@@ -25,32 +25,37 @@ static const secp256k1_fe_t secp256k1_ecdsa_const_p_minus_order = SECP256K1_FE_C
2525);
2626
2727static int secp256k1_ecdsa_sig_parse (secp256k1_ecdsa_sig_t * r , const unsigned char * sig , int size ) {
28+ unsigned char ra [32 ] = {0 }, sa [32 ] = {0 };
29+ const unsigned char * rp ;
30+ const unsigned char * sp ;
31+ int lenr ;
32+ int lens ;
33+ int overflow ;
2834 if (sig [0 ] != 0x30 ) return 0 ;
29- int lenr = sig [3 ];
35+ lenr = sig [3 ];
3036 if (5 + lenr >= size ) return 0 ;
31- int lens = sig [lenr + 5 ];
37+ lens = sig [lenr + 5 ];
3238 if (sig [1 ] != lenr + lens + 4 ) return 0 ;
3339 if (lenr + lens + 6 > size ) return 0 ;
3440 if (sig [2 ] != 0x02 ) return 0 ;
3541 if (lenr == 0 ) return 0 ;
3642 if (sig [lenr + 4 ] != 0x02 ) return 0 ;
3743 if (lens == 0 ) return 0 ;
38- const unsigned char * sp = sig + 6 + lenr ;
44+ sp = sig + 6 + lenr ;
3945 while (lens > 0 && sp [0 ] == 0 ) {
4046 lens -- ;
4147 sp ++ ;
4248 }
4349 if (lens > 32 ) return 0 ;
44- const unsigned char * rp = sig + 4 ;
50+ rp = sig + 4 ;
4551 while (lenr > 0 && rp [0 ] == 0 ) {
4652 lenr -- ;
4753 rp ++ ;
4854 }
4955 if (lenr > 32 ) return 0 ;
50- unsigned char ra [32 ] = {0 }, sa [32 ] = {0 };
5156 memcpy (ra + 32 - lenr , rp , lenr );
5257 memcpy (sa + 32 - lens , sp , lens );
53- int overflow = 0 ;
58+ overflow = 0 ;
5459 secp256k1_scalar_set_b32 (& r -> r , ra , & overflow );
5560 if (overflow ) return 0 ;
5661 secp256k1_scalar_set_b32 (& r -> s , sa , & overflow );
@@ -60,10 +65,10 @@ static int secp256k1_ecdsa_sig_parse(secp256k1_ecdsa_sig_t *r, const unsigned ch
6065
6166static int secp256k1_ecdsa_sig_serialize (unsigned char * sig , int * size , const secp256k1_ecdsa_sig_t * a ) {
6267 unsigned char r [33 ] = {0 }, s [33 ] = {0 };
63- secp256k1_scalar_get_b32 (& r [1 ], & a -> r );
64- secp256k1_scalar_get_b32 (& s [1 ], & a -> s );
6568 unsigned char * rp = r , * sp = s ;
6669 int lenR = 33 , lenS = 33 ;
70+ secp256k1_scalar_get_b32 (& r [1 ], & a -> r );
71+ secp256k1_scalar_get_b32 (& s [1 ], & a -> s );
6772 while (lenR > 1 && rp [0 ] == 0 && rp [1 ] < 0x80 ) { lenR -- ; rp ++ ; }
6873 while (lenS > 1 && sp [0 ] == 0 && sp [1 ] < 0x80 ) { lenS -- ; sp ++ ; }
6974 if (* size < 6 + lenS + lenR )
@@ -81,21 +86,24 @@ static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, int *size, const se
8186}
8287
8388static int secp256k1_ecdsa_sig_verify (const secp256k1_ecdsa_sig_t * sig , const secp256k1_ge_t * pubkey , const secp256k1_scalar_t * message ) {
89+ unsigned char c [32 ];
90+ secp256k1_scalar_t sn , u1 , u2 ;
91+ secp256k1_fe_t xr ;
92+ secp256k1_gej_t pubkeyj ;
93+ secp256k1_gej_t pr ;
94+
8495 if (secp256k1_scalar_is_zero (& sig -> r ) || secp256k1_scalar_is_zero (& sig -> s ))
8596 return 0 ;
8697
87- secp256k1_scalar_t sn , u1 , u2 ;
8898 secp256k1_scalar_inverse_var (& sn , & sig -> s );
8999 secp256k1_scalar_mul (& u1 , & sn , message );
90100 secp256k1_scalar_mul (& u2 , & sn , & sig -> r );
91- secp256k1_gej_t pubkeyj ; secp256k1_gej_set_ge (& pubkeyj , pubkey );
92- secp256k1_gej_t pr ; secp256k1_ecmult (& pr , & pubkeyj , & u2 , & u1 );
101+ secp256k1_gej_set_ge (& pubkeyj , pubkey );
102+ secp256k1_ecmult (& pr , & pubkeyj , & u2 , & u1 );
93103 if (secp256k1_gej_is_infinity (& pr )) {
94104 return 0 ;
95105 }
96- unsigned char c [32 ];
97106 secp256k1_scalar_get_b32 (c , & sig -> r );
98- secp256k1_fe_t xr ;
99107 secp256k1_fe_set_b32 (& xr , c );
100108
101109 /** We now have the recomputed R point in pr, and its claimed x coordinate (modulo n)
@@ -131,44 +139,47 @@ static int secp256k1_ecdsa_sig_verify(const secp256k1_ecdsa_sig_t *sig, const se
131139}
132140
133141static int secp256k1_ecdsa_sig_recover (const secp256k1_ecdsa_sig_t * sig , secp256k1_ge_t * pubkey , const secp256k1_scalar_t * message , int recid ) {
142+ unsigned char brx [32 ];
143+ secp256k1_fe_t fx ;
144+ secp256k1_ge_t x ;
145+ secp256k1_gej_t xj ;
146+ secp256k1_scalar_t rn , u1 , u2 ;
147+ secp256k1_gej_t qj ;
148+
134149 if (secp256k1_scalar_is_zero (& sig -> r ) || secp256k1_scalar_is_zero (& sig -> s ))
135150 return 0 ;
136151
137- unsigned char brx [32 ];
138152 secp256k1_scalar_get_b32 (brx , & sig -> r );
139- secp256k1_fe_t fx ;
140153 VERIFY_CHECK (secp256k1_fe_set_b32 (& fx , brx )); /* brx comes from a scalar, so is less than the order; certainly less than p */
141154 if (recid & 2 ) {
142155 if (secp256k1_fe_cmp_var (& fx , & secp256k1_ecdsa_const_p_minus_order ) >= 0 )
143156 return 0 ;
144157 secp256k1_fe_add (& fx , & secp256k1_ecdsa_const_order_as_fe );
145158 }
146- secp256k1_ge_t x ;
147159 if (!secp256k1_ge_set_xo_var (& x , & fx , recid & 1 ))
148160 return 0 ;
149- secp256k1_gej_t xj ;
150161 secp256k1_gej_set_ge (& xj , & x );
151- secp256k1_scalar_t rn , u1 , u2 ;
152162 secp256k1_scalar_inverse_var (& rn , & sig -> r );
153163 secp256k1_scalar_mul (& u1 , & rn , message );
154164 secp256k1_scalar_negate (& u1 , & u1 );
155165 secp256k1_scalar_mul (& u2 , & rn , & sig -> s );
156- secp256k1_gej_t qj ;
157166 secp256k1_ecmult (& qj , & xj , & u2 , & u1 );
158167 secp256k1_ge_set_gej_var (pubkey , & qj );
159168 return !secp256k1_gej_is_infinity (& qj );
160169}
161170
162171static int secp256k1_ecdsa_sig_sign (secp256k1_ecdsa_sig_t * sig , const secp256k1_scalar_t * seckey , const secp256k1_scalar_t * message , const secp256k1_scalar_t * nonce , int * recid ) {
172+ unsigned char b [32 ];
163173 secp256k1_gej_t rp ;
164- secp256k1_ecmult_gen (& rp , nonce );
165174 secp256k1_ge_t r ;
175+ secp256k1_scalar_t n ;
176+ int overflow = 0 ;
177+
178+ secp256k1_ecmult_gen (& rp , nonce );
166179 secp256k1_ge_set_gej (& r , & rp );
167- unsigned char b [32 ];
168180 secp256k1_fe_normalize (& r .x );
169181 secp256k1_fe_normalize (& r .y );
170182 secp256k1_fe_get_b32 (b , & r .x );
171- int overflow = 0 ;
172183 secp256k1_scalar_set_b32 (& sig -> r , b , & overflow );
173184 if (secp256k1_scalar_is_zero (& sig -> r )) {
174185 /* P.x = order is on the curve, so technically sig->r could end up zero, which would be an invalid signature. */
@@ -178,7 +189,6 @@ static int secp256k1_ecdsa_sig_sign(secp256k1_ecdsa_sig_t *sig, const secp256k1_
178189 }
179190 if (recid )
180191 * recid = (overflow ? 2 : 0 ) | (secp256k1_fe_is_odd (& r .y ) ? 1 : 0 );
181- secp256k1_scalar_t n ;
182192 secp256k1_scalar_mul (& n , & sig -> r , seckey );
183193 secp256k1_scalar_add (& n , & n , message );
184194 secp256k1_scalar_inverse (& sig -> s , nonce );
0 commit comments