Deterministic signatures according to RFC6979 #360

oleganza · 2015-03-31T15:17:25Z

See #358 for discussion.

The test vectors are the same as in Trezor and CoreBitcoin implementations and cover both the raw nonce (k) and the complete DER-encoded signature (which must have canonical S).

davecgh · 2015-03-31T15:41:58Z

Thanks for the pull request. I'm going to do a quick review now for general things, but I plan to dig into the RFC a little later and do a very careful analysis since this is obviously extremely important to get right given signature issues can easily lead to stolen funds.

davecgh · 2015-03-31T15:42:06Z

btcec/privkey.go

@@ -56,11 +56,7 @@ func (p *PrivateKey) ToECDSA() *ecdsa.PrivateKey {
 // Sign wraps ecdsa.Sign to sign the provided hash (which should be the result


Please update the comment to reflect reality here.

oleganza · 2015-03-31T15:55:00Z

@davecgh thanks, updated the code according to your remarks.

davecgh · 2015-03-31T16:19:45Z

btcec/signature_test.go

+	// - https://github.com/trezor/trezor-crypto/blob/9fea8f8ab377dc514e40c6fd1f7c89a74c1d8dc6/tests.c#L432-L453
+	// - https://github.com/oleganza/CoreBitcoin/blob/e93dd71207861b5bf044415db5fa72405e7d8fbc/CoreBitcoin/BTCKey%2BTests.m#L23-L49
+	verifyRFC6979Nonce(
+		"cca9fbcc1b41e5a95d369eaa6ddcff73b61a4efaa279cfc6567e8daa39cbaf50",


Because these are hard coded strings in the test source code, I'd prefer all of these use a function like the following decodeHex which panics if any errors occur parsing them rather than ignoring them.

// decodeHex converts the passed hex string into a big integer pointer and will // panic is there is an error. This is only provided for the hard-coded // constants so errors in the source code can bet detected. It will only (and // must only) be called for initialization purposes. func decodeHex(hexStr string) []byte { hexBytes, err := hex.DecodeString(hexStr) if err != nil { panic("invalid hex in source file: " + hexStr) } return hexBytes }

davecgh · 2015-03-31T17:52:30Z

Alright that's it for now. I'll do an in-depth review of the algorithm against the RFC later tonight.

davecgh · 2015-03-31T17:58:10Z

btcec/signature.go

@@ -396,3 +408,130 @@ func RecoverCompact(curve *KoblitzCurve, signature,

 	return key, ((signature[0] - 27) & 4) == 4, nil
 }
+
+// SignRFC6979 generates a deterministic ECDSA signature according to RFC 6979 and BIP 62.
+func SignRFC6979(privateKey *PrivateKey, hash []byte) (*Signature, error) {


Probably don't need to export this since it's scoped to the private key.

oleganza · 2015-03-31T19:32:44Z

@davecgh do you know what's wrong with ./goclean.sh exiting with status 1 that makes Travis fail?

davecgh · 2015-03-31T19:33:24Z

Looks like it needs a gofmt on signature_test.go.

oleganza · 2015-03-31T19:36:05Z

Thanks. The error was not very helpful. Lets see if it works.

davecgh · 2015-03-31T19:38:29Z

Yeah, I noticed that as well. I just made #361 to address that.

davecgh · 2015-03-31T19:48:34Z

Thanks for your work on this! It's looking good.

I imagine it's right given the tests pass, but as I said previously, I still plan to give the algorithm a through review later tonight after I finish up with some other things I'm working on.

oleganza · 2015-03-31T19:58:58Z

Thanks for the comments, I appreciate your feedback.

davecgh · 2015-03-31T20:11:20Z

Oh, now that we have deterministic signatures, I think it would be worth updating the SignMessage example in example_test.go. IIRC it has the print of the serialized signature commented out because it used to be random. With a deterministic signature, it can be printed and checked with the // Output: line.

EDIT: If you're unaware, go test actually runs the examples and compares the output to ensure the example code compiles and produces the output as documented.

davecgh · 2015-04-01T06:47:21Z

btcec/signature.go

+	s.Mod(s, N)
+
+	if s.Cmp(halforder) == 1 {
+		s = new(big.Int).Sub(order, s)


The extra allocation can be avoided here.

s.Sub(N, s)

That is s = N - s.

Also, the rest of the code here is using N for the order, probably should use N here too.

davecgh · 2015-04-01T18:31:05Z

Alright, I've finished carefully comparing this against the RFC and everything looks accurate. I would like to point out a few things that can be improved in the future:

There are various allocations happening through the use of append that could be avoided by creating appropriately size byte slices and copying the relevant data into them.
The Sign function takes an already hashed message while the signing code assumes the hash function is sha256. This is a currently a valid assumption, however care will need to be taken should another hash function come into use.
This code assumes that the curve is secp256k1 while this package is intended to be able to work with any curve. There are a few other areas where this is the case however, so I don't think it would be fair to hold up this PR due to this.
There are several optimization opportunities where the conversions between big.Ints and []byte could be avoided.

All of that said, I see no reason any of those points should hold up this PR since it works properly and provides highly useful functionality.

@oleganza However, I would like to see the the other comments addressed.

davecgh · 2015-04-01T18:31:14Z

@jimmysong Can you review and verify the algorithms conform to the RFC as well?

jimmysong · 2015-04-01T19:17:08Z

@davecgh Looking at the RFC spec now. Will review the code soon.

oleganza · 2015-04-01T19:39:29Z

@davecgh thanks! It's my first time I write in Go. Sorry for some obvious things like unnecessary allocations. Thanks for correcting those.

jimmysong · 2015-04-01T19:52:51Z

btcec/signature.go

+	k := nonceRFC6979(privkey.D.Bytes(), hash)
+	inv := new(big.Int).ModInverse(k, N)
+	r, _ := privkey.Curve.ScalarBaseMult(k.Bytes())
+	r.Mod(r, N)


Tiny nit here, this is probably just a bit faster:

if r.cmp(N) == 1 { r.Sub(r, N) }

jimmysong · 2015-04-01T20:48:55Z

@oleganza @davecgh I've checked everything and made my comments. A couple of nits and the only major thing is step H2. But even there, it'll go through fine if qlen is a multiple of 8, which it is in secp256k1.

davecgh · 2015-04-01T20:51:26Z

@jimmysong Thanks for taking the time to look it over!

oleganza · 2015-04-01T22:09:45Z

Addressed all the remarks. Please double-check.

oleganza · 2015-04-01T22:13:04Z

@davecgh @jimmysong Should I squash and rebase to make the merge neat?

jimmysong · 2015-04-01T22:13:57Z

@oleganza I would check for s being zero, but that's about it.

davecgh · 2015-04-01T22:23:31Z

@oleganza Yes, I'd like a single commit after the final OKs. Please hold off until then though as it's much easier to review the incremental changes during the review process that address items as separate commits.

Also, in the final commit, please add a closes #358 at the end so the associated issue is automatically closed.

davecgh · 2015-04-01T22:29:43Z

btcec/signature.go

+	if s.Cmp(halforder) == 1 {
+		s.Sub(N, s)
+	}
+	if r.Sign() == 0 {


davecgh · 2015-04-01T22:30:49Z

All updates look good except the typo in commit 489d98e, which I commented on (s.Sign).

davecgh · 2015-04-02T03:29:13Z

btcec/example_test.go

@@ -37,13 +37,14 @@ func Example_signMessage() {
 	//


This NOTE can be removed now since it's no longer true with you change.

oleganza · 2015-04-02T06:52:44Z

Oops, thanks. Waiting for the final OK.

davecgh · 2015-04-02T06:55:38Z

Looks good. OK.

…csuite#358.

oleganza mentioned this pull request Mar 31, 2015

Support deterministic signing (RFC6979) btcsuite/btcwallet#146

Closed

davecgh reviewed Mar 31, 2015
View reviewed changes

oleganza mentioned this pull request Mar 31, 2015

Support for additional query parameters for BTCBitcoinURL oleganza/CoreBitcoin#29

Merged

davecgh reviewed Apr 1, 2015
View reviewed changes

jimmysong reviewed Apr 1, 2015
View reviewed changes

davecgh reviewed Apr 1, 2015
View reviewed changes

btcec/signature.go

if s.Cmp(halforder) == 1 {

s.Sub(N, s)

}

if r.Sign() == 0 {

Copy link

Member

davecgh Apr 1, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s.Sign

davecgh reviewed Apr 2, 2015
View reviewed changes

Makes signing deterministic according to RFC6979 and BIP62. Closes bt…

122031b

…csuite#358.

oleganza force-pushed the rfc6979 branch from a5ceb69 to 122031b Compare April 2, 2015 07:58

conformal-deploy merged commit 122031b into btcsuite:master Apr 2, 2015

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deterministic signatures according to RFC6979 #360

Deterministic signatures according to RFC6979 #360

oleganza commented Mar 31, 2015

davecgh commented Mar 31, 2015

davecgh Mar 31, 2015

oleganza commented Mar 31, 2015

davecgh Mar 31, 2015

davecgh commented Mar 31, 2015

davecgh Mar 31, 2015

oleganza commented Mar 31, 2015

davecgh commented Mar 31, 2015

oleganza commented Mar 31, 2015

davecgh commented Mar 31, 2015

davecgh commented Mar 31, 2015

oleganza commented Mar 31, 2015

davecgh commented Mar 31, 2015

davecgh Apr 1, 2015

davecgh commented Apr 1, 2015

davecgh commented Apr 1, 2015

jimmysong commented Apr 1, 2015

oleganza commented Apr 1, 2015

jimmysong Apr 1, 2015

jimmysong commented Apr 1, 2015

davecgh commented Apr 1, 2015

oleganza commented Apr 1, 2015

oleganza commented Apr 1, 2015

jimmysong commented Apr 1, 2015

davecgh commented Apr 1, 2015

davecgh Apr 1, 2015

davecgh commented Apr 1, 2015

davecgh Apr 2, 2015

oleganza commented Apr 2, 2015

davecgh commented Apr 2, 2015

		@@ -56,11 +56,7 @@ func (p PrivateKey) ToECDSA() ecdsa.PrivateKey {
		// Sign wraps ecdsa.Sign to sign the provided hash (which should be the result

Deterministic signatures according to RFC6979 #360

Deterministic signatures according to RFC6979 #360

Conversation

oleganza commented Mar 31, 2015

davecgh commented Mar 31, 2015

davecgh Mar 31, 2015

Choose a reason for hiding this comment

oleganza commented Mar 31, 2015

davecgh Mar 31, 2015

Choose a reason for hiding this comment

davecgh commented Mar 31, 2015

davecgh Mar 31, 2015

Choose a reason for hiding this comment

oleganza commented Mar 31, 2015

davecgh commented Mar 31, 2015

oleganza commented Mar 31, 2015

davecgh commented Mar 31, 2015

davecgh commented Mar 31, 2015

oleganza commented Mar 31, 2015

davecgh commented Mar 31, 2015

davecgh Apr 1, 2015

Choose a reason for hiding this comment

davecgh commented Apr 1, 2015

davecgh commented Apr 1, 2015

jimmysong commented Apr 1, 2015

oleganza commented Apr 1, 2015

jimmysong Apr 1, 2015

Choose a reason for hiding this comment

jimmysong commented Apr 1, 2015

davecgh commented Apr 1, 2015

oleganza commented Apr 1, 2015

oleganza commented Apr 1, 2015

jimmysong commented Apr 1, 2015

davecgh commented Apr 1, 2015

davecgh Apr 1, 2015

Choose a reason for hiding this comment

davecgh commented Apr 1, 2015

davecgh Apr 2, 2015

Choose a reason for hiding this comment

oleganza commented Apr 2, 2015

davecgh commented Apr 2, 2015