6E, 0xA0, 0x0D, 0x73, 0x7D, 0xF9, - 0x1B, 0xBD, 0x74, 0x93, 0xDE, 0x25, 0x7A, 0xE6, - 0x0C, 0x18, 0xF0, 0x3B, 0x3E, 0xBE, 0x78, 0xCD, - 0xA6, 0xE9, 0x9F, 0x08, 0x74, 0x05, 0x4F, 0xB1 + 0xA7, 0xFC, 0x93, 0x12, 0xDD, 0xAF, 0xF8, 0xC9, + 0x53, 0x3F, 0x9F, 0x73, 0x50, 0x04, 0x21, 0xD4, + 0xEB, 0xB7, 0x36, 0x3E, 0xFE, 0xA9, 0xE2, 0x17, + 0xCA, 0x70, 0xE5, 0xFE, 0xA1, 0xDC, 0xE4, 0x3D, + 0xC9, 0x51, 0xFE, 0x64, 0x5F, 0x33, 0x9C, 0xC5, + 0x80, 0x02, 0x0F, 0x7E, 0xFA, 0x3D, 0x04, 0xAB, + 0xBE, 0x63, 0xC9, 0x13, 0xF7, 0xD1, 0x59, 0x66, + 0x21, 0x4F, 0x63, 0x4A, 0xE0, 0x64, 0xE2, 0x1A }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); @@ -579,14 +578,14 @@ void test_schnorr_adaptor_vectors(void) { 0xB7, 0xCB, 0xA8, 0xD5, 0x69, 0xB2, 0x40, 0xEF, 0xE4 }; const unsigned char sig[65] = { - 0x02, 0x8F, 0x3F, 0xE7, 0x3C, 0x5D, 0x2E, 0xB4, - 0xAD, 0x2E, 0xA8, 0x95, 0xC7, 0xA9, 0x65, 0xA8, - 0x0B, 0x36, 0xF2, 0x8E, 0xE4, 0x36, 0xEC, 0x69, - 0x21, 0x13, 0x68, 0x4A, 0x83, 0x28, 0x31, 0x62, - 0x00, 0xAB, 0x8E, 0x73, 0xC8, 0x44, 0x38, 0xDD, - 0xA3, 0x1A, 0xD6, 0x84, 0x01, 0x51, 0x50, 0x56, - 0x33, 0x54, 0x7F, 0xBD, 0x8C, 0x07, 0xC2, 0x53, - 0x5B, 0x58, 0xF0, 0x96, 0x1B, 0x31, 0x9C, 0x4F, 0x3C + 0x02, 0x36, 0xF7, 0xE1, 0x79, 0x5A, 0x04, 0x98, + 0x76, 0x54, 0x4B, 0x25, 0x4C, 0xEA, 0x10, 0xD1, + 0x8E, 0xDE, 0x69, 0x67, 0xD1, 0x4A, 0x9F, 0x36, + 0x5D, 0x84, 0xFD, 0xF4, 0x38, 0x4C, 0x97, 0x7C, + 0x6A, 0x19, 0xC6, 0x05, 0x0F, 0x5C, 0x5A, 0xF5, + 0x61, 0x72, 0x0D, 0x2B, 0x0B, 0xA0, 0x6F, 0x5E, + 0xD8, 0x36, 0xE7, 0x15, 0xF2, 0xD5, 0xDA, 0xE8, + 0x96, 0x4C, 0x7F, 0x9F, 0x17, 0xFD, 0x0C, 0xF0, 0x90 }; test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); }; @@ -612,14 +611,14 @@ void test_schnorr_adaptor_vectors(void) { 0x84, 0x74, 0xFA, 0x94, 0xAB, 0xE8, 0xC4, 0xCD, 0x13 }; const unsigned char sig[65] = { - 0x02, 0x07, 0x21, 0x04, 0x10, 0xBE, 0x6B, 0x9F, - 0xFA, 0xEE, 0x0C, 0xA3, 0x8D, 0x36, 0x5C, 0xFA, - 0xBD, 0xBE, 0x36, 0x64, 0x01, 0x49, 0xDC, 0xDE, - 0xCB, 0xB0, 0x41, 0x0A, 0xA1, 0x47, 0x9A, 0x01, - 0x8A, 0x57, 0xEE, 0x6D, 0x4B, 0x4E, 0x00, 0x4A, - 0xF7, 0x89, 0x79, 0x5E, 0xC8, 0xBE, 0xB6, 0x18, - 0x87, 0xB3, 0x43, 0x8E, 0xD9, 0x08, 0x88, 0x19, - 0x9C, 0xA4, 0xE9, 0x61, 0x37, 0x36, 0x76, 0x1A, 0x4C + 0x03, 0x40, 0x66, 0xF5, 0xBE, 0x7E, 0xD4, 0xB6, + 0xE0, 0x2E, 0xB3, 0x8B, 0x26, 0xFC, 0x0A, 0x8C, + 0xA8, 0x49, 0xA3, 0x2D, 0x7E, 0xCD, 0x64, 0x5B, + 0x49, 0xE4, 0x50, 0xFD, 0x5E, 0x06, 0x5A, 0x5E, + 0x77, 0xE4, 0x9E, 0xBB, 0x07, 0xC6, 0x37, 0xF9, + 0x99, 0x1C, 0xB2, 0x5A, 0x07, 0x7E, 0xE8, 0x46, + 0xE8, 0xA4, 0x50, 0xF7, 0xC7, 0x07, 0x0A, 0x86, + 0xC8, 0x58, 0xFF, 0xE6, 0x26, 0x9A, 0xF3, 0x53, 0xE1 }; test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); }; @@ -645,14 +644,14 @@ void test_schnorr_adaptor_vectors(void) { 0xB7, 0xCB, 0xA8, 0xD5, 0x69, 0xB2, 0x40, 0xEF, 0xE4 }; const unsigned char sig[65] = { - 0x02, 0xDE, 0x06, 0x93, 0xAC, 0x8E, 0xCE, 0xA6, - 0xB8, 0x16, 0x7E, 0x7B, 0x02, 0x33, 0x97, 0x32, - 0x89, 0xAE, 0x1C, 0xFA, 0xCD, 0xDC, 0x31, 0x6A, - 0xA5, 0x1C, 0xFB, 0x49, 0x1F, 0x22, 0xB1, 0x8B, - 0xD2, 0x44, 0x74, 0x75, 0x25, 0xEC, 0x34, 0x02, - 0x27, 0x0C, 0x2C, 0x96, 0x9B, 0xAF, 0x93, 0xB1, - 0xCF, 0x0C, 0xCB, 0x41, 0x1B, 0x06, 0x88, 0x25, - 0xEE, 0x8C, 0x70, 0xEB, 0xAE, 0xD2, 0x70, 0xE4, 0xBB + 0x03, 0x14, 0xDE, 0x03, 0xC2, 0x84, 0x36, 0xAB, + 0x9A, 0x24, 0x4F, 0xE3, 0x0F, 0x60, 0x92, 0x12, + 0x9B, 0xB1, 0xFF, 0x99, 0x73, 0x0F, 0xB7, 0xE4, + 0xEA, 0x59, 0x2B, 0x5B, 0xB2, 0xC5, 0xDD, 0xE4, + 0xF9, 0xED, 0x14, 0x0B, 0xA5, 0xE3, 0x2F, 0x25, + 0x0A, 0xE1, 0xCE, 0xF8, 0xE2, 0xC5, 0xD9, 0x75, + 0x63, 0xDC, 0x77, 0x66, 0x35, 0x83, 0xE5, 0xEC, + 0xA4, 0x0F, 0xFE, 0xC9, 0x79, 0xF5, 0xF3, 0x73, 0x8E }; test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); }; @@ -660,14 +659,14 @@ void test_schnorr_adaptor_vectors(void) { /* Test vector 9 */ /* Verification test */ const unsigned char sig[65] = { - 0x03, 0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, + 0x02, 0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, 0x50, 0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF, 0x21, 0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76, 0x87, 0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A, - 0x34, 0x44, 0x74, 0x75, 0x25, 0xEC, 0x34, 0x02, - 0x27, 0x0C, 0x2C, 0x96, 0x9B, 0xAF, 0x93, 0xB1, - 0xCF, 0x0C, 0xCB, 0x41, 0x1B, 0x06, 0x88, 0x25, - 0xEE, 0x8C, 0x70, 0xEB, 0xAE, 0xD2, 0x70, 0xE4, 0xBB + 0x34, 0xED, 0x14, 0x0B, 0xA5, 0xE3, 0x2F, 0x25, + 0x0A, 0xE1, 0xCE, 0xF8, 0xE2, 0xC5, 0xD9, 0x75, + 0x63, 0xDC, 0x77, 0x66, 0x35, 0x83, 0xE5, 0xEC, + 0xA4, 0x0F, 0xFE, 0xC9, 0x79, 0xF5, 0xF3, 0x73, 0x8E }; secp256k1_ge r0; CHECK(!secp256k1_eckey_pubkey_parse(&r0, sig, 33)); @@ -682,24 +681,24 @@ void test_schnorr_adaptor_vectors(void) { 0x6C, 0xE2, 0x73, 0x53, 0xCE, 0xAD, 0xF5, 0x11 }; const unsigned char sig[65] = { - 0x03, 0xC8, 0x73, 0xA1, 0x86, 0xE5, 0xEF, 0xFC, - 0x79, 0x30, 0xE7, 0xFA, 0xF4, 0x3E, 0x30, 0xA6, - 0xE7, 0x33, 0x04, 0x8E, 0x56, 0x54, 0xDB, 0xFA, - 0x31, 0xDE, 0xC8, 0x61, 0x61, 0xCF, 0x82, 0xA7, - 0xDF, 0x75, 0xDF, 0x7D, 0x3D, 0x21, 0xF2, 0xAC, - 0x00, 0xCA, 0x86, 0x31, 0x91, 0xF5, 0x35, 0xF6, - 0xF7, 0x8C, 0xD8, 0xD6, 0x78, 0x69, 0x88, 0xA9, - 0xE5, 0x5E, 0x81, 0x47, 0x8C, 0x50, 0xDF, 0x56, 0x55 + 0x02, 0xFA, 0x88, 0x46, 0x5F, 0xAF, 0x40, 0x88, + 0x31, 0x04, 0xFA, 0x0B, 0x77, 0xC1, 0x99, 0x0C, + 0xC1, 0xB2, 0xD7, 0x74, 0x56, 0xD1, 0x51, 0x86, + 0xCE, 0xF2, 0x40, 0xF6, 0x19, 0xE0, 0xFD, 0xED, + 0x82, 0xAA, 0x34, 0x62, 0xF8, 0x66, 0x63, 0x2C, + 0xB5, 0xAA, 0xDA, 0x9C, 0xB0, 0x43, 0x35, 0x93, + 0x75, 0xEC, 0x5C, 0xF2, 0x66, 0x6B, 0xFA, 0x71, + 0xDE, 0x84, 0xA5, 0x46, 0x83, 0x59, 0x9C, 0xD1, 0x5D }; const unsigned char sig64[64] = { - 0xC8, 0x73, 0xA1, 0x86, 0xE5, 0xEF, 0xFC, 0x79, - 0x30, 0xE7, 0xFA, 0xF4, 0x3E, 0x30, 0xA6, 0xE7, - 0x33, 0x04, 0x8E, 0x56, 0x54, 0xDB, 0xFA, 0x31, - 0xDE, 0xC8, 0x61, 0x61, 0xCF, 0x82, 0xA7, 0xDF, - 0xCE, 0x3D, 0x35, 0x3C, 0x03, 0x80, 0xA8, 0x7F, - 0x61, 0x8B, 0x86, 0x7B, 0x7F, 0x1B, 0x52, 0x77, - 0xF3, 0x83, 0xA8, 0x6D, 0x0A, 0x92, 0x13, 0x5F, - 0xB1, 0x71, 0x32, 0xC5, 0x52, 0x67, 0xA2, 0x85 + 0xFA, 0x88, 0x46, 0x5F, 0xAF, 0x40, 0x88, 0x31, + 0x04, 0xFA, 0x0B, 0x77, 0xC1, 0x99, 0x0C, 0xC1, + 0xB2, 0xD7, 0x74, 0x56, 0xD1, 0x51, 0x86, 0xCE, + 0xF2, 0x40, 0xF6, 0x19, 0xE0, 0xFD, 0xED, 0x82, + 0x51, 0xD6, 0xAA, 0xF9, 0x84, 0xD5, 0x30, 0x37, + 0x13, 0xD5, 0x47, 0xC6, 0xB9, 0x50, 0x37, 0xF5, + 0x85, 0xB2, 0x20, 0x71, 0xCA, 0xF1, 0x08, 0x64, + 0x31, 0xB5, 0x5B, 0x4A, 0x58, 0x14, 0x85, 0x2D }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); @@ -714,24 +713,24 @@ void test_schnorr_adaptor_vectors(void) { 0x6B, 0x38, 0x80, 0xB5, 0xCC, 0xFB, 0x3C, 0x97 }; const unsigned char sig[65] = { - 0x03, 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, - 0x05, 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, - 0xDE, 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, - 0x72, 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, - 0x1D, 0x46, 0xB1, 0xB3, 0x7F, 0x4D, 0x71, 0xC1, - 0x4A, 0x19, 0x24, 0xED, 0x1D, 0x96, 0xBA, 0x61, - 0xC9, 0x73, 0xBE, 0x90, 0xF6, 0xB9, 0x83, 0x64, - 0xD6, 0xFE, 0x12, 0x10, 0x52, 0x97, 0xD3, 0x81, 0x30 + 0x02, 0x2D, 0xB0, 0x2D, 0x30, 0x37, 0x63, 0xF5, + 0x12, 0xCB, 0x83, 0x02, 0x5E, 0x25, 0x16, 0x75, + 0xAB, 0xB8, 0x08, 0x82, 0x94, 0xFA, 0x06, 0x4D, + 0xE9, 0xB4, 0x63, 0x80, 0x69, 0x98, 0x2E, 0xC3, + 0x02, 0xD5, 0xC4, 0x2F, 0xB6, 0x91, 0x07, 0x17, + 0x38, 0xB1, 0x10, 0xDF, 0xB7, 0xDE, 0xBF, 0xAF, + 0x58, 0x8B, 0xC4, 0xB9, 0xDE, 0x93, 0x84, 0xCD, + 0xC4, 0x00, 0xD9, 0xDD, 0x78, 0x8E, 0xDD, 0xD0, 0xF4 }; const unsigned char sig64[64] = { - 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, 0x05, - 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, 0xDE, - 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, 0x72, - 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, 0x1D, - 0xD6, 0x2A, 0xB6, 0xA6, 0x5B, 0x93, 0x2A, 0xB4, - 0x2D, 0x74, 0x07, 0x80, 0xBA, 0xEF, 0x5D, 0xB8, - 0x83, 0x7C, 0x39, 0x56, 0xF7, 0x02, 0xF6, 0xBE, - 0x16, 0x5A, 0x2C, 0x11, 0x3B, 0x9D, 0xC4, 0xBB + 0x2D, 0xB0, 0x2D, 0x30, 0x37, 0x63, 0xF5, 0x12, + 0xCB, 0x83, 0x02, 0x5E, 0x25, 0x16, 0x75, 0xAB, + 0xB8, 0x08, 0x82, 0x94, 0xFA, 0x06, 0x4D, 0xE9, + 0xB4, 0x63, 0x80, 0x69, 0x98, 0x2E, 0xC3, 0x02, + 0x0D, 0x5F, 0x66, 0x23, 0xC5, 0xF3, 0xFC, 0xC9, + 0x08, 0x56, 0x2B, 0xA9, 0xCF, 0x96, 0x91, 0x22, + 0xF2, 0x5E, 0x35, 0xA1, 0x1A, 0x86, 0x17, 0x1E, + 0x6A, 0x5E, 0xA3, 0x3D, 0x3E, 0x1D, 0x6B, 0xA3 }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 0); @@ -746,24 +745,24 @@ void test_schnorr_adaptor_vectors(void) { 0x6B, 0x38, 0x80, 0xB5, 0xCC, 0xFB, 0x3C, 0x97 }; const unsigned char sig[65] = { - 0x02, 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, - 0x05, 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, - 0xDE, 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, - 0x72, 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, - 0x1D, 0x46, 0xB1, 0xB3, 0x7F, 0x4D, 0x71, 0xC1, - 0x4A, 0x19, 0x24, 0xED, 0x1D, 0x96, 0xBA, 0x61, - 0xC9, 0x73, 0xBE, 0x90, 0xF6, 0xB9, 0x83, 0x64, - 0xD6, 0xFE, 0x12, 0x10, 0x52, 0x97, 0xD3, 0x81, 0x30 + 0x03, 0x2D, 0xB0, 0x2D, 0x30, 0x37, 0x63, 0xF5, + 0x12, 0xCB, 0x83, 0x02, 0x5E, 0x25, 0x16, 0x75, + 0xAB, 0xB8, 0x08, 0x82, 0x94, 0xFA, 0x06, 0x4D, + 0xE9, 0xB4, 0x63, 0x80, 0x69, 0x98, 0x2E, 0xC3, + 0x02, 0x2A, 0x3B, 0xD0, 0x49, 0x6E, 0xF8, 0xE8, + 0xC7, 0x4E, 0xEF, 0x20, 0x48, 0x21, 0x40, 0x50, + 0xA6, 0x2E, 0xEA, 0x23, 0x08, 0x1B, 0xC3, 0xD2, + 0x77, 0xBE, 0xF8, 0x81, 0x14, 0x41, 0x58, 0x70, 0x4D }; const unsigned char sig64[64] = { - 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, 0x05, - 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, 0xDE, - 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, 0x72, - 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, 0x1D, - 0xD6, 0x2A, 0xB6, 0xA6, 0x5B, 0x93, 0x2A, 0xB4, - 0x2D, 0x74, 0x07, 0x80, 0xBA, 0xEF, 0x5D, 0xB8, - 0x83, 0x7C, 0x39, 0x56, 0xF7, 0x02, 0xF6, 0xBE, - 0x16, 0x5A, 0x2C, 0x11, 0x3B, 0x9D, 0xC4, 0xBB + 0x2D, 0xB0, 0x2D, 0x30, 0x37, 0x63, 0xF5, 0x12, + 0xCB, 0x83, 0x02, 0x5E, 0x25, 0x16, 0x75, 0xAB, + 0xB8, 0x08, 0x82, 0x94, 0xFA, 0x06, 0x4D, 0xE9, + 0xB4, 0x63, 0x80, 0x69, 0x98, 0x2E, 0xC3, 0x02, + 0x0D, 0x5F, 0x66, 0x23, 0xC5, 0xF3, 0xFC, 0xC9, + 0x08, 0x56, 0x2B, 0xA9, 0xCF, 0x96, 0x91, 0x22, + 0xF2, 0x5E, 0x35, 0xA1, 0x1A, 0x86, 0x17, 0x1E, + 0x6A, 0x5E, 0xA3, 0x3D, 0x3E, 0x1D, 0x6B, 0xA3 }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 0); @@ -778,24 +777,24 @@ void test_schnorr_adaptor_vectors(void) { 0x6B, 0x38, 0x80, 0xB5, 0xCC, 0xFB, 0x3C, 0x97 }; const unsigned char sig[65] = { - 0x03, 0x30, 0x40, 0x09, 0x27, 0xEE, 0x56, 0xB0, - 0x05, 0x99, 0x0D, 0xAE, 0x2A, 0xCC, 0xB8, 0x7D, - 0xDE, 0x07, 0x41, 0x9C, 0x2D, 0x56, 0xC8, 0x70, - 0x72, 0xFC, 0x8B, 0x12, 0x21, 0x0A, 0x9D, 0xE1, - 0x1D, 0x46, 0xB1, 0xB3, 0x7F, 0x4D, 0x71, 0xC1, - 0x4A, 0x19, 0x24, 0xED, 0x1D, 0x96, 0xBA, 0x61, - 0xC9, 0x73, 0xBE, 0x90, 0xF6, 0xB9, 0x83, 0x64, - 0xD6, 0xFE, 0x12, 0x10, 0x52, 0x97, 0xD3, 0x81, 0x30 + 0x02, 0x2D, 0xB0, 0x2D, 0x30, 0x37, 0x63, 0xF5, + 0x12, 0xCB, 0x83, 0x02, 0x5E, 0x25, 0x16, 0x75, + 0xAB, 0xB8, 0x08, 0x82, 0x94, 0xFA, 0x06, 0x4D, + 0xE9, 0xB4, 0x63, 0x80, 0x69, 0x98, 0x2E, 0xC3, + 0x02, 0x2A, 0x3B, 0xD0, 0x49, 0x6E, 0xF8, 0xE8, + 0xC7, 0x4E, 0xEF, 0x20, 0x48, 0x21, 0x40, 0x50, + 0xA6, 0x2E, 0xEA, 0x23, 0x08, 0x1B, 0xC3, 0xD2, + 0x77, 0xBE, 0xF8, 0x81, 0x14, 0x41, 0x58, 0x70, 0x4D }; const unsigned char sig64[64] = { 0x9F, 0x08, 0xBE, 0x86, 0x5F, 0x69, 0x3B, 0xDB, 0xC1, 0xAE, 0x97, 0x6D, 0xFF, 0xB8, 0xBC, 0x88, 0x4C, 0x37, 0x20, 0x52, 0xB0, 0x92, 0x6E, 0x49, 0xE0, 0x29, 0x8A, 0x9F, 0x2D, 0x7B, 0x48, 0x60, - 0xD6, 0x2A, 0xB6, 0xA6, 0x5B, 0x93, 0x2A, 0xB4, - 0x2D, 0x74, 0x07, 0x80, 0xBA, 0xEF, 0x5D, 0xB8, - 0x83, 0x7C, 0x39, 0x56, 0xF7, 0x02, 0xF6, 0xBE, - 0x16, 0x5A, 0x2C, 0x11, 0x3B, 0x9D, 0xC4, 0xBB + 0x0D, 0x5F, 0x66, 0x23, 0xC5, 0xF3, 0xFC, 0xC9, + 0x08, 0x56, 0x2B, 0xA9, 0xCF, 0x96, 0x91, 0x22, + 0xF2, 0x5E, 0x35, 0xA1, 0x1A, 0x86, 0x17, 0x1E, + 0x6A, 0x5E, 0xA3, 0x3D, 0x3E, 0x1D, 0x6B, 0xA3 }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); }; From 2aa074d3c1d43b5d80be1a4b1f7e59e21e478c75 Mon Sep 17 00:00:00 2001 From: ZhePang Date: Tue, 5 Dec 2023 10:22:57 -0500 Subject: [PATCH 06/10] Bug fixed: all hash tags correct and passed all vector tests --- src/modules/schnorr_adaptor/main_impl.h | 18 +++++++++--------- src/modules/schnorr_adaptor/tests_impl.h | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/modules/schnorr_adaptor/main_impl.h b/src/modules/schnorr_adaptor/main_impl.h index a1d1f713a..6e412063a 100644 --- a/src/modules/schnorr_adaptor/main_impl.h +++ b/src/modules/schnorr_adaptor/main_impl.h @@ -31,14 +31,14 @@ static void secp256k1_adaptor_nonce_function_bip340_sha256_tagged(secp256k1_sha2 * SHA256 to SHA256("SchnorrAdaptor/aux")||SHA256("SchnorrAdaptor/aux"). */ static void secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(secp256k1_sha256 *sha) { secp256k1_sha256_initialize(sha); - sha->s[0] = 0x60c4ec6dul; - sha->s[1] = 0x2fc91363ul; - sha->s[2] = 0xce54f4a5ul; - sha->s[3] = 0x962e1565ul; - sha->s[4] = 0x2b5da649ul; - sha->s[5] = 0x6ba94748ul; - sha->s[6] = 0x456c70adul; - sha->s[7] = 0x842cbaddul; + sha->s[0] = 0x50685e98ul; + sha->s[1] = 0x6313905eul; + sha->s[2] = 0x6db24fa0ul; + sha->s[3] = 0xc8b15c48ul; + sha->s[4] = 0x6b318921ul; + sha->s[5] = 0x441d8ff3ul; + sha->s[6] = 0xa7033a66ul; + sha->s[7] = 0xc3545cddul; sha->bytes = 64; } @@ -136,7 +136,7 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c /* bytes_from_point(P) */ secp256k1_fe_get_b32(pk_buf, &pk.x); - ret &= !!noncefp(nonce32, msg32, seckey, t33, pk_buf, bip340_algo, sizeof(bip340_algo), ndata); + ret &= !!noncefp(nonce32, msg32, seckey, t33, pk_buf, adaptor_bip340_algo, sizeof(adaptor_bip340_algo), ndata); /* k0 */ secp256k1_scalar_set_b32(&k, nonce32, NULL); ret &= !secp256k1_scalar_is_zero(&k); diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h index 7e4a77d5a..b48dd9b15 100644 --- a/src/modules/schnorr_adaptor/tests_impl.h +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -942,7 +942,7 @@ void test_schnorr_adaptor_adapt_extract_adaptor(void) { void run_schnorr_adaptor_tests(void) { int i; - run_nonce_function_bip340_tests(); + run_adaptor_nonce_function_bip340_tests(); test_schnorr_adaptor_api(); test_schnorrsig_sha256_tagged(); From 094b863f8137002772195551a0dd0689f673dc3e Mon Sep 17 00:00:00 2001 From: ZhePang Date: Tue, 2 Jan 2024 19:46:27 +0800 Subject: [PATCH 07/10] changed variable and function names for clarity and simplicity --- .github/workflows/ci.yml | 33 ++-- include/secp256k1_schnorr_adaptor.h | 46 ++--- src/modules/schnorr_adaptor/main_impl.h | 82 ++++----- src/modules/schnorr_adaptor/tests_impl.h | 218 +++++++++++------------ 4 files changed, 195 insertions(+), 184 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7d1f765e0..8ccf46730 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,6 +40,7 @@ env: MUSIG: 'no' ECDSAADAPTOR: 'no' BPPP: 'no' + SCHNORRADAPTOR: 'no' ### test options SECP256K1_TEST_ITERS: BENCH: 'yes' @@ -78,14 +79,14 @@ jobs: matrix: configuration: - env_vars: { WIDEMUL: 'int64', RECOVERY: 'yes' } - - env_vars: { WIDEMUL: 'int64', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes' } + - env_vars: { WIDEMUL: 'int64', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes'} - env_vars: { WIDEMUL: 'int128' } - env_vars: { WIDEMUL: 'int128_struct', ELLSWIFT: 'yes' } - env_vars: { WIDEMUL: 'int128', RECOVERY: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' } - - env_vars: { WIDEMUL: 'int128', ECDH: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes'} + - env_vars: { WIDEMUL: 'int128', ECDH: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes'} - env_vars: { WIDEMUL: 'int128', ASM: 'x86_64', ELLSWIFT: 'yes' } - - env_vars: { RECOVERY: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes'} - - env_vars: { CTIMETESTS: 'no', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', CPPFLAGS: '-DVERIFY' } + - env_vars: { RECOVERY: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes'} + - env_vars: { CTIMETESTS: 'no', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes', CPPFLAGS: '-DVERIFY' } - env_vars: { BUILD: 'distcheck', WITH_VALGRIND: 'no', CTIMETESTS: 'no', BENCH: 'no' } - env_vars: { CPPFLAGS: '-DDETERMINISTIC' } - env_vars: { CFLAGS: '-O0', CTIMETESTS: 'no' } @@ -156,6 +157,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' CC: ${{ matrix.cc }} steps: @@ -208,6 +210,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' CTIMETESTS: 'no' steps: @@ -267,6 +270,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' CTIMETESTS: 'no' steps: @@ -320,6 +324,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' CTIMETESTS: 'no' strategy: @@ -383,6 +388,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' CTIMETESTS: 'no' steps: @@ -443,6 +449,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' CTIMETESTS: 'no' SECP256K1_TEST_ITERS: 2 @@ -502,6 +509,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' CTIMETESTS: 'no' CFLAGS: '-fsanitize=undefined,address -g' UBSAN_OPTIONS: 'print_stacktrace=1:halt_on_error=1' @@ -567,6 +575,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' CTIMETESTS: 'yes' CC: 'clang' SECP256K1_TEST_ITERS: 32 @@ -622,6 +631,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' CTIMETESTS: 'no' strategy: @@ -678,15 +688,15 @@ jobs: fail-fast: false matrix: env_vars: - - { WIDEMUL: 'int64', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes' } + - { WIDEMUL: 'int64', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes' } - { WIDEMUL: 'int128_struct', ECMULTGENPRECISION: 2, ECMULTWINDOW: 4 } - - { WIDEMUL: 'int128', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes' } + - { WIDEMUL: 'int128', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes' } - { WIDEMUL: 'int128', RECOVERY: 'yes' } - - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes' } - - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', CC: 'gcc' } - - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 } - - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', CC: 'gcc', WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 } - - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', CPPFLAGS: '-DVERIFY', CTIMETESTS: 'no' } + - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes' } + - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes', CC: 'gcc' } + - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes', WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 } + - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes', CC: 'gcc', WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 } + - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', SCHNORRADAPTOR: 'yes', CPPFLAGS: '-DVERIFY', CTIMETESTS: 'no' } - BUILD: 'distcheck' steps: @@ -805,6 +815,7 @@ jobs: MUSIG: 'yes' ECDSAADAPTOR: 'yes' BPPP: 'yes' + SCHNORRADAPTOR: 'yes' steps: - name: Checkout diff --git a/include/secp256k1_schnorr_adaptor.h b/include/secp256k1_schnorr_adaptor.h index a3bc568ec..4b49eca91 100644 --- a/include/secp256k1_schnorr_adaptor.h +++ b/include/secp256k1_schnorr_adaptor.h @@ -20,7 +20,7 @@ extern "C" { * Out: nonce32: pointer to a 32-byte array to be filled by the function * In: msg32: the 32-byte message being verified (will not be NULL) * key32: pointer to a 32-byte secret key (will not be NULL) - * t33: the 33-byte serialized adaptor point (will not be NULL) + * adaptor: the 33-byte serialized adaptor point (will not be NULL) * xonly_pk32: the 32-byte serialized xonly pubkey corresponding to key32 * (will not be NULL) * algo: pointer to an array describing the signature @@ -35,7 +35,7 @@ typedef int (*secp256k1_adaptor_nonce_function_hardened)( unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, - const unsigned char *t33, + const unsigned char *adaptor, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, @@ -65,10 +65,10 @@ SECP256K1_API const secp256k1_adaptor_nonce_function_hardened secp256k1_adaptor_ * * Returns 1 on success, 0 on failure. * Args: ctx: pointer to a context object (not secp256k1_context_static). - * Out: sig65: pointer to a 65-byte array to store the serialized signature. + * Out: presig65: pointer to a 65-byte array to store the serialized adaptor signature. * In: msg32: the 32-byte message being signed. * keypair: pointer to an initialized keypair. - * t33: pointer to a 33-byte compressed adaptor point. + * adaptor: pointer to a 33-byte compressed adaptor point. * aux_rand32: 32 bytes of fresh randomness. While recommended to provide * this, it is only supplemental to security and can be NULL. A * NULL argument is treated the same as an all-zero one. See @@ -77,10 +77,10 @@ SECP256K1_API const secp256k1_adaptor_nonce_function_hardened secp256k1_adaptor_ */ SECP256K1_API int secp256k1_schnorr_adaptor_presign( const secp256k1_context *ctx, - unsigned char *sig65, + unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, - const unsigned char *t33, + const unsigned char *adaptor, const unsigned char *aux_rand32 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); @@ -88,15 +88,15 @@ SECP256K1_API int secp256k1_schnorr_adaptor_presign( * * Returns 1 on success, 0 on failure. * Args: ctx: pointer to a context object. - * Out: t33: pointer to a 33-byte array to store the compressed adaptor point. - * In: sig65: pointer to a 65-byte serialized signature. + * Out: adaptor: pointer to a 33-byte array to store the compressed adaptor point. + * In: presig65: pointer to a 65-byte serialized adaptor signature. * msg32: the 32-byte message being signed. * pubkey: pointer to an x-only public key to verify with (cannot be NULL) */ -SECP256K1_API int secp256k1_schnorr_adaptor_extract_t( +SECP256K1_API int secp256k1_schnorr_adaptor_extract( const secp256k1_context *ctx, - unsigned char *t33, - const unsigned char *sig65, + unsigned char *adaptor, + const unsigned char *presig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); @@ -104,30 +104,30 @@ SECP256K1_API int secp256k1_schnorr_adaptor_extract_t( /** Adapt an adaptor signature to a schnorr signature. * * Returns 1 on success, 0 on failure. - * Args: ctx: pointer to a context object. - * Out: sig64: pointer to a 64-byte array to store the adapted schnorr signature. - * In: sig65: pointer to a 65-byte serialized adaptor signature. - * t32: pointer to a 32-byte adaptor. + * Args: ctx: pointer to a context object. + * Out: sig64: pointer to a 64-byte array to store the adapted schnorr signature. + * In: presig65: pointer to a 65-byte serialized adaptor signature. + * secadaptor: pointer to a 32-byte secadaptor. */ SECP256K1_API int secp256k1_schnorr_adaptor_adapt( const secp256k1_context *ctx, unsigned char *sig64, - const unsigned char *sig65, - const unsigned char *t32 + const unsigned char *presig65, + const unsigned char *secadaptor ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); -/** Extract the adaptor from an adaptor signature and a schnorr signature. +/** Extract the secadaptor from an adaptor signature and a schnorr signature. * * Returns 1 on success, 0 on failure. * Args: ctx: pointer to a context object. - * Out: t32: pointer to a 32-byte array to store the adaptor. - * In: sig65: pointer to a 65-byte serialized adaptor signature. + * Out: secadaptor: pointer to a 32-byte array to store the secadaptor. + * In: presig65: pointer to a 65-byte serialized adaptor signature. * sig64: pointer to a 64-byte adapted schnorr signature. */ -SECP256K1_API int secp256k1_schnorr_adaptor_extract_adaptor( +SECP256K1_API int secp256k1_schnorr_adaptor_extract_sec( const secp256k1_context *ctx, - unsigned char *t32, - const unsigned char *sig65, + unsigned char *secadaptor, + const unsigned char *presig65, const unsigned char *sig64 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); diff --git a/src/modules/schnorr_adaptor/main_impl.h b/src/modules/schnorr_adaptor/main_impl.h index 6e412063a..0aefb5b78 100644 --- a/src/modules/schnorr_adaptor/main_impl.h +++ b/src/modules/schnorr_adaptor/main_impl.h @@ -47,7 +47,7 @@ static void secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(secp256k1_ * by using the correct tagged hash function. */ static const unsigned char adaptor_bip340_algo[20] = "SchnorrAdaptor/nonce"; -static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *t33, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) { +static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *adaptor, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) { secp256k1_sha256 sha; unsigned char masked_key[32]; int i; @@ -88,7 +88,7 @@ static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned /* Hash masked-key||pk||msg using the tagged hash as per the spec */ secp256k1_sha256_write(&sha, masked_key, 32); - secp256k1_sha256_write(&sha, t33, 33); + secp256k1_sha256_write(&sha, adaptor, 33); secp256k1_sha256_write(&sha, xonly_pk32, 32); secp256k1_sha256_write(&sha, msg32, 32); secp256k1_sha256_finalize(&sha, nonce32); @@ -97,7 +97,7 @@ static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned const secp256k1_adaptor_nonce_function_hardened secp256k1_adaptor_nonce_function_bip340 = adaptor_nonce_function_bip340; -static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *ctx, unsigned char *sig65, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_adaptor_nonce_function_hardened noncefp, const unsigned char *t33, void *ndata) { +static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_adaptor_nonce_function_hardened noncefp, const unsigned char *adaptor, void *ndata) { secp256k1_scalar sk; secp256k1_scalar e; secp256k1_scalar k; @@ -116,10 +116,10 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c VERIFY_CHECK(ctx != NULL); ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)); - ARG_CHECK(sig65 != NULL); + ARG_CHECK(presig65 != NULL); ARG_CHECK(msg32 != NULL); ARG_CHECK(keypair != NULL); - ARG_CHECK(t33 != NULL); + ARG_CHECK(adaptor != NULL); if (noncefp == NULL) { noncefp = secp256k1_adaptor_nonce_function_bip340; @@ -136,7 +136,7 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c /* bytes_from_point(P) */ secp256k1_fe_get_b32(pk_buf, &pk.x); - ret &= !!noncefp(nonce32, msg32, seckey, t33, pk_buf, adaptor_bip340_algo, sizeof(adaptor_bip340_algo), ndata); + ret &= !!noncefp(nonce32, msg32, seckey, adaptor, pk_buf, adaptor_bip340_algo, sizeof(adaptor_bip340_algo), ndata); /* k0 */ secp256k1_scalar_set_b32(&k, nonce32, NULL); ret &= !secp256k1_scalar_is_zero(&k); @@ -147,7 +147,7 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c secp256k1_ge_set_gej(&r, &rj); /* T = cpoint(T) */ - ret &= !!secp256k1_eckey_pubkey_parse(&t, t33, 33); + ret &= !!secp256k1_eckey_pubkey_parse(&t, adaptor, 33); /* R' = k*G + T, can use gej_add_ge_var since r and t aren't secret */ secp256k1_gej_add_ge_var(&r0j, &rj, &t, NULL); @@ -161,15 +161,15 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c secp256k1_scalar_negate(&k, &k); } - ret &= !!secp256k1_eckey_pubkey_serialize(&r0, sig65, &size, 1); + ret &= !!secp256k1_eckey_pubkey_serialize(&r0, presig65, &size, 1); - secp256k1_schnorrsig_challenge(&e, &sig65[1], msg32, msglen, pk_buf); + secp256k1_schnorrsig_challenge(&e, &presig65[1], msg32, msglen, pk_buf); secp256k1_scalar_mul(&e, &e, &sk); /* k + e * d */ secp256k1_scalar_add(&e, &e, &k); - secp256k1_scalar_get_b32(&sig65[33], &e); + secp256k1_scalar_get_b32(&presig65[33], &e); - secp256k1_memczero(sig65, 65, !ret); + secp256k1_memczero(presig65, 65, !ret); secp256k1_scalar_clear(&k); secp256k1_scalar_clear(&sk); memset(seckey, 0, sizeof(seckey)); @@ -177,12 +177,12 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c return ret; } -int secp256k1_schnorr_adaptor_presign(const secp256k1_context *ctx, unsigned char *sig65, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *t33, const unsigned char *aux_rand32) { +int secp256k1_schnorr_adaptor_presign(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *adaptor, const unsigned char *aux_rand32) { /* We cast away const from the passed aux_rand32 argument since we know the default nonce function does not modify it. */ - return secp256k1_schnorr_adaptor_presign_internal(ctx, sig65, msg32, keypair, secp256k1_adaptor_nonce_function_bip340, t33, (unsigned char*)aux_rand32); + return secp256k1_schnorr_adaptor_presign_internal(ctx, presig65, msg32, keypair, secp256k1_adaptor_nonce_function_bip340, adaptor, (unsigned char*)aux_rand32); } -int secp256k1_schnorr_adaptor_extract_t(const secp256k1_context *ctx, unsigned char *t33, const unsigned char *sig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey) { +int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned char *adaptor, const unsigned char *presig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey) { secp256k1_scalar s0; secp256k1_scalar e; secp256k1_gej rj; @@ -200,8 +200,8 @@ int secp256k1_schnorr_adaptor_extract_t(const secp256k1_context *ctx, unsigned c int ret = 1; VERIFY_CHECK(ctx != NULL); - ARG_CHECK(t33 != NULL); - ARG_CHECK(sig65 != NULL); + ARG_CHECK(adaptor != NULL); + ARG_CHECK(presig65 != NULL); ARG_CHECK(msg32 != NULL); ARG_CHECK(pubkey != NULL); @@ -209,16 +209,16 @@ int secp256k1_schnorr_adaptor_extract_t(const secp256k1_context *ctx, unsigned c ret &= !!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey); /* s0 */ - secp256k1_scalar_set_b32(&s0, &sig65[33], &overflow); + secp256k1_scalar_set_b32(&s0, &presig65[33], &overflow); ret &= !overflow; /* R0 */ - ret &= !!secp256k1_xonly_pubkey_parse(ctx, &pkr0, &sig65[1]); + ret &= !!secp256k1_xonly_pubkey_parse(ctx, &pkr0, &presig65[1]); ret &= !!secp256k1_xonly_pubkey_load(ctx, &r0, &pkr0); /* Compute e */ secp256k1_fe_get_b32(buf, &pk.x); - secp256k1_schnorrsig_challenge(&e, &sig65[1], msg32, msglen, buf); + secp256k1_schnorrsig_challenge(&e, &presig65[1], msg32, msglen, buf); /* Compute rj = s0*G + (-e) * pkj */ secp256k1_scalar_negate(&e, &e); @@ -232,22 +232,22 @@ int secp256k1_schnorr_adaptor_extract_t(const secp256k1_context *ctx, unsigned c /* T = R0 + (- R) */ secp256k1_gej_neg(&rj, &rj); secp256k1_gej_add_ge_var(&tj, &rj, &r0, NULL); - if (sig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { + if (presig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { ; - } else if (sig65[0] == SECP256K1_TAG_PUBKEY_ODD) { + } else if (presig65[0] == SECP256K1_TAG_PUBKEY_ODD) { secp256k1_gej_neg(&tj, &tj); } else { ret = 0; } secp256k1_ge_set_gej(&t, &tj); - ret &= !!secp256k1_eckey_pubkey_serialize(&t, t33, &size, 1); + ret &= !!secp256k1_eckey_pubkey_serialize(&t, adaptor, &size, 1); - secp256k1_memczero(t33, 33, !ret); + secp256k1_memczero(adaptor, 33, !ret); return ret; } -int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *sig65, const unsigned char *t32) { +int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *presig65, const unsigned char *secadaptor) { secp256k1_scalar s0; secp256k1_scalar s; secp256k1_scalar t; @@ -256,26 +256,26 @@ int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char VERIFY_CHECK(ctx != NULL); ARG_CHECK(sig64 != NULL); - ARG_CHECK(sig65 != NULL); - ARG_CHECK(sig65[0] == SECP256K1_TAG_PUBKEY_EVEN || sig65[0] == SECP256K1_TAG_PUBKEY_ODD); - ARG_CHECK(t32 != NULL); + ARG_CHECK(presig65 != NULL); + ARG_CHECK(presig65[0] == SECP256K1_TAG_PUBKEY_EVEN || presig65[0] == SECP256K1_TAG_PUBKEY_ODD); + ARG_CHECK(secadaptor != NULL); /* s0 */ - secp256k1_scalar_set_b32(&s0, &sig65[33], &overflow); + secp256k1_scalar_set_b32(&s0, &presig65[33], &overflow); ret &= !overflow; /* t */ - secp256k1_scalar_set_b32(&t, t32, &overflow); + secp256k1_scalar_set_b32(&t, secadaptor, &overflow); ret &= !overflow; - if (sig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { + if (presig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { secp256k1_scalar_add(&s, &s0, &t); - } else if (sig65[0] == SECP256K1_TAG_PUBKEY_ODD) { + } else if (presig65[0] == SECP256K1_TAG_PUBKEY_ODD) { secp256k1_scalar_negate(&t, &t); secp256k1_scalar_add(&s, &s0, &t); } - memcpy(sig64, &sig65[1], 32); + memcpy(sig64, &presig65[1], 32); secp256k1_scalar_get_b32(&sig64[32], &s); secp256k1_memczero(sig64, 64, !ret); secp256k1_scalar_clear(&s); @@ -284,7 +284,7 @@ int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char return ret; } -int secp256k1_schnorr_adaptor_extract_adaptor(const secp256k1_context *ctx, unsigned char *t32, const unsigned char *sig65, const unsigned char *sig64) { +int secp256k1_schnorr_adaptor_extract_sec(const secp256k1_context *ctx, unsigned char *secadaptor, const unsigned char *presig65, const unsigned char *sig64) { secp256k1_scalar s0; secp256k1_scalar s; secp256k1_scalar t; @@ -292,29 +292,29 @@ int secp256k1_schnorr_adaptor_extract_adaptor(const secp256k1_context *ctx, unsi int ret = 1; VERIFY_CHECK(ctx != NULL); - ARG_CHECK(t32 != NULL); - ARG_CHECK(sig65 != NULL); - ARG_CHECK(sig65[0] == SECP256K1_TAG_PUBKEY_EVEN || sig65[0] == SECP256K1_TAG_PUBKEY_ODD); + ARG_CHECK(secadaptor != NULL); + ARG_CHECK(presig65 != NULL); + ARG_CHECK(presig65[0] == SECP256K1_TAG_PUBKEY_EVEN || presig65[0] == SECP256K1_TAG_PUBKEY_ODD); ARG_CHECK(sig64 != NULL); /* s0 */ - secp256k1_scalar_set_b32(&s0, &sig65[33], &overflow); + secp256k1_scalar_set_b32(&s0, &presig65[33], &overflow); ret &= !overflow; /* s */ secp256k1_scalar_set_b32(&s, &sig64[32], &overflow); ret &= !overflow; - if (sig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { + if (presig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { secp256k1_scalar_negate(&s0, &s0); secp256k1_scalar_add(&t, &s, &s0); - } else if (sig65[0] == SECP256K1_TAG_PUBKEY_ODD) { + } else if (presig65[0] == SECP256K1_TAG_PUBKEY_ODD) { secp256k1_scalar_negate(&s, &s); secp256k1_scalar_add(&t, &s0, &s); } - secp256k1_scalar_get_b32(t32, &t); - secp256k1_memczero(t32, 32, !ret); + secp256k1_scalar_get_b32(secadaptor, &t); + secp256k1_memczero(secadaptor, 32, !ret); secp256k1_scalar_clear(&s); secp256k1_scalar_clear(&t); diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h index b48dd9b15..00e3e518b 100644 --- a/src/modules/schnorr_adaptor/tests_impl.h +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -27,14 +27,14 @@ void run_adaptor_nonce_function_bip340_tests(void) { size_t algolen = sizeof(algo); secp256k1_sha256 sha; secp256k1_sha256 sha_optimized; - secp256k1_scalar adaptor; + secp256k1_scalar adaptor_scalar; secp256k1_gej tj; secp256k1_ge tg; unsigned char nonce[32], nonce_z[32]; unsigned char msg[32]; unsigned char key[32]; unsigned char t[32]; - unsigned char t33[33]; + unsigned char adaptor[33]; unsigned char pk[32]; unsigned char aux_rand[32]; unsigned char *args[6]; @@ -61,15 +61,15 @@ void run_adaptor_nonce_function_bip340_tests(void) { secp256k1_testrand256(pk); secp256k1_testrand256(aux_rand); - secp256k1_scalar_set_b32(&adaptor, t, NULL); - secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor); + secp256k1_scalar_set_b32(&adaptor_scalar, t, NULL); + secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor_scalar); secp256k1_ge_set_gej(&tg, &tj); - CHECK(secp256k1_eckey_pubkey_serialize(&tg, t33, &size, 1) == 1); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor, &size, 1) == 1); /* Check that a bitflip in an argument results in different nonces. */ args[0] = msg; args[1] = key; - args[2] = t33; + args[2] = adaptor; args[3] = pk; args[4] = algo; args[5] = aux_rand; @@ -115,7 +115,7 @@ void test_schnorr_adaptor_api(void) { unsigned char sk2[32]; unsigned char sk3[32]; unsigned char msg[32]; - unsigned char t32[32]; + unsigned char secadaptor[32]; unsigned char t[33] = { 0x02, 0xC6, 0x04, 0x7F, 0x94, 0x41, 0xED, 0x7D, 0x6D, 0x30, 0x45, 0x40, 0x6E, 0x95, 0xC0, 0x7C, @@ -137,7 +137,7 @@ void test_schnorr_adaptor_api(void) { secp256k1_testrand256(sk2); secp256k1_testrand256(sk3); secp256k1_testrand256(msg); - secp256k1_testrand256(t32); + secp256k1_testrand256(secadaptor); CHECK(secp256k1_keypair_create(CTX, &keypairs[0], sk1) == 1); CHECK(secp256k1_keypair_create(CTX, &keypairs[1], sk2) == 1); CHECK(secp256k1_keypair_create(CTX, &keypairs[2], sk3) == 1); @@ -157,74 +157,74 @@ void test_schnorr_adaptor_api(void) { CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL)); CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], t, NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &pk[0]) == 1); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, NULL, sig, msg, &pk[0])); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, t2, NULL, msg, &pk[0])); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, NULL, &pk[0])); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, NULL)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_t(CTX, t2, sig, msg, &zero_pk)); - - CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, NULL, sig, t32)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, sig64, NULL, t32)); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, &pk[0]) == 1); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, NULL, sig, msg, &pk[0])); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, NULL, msg, &pk[0])); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, NULL, &pk[0])); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, &zero_pk)); + + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, secadaptor) == 1); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, NULL, sig, secadaptor)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, sig64, NULL, secadaptor)); CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, NULL)); - CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, sig64) == 1); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_adaptor(CTX, NULL, sig, sig64)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, NULL, sig64)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_adaptor(CTX, adaptor, sig, NULL)); + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, secadaptor) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_sec(CTX, adaptor, sig, sig64) == 1); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_sec(CTX, NULL, sig, sig64)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_sec(CTX, adaptor, NULL, sig64)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_sec(CTX, adaptor, sig, NULL)); } /* Helper function for schnorr_adaptor_vectors * Signs the message and checks that it's the same as expected_sig. */ -void test_schnorr_adaptor_vectors_check_presigning(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *t33, const unsigned char *expected_sig) { +void test_schnorr_adaptor_vectors_check_presigning(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *adaptor, const unsigned char *expected_sig) { unsigned char sig[65]; unsigned char t[33]; secp256k1_keypair keypair; secp256k1_xonly_pubkey pk, pk_expected; CHECK(secp256k1_keypair_create(CTX, &keypair, sk)); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg32, &keypair, t33, aux_rand)); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg32, &keypair, adaptor, aux_rand)); CHECK(secp256k1_memcmp_var(sig, expected_sig, 65) == 0); CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk_expected, pk_serialized)); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair)); CHECK(secp256k1_memcmp_var(&pk, &pk_expected, sizeof(pk)) == 0); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg32, &pk)); - CHECK(secp256k1_memcmp_var(t, t33, 33) == 0); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg32, &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor, 33) == 0); } /* Helper function for schnorr_adaptor_vectors * Extracts the adaptor point and checks if it returns the same value as expected. */ - void test_schnorr_adaptor_vectors_check_extract_t(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, const unsigned char *expected_t, int expected) { + void test_schnorr_adaptor_vectors_check_extract(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, const unsigned char *expected_t, int expected) { secp256k1_xonly_pubkey pk; unsigned char t[33]; CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk, pk_serialized)); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg32, &pk)); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg32, &pk)); CHECK(expected == (secp256k1_memcmp_var(t, expected_t, 33) == 0)); } /* Helper function for schnorr_adaptor_vectors * Adapt a Schnorr adptor signature to a valid Schnorr signature * and checks if it is the same as expected_sig64. */ -void test_schnorr_adaptor_vectors_check_adapt(const unsigned char *sig, const unsigned char *t32, const unsigned char *expected_sig64, int expected) { +void test_schnorr_adaptor_vectors_check_adapt(const unsigned char *sig, const unsigned char *secadaptor, const unsigned char *expected_sig64, int expected) { unsigned char sig64[64]; - CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32)); + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, secadaptor)); CHECK(expected == (secp256k1_memcmp_var(sig64, expected_sig64, 64) == 0)); } /* Helper function for schnorr_adaptor_vectors * Extract adaptor from a Schnorr adptor signature and a Schnorr signature - * and checks if it is the same as expected_t32. */ -void test_schnorr_adaptor_vectors_check_extract_adaptor(const unsigned char *sig, const unsigned char *sig64, const unsigned char *expected_t32, int expected) { - unsigned char t32[32]; + * and checks if it is the same as expected_secadaptor. */ +void test_schnorr_adaptor_vectors_check_extract_sec(const unsigned char *sig, const unsigned char *sig64, const unsigned char *expected_secadaptor, int expected) { + unsigned char secadaptor[32]; - CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, t32, sig, sig64)); - CHECK(expected == (secp256k1_memcmp_var(t32, expected_t32, 32) == 0)); + CHECK(secp256k1_schnorr_adaptor_extract_sec(CTX, secadaptor, sig, sig64)); + CHECK(expected == (secp256k1_memcmp_var(secadaptor, expected_secadaptor, 32) == 0)); } /* Test vectors, see https://github.com/ZhePang/Python_Specification_for_Schnorr_Adaptor */ @@ -288,9 +288,9 @@ void test_schnorr_adaptor_vectors(void) { 0x02, 0xCB, 0x80, 0x8C, 0xD3, 0x19, 0x23, 0x9E }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); - test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_extract(pk, msg, sig, t, 1); test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); - test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + test_schnorr_adaptor_vectors_check_extract_sec(sig, sig64, t32, 1); }; { /* Test vector 1 */ @@ -351,9 +351,9 @@ void test_schnorr_adaptor_vectors(void) { 0x99, 0x4C, 0x23, 0x24, 0xB0, 0x9C, 0xEB, 0x21 }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); - test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_extract(pk, msg, sig, t, 1); test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); - test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + test_schnorr_adaptor_vectors_check_extract_sec(sig, sig64, t32, 1); }; { /* Test vector 2 */ @@ -414,9 +414,9 @@ void test_schnorr_adaptor_vectors(void) { 0xC4, 0x74, 0xCB, 0xDA, 0x9C, 0x1A, 0xA3, 0x1C }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); - test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_extract(pk, msg, sig, t, 1); test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); - test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + test_schnorr_adaptor_vectors_check_extract_sec(sig, sig64, t32, 1); }; { /* Test vector 3 */ @@ -477,9 +477,9 @@ void test_schnorr_adaptor_vectors(void) { 0x99, 0x2E, 0xD5, 0x62, 0xB2, 0x72, 0xDD, 0x27 }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); - test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_extract(pk, msg, sig, t, 1); test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); - test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + test_schnorr_adaptor_vectors_check_extract_sec(sig, sig64, t32, 1); }; { /* Test vector 4 */ @@ -540,9 +540,9 @@ void test_schnorr_adaptor_vectors(void) { 0x21, 0x4F, 0x63, 0x4A, 0xE0, 0x64, 0xE2, 0x1A }; test_schnorr_adaptor_vectors_check_presigning(sk, pk, aux_rand, msg, t, sig); - test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 1); + test_schnorr_adaptor_vectors_check_extract(pk, msg, sig, t, 1); test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); - test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + test_schnorr_adaptor_vectors_check_extract_sec(sig, sig64, t32, 1); }; { /* Test vector 5 */ @@ -587,7 +587,7 @@ void test_schnorr_adaptor_vectors(void) { 0xD8, 0x36, 0xE7, 0x15, 0xF2, 0xD5, 0xDA, 0xE8, 0x96, 0x4C, 0x7F, 0x9F, 0x17, 0xFD, 0x0C, 0xF0, 0x90 }; - test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); + test_schnorr_adaptor_vectors_check_extract(pk, msg, sig, t, 0); }; { /* Test vector 7 */ @@ -620,7 +620,7 @@ void test_schnorr_adaptor_vectors(void) { 0xE8, 0xA4, 0x50, 0xF7, 0xC7, 0x07, 0x0A, 0x86, 0xC8, 0x58, 0xFF, 0xE6, 0x26, 0x9A, 0xF3, 0x53, 0xE1 }; - test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); + test_schnorr_adaptor_vectors_check_extract(pk, msg, sig, t, 0); }; { /* Test vector 8 */ @@ -653,7 +653,7 @@ void test_schnorr_adaptor_vectors(void) { 0x63, 0xDC, 0x77, 0x66, 0x35, 0x83, 0xE5, 0xEC, 0xA4, 0x0F, 0xFE, 0xC9, 0x79, 0xF5, 0xF3, 0x73, 0x8E }; - test_schnorr_adaptor_vectors_check_extract_t(pk, msg, sig, t, 0); + test_schnorr_adaptor_vectors_check_extract(pk, msg, sig, t, 0); }; { /* Test vector 9 */ @@ -701,7 +701,7 @@ void test_schnorr_adaptor_vectors(void) { 0x31, 0xB5, 0x5B, 0x4A, 0x58, 0x14, 0x85, 0x2D }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 1); - test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 1); + test_schnorr_adaptor_vectors_check_extract_sec(sig, sig64, t32, 1); }; { /* Test vector 11 */ @@ -733,7 +733,7 @@ void test_schnorr_adaptor_vectors(void) { 0x6A, 0x5E, 0xA3, 0x3D, 0x3E, 0x1D, 0x6B, 0xA3 }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); - test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 0); + test_schnorr_adaptor_vectors_check_extract_sec(sig, sig64, t32, 0); }; { /* Test vector 12 */ @@ -765,7 +765,7 @@ void test_schnorr_adaptor_vectors(void) { 0x6A, 0x5E, 0xA3, 0x3D, 0x3E, 0x1D, 0x6B, 0xA3 }; test_schnorr_adaptor_vectors_check_adapt(sig, t32, sig64, 0); - test_schnorr_adaptor_vectors_check_extract_adaptor(sig, sig64, t32, 0); + test_schnorr_adaptor_vectors_check_extract_sec(sig, sig64, t32, 0); }; { /* Test vector 13 */ @@ -804,52 +804,52 @@ void test_schnorr_adaptor_presign(void) { unsigned char sk[32]; secp256k1_xonly_pubkey pk; secp256k1_keypair keypair; - secp256k1_scalar adaptor; + secp256k1_scalar adaptor_scalar; secp256k1_gej tj; secp256k1_ge tg; const unsigned char msg[32] = "this is for the schnorr adaptor."; unsigned char sig[65]; unsigned char sig2[65]; - unsigned char t32[32]; + unsigned char secadaptor[32]; unsigned char aux_rand[32]; - unsigned char t33[33]; + unsigned char adaptor[33]; unsigned char t[33]; size_t size = 33; secp256k1_testrand256(sk); - secp256k1_testrand256(t32); + secp256k1_testrand256(secadaptor); secp256k1_testrand256(aux_rand); - secp256k1_scalar_set_b32(&adaptor, t32, NULL); - secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor); + secp256k1_scalar_set_b32(&adaptor_scalar, secadaptor, NULL); + secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor_scalar); secp256k1_ge_set_gej(&tg, &tj); - CHECK(secp256k1_eckey_pubkey_serialize(&tg, t33, &size, 1) == 1); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor, &size, 1) == 1); CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, t33, NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg, &pk)); - CHECK(secp256k1_memcmp_var(t, t33, 33) == 0); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, adaptor, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg, &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor, 33) == 0); /* Test with aux_rand */ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig2, msg, &keypair, t33, aux_rand) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg, &pk)); - CHECK(secp256k1_memcmp_var(t, t33, 33) == 0); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig2, msg, &keypair, adaptor, aux_rand) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg, &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor, 33) == 0); } #define N_SIGS 3 -/* Creates N_SIGS valid signatures and verifies them with extract_t - * Then flips some bits and checks that extract_t now fails to get the right +/* Creates N_SIGS valid signatures and verifies them with extract + * Then flips some bits and checks that extract now fails to get the right * adaptor point. */ -void test_schnorr_adaptor_extract_t(void) { +void test_schnorr_adaptor_extract(void) { unsigned char sk[32]; secp256k1_xonly_pubkey pk; secp256k1_keypair keypair; - secp256k1_scalar adaptor; + secp256k1_scalar adaptor_scalar; secp256k1_gej tj; secp256k1_ge tg; secp256k1_scalar s; unsigned char msg[N_SIGS][32]; unsigned char sig[N_SIGS][65]; - unsigned char t32[N_SIGS][32]; - unsigned char t33[N_SIGS][33]; + unsigned char secadaptor[N_SIGS][32]; + unsigned char adaptor[N_SIGS][33]; unsigned char t[33]; size_t size = 33; size_t i; @@ -860,84 +860,84 @@ void test_schnorr_adaptor_extract_t(void) { for (i = 0; i < N_SIGS; i++) { secp256k1_testrand256(msg[i]); - secp256k1_testrand256(t32[i]); - secp256k1_scalar_set_b32(&adaptor, t32[i], NULL); - secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor); + secp256k1_testrand256(secadaptor[i]); + secp256k1_scalar_set_b32(&adaptor_scalar, secadaptor[i], NULL); + secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor_scalar); secp256k1_ge_set_gej(&tg, &tj); - CHECK(secp256k1_eckey_pubkey_serialize(&tg, t33[i], &size, 1) == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[i], msg[i], &keypair, t33[i], NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[i], msg[i], &pk)); - CHECK(secp256k1_memcmp_var(t, t33[i], 33) == 0); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor[i], &size, 1) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[i], msg[i], &keypair, adaptor[i], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[i], msg[i], &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor[i], 33) == 0); } { - /* Flip some bits in the signature and check that extract_t fails to + /* Flip some bits in the signature and check that extract fails to * extract the correct adaptor point */ size_t sig_idx = secp256k1_testrand_int(N_SIGS); size_t byte_idx = secp256k1_testrand_bits(5); unsigned char xorbyte = secp256k1_testrand_int(254)+1; sig[sig_idx][33 + byte_idx] ^= xorbyte; - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); - CHECK(secp256k1_memcmp_var(t, t33[sig_idx], 33) != 0); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor[sig_idx], 33) != 0); sig[sig_idx][33 + byte_idx] ^= xorbyte; - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); - CHECK(secp256k1_memcmp_var(t, t33[sig_idx], 33) == 0); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor[sig_idx], 33) == 0); } /* Test overflowing s */ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, t33[0], NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, t33[0], 33) == 0); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, adaptor[0], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor[0], 33) == 0); memset(&sig[0][33], 0xFF, 32); - CHECK(!secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, t33[0], 33) != 0); + CHECK(!secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor[0], 33) != 0); /* Test negative s */ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, t33[0], NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, t33[0], 33) == 0); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, adaptor[0], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor[0], 33) == 0); secp256k1_scalar_set_b32(&s, &sig[0][33], NULL); secp256k1_scalar_negate(&s, &s); secp256k1_scalar_get_b32(&sig[0][33], &s); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, t33[0], 33) != 0); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor[0], 33) != 0); } #undef N_SIGS -void test_schnorr_adaptor_adapt_extract_adaptor(void) { +void test_schnorr_adaptor_adapt_extract_sec(void) { unsigned char sk[32]; secp256k1_xonly_pubkey pk; secp256k1_keypair keypair; - secp256k1_scalar adaptor; + secp256k1_scalar adaptor_scalar; secp256k1_gej tj; secp256k1_ge tg; unsigned char msg[32]; unsigned char sig[65]; unsigned char sig64[64]; - unsigned char t32[32]; + unsigned char secadaptor[32]; unsigned char aux_rand[32]; - unsigned char t33[33]; + unsigned char adaptor[33]; unsigned char t[33]; unsigned char t2[32]; size_t size = 33; secp256k1_testrand256(sk); secp256k1_testrand256(msg); - secp256k1_testrand256(t32); + secp256k1_testrand256(secadaptor); secp256k1_testrand256(aux_rand); - secp256k1_scalar_set_b32(&adaptor, t32, NULL); - secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor); + secp256k1_scalar_set_b32(&adaptor_scalar, secadaptor, NULL); + secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor_scalar); secp256k1_ge_set_gej(&tg, &tj); - CHECK(secp256k1_eckey_pubkey_serialize(&tg, t33, &size, 1) == 1); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor, &size, 1) == 1); CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, t33, NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_t(CTX, t, sig, msg, &pk)); - CHECK(secp256k1_memcmp_var(t, t33, 33) == 0); - CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, t32) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_adaptor(CTX, t2, sig, sig64) == 1); - CHECK(secp256k1_memcmp_var(t2, t32, 32) == 0); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, adaptor, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg, &pk)); + CHECK(secp256k1_memcmp_var(t, adaptor, 33) == 0); + CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, secadaptor) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_sec(CTX, t2, sig, sig64) == 1); + CHECK(secp256k1_memcmp_var(t2, secadaptor, 32) == 0); } void run_schnorr_adaptor_tests(void) { @@ -949,8 +949,8 @@ void run_schnorr_adaptor_tests(void) { test_schnorr_adaptor_vectors(); for (i = 0; i < COUNT; i++) { test_schnorr_adaptor_presign(); - test_schnorr_adaptor_extract_t(); - test_schnorr_adaptor_adapt_extract_adaptor(); + test_schnorr_adaptor_extract(); + test_schnorr_adaptor_adapt_extract_sec(); } } From 344620e0ce4e9168bbe7bd8f1b07e6288dadc436 Mon Sep 17 00:00:00 2001 From: ZhePang Date: Mon, 1 Apr 2024 11:01:32 -0400 Subject: [PATCH 08/10] update naming and documentations and some debugs --- configure.ac | 3 +- include/secp256k1_schnorr_adaptor.h | 73 +++++----- src/modules/schnorr_adaptor/main_impl.h | 62 ++++----- src/modules/schnorr_adaptor/tests_impl.h | 167 +++++++++++------------ 4 files changed, 140 insertions(+), 165 deletions(-) diff --git a/configure.ac b/configure.ac index a3d20804e..fe512c82f 100644 --- a/configure.ac +++ b/configure.ac @@ -497,6 +497,7 @@ fi if test x"$enable_module_schnorr_adaptor" = x"yes"; then AC_DEFINE(ENABLE_MODULE_SCHNORR_ADAPTOR, 1, [Define thsi symbol to enable the Schnorr adaptor module]) enable_module_extrakeys=yes + enable_module_schnorrsig=yes fi if test x"$enable_module_ellswift" = x"yes"; then @@ -567,7 +568,7 @@ else AC_MSG_ERROR([ARM32 assembly optimization is experimental. Use --enable-experimental to allow.]) fi if test x"$enable_module_schnorr_adaptor" = x"yes"; then - AC_MSG_ERROR([schnorr adaptor signatures module is experimental. Use --enable-experimental to allow.]) + AC_MSG_ERROR([Schnorr adaptor signatures module is experimental. Use --enable-experimental to allow.]) fi fi diff --git a/include/secp256k1_schnorr_adaptor.h b/include/secp256k1_schnorr_adaptor.h index 4b49eca91..7a53f6cc6 100644 --- a/include/secp256k1_schnorr_adaptor.h +++ b/include/secp256k1_schnorr_adaptor.h @@ -11,16 +11,14 @@ extern "C" { /** A pointer to a function to deterministically generate a nonce. * * Same as secp256k1_schnorrsig_nonce function with the exception of accepting an - * additional adaptor point t argument. The adaptor point argument can protect - * signature schemes with key-prefixed challenge hash inputs against reusing the - * nonce when signing with different adaptor points. + * additional adaptor point argument. * * Returns: 1 if a nonce was successfully generated. 0 will cause signing to * return an error. * Out: nonce32: pointer to a 32-byte array to be filled by the function * In: msg32: the 32-byte message being verified (will not be NULL) * key32: pointer to a 32-byte secret key (will not be NULL) - * adaptor: the 33-byte serialized adaptor point (will not be NULL) + * adaptor33: the 33-byte serialized adaptor point (will not be NULL) * xonly_pk32: the 32-byte serialized xonly pubkey corresponding to key32 * (will not be NULL) * algo: pointer to an array describing the signature @@ -35,24 +33,15 @@ typedef int (*secp256k1_adaptor_nonce_function_hardened)( unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, - const unsigned char *adaptor, + const unsigned char *adaptor33, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data ); -/** A modified BIP-340 nonce generation function. - * - * If a data pointer is passed, it is assumed to be a pointer to 32 bytes of - * auxiliary random data as defined in BIP-340. If the data pointer is NULL, - * the nonce derivation procedure follows BIP-340 by setting the auxiliary - * random data to zero. The algo argument must be non-NULL, otherwise the - * function will fail and return 0. The hash will be tagged with algo. - * Therefore, to create BIP-340 compliant signatures, algo must be set to - * "BIP0340/nonce" and algolen to 13. - */ -SECP256K1_API const secp256k1_adaptor_nonce_function_hardened secp256k1_adaptor_nonce_function_bip340; +/** A Schnorr Adaptor nonce generation function. */ +SECP256K1_API const secp256k1_adaptor_nonce_function_hardened secp256k1_nonce_function_schnorr_adaptor; /** Create a Schnorr adaptor signature. * @@ -64,49 +53,49 @@ SECP256K1_API const secp256k1_adaptor_nonce_function_hardened secp256k1_adaptor_ * signatures from being valid in multiple contexts by accident. * * Returns 1 on success, 0 on failure. - * Args: ctx: pointer to a context object (not secp256k1_context_static). - * Out: presig65: pointer to a 65-byte array to store the serialized adaptor signature. - * In: msg32: the 32-byte message being signed. - * keypair: pointer to an initialized keypair. - * adaptor: pointer to a 33-byte compressed adaptor point. - * aux_rand32: 32 bytes of fresh randomness. While recommended to provide - * this, it is only supplemental to security and can be NULL. A - * NULL argument is treated the same as an all-zero one. See - * BIP-340 "Default Signing" for a full explanation of this - * argument and for guidance if randomness is expensive. + * Args: ctx: pointer to a context object (not secp256k1_context_static). + * Out: presig65: pointer to a 65-byte array to store the adaptor signature. + * In: msg32: the 32-byte message being signed. + * keypair: pointer to an initialized keypair. + * adaptor33: pointer to a 33-byte compressed adaptor point. + * aux_rand32: 32 bytes of fresh randomness. While recommended to provide + * this, it is only supplemental to security and can be NULL. A + * NULL argument is treated the same as an all-zero one. See + * BIP-340 "Default Signing" for a full explanation of this + * argument and for guidance if randomness is expensive. */ SECP256K1_API int secp256k1_schnorr_adaptor_presign( const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, - const unsigned char *adaptor, + const unsigned char *adaptor33, const unsigned char *aux_rand32 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); -/** Extract an adaptor point T from the signature. +/** Extract an adaptor point from the signature. * * Returns 1 on success, 0 on failure. - * Args: ctx: pointer to a context object. - * Out: adaptor: pointer to a 33-byte array to store the compressed adaptor point. - * In: presig65: pointer to a 65-byte serialized adaptor signature. - * msg32: the 32-byte message being signed. - * pubkey: pointer to an x-only public key to verify with (cannot be NULL) + * Args: ctx: pointer to a context object. + * Out: adaptor33: pointer to a 33-byte array to store the compressed adaptor point. + * In: presig65: pointer to a 65-byte adaptor signature. + * msg32: the 32-byte message being signed. + * pubkey: pointer to an x-only public key to verify with */ SECP256K1_API int secp256k1_schnorr_adaptor_extract( const secp256k1_context *ctx, - unsigned char *adaptor, + unsigned char *adaptor33, const unsigned char *presig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); -/** Adapt an adaptor signature to a schnorr signature. +/** Adapt an adaptor signature to result in a Schnorr signature. * * Returns 1 on success, 0 on failure. * Args: ctx: pointer to a context object. - * Out: sig64: pointer to a 64-byte array to store the adapted schnorr signature. - * In: presig65: pointer to a 65-byte serialized adaptor signature. + * Out: sig64: pointer to a 64-byte array to store the adapted Schnorr signature. + * In: presig65: pointer to a 65-byte adaptor signature. * secadaptor: pointer to a 32-byte secadaptor. */ SECP256K1_API int secp256k1_schnorr_adaptor_adapt( @@ -116,13 +105,13 @@ SECP256K1_API int secp256k1_schnorr_adaptor_adapt( const unsigned char *secadaptor ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); -/** Extract the secadaptor from an adaptor signature and a schnorr signature. +/** Extract the secadaptor from a valid adaptor signature and a Schnorr signature. * * Returns 1 on success, 0 on failure. - * Args: ctx: pointer to a context object. - * Out: secadaptor: pointer to a 32-byte array to store the secadaptor. - * In: presig65: pointer to a 65-byte serialized adaptor signature. - * sig64: pointer to a 64-byte adapted schnorr signature. + * Args: ctx: pointer to a context object. + * Out: secadaptor: pointer to a 32-byte array to store the secadaptor. + * In: presig65: pointer to a 65-byte adaptor signature. + * sig64: pointer to a 64-byte adapted Schnorr signature. */ SECP256K1_API int secp256k1_schnorr_adaptor_extract_sec( const secp256k1_context *ctx, diff --git a/src/modules/schnorr_adaptor/main_impl.h b/src/modules/schnorr_adaptor/main_impl.h index 0aefb5b78..72091cfd3 100644 --- a/src/modules/schnorr_adaptor/main_impl.h +++ b/src/modules/schnorr_adaptor/main_impl.h @@ -13,7 +13,7 @@ /* Initializes SHA256 with fixed midstate. This midstate was computed by applying * SHA256 to SHA256("SchnorrAdaptor/nonce")||SHA256("SchnorrAdaptor/nonce"). */ -static void secp256k1_adaptor_nonce_function_bip340_sha256_tagged(secp256k1_sha256 *sha) { +static void secp256k1_nonce_function_schnorr_adaptor_sha256_tagged(secp256k1_sha256 *sha) { secp256k1_sha256_initialize(sha); sha->s[0] = 0xe268ac2aul; sha->s[1] = 0x3a221b84ul; @@ -29,7 +29,7 @@ static void secp256k1_adaptor_nonce_function_bip340_sha256_tagged(secp256k1_sha2 /* Initializes SHA256 with fixed midstate. This midstate was computed by applying * SHA256 to SHA256("SchnorrAdaptor/aux")||SHA256("SchnorrAdaptor/aux"). */ -static void secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(secp256k1_sha256 *sha) { +static void secp256k1_nonce_function_schnorr_adaptor_sha256_tagged_aux(secp256k1_sha256 *sha) { secp256k1_sha256_initialize(sha); sha->s[0] = 0x50685e98ul; sha->s[1] = 0x6313905eul; @@ -47,7 +47,7 @@ static void secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(secp256k1_ * by using the correct tagged hash function. */ static const unsigned char adaptor_bip340_algo[20] = "SchnorrAdaptor/nonce"; -static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *adaptor, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) { +static int nonce_function_schnorr_adaptor(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *adaptor33, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) { secp256k1_sha256 sha; unsigned char masked_key[32]; int i; @@ -57,7 +57,7 @@ static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned } if (data != NULL) { - secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(&sha); + secp256k1_nonce_function_schnorr_adaptor_sha256_tagged_aux(&sha); secp256k1_sha256_write(&sha, data, 32); secp256k1_sha256_finalize(&sha, masked_key); for (i = 0; i < 32; i++) { @@ -77,27 +77,26 @@ static int adaptor_nonce_function_bip340(unsigned char *nonce32, const unsigned } /* Tag the hash with algo which is important to avoid nonce reuse across - * algorithms. If this nonce function is used in BIP-340 signing as defined - * in the spec, an optimized tagging implementation is used. */ + * algorithms. */ if (algolen == sizeof(adaptor_bip340_algo) && secp256k1_memcmp_var(algo, adaptor_bip340_algo, algolen) == 0) { - secp256k1_adaptor_nonce_function_bip340_sha256_tagged(&sha); + secp256k1_nonce_function_schnorr_adaptor_sha256_tagged(&sha); } else { secp256k1_sha256_initialize_tagged(&sha, algo, algolen); } - /* Hash masked-key||pk||msg using the tagged hash as per the spec */ + /* Hash masked-key||adaptor33||msg using the tagged hash */ secp256k1_sha256_write(&sha, masked_key, 32); - secp256k1_sha256_write(&sha, adaptor, 33); + secp256k1_sha256_write(&sha, adaptor33, 33); secp256k1_sha256_write(&sha, xonly_pk32, 32); secp256k1_sha256_write(&sha, msg32, 32); secp256k1_sha256_finalize(&sha, nonce32); return 1; } -const secp256k1_adaptor_nonce_function_hardened secp256k1_adaptor_nonce_function_bip340 = adaptor_nonce_function_bip340; +const secp256k1_adaptor_nonce_function_hardened secp256k1_nonce_function_schnorr_adaptor = nonce_function_schnorr_adaptor; -static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_adaptor_nonce_function_hardened noncefp, const unsigned char *adaptor, void *ndata) { +static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_adaptor_nonce_function_hardened noncefp, const unsigned char *adaptor33, void *ndata) { secp256k1_scalar sk; secp256k1_scalar e; secp256k1_scalar k; @@ -119,10 +118,10 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c ARG_CHECK(presig65 != NULL); ARG_CHECK(msg32 != NULL); ARG_CHECK(keypair != NULL); - ARG_CHECK(adaptor != NULL); + ARG_CHECK(adaptor33 != NULL); if (noncefp == NULL) { - noncefp = secp256k1_adaptor_nonce_function_bip340; + noncefp = secp256k1_nonce_function_schnorr_adaptor; } ret &= secp256k1_keypair_load(ctx, &sk, &pk, keypair); @@ -136,7 +135,7 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c /* bytes_from_point(P) */ secp256k1_fe_get_b32(pk_buf, &pk.x); - ret &= !!noncefp(nonce32, msg32, seckey, adaptor, pk_buf, adaptor_bip340_algo, sizeof(adaptor_bip340_algo), ndata); + ret &= !!noncefp(nonce32, msg32, seckey, adaptor33, pk_buf, adaptor_bip340_algo, sizeof(adaptor_bip340_algo), ndata); /* k0 */ secp256k1_scalar_set_b32(&k, nonce32, NULL); ret &= !secp256k1_scalar_is_zero(&k); @@ -147,7 +146,7 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c secp256k1_ge_set_gej(&r, &rj); /* T = cpoint(T) */ - ret &= !!secp256k1_eckey_pubkey_parse(&t, adaptor, 33); + ret &= secp256k1_eckey_pubkey_parse(&t, adaptor33, 33); /* R' = k*G + T, can use gej_add_ge_var since r and t aren't secret */ secp256k1_gej_add_ge_var(&r0j, &rj, &t, NULL); @@ -161,7 +160,7 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c secp256k1_scalar_negate(&k, &k); } - ret &= !!secp256k1_eckey_pubkey_serialize(&r0, presig65, &size, 1); + ret &= secp256k1_eckey_pubkey_serialize(&r0, presig65, &size, 1); secp256k1_schnorrsig_challenge(&e, &presig65[1], msg32, msglen, pk_buf); secp256k1_scalar_mul(&e, &e, &sk); @@ -177,16 +176,15 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c return ret; } -int secp256k1_schnorr_adaptor_presign(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *adaptor, const unsigned char *aux_rand32) { +int secp256k1_schnorr_adaptor_presign(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *adaptor33, const unsigned char *aux_rand32) { /* We cast away const from the passed aux_rand32 argument since we know the default nonce function does not modify it. */ - return secp256k1_schnorr_adaptor_presign_internal(ctx, presig65, msg32, keypair, secp256k1_adaptor_nonce_function_bip340, adaptor, (unsigned char*)aux_rand32); + return secp256k1_schnorr_adaptor_presign_internal(ctx, presig65, msg32, keypair, secp256k1_nonce_function_schnorr_adaptor, adaptor33, (unsigned char*)aux_rand32); } -int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned char *adaptor, const unsigned char *presig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey) { +int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned char *adaptor33, const unsigned char *presig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey) { secp256k1_scalar s0; secp256k1_scalar e; secp256k1_gej rj; - secp256k1_ge r; secp256k1_ge pk; secp256k1_gej pkj; secp256k1_ge r0; @@ -200,21 +198,21 @@ int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned cha int ret = 1; VERIFY_CHECK(ctx != NULL); - ARG_CHECK(adaptor != NULL); + ARG_CHECK(adaptor33 != NULL); ARG_CHECK(presig65 != NULL); ARG_CHECK(msg32 != NULL); ARG_CHECK(pubkey != NULL); /* P */ - ret &= !!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey); + ret &= secp256k1_xonly_pubkey_load(ctx, &pk, pubkey); /* s0 */ secp256k1_scalar_set_b32(&s0, &presig65[33], &overflow); ret &= !overflow; /* R0 */ - ret &= !!secp256k1_xonly_pubkey_parse(ctx, &pkr0, &presig65[1]); - ret &= !!secp256k1_xonly_pubkey_load(ctx, &r0, &pkr0); + ret &= secp256k1_xonly_pubkey_parse(ctx, &pkr0, &presig65[1]); + ret &= secp256k1_xonly_pubkey_load(ctx, &r0, &pkr0); /* Compute e */ secp256k1_fe_get_b32(buf, &pk.x); @@ -226,8 +224,7 @@ int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned cha secp256k1_ecmult(&rj, &pkj, &e, &s0); /* R */ - secp256k1_ge_set_gej_var(&r, &rj); - ret &= !secp256k1_ge_is_infinity(&r); + ret &= !secp256k1_gej_is_infinity(&rj); /* T = R0 + (- R) */ secp256k1_gej_neg(&rj, &rj); @@ -240,9 +237,9 @@ int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned cha ret = 0; } secp256k1_ge_set_gej(&t, &tj); - ret &= !!secp256k1_eckey_pubkey_serialize(&t, adaptor, &size, 1); + ret &= secp256k1_eckey_pubkey_serialize(&t, adaptor33, &size, 1); - secp256k1_memczero(adaptor, 33, !ret); + secp256k1_memczero(adaptor33, 33, !ret); return ret; } @@ -268,12 +265,10 @@ int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char secp256k1_scalar_set_b32(&t, secadaptor, &overflow); ret &= !overflow; - if (presig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { - secp256k1_scalar_add(&s, &s0, &t); - } else if (presig65[0] == SECP256K1_TAG_PUBKEY_ODD) { + if (presig65[0] == SECP256K1_TAG_PUBKEY_ODD) { secp256k1_scalar_negate(&t, &t); - secp256k1_scalar_add(&s, &s0, &t); } + secp256k1_scalar_add(&s, &s0, &t); memcpy(sig64, &presig65[1], 32); secp256k1_scalar_get_b32(&sig64[32], &s); @@ -307,11 +302,10 @@ int secp256k1_schnorr_adaptor_extract_sec(const secp256k1_context *ctx, unsigned if (presig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { secp256k1_scalar_negate(&s0, &s0); - secp256k1_scalar_add(&t, &s, &s0); } else if (presig65[0] == SECP256K1_TAG_PUBKEY_ODD) { secp256k1_scalar_negate(&s, &s); - secp256k1_scalar_add(&t, &s0, &s); } + secp256k1_scalar_add(&t, &s0, &s); secp256k1_scalar_get_b32(secadaptor, &t); secp256k1_memczero(secadaptor, 32, !ret); diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h index 00e3e518b..cb74ee7aa 100644 --- a/src/modules/schnorr_adaptor/tests_impl.h +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -12,15 +12,15 @@ /* Checks that a bit flip in the n_flip-th argument (that has n_bytes many * bytes) changes the hash function */ -void adaptor_nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes, size_t algolen) { +static void nonce_function_schnorr_adaptor_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes, size_t algolen) { unsigned char nonces[2][32]; - CHECK(adaptor_nonce_function_bip340(nonces[0], args[0], args[1], args[2], args[3], args[4], algolen, args[5]) == 1); + CHECK(nonce_function_schnorr_adaptor(nonces[0], args[0], args[1], args[2], args[3], args[4], algolen, args[5]) == 1); secp256k1_testrand_flip(args[n_flip], n_bytes); - CHECK(adaptor_nonce_function_bip340(nonces[1], args[0], args[1], args[2], args[3], args[4], algolen, args[5]) == 1); + CHECK(nonce_function_schnorr_adaptor(nonces[1], args[0], args[1], args[2], args[3], args[4], algolen, args[5]) == 1); CHECK(secp256k1_memcmp_var(nonces[0], nonces[1], 32) != 0); } -void run_adaptor_nonce_function_bip340_tests(void) { +static void run_nonce_function_schnorr_adaptor_tests(void) { unsigned char tag[20] = "SchnorrAdaptor/nonce"; unsigned char aux_tag[18] = "SchnorrAdaptor/aux"; unsigned char algo[20] = "SchnorrAdaptor/nonce"; @@ -34,7 +34,7 @@ void run_adaptor_nonce_function_bip340_tests(void) { unsigned char msg[32]; unsigned char key[32]; unsigned char t[32]; - unsigned char adaptor[33]; + unsigned char adaptor33[33]; unsigned char pk[32]; unsigned char aux_rand[32]; unsigned char *args[6]; @@ -42,17 +42,17 @@ void run_adaptor_nonce_function_bip340_tests(void) { size_t size = 33; /* Check that hash initialized by - * secp256k1_adaptor_nonce_function_bip340_sha256_tagged has the expected + * secp256k1_nonce_function_schnorr_adaptor_sha256_tagged has the expected * state. */ secp256k1_sha256_initialize_tagged(&sha, tag, sizeof(tag)); - secp256k1_adaptor_nonce_function_bip340_sha256_tagged(&sha_optimized); + secp256k1_nonce_function_schnorr_adaptor_sha256_tagged(&sha_optimized); test_sha256_eq(&sha, &sha_optimized); /* Check that hash initialized by - * secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux has the expected + * secp256k1_nonce_function_schnorr_adaptor_sha256_tagged_aux has the expected * state. */ secp256k1_sha256_initialize_tagged(&sha, aux_tag, sizeof(aux_tag)); - secp256k1_adaptor_nonce_function_bip340_sha256_tagged_aux(&sha_optimized); + secp256k1_nonce_function_schnorr_adaptor_sha256_tagged_aux(&sha_optimized); test_sha256_eq(&sha, &sha_optimized); secp256k1_testrand256(msg); @@ -64,33 +64,33 @@ void run_adaptor_nonce_function_bip340_tests(void) { secp256k1_scalar_set_b32(&adaptor_scalar, t, NULL); secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor_scalar); secp256k1_ge_set_gej(&tg, &tj); - CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor, &size, 1) == 1); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor33, &size, 1) == 1); /* Check that a bitflip in an argument results in different nonces. */ args[0] = msg; args[1] = key; - args[2] = adaptor; + args[2] = adaptor33; args[3] = pk; args[4] = algo; args[5] = aux_rand; for (i = 0; i < COUNT; i++) { - adaptor_nonce_function_bip340_bitflip(args, 0, 32, algolen); - adaptor_nonce_function_bip340_bitflip(args, 1, 32, algolen); - adaptor_nonce_function_bip340_bitflip(args, 2, 32, algolen); - adaptor_nonce_function_bip340_bitflip(args, 3, 32, algolen); + nonce_function_schnorr_adaptor_bitflip(args, 0, 32, algolen); + nonce_function_schnorr_adaptor_bitflip(args, 1, 32, algolen); + nonce_function_schnorr_adaptor_bitflip(args, 2, 33, algolen); + nonce_function_schnorr_adaptor_bitflip(args, 3, 32, algolen); /* Flip algo special case "SchnorrAdaptor/nonce" */ - adaptor_nonce_function_bip340_bitflip(args, 4, algolen, algolen); + nonce_function_schnorr_adaptor_bitflip(args, 4, algolen, algolen); /* Flip algo again */ - adaptor_nonce_function_bip340_bitflip(args, 4, algolen, algolen); - adaptor_nonce_function_bip340_bitflip(args, 5, 32, algolen); + nonce_function_schnorr_adaptor_bitflip(args, 4, algolen, algolen); + nonce_function_schnorr_adaptor_bitflip(args, 5, 32, algolen); } /* NULL algo is disallowed */ - CHECK(adaptor_nonce_function_bip340(nonce, msg, key, t, pk, NULL, 0, NULL) == 0); - CHECK(adaptor_nonce_function_bip340(nonce, msg, key, t, pk, algo, algolen, NULL) == 1); + CHECK(nonce_function_schnorr_adaptor(nonce, msg, key, t, pk, NULL, 0, NULL) == 0); + CHECK(nonce_function_schnorr_adaptor(nonce, msg, key, t, pk, algo, algolen, NULL) == 1); /* Other algo is fine */ secp256k1_testrand_bytes_test(algo, algolen); - CHECK(adaptor_nonce_function_bip340(nonce, msg, key, t, pk, algo, algolen, NULL) == 1); + CHECK(nonce_function_schnorr_adaptor(nonce, msg, key, t, pk, algo, algolen, NULL) == 1); for (i = 0; i < COUNT; i++) { unsigned char nonce2[32]; @@ -99,21 +99,19 @@ void run_adaptor_nonce_function_bip340_tests(void) { /* Different algolen gives different nonce */ uint32_t offset = secp256k1_testrand_int(algolen - 1); algolen_tmp = (algolen + offset) % algolen; - CHECK(adaptor_nonce_function_bip340(nonce2, msg, key, t, pk, algo, algolen_tmp, NULL) == 1); + CHECK(nonce_function_schnorr_adaptor(nonce2, msg, key, t, pk, algo, algolen_tmp, NULL) == 1); CHECK(secp256k1_memcmp_var(nonce, nonce2, 32) != 0); } /* NULL aux_rand argument is allowed, and identical to passing all zero aux_rand. */ memset(aux_rand, 0, 32); - CHECK(adaptor_nonce_function_bip340(nonce_z, msg, key, t, pk, algo, algolen, &aux_rand) == 1); - CHECK(adaptor_nonce_function_bip340(nonce, msg, key, t, pk, algo, algolen, NULL) == 1); + CHECK(nonce_function_schnorr_adaptor(nonce_z, msg, key, t, pk, algo, algolen, &aux_rand) == 1); + CHECK(nonce_function_schnorr_adaptor(nonce, msg, key, t, pk, algo, algolen, NULL) == 1); CHECK(secp256k1_memcmp_var(nonce_z, nonce, 32) == 0); } -void test_schnorr_adaptor_api(void) { - unsigned char sk1[32]; - unsigned char sk2[32]; - unsigned char sk3[32]; +static void test_schnorr_adaptor_api(void) { + unsigned char sk[32]; unsigned char msg[32]; unsigned char secadaptor[32]; unsigned char t[33] = { @@ -122,45 +120,37 @@ void test_schnorr_adaptor_api(void) { 0xD8, 0x5C, 0x77, 0x8E, 0x4B, 0x8C, 0xEF, 0x3C, 0xA7, 0xAB, 0xAC, 0x09, 0xB9, 0x5C, 0x70, 0x9E, 0xE5 }; - secp256k1_keypair keypairs[3]; + secp256k1_keypair keypair; secp256k1_keypair invalid_keypair = {{ 0 }}; - secp256k1_xonly_pubkey pk[3]; + secp256k1_xonly_pubkey pk; secp256k1_xonly_pubkey zero_pk; unsigned char sig[65]; unsigned char sig64[64]; unsigned char t2[33]; - unsigned char adaptor[32]; + unsigned char extracted_secadaptor[32]; /** setup **/ - secp256k1_testrand256(sk1); - secp256k1_testrand256(sk2); - secp256k1_testrand256(sk3); + secp256k1_testrand256(sk); secp256k1_testrand256(msg); secp256k1_testrand256(secadaptor); - CHECK(secp256k1_keypair_create(CTX, &keypairs[0], sk1) == 1); - CHECK(secp256k1_keypair_create(CTX, &keypairs[1], sk2) == 1); - CHECK(secp256k1_keypair_create(CTX, &keypairs[2], sk3) == 1); - CHECK(secp256k1_keypair_xonly_pub(CTX, &pk[0], NULL, &keypairs[0]) == 1); - CHECK(secp256k1_keypair_xonly_pub(CTX, &pk[1], NULL, &keypairs[1]) == 1); - CHECK(secp256k1_keypair_xonly_pub(CTX, &pk[2], NULL, &keypairs[2]) == 1); + CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); + CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); memset(&zero_pk, 0, sizeof(zero_pk)); /** main test body **/ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], t, NULL) == 1); - CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, NULL, msg, &keypairs[0], t, NULL)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, NULL, &keypairs[0], t, NULL)); + CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypair, t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, NULL, msg, &keypair, t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, NULL, &keypair, t, NULL)); CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, NULL, t, NULL)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], NULL, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, NULL, NULL)); CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &invalid_keypair, t, NULL)); - CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypairs[0], t, NULL)); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypairs[0], t, NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, &pk[0]) == 1); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, NULL, sig, msg, &pk[0])); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, NULL, msg, &pk[0])); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, NULL, &pk[0])); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, t, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, &pk) == 1); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, NULL, sig, msg, &pk)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, NULL, msg, &pk)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, NULL, &pk)); CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, NULL)); CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, &zero_pk)); @@ -170,35 +160,35 @@ void test_schnorr_adaptor_api(void) { CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, NULL)); CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, secadaptor) == 1); - CHECK(secp256k1_schnorr_adaptor_extract_sec(CTX, adaptor, sig, sig64) == 1); + CHECK(secp256k1_schnorr_adaptor_extract_sec(CTX, extracted_secadaptor, sig, sig64) == 1); CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_sec(CTX, NULL, sig, sig64)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_sec(CTX, adaptor, NULL, sig64)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_sec(CTX, adaptor, sig, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_sec(CTX, extracted_secadaptor, NULL, sig64)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract_sec(CTX, extracted_secadaptor, sig, NULL)); } /* Helper function for schnorr_adaptor_vectors * Signs the message and checks that it's the same as expected_sig. */ -void test_schnorr_adaptor_vectors_check_presigning(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *adaptor, const unsigned char *expected_sig) { +static void test_schnorr_adaptor_vectors_check_presigning(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *adaptor33, const unsigned char *expected_sig) { unsigned char sig[65]; unsigned char t[33]; secp256k1_keypair keypair; secp256k1_xonly_pubkey pk, pk_expected; CHECK(secp256k1_keypair_create(CTX, &keypair, sk)); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg32, &keypair, adaptor, aux_rand)); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg32, &keypair, adaptor33, aux_rand)); CHECK(secp256k1_memcmp_var(sig, expected_sig, 65) == 0); CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk_expected, pk_serialized)); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair)); CHECK(secp256k1_memcmp_var(&pk, &pk_expected, sizeof(pk)) == 0); CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg32, &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor, 33) == 0); + CHECK(secp256k1_memcmp_var(t, adaptor33, 33) == 0); } /* Helper function for schnorr_adaptor_vectors * Extracts the adaptor point and checks if it returns the same value as expected. */ - void test_schnorr_adaptor_vectors_check_extract(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, const unsigned char *expected_t, int expected) { +static void test_schnorr_adaptor_vectors_check_extract(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, const unsigned char *expected_t, int expected) { secp256k1_xonly_pubkey pk; unsigned char t[33]; @@ -210,7 +200,7 @@ void test_schnorr_adaptor_vectors_check_presigning(const unsigned char *sk, cons /* Helper function for schnorr_adaptor_vectors * Adapt a Schnorr adptor signature to a valid Schnorr signature * and checks if it is the same as expected_sig64. */ -void test_schnorr_adaptor_vectors_check_adapt(const unsigned char *sig, const unsigned char *secadaptor, const unsigned char *expected_sig64, int expected) { +static void test_schnorr_adaptor_vectors_check_adapt(const unsigned char *sig, const unsigned char *secadaptor, const unsigned char *expected_sig64, int expected) { unsigned char sig64[64]; CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, secadaptor)); @@ -220,7 +210,7 @@ void test_schnorr_adaptor_vectors_check_adapt(const unsigned char *sig, const un /* Helper function for schnorr_adaptor_vectors * Extract adaptor from a Schnorr adptor signature and a Schnorr signature * and checks if it is the same as expected_secadaptor. */ -void test_schnorr_adaptor_vectors_check_extract_sec(const unsigned char *sig, const unsigned char *sig64, const unsigned char *expected_secadaptor, int expected) { +static void test_schnorr_adaptor_vectors_check_extract_sec(const unsigned char *sig, const unsigned char *sig64, const unsigned char *expected_secadaptor, int expected) { unsigned char secadaptor[32]; CHECK(secp256k1_schnorr_adaptor_extract_sec(CTX, secadaptor, sig, sig64)); @@ -228,7 +218,7 @@ void test_schnorr_adaptor_vectors_check_extract_sec(const unsigned char *sig, co } /* Test vectors, see https://github.com/ZhePang/Python_Specification_for_Schnorr_Adaptor */ -void test_schnorr_adaptor_vectors(void) { +static void test_schnorr_adaptor_vectors(void) { { /* Test vector 0 */ const unsigned char sk[32] = { @@ -800,7 +790,7 @@ void test_schnorr_adaptor_vectors(void) { }; } -void test_schnorr_adaptor_presign(void) { +static void test_schnorr_adaptor_presign(void) { unsigned char sk[32]; secp256k1_xonly_pubkey pk; secp256k1_keypair keypair; @@ -812,7 +802,7 @@ void test_schnorr_adaptor_presign(void) { unsigned char sig2[65]; unsigned char secadaptor[32]; unsigned char aux_rand[32]; - unsigned char adaptor[33]; + unsigned char adaptor33[33]; unsigned char t[33]; size_t size = 33; @@ -822,23 +812,23 @@ void test_schnorr_adaptor_presign(void) { secp256k1_scalar_set_b32(&adaptor_scalar, secadaptor, NULL); secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor_scalar); secp256k1_ge_set_gej(&tg, &tj); - CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor, &size, 1) == 1); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor33, &size, 1) == 1); CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, adaptor, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, adaptor33, NULL) == 1); CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg, &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor, 33) == 0); + CHECK(secp256k1_memcmp_var(t, adaptor33, 33) == 0); /* Test with aux_rand */ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig2, msg, &keypair, adaptor, aux_rand) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig2, msg, &keypair, adaptor33, aux_rand) == 1); CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg, &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor, 33) == 0); + CHECK(secp256k1_memcmp_var(t, adaptor33, 33) == 0); } #define N_SIGS 3 /* Creates N_SIGS valid signatures and verifies them with extract * Then flips some bits and checks that extract now fails to get the right * adaptor point. */ -void test_schnorr_adaptor_extract(void) { +static void test_schnorr_adaptor_extract(void) { unsigned char sk[32]; secp256k1_xonly_pubkey pk; secp256k1_keypair keypair; @@ -849,7 +839,7 @@ void test_schnorr_adaptor_extract(void) { unsigned char msg[N_SIGS][32]; unsigned char sig[N_SIGS][65]; unsigned char secadaptor[N_SIGS][32]; - unsigned char adaptor[N_SIGS][33]; + unsigned char adaptor33[N_SIGS][33]; unsigned char t[33]; size_t size = 33; size_t i; @@ -864,10 +854,10 @@ void test_schnorr_adaptor_extract(void) { secp256k1_scalar_set_b32(&adaptor_scalar, secadaptor[i], NULL); secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor_scalar); secp256k1_ge_set_gej(&tg, &tj); - CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor[i], &size, 1) == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[i], msg[i], &keypair, adaptor[i], NULL) == 1); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor33[i], &size, 1) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[i], msg[i], &keypair, adaptor33[i], NULL) == 1); CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[i], msg[i], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor[i], 33) == 0); + CHECK(secp256k1_memcmp_var(t, adaptor33[i], 33) == 0); } { @@ -878,34 +868,34 @@ void test_schnorr_adaptor_extract(void) { unsigned char xorbyte = secp256k1_testrand_int(254)+1; sig[sig_idx][33 + byte_idx] ^= xorbyte; CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor[sig_idx], 33) != 0); + CHECK(secp256k1_memcmp_var(t, adaptor33[sig_idx], 33) != 0); sig[sig_idx][33 + byte_idx] ^= xorbyte; CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor[sig_idx], 33) == 0); + CHECK(secp256k1_memcmp_var(t, adaptor33[sig_idx], 33) == 0); } /* Test overflowing s */ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, adaptor[0], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, adaptor33[0], NULL) == 1); CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor[0], 33) == 0); + CHECK(secp256k1_memcmp_var(t, adaptor33[0], 33) == 0); memset(&sig[0][33], 0xFF, 32); CHECK(!secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor[0], 33) != 0); + CHECK(secp256k1_memcmp_var(t, adaptor33[0], 33) != 0); /* Test negative s */ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, adaptor[0], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, adaptor33[0], NULL) == 1); CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor[0], 33) == 0); + CHECK(secp256k1_memcmp_var(t, adaptor33[0], 33) == 0); secp256k1_scalar_set_b32(&s, &sig[0][33], NULL); secp256k1_scalar_negate(&s, &s); secp256k1_scalar_get_b32(&sig[0][33], &s); CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor[0], 33) != 0); + CHECK(secp256k1_memcmp_var(t, adaptor33[0], 33) != 0); } #undef N_SIGS -void test_schnorr_adaptor_adapt_extract_sec(void) { +static void test_schnorr_adaptor_adapt_extract_sec(void) { unsigned char sk[32]; secp256k1_xonly_pubkey pk; secp256k1_keypair keypair; @@ -917,7 +907,7 @@ void test_schnorr_adaptor_adapt_extract_sec(void) { unsigned char sig64[64]; unsigned char secadaptor[32]; unsigned char aux_rand[32]; - unsigned char adaptor[33]; + unsigned char adaptor33[33]; unsigned char t[33]; unsigned char t2[32]; size_t size = 33; @@ -929,20 +919,21 @@ void test_schnorr_adaptor_adapt_extract_sec(void) { secp256k1_scalar_set_b32(&adaptor_scalar, secadaptor, NULL); secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor_scalar); secp256k1_ge_set_gej(&tg, &tj); - CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor, &size, 1) == 1); + CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor33, &size, 1) == 1); CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, adaptor, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, adaptor33, aux_rand) == 1); CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg, &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor, 33) == 0); + CHECK(secp256k1_memcmp_var(t, adaptor33, 33) == 0); CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, secadaptor) == 1); + CHECK(secp256k1_schnorrsig_verify(CTX, sig64, msg, sizeof(msg), &pk) == 1); CHECK(secp256k1_schnorr_adaptor_extract_sec(CTX, t2, sig, sig64) == 1); CHECK(secp256k1_memcmp_var(t2, secadaptor, 32) == 0); } -void run_schnorr_adaptor_tests(void) { +static void run_schnorr_adaptor_tests(void) { int i; - run_adaptor_nonce_function_bip340_tests(); + run_nonce_function_schnorr_adaptor_tests(); test_schnorr_adaptor_api(); test_schnorrsig_sha256_tagged(); From bf0b7f4405304e6ec23463ae0bc22493a1969799 Mon Sep 17 00:00:00 2001 From: ZhePang Date: Thu, 23 May 2024 20:43:31 -0400 Subject: [PATCH 09/10] removed ret variable from extract, adapt, and extract_sec to be non-const time --- src/modules/schnorr_adaptor/main_impl.h | 55 +++++++++++++++--------- src/modules/schnorr_adaptor/tests_impl.h | 1 - 2 files changed, 34 insertions(+), 22 deletions(-) diff --git a/src/modules/schnorr_adaptor/main_impl.h b/src/modules/schnorr_adaptor/main_impl.h index 72091cfd3..db5a07e47 100644 --- a/src/modules/schnorr_adaptor/main_impl.h +++ b/src/modules/schnorr_adaptor/main_impl.h @@ -195,7 +195,6 @@ int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned cha size_t size = 33; size_t msglen = 32; int overflow; - int ret = 1; VERIFY_CHECK(ctx != NULL); ARG_CHECK(adaptor33 != NULL); @@ -204,15 +203,23 @@ int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned cha ARG_CHECK(pubkey != NULL); /* P */ - ret &= secp256k1_xonly_pubkey_load(ctx, &pk, pubkey); + if (!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) { + return 0; + } /* s0 */ secp256k1_scalar_set_b32(&s0, &presig65[33], &overflow); - ret &= !overflow; + if (overflow) { + return 0; + } /* R0 */ - ret &= secp256k1_xonly_pubkey_parse(ctx, &pkr0, &presig65[1]); - ret &= secp256k1_xonly_pubkey_load(ctx, &r0, &pkr0); + if (!secp256k1_xonly_pubkey_parse(ctx, &pkr0, &presig65[1])) { + return 0; + } + if (!secp256k1_xonly_pubkey_load(ctx, &r0, &pkr0)) { + return 0; + } /* Compute e */ secp256k1_fe_get_b32(buf, &pk.x); @@ -224,7 +231,9 @@ int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned cha secp256k1_ecmult(&rj, &pkj, &e, &s0); /* R */ - ret &= !secp256k1_gej_is_infinity(&rj); + if (secp256k1_gej_is_infinity(&rj)) { + return 0; + } /* T = R0 + (- R) */ secp256k1_gej_neg(&rj, &rj); @@ -234,14 +243,14 @@ int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned cha } else if (presig65[0] == SECP256K1_TAG_PUBKEY_ODD) { secp256k1_gej_neg(&tj, &tj); } else { - ret = 0; + return 0; } secp256k1_ge_set_gej(&t, &tj); - ret &= secp256k1_eckey_pubkey_serialize(&t, adaptor33, &size, 1); - - secp256k1_memczero(adaptor33, 33, !ret); + if (!secp256k1_eckey_pubkey_serialize(&t, adaptor33, &size, 1)) { + return 0; + } - return ret; + return 1; } int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *presig65, const unsigned char *secadaptor) { @@ -249,7 +258,6 @@ int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char secp256k1_scalar s; secp256k1_scalar t; int overflow; - int ret = 1; VERIFY_CHECK(ctx != NULL); ARG_CHECK(sig64 != NULL); @@ -259,11 +267,15 @@ int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char /* s0 */ secp256k1_scalar_set_b32(&s0, &presig65[33], &overflow); - ret &= !overflow; + if (overflow) { + return 0; + } /* t */ secp256k1_scalar_set_b32(&t, secadaptor, &overflow); - ret &= !overflow; + if (overflow) { + return 0; + } if (presig65[0] == SECP256K1_TAG_PUBKEY_ODD) { secp256k1_scalar_negate(&t, &t); @@ -272,11 +284,10 @@ int secp256k1_schnorr_adaptor_adapt(const secp256k1_context *ctx, unsigned char memcpy(sig64, &presig65[1], 32); secp256k1_scalar_get_b32(&sig64[32], &s); - secp256k1_memczero(sig64, 64, !ret); secp256k1_scalar_clear(&s); secp256k1_scalar_clear(&t); - return ret; + return 1; } int secp256k1_schnorr_adaptor_extract_sec(const secp256k1_context *ctx, unsigned char *secadaptor, const unsigned char *presig65, const unsigned char *sig64) { @@ -284,7 +295,6 @@ int secp256k1_schnorr_adaptor_extract_sec(const secp256k1_context *ctx, unsigned secp256k1_scalar s; secp256k1_scalar t; int overflow; - int ret = 1; VERIFY_CHECK(ctx != NULL); ARG_CHECK(secadaptor != NULL); @@ -294,11 +304,15 @@ int secp256k1_schnorr_adaptor_extract_sec(const secp256k1_context *ctx, unsigned /* s0 */ secp256k1_scalar_set_b32(&s0, &presig65[33], &overflow); - ret &= !overflow; + if (overflow) { + return 0; + } /* s */ secp256k1_scalar_set_b32(&s, &sig64[32], &overflow); - ret &= !overflow; + if (overflow) { + return 0; + } if (presig65[0] == SECP256K1_TAG_PUBKEY_EVEN) { secp256k1_scalar_negate(&s0, &s0); @@ -308,11 +322,10 @@ int secp256k1_schnorr_adaptor_extract_sec(const secp256k1_context *ctx, unsigned secp256k1_scalar_add(&t, &s0, &s); secp256k1_scalar_get_b32(secadaptor, &t); - secp256k1_memczero(secadaptor, 32, !ret); secp256k1_scalar_clear(&s); secp256k1_scalar_clear(&t); - return ret; + return 1; } #endif diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h index cb74ee7aa..e5ea8b087 100644 --- a/src/modules/schnorr_adaptor/tests_impl.h +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -881,7 +881,6 @@ static void test_schnorr_adaptor_extract(void) { CHECK(secp256k1_memcmp_var(t, adaptor33[0], 33) == 0); memset(&sig[0][33], 0xFF, 32); CHECK(!secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33[0], 33) != 0); /* Test negative s */ CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, adaptor33[0], NULL) == 1); From 69a547189512319059105c89f90442610554484c Mon Sep 17 00:00:00 2001 From: ZhePang Date: Sun, 28 Jul 2024 19:15:43 -0400 Subject: [PATCH 10/10] changed adaptor object from bytes to pubkey --- include/secp256k1_schnorr_adaptor.h | 8 +- src/modules/schnorr_adaptor/main_impl.h | 26 +++--- src/modules/schnorr_adaptor/tests_impl.h | 111 +++++++++++++---------- 3 files changed, 80 insertions(+), 65 deletions(-) diff --git a/include/secp256k1_schnorr_adaptor.h b/include/secp256k1_schnorr_adaptor.h index 7a53f6cc6..525e14bff 100644 --- a/include/secp256k1_schnorr_adaptor.h +++ b/include/secp256k1_schnorr_adaptor.h @@ -57,7 +57,7 @@ SECP256K1_API const secp256k1_adaptor_nonce_function_hardened secp256k1_nonce_fu * Out: presig65: pointer to a 65-byte array to store the adaptor signature. * In: msg32: the 32-byte message being signed. * keypair: pointer to an initialized keypair. - * adaptor33: pointer to a 33-byte compressed adaptor point. + * adaptor: pointer to an adaptor point. * aux_rand32: 32 bytes of fresh randomness. While recommended to provide * this, it is only supplemental to security and can be NULL. A * NULL argument is treated the same as an all-zero one. See @@ -69,7 +69,7 @@ SECP256K1_API int secp256k1_schnorr_adaptor_presign( unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, - const unsigned char *adaptor33, + const secp256k1_pubkey *adaptor, const unsigned char *aux_rand32 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); @@ -77,14 +77,14 @@ SECP256K1_API int secp256k1_schnorr_adaptor_presign( * * Returns 1 on success, 0 on failure. * Args: ctx: pointer to a context object. - * Out: adaptor33: pointer to a 33-byte array to store the compressed adaptor point. + * Out: adaptor33: pointer to an adaptor point. * In: presig65: pointer to a 65-byte adaptor signature. * msg32: the 32-byte message being signed. * pubkey: pointer to an x-only public key to verify with */ SECP256K1_API int secp256k1_schnorr_adaptor_extract( const secp256k1_context *ctx, - unsigned char *adaptor33, + secp256k1_pubkey *adaptor, const unsigned char *presig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey diff --git a/src/modules/schnorr_adaptor/main_impl.h b/src/modules/schnorr_adaptor/main_impl.h index db5a07e47..4d8ddc07b 100644 --- a/src/modules/schnorr_adaptor/main_impl.h +++ b/src/modules/schnorr_adaptor/main_impl.h @@ -96,7 +96,7 @@ static int nonce_function_schnorr_adaptor(unsigned char *nonce32, const unsigned const secp256k1_adaptor_nonce_function_hardened secp256k1_nonce_function_schnorr_adaptor = nonce_function_schnorr_adaptor; -static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_adaptor_nonce_function_hardened noncefp, const unsigned char *adaptor33, void *ndata) { +static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_adaptor_nonce_function_hardened noncefp, const secp256k1_pubkey *adaptor, void *ndata) { secp256k1_scalar sk; secp256k1_scalar e; secp256k1_scalar k; @@ -109,6 +109,7 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c unsigned char nonce32[32] = {0}; unsigned char pk_buf[32]; unsigned char seckey[32]; + unsigned char adaptor33_buff[33]; size_t size = 33; size_t msglen = 32; int ret = 1; @@ -118,7 +119,7 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c ARG_CHECK(presig65 != NULL); ARG_CHECK(msg32 != NULL); ARG_CHECK(keypair != NULL); - ARG_CHECK(adaptor33 != NULL); + ARG_CHECK(adaptor != NULL); if (noncefp == NULL) { noncefp = secp256k1_nonce_function_schnorr_adaptor; @@ -135,7 +136,11 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c /* bytes_from_point(P) */ secp256k1_fe_get_b32(pk_buf, &pk.x); - ret &= !!noncefp(nonce32, msg32, seckey, adaptor33, pk_buf, adaptor_bip340_algo, sizeof(adaptor_bip340_algo), ndata); + /* T = cpoint(T) */ + ret &= secp256k1_pubkey_load(ctx, &t, adaptor); + ret &= secp256k1_eckey_pubkey_serialize(&t, adaptor33_buff, &size, 1); + + ret &= !!noncefp(nonce32, msg32, seckey, adaptor33_buff, pk_buf, adaptor_bip340_algo, sizeof(adaptor_bip340_algo), ndata); /* k0 */ secp256k1_scalar_set_b32(&k, nonce32, NULL); ret &= !secp256k1_scalar_is_zero(&k); @@ -145,9 +150,6 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &k); secp256k1_ge_set_gej(&r, &rj); - /* T = cpoint(T) */ - ret &= secp256k1_eckey_pubkey_parse(&t, adaptor33, 33); - /* R' = k*G + T, can use gej_add_ge_var since r and t aren't secret */ secp256k1_gej_add_ge_var(&r0j, &rj, &t, NULL); secp256k1_ge_set_gej(&r0, &r0j); @@ -176,12 +178,12 @@ static int secp256k1_schnorr_adaptor_presign_internal(const secp256k1_context *c return ret; } -int secp256k1_schnorr_adaptor_presign(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *adaptor33, const unsigned char *aux_rand32) { +int secp256k1_schnorr_adaptor_presign(const secp256k1_context *ctx, unsigned char *presig65, const unsigned char *msg32, const secp256k1_keypair *keypair, const secp256k1_pubkey *adaptor, const unsigned char *aux_rand32) { /* We cast away const from the passed aux_rand32 argument since we know the default nonce function does not modify it. */ - return secp256k1_schnorr_adaptor_presign_internal(ctx, presig65, msg32, keypair, secp256k1_nonce_function_schnorr_adaptor, adaptor33, (unsigned char*)aux_rand32); + return secp256k1_schnorr_adaptor_presign_internal(ctx, presig65, msg32, keypair, secp256k1_nonce_function_schnorr_adaptor, adaptor, (unsigned char*)aux_rand32); } -int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned char *adaptor33, const unsigned char *presig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey) { +int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, secp256k1_pubkey *adaptor, const unsigned char *presig65, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey) { secp256k1_scalar s0; secp256k1_scalar e; secp256k1_gej rj; @@ -197,7 +199,7 @@ int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned cha int overflow; VERIFY_CHECK(ctx != NULL); - ARG_CHECK(adaptor33 != NULL); + ARG_CHECK(adaptor != NULL); ARG_CHECK(presig65 != NULL); ARG_CHECK(msg32 != NULL); ARG_CHECK(pubkey != NULL); @@ -246,9 +248,7 @@ int secp256k1_schnorr_adaptor_extract(const secp256k1_context *ctx, unsigned cha return 0; } secp256k1_ge_set_gej(&t, &tj); - if (!secp256k1_eckey_pubkey_serialize(&t, adaptor33, &size, 1)) { - return 0; - } + secp256k1_pubkey_save(adaptor, &t); return 1; } diff --git a/src/modules/schnorr_adaptor/tests_impl.h b/src/modules/schnorr_adaptor/tests_impl.h index e5ea8b087..239cefb19 100644 --- a/src/modules/schnorr_adaptor/tests_impl.h +++ b/src/modules/schnorr_adaptor/tests_impl.h @@ -114,7 +114,7 @@ static void test_schnorr_adaptor_api(void) { unsigned char sk[32]; unsigned char msg[32]; unsigned char secadaptor[32]; - unsigned char t[33] = { + unsigned char adaptor33[33] = { 0x02, 0xC6, 0x04, 0x7F, 0x94, 0x41, 0xED, 0x7D, 0x6D, 0x30, 0x45, 0x40, 0x6E, 0x95, 0xC0, 0x7C, 0xD8, 0x5C, 0x77, 0x8E, 0x4B, 0x8C, 0xEF, 0x3C, @@ -126,7 +126,8 @@ static void test_schnorr_adaptor_api(void) { secp256k1_xonly_pubkey zero_pk; unsigned char sig[65]; unsigned char sig64[64]; - unsigned char t2[33]; + secp256k1_pubkey t; + secp256k1_pubkey t2; unsigned char extracted_secadaptor[32]; /** setup **/ @@ -137,22 +138,23 @@ static void test_schnorr_adaptor_api(void) { CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); memset(&zero_pk, 0, sizeof(zero_pk)); + secp256k1_ec_pubkey_parse(CTX, &t, adaptor33, 33); /** main test body **/ - CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypair, t, NULL)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, NULL, msg, &keypair, t, NULL)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, NULL, &keypair, t, NULL)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, NULL, t, NULL)); + CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorr_adaptor_presign(STATIC_CTX, sig, msg, &keypair, &t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, NULL, msg, &keypair, &t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, NULL, &keypair, &t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, NULL, &t, NULL)); CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, NULL, NULL)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &invalid_keypair, t, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &invalid_keypair, &t, NULL)); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, t, NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, &pk) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, &t, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t2, sig, msg, &pk) == 1); CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, NULL, sig, msg, &pk)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, NULL, msg, &pk)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, NULL, &pk)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, NULL)); - CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, t2, sig, msg, &zero_pk)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, &t2, NULL, msg, &pk)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, &t2, sig, NULL, &pk)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, &t2, sig, msg, NULL)); + CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_extract(CTX, &t2, sig, msg, &zero_pk)); CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, secadaptor) == 1); CHECK_ILLEGAL(CTX, secp256k1_schnorr_adaptor_adapt(CTX, NULL, sig, secadaptor)); @@ -171,30 +173,37 @@ static void test_schnorr_adaptor_api(void) { * Signs the message and checks that it's the same as expected_sig. */ static void test_schnorr_adaptor_vectors_check_presigning(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *adaptor33, const unsigned char *expected_sig) { unsigned char sig[65]; - unsigned char t[33]; + secp256k1_pubkey t; secp256k1_keypair keypair; secp256k1_xonly_pubkey pk, pk_expected; + secp256k1_pubkey adaptor; + secp256k1_ec_pubkey_parse(CTX, &adaptor, adaptor33, 33); CHECK(secp256k1_keypair_create(CTX, &keypair, sk)); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg32, &keypair, adaptor33, aux_rand)); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg32, &keypair, &adaptor, aux_rand)); CHECK(secp256k1_memcmp_var(sig, expected_sig, 65) == 0); CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk_expected, pk_serialized)); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair)); CHECK(secp256k1_memcmp_var(&pk, &pk_expected, sizeof(pk)) == 0); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg32, &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33, 33) == 0); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig, msg32, &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor) == 0); } /* Helper function for schnorr_adaptor_vectors * Extracts the adaptor point and checks if it returns the same value as expected. */ static void test_schnorr_adaptor_vectors_check_extract(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, const unsigned char *expected_t, int expected) { secp256k1_xonly_pubkey pk; - unsigned char t[33]; + secp256k1_pubkey t; + unsigned char t33[33]; + secp256k1_ge adaptor; + size_t size = 33; CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk, pk_serialized)); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg32, &pk)); - CHECK(expected == (secp256k1_memcmp_var(t, expected_t, 33) == 0)); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig, msg32, &pk)); + secp256k1_pubkey_load(CTX, &adaptor, &t); + secp256k1_eckey_pubkey_serialize(&adaptor, t33, &size, 1); + CHECK(expected == (secp256k1_memcmp_var(t33, expected_t, 33) == 0)); } /* Helper function for schnorr_adaptor_vectors @@ -803,7 +812,8 @@ static void test_schnorr_adaptor_presign(void) { unsigned char secadaptor[32]; unsigned char aux_rand[32]; unsigned char adaptor33[33]; - unsigned char t[33]; + secp256k1_pubkey t; + secp256k1_pubkey adaptor; size_t size = 33; secp256k1_testrand256(sk); @@ -815,13 +825,14 @@ static void test_schnorr_adaptor_presign(void) { CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor33, &size, 1) == 1); CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, adaptor33, NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg, &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33, 33) == 0); + CHECK(secp256k1_ec_pubkey_parse(CTX, &adaptor, adaptor33, 33) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, &adaptor, NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig, msg, &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor) == 0); /* Test with aux_rand */ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig2, msg, &keypair, adaptor33, aux_rand) == 1); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg, &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33, 33) == 0); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig2, msg, &keypair, &adaptor, aux_rand) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig, msg, &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor) == 0); } #define N_SIGS 3 @@ -840,7 +851,8 @@ static void test_schnorr_adaptor_extract(void) { unsigned char sig[N_SIGS][65]; unsigned char secadaptor[N_SIGS][32]; unsigned char adaptor33[N_SIGS][33]; - unsigned char t[33]; + secp256k1_pubkey t; + secp256k1_pubkey adaptor[N_SIGS]; size_t size = 33; size_t i; @@ -855,9 +867,10 @@ static void test_schnorr_adaptor_extract(void) { secp256k1_ecmult_gen(&CTX->ecmult_gen_ctx, &tj, &adaptor_scalar); secp256k1_ge_set_gej(&tg, &tj); CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor33[i], &size, 1) == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[i], msg[i], &keypair, adaptor33[i], NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[i], msg[i], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33[i], 33) == 0); + CHECK(secp256k1_ec_pubkey_parse(CTX, &adaptor[i], adaptor33[i], 33) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[i], msg[i], &keypair, &adaptor[i], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig[i], msg[i], &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor[i]) == 0); } { @@ -867,30 +880,30 @@ static void test_schnorr_adaptor_extract(void) { size_t byte_idx = secp256k1_testrand_bits(5); unsigned char xorbyte = secp256k1_testrand_int(254)+1; sig[sig_idx][33 + byte_idx] ^= xorbyte; - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33[sig_idx], 33) != 0); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig[sig_idx], msg[sig_idx], &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor[sig_idx]) != 0); sig[sig_idx][33 + byte_idx] ^= xorbyte; - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[sig_idx], msg[sig_idx], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33[sig_idx], 33) == 0); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig[sig_idx], msg[sig_idx], &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor[sig_idx]) == 0); } /* Test overflowing s */ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, adaptor33[0], NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33[0], 33) == 0); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, &adaptor[0], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig[0], msg[0], &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor[0]) == 0); memset(&sig[0][33], 0xFF, 32); - CHECK(!secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); + CHECK(!secp256k1_schnorr_adaptor_extract(CTX, &t, sig[0], msg[0], &pk)); /* Test negative s */ - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, adaptor33[0], NULL) == 1); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33[0], 33) == 0); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig[0], msg[0], &keypair, &adaptor[0], NULL) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig[0], msg[0], &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor[0]) == 0); secp256k1_scalar_set_b32(&s, &sig[0][33], NULL); secp256k1_scalar_negate(&s, &s); secp256k1_scalar_get_b32(&sig[0][33], &s); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig[0], msg[0], &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33[0], 33) != 0); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig[0], msg[0], &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor[0]) != 0); } #undef N_SIGS @@ -907,8 +920,9 @@ static void test_schnorr_adaptor_adapt_extract_sec(void) { unsigned char secadaptor[32]; unsigned char aux_rand[32]; unsigned char adaptor33[33]; - unsigned char t[33]; + secp256k1_pubkey t; unsigned char t2[32]; + secp256k1_pubkey adaptor; size_t size = 33; secp256k1_testrand256(sk); @@ -921,9 +935,10 @@ static void test_schnorr_adaptor_adapt_extract_sec(void) { CHECK(secp256k1_eckey_pubkey_serialize(&tg, adaptor33, &size, 1) == 1); CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1); CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair) == 1); - CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, adaptor33, aux_rand) == 1); - CHECK(secp256k1_schnorr_adaptor_extract(CTX, t, sig, msg, &pk)); - CHECK(secp256k1_memcmp_var(t, adaptor33, 33) == 0); + CHECK(secp256k1_ec_pubkey_parse(CTX, &adaptor, adaptor33, 33) == 1); + CHECK(secp256k1_schnorr_adaptor_presign(CTX, sig, msg, &keypair, &adaptor, aux_rand) == 1); + CHECK(secp256k1_schnorr_adaptor_extract(CTX, &t, sig, msg, &pk)); + CHECK(secp256k1_ec_pubkey_cmp(CTX, &t, &adaptor) == 0); CHECK(secp256k1_schnorr_adaptor_adapt(CTX, sig64, sig, secadaptor) == 1); CHECK(secp256k1_schnorrsig_verify(CTX, sig64, msg, sizeof(msg), &pk) == 1); CHECK(secp256k1_schnorr_adaptor_extract_sec(CTX, t2, sig, sig64) == 1);