ThomasV
2 years ago
committed by
SomberNight
37 changed files with 84 additions and 795 deletions
@ -1,553 +0,0 @@ |
|||||||
# -*- coding: utf-8 -*- |
|
||||||
# |
|
||||||
# Electrum - lightweight Bitcoin client |
|
||||||
# Copyright (C) 2018-2024 The Electrum developers |
|
||||||
# |
|
||||||
# Permission is hereby granted, free of charge, to any person |
|
||||||
# obtaining a copy of this software and associated documentation files |
|
||||||
# (the "Software"), to deal in the Software without restriction, |
|
||||||
# including without limitation the rights to use, copy, modify, merge, |
|
||||||
# publish, distribute, sublicense, and/or sell copies of the Software, |
|
||||||
# and to permit persons to whom the Software is furnished to do so, |
|
||||||
# subject to the following conditions: |
|
||||||
# |
|
||||||
# The above copyright notice and this permission notice shall be |
|
||||||
# included in all copies or substantial portions of the Software. |
|
||||||
# |
|
||||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, |
|
||||||
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
|
||||||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND |
|
||||||
# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS |
|
||||||
# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN |
|
||||||
# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN |
|
||||||
# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
|
||||||
# SOFTWARE. |
|
||||||
|
|
||||||
import base64 |
|
||||||
import hashlib |
|
||||||
import functools |
|
||||||
import secrets |
|
||||||
from typing import Union, Tuple, Optional |
|
||||||
from ctypes import ( |
|
||||||
byref, c_char_p, c_size_t, create_string_buffer, cast, |
|
||||||
) |
|
||||||
|
|
||||||
from . import ecc_fast |
|
||||||
from .ecc_fast import _libsecp256k1, SECP256K1_EC_UNCOMPRESSED, LibModuleMissing |
|
||||||
|
|
||||||
def assert_bytes(x): |
|
||||||
assert isinstance(x, (bytes, bytearray)) |
|
||||||
|
|
||||||
# Some unit tests need to create ECDSA sigs without grinding the R value (and just use RFC6979). |
|
||||||
# see https://github.com/bitcoin/bitcoin/pull/13666 |
|
||||||
ENABLE_ECDSA_R_VALUE_GRINDING = True |
|
||||||
|
|
||||||
|
|
||||||
def string_to_number(b: bytes) -> int: |
|
||||||
return int.from_bytes(b, byteorder='big', signed=False) |
|
||||||
|
|
||||||
|
|
||||||
def ecdsa_sig64_from_der_sig(der_sig: bytes) -> bytes: |
|
||||||
r, s = get_r_and_s_from_ecdsa_der_sig(der_sig) |
|
||||||
return ecdsa_sig64_from_r_and_s(r, s) |
|
||||||
|
|
||||||
|
|
||||||
def ecdsa_der_sig_from_ecdsa_sig64(sig64: bytes) -> bytes: |
|
||||||
r, s = get_r_and_s_from_ecdsa_sig64(sig64) |
|
||||||
return ecdsa_der_sig_from_r_and_s(r, s) |
|
||||||
|
|
||||||
|
|
||||||
def ecdsa_der_sig_from_r_and_s(r: int, s: int) -> bytes: |
|
||||||
sig64 = ( |
|
||||||
int.to_bytes(r, length=32, byteorder="big") + |
|
||||||
int.to_bytes(s, length=32, byteorder="big")) |
|
||||||
sig = create_string_buffer(64) |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_parse_compact(_libsecp256k1.ctx, sig, sig64) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception("Bad signature") |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_normalize(_libsecp256k1.ctx, sig, sig) |
|
||||||
der_sig = create_string_buffer(80) # this much space should be enough |
|
||||||
der_sig_size = c_size_t(len(der_sig)) |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_serialize_der(_libsecp256k1.ctx, der_sig, byref(der_sig_size), sig) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception("failed to serialize DER sig") |
|
||||||
der_sig_size = der_sig_size.value |
|
||||||
return bytes(der_sig)[:der_sig_size] |
|
||||||
|
|
||||||
|
|
||||||
def get_r_and_s_from_ecdsa_der_sig(der_sig: bytes) -> Tuple[int, int]: |
|
||||||
assert isinstance(der_sig, bytes) |
|
||||||
sig = create_string_buffer(64) |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_parse_der(_libsecp256k1.ctx, sig, der_sig, len(der_sig)) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception("Bad signature") |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_normalize(_libsecp256k1.ctx, sig, sig) |
|
||||||
compact_signature = create_string_buffer(64) |
|
||||||
_libsecp256k1.secp256k1_ecdsa_signature_serialize_compact(_libsecp256k1.ctx, compact_signature, sig) |
|
||||||
r = int.from_bytes(compact_signature[:32], byteorder="big") |
|
||||||
s = int.from_bytes(compact_signature[32:], byteorder="big") |
|
||||||
return r, s |
|
||||||
|
|
||||||
|
|
||||||
def get_r_and_s_from_ecdsa_sig64(sig64: bytes) -> Tuple[int, int]: |
|
||||||
if not (isinstance(sig64, bytes) and len(sig64) == 64): |
|
||||||
raise Exception("sig64 must be bytes, and 64 bytes exactly") |
|
||||||
sig = create_string_buffer(64) |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_parse_compact(_libsecp256k1.ctx, sig, sig64) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception("Bad signature") |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_normalize(_libsecp256k1.ctx, sig, sig) |
|
||||||
compact_signature = create_string_buffer(64) |
|
||||||
_libsecp256k1.secp256k1_ecdsa_signature_serialize_compact(_libsecp256k1.ctx, compact_signature, sig) |
|
||||||
r = int.from_bytes(compact_signature[:32], byteorder="big") |
|
||||||
s = int.from_bytes(compact_signature[32:], byteorder="big") |
|
||||||
return r, s |
|
||||||
|
|
||||||
|
|
||||||
def ecdsa_sig64_from_r_and_s(r: int, s: int) -> bytes: |
|
||||||
sig64 = ( |
|
||||||
int.to_bytes(r, length=32, byteorder="big") + |
|
||||||
int.to_bytes(s, length=32, byteorder="big")) |
|
||||||
sig = create_string_buffer(64) |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_parse_compact(_libsecp256k1.ctx, sig, sig64) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception("Bad signature") |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_normalize(_libsecp256k1.ctx, sig, sig) |
|
||||||
compact_signature = create_string_buffer(64) |
|
||||||
_libsecp256k1.secp256k1_ecdsa_signature_serialize_compact(_libsecp256k1.ctx, compact_signature, sig) |
|
||||||
return bytes(compact_signature) |
|
||||||
|
|
||||||
|
|
||||||
def _x_and_y_from_pubkey_bytes(pubkey: bytes) -> Tuple[int, int]: |
|
||||||
assert isinstance(pubkey, bytes), f'pubkey must be bytes, not {type(pubkey)}' |
|
||||||
pubkey_ptr = create_string_buffer(64) |
|
||||||
ret = _libsecp256k1.secp256k1_ec_pubkey_parse( |
|
||||||
_libsecp256k1.ctx, pubkey_ptr, pubkey, len(pubkey)) |
|
||||||
if 1 != ret: |
|
||||||
raise InvalidECPointException( |
|
||||||
f'public key could not be parsed or is invalid: {pubkey.hex()!r}') |
|
||||||
|
|
||||||
pubkey_serialized = create_string_buffer(65) |
|
||||||
pubkey_size = c_size_t(65) |
|
||||||
_libsecp256k1.secp256k1_ec_pubkey_serialize( |
|
||||||
_libsecp256k1.ctx, pubkey_serialized, byref(pubkey_size), pubkey_ptr, SECP256K1_EC_UNCOMPRESSED) |
|
||||||
pubkey_serialized = bytes(pubkey_serialized) |
|
||||||
assert pubkey_serialized[0] == 0x04, pubkey_serialized |
|
||||||
x = int.from_bytes(pubkey_serialized[1:33], byteorder='big', signed=False) |
|
||||||
y = int.from_bytes(pubkey_serialized[33:65], byteorder='big', signed=False) |
|
||||||
return x, y |
|
||||||
|
|
||||||
|
|
||||||
class InvalidECPointException(Exception): |
|
||||||
"""e.g. not on curve, or infinity""" |
|
||||||
|
|
||||||
|
|
||||||
@functools.total_ordering |
|
||||||
class ECPubkey(object): |
|
||||||
|
|
||||||
def __init__(self, b: Optional[bytes]): |
|
||||||
if b is not None: |
|
||||||
assert isinstance(b, (bytes, bytearray)), f'pubkey must be bytes-like, not {type(b)}' |
|
||||||
if isinstance(b, bytearray): |
|
||||||
b = bytes(b) |
|
||||||
self._x, self._y = _x_and_y_from_pubkey_bytes(b) |
|
||||||
else: |
|
||||||
self._x, self._y = None, None |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def from_ecdsa_sig64(cls, sig64: bytes, recid: int, msg32: bytes) -> 'ECPubkey': |
|
||||||
assert_bytes(sig64) |
|
||||||
if len(sig64) != 64: |
|
||||||
raise Exception(f'wrong encoding used for signature? len={len(sig64)} (should be 64)') |
|
||||||
if not (0 <= recid <= 3): |
|
||||||
raise ValueError('recid is {}, but should be 0 <= recid <= 3'.format(recid)) |
|
||||||
assert isinstance(msg32, (bytes, bytearray)), type(msg32) |
|
||||||
assert len(msg32) == 32, len(msg32) |
|
||||||
sig65 = create_string_buffer(65) |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_recoverable_signature_parse_compact( |
|
||||||
_libsecp256k1.ctx, sig65, sig64, recid) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception('failed to parse signature') |
|
||||||
pubkey = create_string_buffer(64) |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_recover(_libsecp256k1.ctx, pubkey, sig65, msg32) |
|
||||||
if 1 != ret: |
|
||||||
raise InvalidECPointException('failed to recover public key') |
|
||||||
return ECPubkey._from_libsecp256k1_pubkey_ptr(pubkey) |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def from_ecdsa_sig65(cls, sig65: bytes, msg32: bytes) -> Tuple['ECPubkey', bool, Optional[str]]: |
|
||||||
assert_bytes(sig65) |
|
||||||
if len(sig65) != 65: |
|
||||||
raise Exception(f'wrong encoding used for signature? len={len(sig65)} (should be 65)') |
|
||||||
nV = sig65[0] |
|
||||||
# as per BIP-0137: |
|
||||||
# 27-30: p2pkh (uncompressed) |
|
||||||
# 31-34: p2pkh (compressed) |
|
||||||
# 35-38: p2wpkh-p2sh |
|
||||||
# 39-42: p2wpkh |
|
||||||
# However, the signatures we create do not respect this, and we instead always use 27-34, |
|
||||||
# only distinguishing between compressed/uncompressed, so we treat those values as "any". |
|
||||||
if not (27 <= nV <= 42): |
|
||||||
raise Exception("Bad encoding") |
|
||||||
txin_type_guess = None |
|
||||||
compressed = True |
|
||||||
if nV >= 39: |
|
||||||
nV -= 12 |
|
||||||
txin_type_guess = "p2wpkh" |
|
||||||
elif nV >= 35: |
|
||||||
nV -= 8 |
|
||||||
txin_type_guess = "p2wpkh-p2sh" |
|
||||||
elif nV >= 31: |
|
||||||
nV -= 4 |
|
||||||
else: |
|
||||||
compressed = False |
|
||||||
recid = nV - 27 |
|
||||||
pubkey = cls.from_ecdsa_sig64(sig65[1:], recid, msg32) |
|
||||||
return pubkey, compressed, txin_type_guess |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def from_x_and_y(cls, x: int, y: int) -> 'ECPubkey': |
|
||||||
_bytes = (b'\x04' |
|
||||||
+ int.to_bytes(x, length=32, byteorder='big', signed=False) |
|
||||||
+ int.to_bytes(y, length=32, byteorder='big', signed=False)) |
|
||||||
return ECPubkey(_bytes) |
|
||||||
|
|
||||||
def get_public_key_bytes(self, compressed=True) -> bytes: |
|
||||||
if self.is_at_infinity(): raise Exception('point is at infinity') |
|
||||||
x = int.to_bytes(self.x(), length=32, byteorder='big', signed=False) |
|
||||||
y = int.to_bytes(self.y(), length=32, byteorder='big', signed=False) |
|
||||||
if compressed: |
|
||||||
header = b'\x03' if self.y() & 1 else b'\x02' |
|
||||||
return header + x |
|
||||||
else: |
|
||||||
header = b'\x04' |
|
||||||
return header + x + y |
|
||||||
|
|
||||||
def get_public_key_hex(self, compressed=True) -> str: |
|
||||||
return self.get_public_key_bytes(compressed).hex() |
|
||||||
|
|
||||||
def point(self) -> Tuple[Optional[int], Optional[int]]: |
|
||||||
x = self.x() |
|
||||||
y = self.y() |
|
||||||
assert (x is None) == (y is None), f"either both x and y, or neither should be None. {(x, y)=}" |
|
||||||
return x, y |
|
||||||
|
|
||||||
def x(self) -> Optional[int]: |
|
||||||
return self._x |
|
||||||
|
|
||||||
def y(self) -> Optional[int]: |
|
||||||
return self._y |
|
||||||
|
|
||||||
def _to_libsecp256k1_pubkey_ptr(self): |
|
||||||
"""pointer to `secp256k1_pubkey` C struct""" |
|
||||||
pubkey_ptr = create_string_buffer(64) |
|
||||||
pk_bytes = self.get_public_key_bytes(compressed=False) |
|
||||||
ret = _libsecp256k1.secp256k1_ec_pubkey_parse( |
|
||||||
_libsecp256k1.ctx, pubkey_ptr, pk_bytes, len(pk_bytes)) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception(f'public key could not be parsed or is invalid: {pk_bytes.hex()!r}') |
|
||||||
return pubkey_ptr |
|
||||||
|
|
||||||
def _to_libsecp256k1_xonly_pubkey_ptr(self): |
|
||||||
"""pointer to `secp256k1_xonly_pubkey` C struct""" |
|
||||||
if not ecc_fast.HAS_SCHNORR: |
|
||||||
raise LibModuleMissing( |
|
||||||
'libsecp256k1 library found but it was built ' |
|
||||||
'without required modules (--enable-module-schnorrsig --enable-module-extrakeys)') |
|
||||||
pubkey_ptr = create_string_buffer(64) |
|
||||||
pk_bytes = self.get_public_key_bytes(compressed=True)[1:] |
|
||||||
ret = _libsecp256k1.secp256k1_xonly_pubkey_parse( |
|
||||||
_libsecp256k1.ctx, pubkey_ptr, pk_bytes) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception(f'public key could not be parsed or is invalid: {pk_bytes.hex()!r}') |
|
||||||
return pubkey_ptr |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def _from_libsecp256k1_pubkey_ptr(cls, pubkey) -> 'ECPubkey': |
|
||||||
pubkey_serialized = create_string_buffer(65) |
|
||||||
pubkey_size = c_size_t(65) |
|
||||||
_libsecp256k1.secp256k1_ec_pubkey_serialize( |
|
||||||
_libsecp256k1.ctx, pubkey_serialized, byref(pubkey_size), pubkey, SECP256K1_EC_UNCOMPRESSED) |
|
||||||
return ECPubkey(bytes(pubkey_serialized)) |
|
||||||
|
|
||||||
def __repr__(self): |
|
||||||
if self.is_at_infinity(): |
|
||||||
return f"<ECPubkey infinity>" |
|
||||||
return f"<ECPubkey {self.get_public_key_hex()}>" |
|
||||||
|
|
||||||
def __mul__(self, other: int): |
|
||||||
if not isinstance(other, int): |
|
||||||
raise TypeError('multiplication not defined for ECPubkey and {}'.format(type(other))) |
|
||||||
|
|
||||||
other %= CURVE_ORDER |
|
||||||
if self.is_at_infinity() or other == 0: |
|
||||||
return POINT_AT_INFINITY |
|
||||||
pubkey = self._to_libsecp256k1_pubkey_ptr() |
|
||||||
|
|
||||||
ret = _libsecp256k1.secp256k1_ec_pubkey_tweak_mul(_libsecp256k1.ctx, pubkey, other.to_bytes(32, byteorder="big")) |
|
||||||
if 1 != ret: |
|
||||||
return POINT_AT_INFINITY |
|
||||||
return ECPubkey._from_libsecp256k1_pubkey_ptr(pubkey) |
|
||||||
|
|
||||||
def __rmul__(self, other: int): |
|
||||||
return self * other |
|
||||||
|
|
||||||
def __add__(self, other): |
|
||||||
if not isinstance(other, ECPubkey): |
|
||||||
raise TypeError('addition not defined for ECPubkey and {}'.format(type(other))) |
|
||||||
if self.is_at_infinity(): return other |
|
||||||
if other.is_at_infinity(): return self |
|
||||||
|
|
||||||
pubkey1 = self._to_libsecp256k1_pubkey_ptr() |
|
||||||
pubkey2 = other._to_libsecp256k1_pubkey_ptr() |
|
||||||
pubkey_sum = create_string_buffer(64) |
|
||||||
|
|
||||||
pubkey1 = cast(pubkey1, c_char_p) |
|
||||||
pubkey2 = cast(pubkey2, c_char_p) |
|
||||||
array_of_pubkey_ptrs = (c_char_p * 2)(pubkey1, pubkey2) |
|
||||||
ret = _libsecp256k1.secp256k1_ec_pubkey_combine(_libsecp256k1.ctx, pubkey_sum, array_of_pubkey_ptrs, 2) |
|
||||||
if 1 != ret: |
|
||||||
return POINT_AT_INFINITY |
|
||||||
return ECPubkey._from_libsecp256k1_pubkey_ptr(pubkey_sum) |
|
||||||
|
|
||||||
def __eq__(self, other) -> bool: |
|
||||||
if not isinstance(other, ECPubkey): |
|
||||||
return False |
|
||||||
return self.point() == other.point() |
|
||||||
|
|
||||||
def __ne__(self, other): |
|
||||||
return not (self == other) |
|
||||||
|
|
||||||
def __hash__(self): |
|
||||||
return hash(self.point()) |
|
||||||
|
|
||||||
def __lt__(self, other): |
|
||||||
if not isinstance(other, ECPubkey): |
|
||||||
raise TypeError('comparison not defined for ECPubkey and {}'.format(type(other))) |
|
||||||
p1 = ((self.x() or 0), (self.y() or 0)) |
|
||||||
p2 = ((other.x() or 0), (other.y() or 0)) |
|
||||||
return p1 < p2 |
|
||||||
|
|
||||||
def ecdsa_verify_recoverable(self, sig65: bytes, msg32: bytes) -> bool: |
|
||||||
try: |
|
||||||
public_key, _compressed, _txin_type_guess = self.from_ecdsa_sig65(sig65, msg32) |
|
||||||
except Exception: |
|
||||||
return False |
|
||||||
# check public key |
|
||||||
if public_key != self: |
|
||||||
return False |
|
||||||
# check message |
|
||||||
return self.ecdsa_verify(sig65[1:], msg32) |
|
||||||
|
|
||||||
def ecdsa_verify( |
|
||||||
self, |
|
||||||
sig64: bytes, |
|
||||||
msg32: bytes, |
|
||||||
*, |
|
||||||
enforce_low_s: bool = True, # policy/standardness rule |
|
||||||
) -> bool: |
|
||||||
assert_bytes(sig64) |
|
||||||
if len(sig64) != 64: |
|
||||||
return False |
|
||||||
if not (isinstance(msg32, bytes) and len(msg32) == 32): |
|
||||||
return False |
|
||||||
|
|
||||||
sig = create_string_buffer(64) |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_parse_compact(_libsecp256k1.ctx, sig, sig64) |
|
||||||
if 1 != ret: |
|
||||||
return False |
|
||||||
if not enforce_low_s: |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_signature_normalize(_libsecp256k1.ctx, sig, sig) |
|
||||||
|
|
||||||
pubkey = self._to_libsecp256k1_pubkey_ptr() |
|
||||||
if 1 != _libsecp256k1.secp256k1_ecdsa_verify(_libsecp256k1.ctx, sig, msg32, pubkey): |
|
||||||
return False |
|
||||||
return True |
|
||||||
|
|
||||||
def schnorr_verify(self, sig64: bytes, msg32: bytes) -> bool: |
|
||||||
assert isinstance(sig64, bytes), type(sig64) |
|
||||||
assert len(sig64) == 64, len(sig64) |
|
||||||
assert isinstance(msg32, bytes), type(msg32) |
|
||||||
assert len(msg32) == 32, len(msg32) |
|
||||||
if not ecc_fast.HAS_SCHNORR: |
|
||||||
raise LibModuleMissing( |
|
||||||
'libsecp256k1 library found but it was built ' |
|
||||||
'without required modules (--enable-module-schnorrsig --enable-module-extrakeys)') |
|
||||||
msglen = 32 |
|
||||||
pubkey = self._to_libsecp256k1_xonly_pubkey_ptr() |
|
||||||
if 1 != _libsecp256k1.secp256k1_schnorrsig_verify(_libsecp256k1.ctx, sig64, msg32, msglen, pubkey): |
|
||||||
return False |
|
||||||
return True |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def order(cls) -> int: |
|
||||||
return CURVE_ORDER |
|
||||||
|
|
||||||
def is_at_infinity(self) -> bool: |
|
||||||
return self == POINT_AT_INFINITY |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def is_pubkey_bytes(cls, b: bytes) -> bool: |
|
||||||
try: |
|
||||||
ECPubkey(b) |
|
||||||
return True |
|
||||||
except Exception: |
|
||||||
return False |
|
||||||
|
|
||||||
def has_even_y(self) -> bool: |
|
||||||
return self.y() % 2 == 0 |
|
||||||
|
|
||||||
|
|
||||||
GENERATOR = ECPubkey(bytes.fromhex('0479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798' |
|
||||||
'483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8')) |
|
||||||
CURVE_ORDER = 0xFFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFE_BAAEDCE6_AF48A03B_BFD25E8C_D0364141 |
|
||||||
POINT_AT_INFINITY = ECPubkey(None) |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
def is_secret_within_curve_range(secret: Union[int, bytes]) -> bool: |
|
||||||
if isinstance(secret, bytes): |
|
||||||
secret = string_to_number(secret) |
|
||||||
return 0 < secret < CURVE_ORDER |
|
||||||
|
|
||||||
|
|
||||||
class ECPrivkey(ECPubkey): |
|
||||||
|
|
||||||
def __init__(self, privkey_bytes: bytes): |
|
||||||
assert_bytes(privkey_bytes) |
|
||||||
if len(privkey_bytes) != 32: |
|
||||||
raise Exception('unexpected size for secret. should be 32 bytes, not {}'.format(len(privkey_bytes))) |
|
||||||
secret = string_to_number(privkey_bytes) |
|
||||||
if not is_secret_within_curve_range(secret): |
|
||||||
raise InvalidECPointException('Invalid secret scalar (not within curve order)') |
|
||||||
self.secret_scalar = secret |
|
||||||
|
|
||||||
pubkey = GENERATOR * secret |
|
||||||
super().__init__(pubkey.get_public_key_bytes(compressed=False)) |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def from_secret_scalar(cls, secret_scalar: int) -> 'ECPrivkey': |
|
||||||
secret_bytes = int.to_bytes(secret_scalar, length=32, byteorder='big', signed=False) |
|
||||||
return ECPrivkey(secret_bytes) |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def from_arbitrary_size_secret(cls, privkey_bytes: bytes) -> 'ECPrivkey': |
|
||||||
"""This method is only for legacy reasons. Do not introduce new code that uses it. |
|
||||||
Unlike the default constructor, this method does not require len(privkey_bytes) == 32, |
|
||||||
and the secret does not need to be within the curve order either. |
|
||||||
""" |
|
||||||
return ECPrivkey(cls.normalize_secret_bytes(privkey_bytes)) |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def normalize_secret_bytes(cls, privkey_bytes: bytes) -> bytes: |
|
||||||
scalar = string_to_number(privkey_bytes) % CURVE_ORDER |
|
||||||
if scalar == 0: |
|
||||||
raise Exception('invalid EC private key scalar: zero') |
|
||||||
privkey_32bytes = int.to_bytes(scalar, length=32, byteorder='big', signed=False) |
|
||||||
return privkey_32bytes |
|
||||||
|
|
||||||
def __repr__(self): |
|
||||||
return f"<ECPrivkey {self.get_public_key_hex()}>" |
|
||||||
|
|
||||||
@classmethod |
|
||||||
def generate_random_key(cls) -> 'ECPrivkey': |
|
||||||
randint = secrets.randbelow(CURVE_ORDER - 1) + 1 |
|
||||||
ephemeral_exponent = int.to_bytes(randint, length=32, byteorder='big', signed=False) |
|
||||||
return ECPrivkey(ephemeral_exponent) |
|
||||||
|
|
||||||
def get_secret_bytes(self) -> bytes: |
|
||||||
return int.to_bytes(self.secret_scalar, length=32, byteorder='big', signed=False) |
|
||||||
|
|
||||||
def ecdsa_sign(self, msg32: bytes, *, sigencode=None) -> bytes: |
|
||||||
if not (isinstance(msg32, bytes) and len(msg32) == 32): |
|
||||||
raise Exception("msg32 to be signed must be bytes, and 32 bytes exactly") |
|
||||||
if sigencode is None: |
|
||||||
sigencode = ecdsa_sig64_from_r_and_s |
|
||||||
|
|
||||||
privkey_bytes = self.secret_scalar.to_bytes(32, byteorder="big") |
|
||||||
nonce_function = None |
|
||||||
sig = create_string_buffer(64) |
|
||||||
def sign_with_extra_entropy(extra_entropy): |
|
||||||
ret = _libsecp256k1.secp256k1_ecdsa_sign( |
|
||||||
_libsecp256k1.ctx, sig, msg32, privkey_bytes, |
|
||||||
nonce_function, extra_entropy) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception('the nonce generation function failed, or the private key was invalid') |
|
||||||
compact_signature = create_string_buffer(64) |
|
||||||
_libsecp256k1.secp256k1_ecdsa_signature_serialize_compact(_libsecp256k1.ctx, compact_signature, sig) |
|
||||||
r = int.from_bytes(compact_signature[:32], byteorder="big") |
|
||||||
s = int.from_bytes(compact_signature[32:], byteorder="big") |
|
||||||
return r, s |
|
||||||
|
|
||||||
r, s = sign_with_extra_entropy(extra_entropy=None) |
|
||||||
if ENABLE_ECDSA_R_VALUE_GRINDING: |
|
||||||
counter = 0 |
|
||||||
while r >= 2**255: # grind for low R value https://github.com/bitcoin/bitcoin/pull/13666 |
|
||||||
counter += 1 |
|
||||||
extra_entropy = counter.to_bytes(32, byteorder="little") |
|
||||||
r, s = sign_with_extra_entropy(extra_entropy=extra_entropy) |
|
||||||
|
|
||||||
sig64 = ecdsa_sig64_from_r_and_s(r, s) |
|
||||||
if not self.ecdsa_verify(sig64, msg32): |
|
||||||
raise Exception("sanity check failed: signature we just created does not verify!") |
|
||||||
|
|
||||||
sig = sigencode(r, s) |
|
||||||
return sig |
|
||||||
|
|
||||||
def schnorr_sign(self, msg32: bytes, *, aux_rand32: bytes = None) -> bytes: |
|
||||||
"""Creates a BIP-340 schnorr signature for the given message (hash) |
|
||||||
and using the optional auxiliary random data. |
|
||||||
|
|
||||||
note: msg32 is supposed to be a 32 byte hash of the message to be signed. |
|
||||||
The BIP recommends using bip340_tagged_hash for hashing the message. |
|
||||||
""" |
|
||||||
assert isinstance(msg32, bytes), type(msg32) |
|
||||||
assert len(msg32) == 32, len(msg32) |
|
||||||
if aux_rand32 is None: |
|
||||||
aux_rand32 = bytes(32) |
|
||||||
assert isinstance(aux_rand32, bytes), type(aux_rand32) |
|
||||||
assert len(aux_rand32) == 32, len(aux_rand32) |
|
||||||
if not ecc_fast.HAS_SCHNORR: |
|
||||||
raise LibModuleMissing( |
|
||||||
'libsecp256k1 library found but it was built ' |
|
||||||
'without required modules (--enable-module-schnorrsig --enable-module-extrakeys)') |
|
||||||
# construct "keypair" obj |
|
||||||
privkey_bytes = self.secret_scalar.to_bytes(32, byteorder="big") |
|
||||||
keypair = create_string_buffer(96) |
|
||||||
ret = _libsecp256k1.secp256k1_keypair_create(_libsecp256k1.ctx, keypair, privkey_bytes) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception('secret key was invalid') |
|
||||||
# sign msg and verify sig |
|
||||||
sig64 = create_string_buffer(64) |
|
||||||
ret = _libsecp256k1.secp256k1_schnorrsig_sign32( |
|
||||||
_libsecp256k1.ctx, sig64, msg32, keypair, aux_rand32) |
|
||||||
sig64 = bytes(sig64) |
|
||||||
if 1 != ret: |
|
||||||
raise Exception('signing failure') |
|
||||||
if not self.schnorr_verify(sig64, msg32): |
|
||||||
raise Exception("sanity check failed: signature we just created does not verify!") |
|
||||||
return sig64 |
|
||||||
|
|
||||||
def ecdsa_sign_recoverable(self, msg32: bytes, *, is_compressed: bool) -> bytes: |
|
||||||
assert len(msg32) == 32, len(msg32) |
|
||||||
|
|
||||||
def bruteforce_recid(sig64: bytes): |
|
||||||
for recid in range(4): |
|
||||||
sig65 = construct_ecdsa_sig65(sig64, recid, is_compressed=is_compressed) |
|
||||||
if not self.ecdsa_verify_recoverable(sig65, msg32): |
|
||||||
continue |
|
||||||
return sig65, recid |
|
||||||
else: |
|
||||||
raise Exception("error: cannot sign message. no recid fits..") |
|
||||||
|
|
||||||
sig64 = self.ecdsa_sign(msg32, sigencode=ecdsa_sig64_from_r_and_s) |
|
||||||
sig65, recid = bruteforce_recid(sig64) |
|
||||||
return sig65 |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
def construct_ecdsa_sig65(sig64: bytes, recid: int, *, is_compressed: bool) -> bytes: |
|
||||||
comp = 4 if is_compressed else 0 |
|
||||||
return bytes([27 + recid + comp]) + sig64 |
|
||||||
|
|
||||||
|
|
||||||
@ -1,194 +0,0 @@ |
|||||||
# Copyright (c) 2013-2018 Richard Kiss |
|
||||||
# Copyright (c) 2018-2024 The Electrum developers |
|
||||||
# Distributed under the MIT software license, see the accompanying |
|
||||||
# file LICENCE or http://www.opensource.org/licenses/mit-license.php |
|
||||||
# |
|
||||||
# Originally based on pycoin: |
|
||||||
# https://github.com/richardkiss/pycoin/blob/01b1787ed902df23f99a55deb00d8cd076a906fe/pycoin/ecdsa/native/secp256k1.py |
|
||||||
|
|
||||||
import os |
|
||||||
import sys |
|
||||||
import traceback |
|
||||||
import ctypes |
|
||||||
from ctypes import ( |
|
||||||
byref, c_byte, c_int, c_uint, c_char_p, c_size_t, c_void_p, create_string_buffer, |
|
||||||
CFUNCTYPE, POINTER, cast |
|
||||||
) |
|
||||||
|
|
||||||
from .logging import get_logger |
|
||||||
|
|
||||||
|
|
||||||
_logger = get_logger(__name__) |
|
||||||
|
|
||||||
|
|
||||||
SECP256K1_FLAGS_TYPE_MASK = ((1 << 8) - 1) |
|
||||||
SECP256K1_FLAGS_TYPE_CONTEXT = (1 << 0) |
|
||||||
SECP256K1_FLAGS_TYPE_COMPRESSION = (1 << 1) |
|
||||||
# /** The higher bits contain the actual data. Do not use directly. */ |
|
||||||
SECP256K1_FLAGS_BIT_CONTEXT_VERIFY = (1 << 8) |
|
||||||
SECP256K1_FLAGS_BIT_CONTEXT_SIGN = (1 << 9) |
|
||||||
SECP256K1_FLAGS_BIT_COMPRESSION = (1 << 8) |
|
||||||
|
|
||||||
# /** Flags to pass to secp256k1_context_create. */ |
|
||||||
SECP256K1_CONTEXT_VERIFY = (SECP256K1_FLAGS_TYPE_CONTEXT | SECP256K1_FLAGS_BIT_CONTEXT_VERIFY) |
|
||||||
SECP256K1_CONTEXT_SIGN = (SECP256K1_FLAGS_TYPE_CONTEXT | SECP256K1_FLAGS_BIT_CONTEXT_SIGN) |
|
||||||
SECP256K1_CONTEXT_NONE = (SECP256K1_FLAGS_TYPE_CONTEXT) |
|
||||||
|
|
||||||
SECP256K1_EC_COMPRESSED = (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION) |
|
||||||
SECP256K1_EC_UNCOMPRESSED = (SECP256K1_FLAGS_TYPE_COMPRESSION) |
|
||||||
|
|
||||||
|
|
||||||
class LibModuleMissing(Exception): pass |
|
||||||
|
|
||||||
|
|
||||||
def load_library(): |
|
||||||
global HAS_SCHNORR |
|
||||||
|
|
||||||
# note: for a mapping between bitcoin-core/secp256k1 git tags and .so.V libtool version numbers, |
|
||||||
# see https://github.com/bitcoin-core/secp256k1/pull/1055#issuecomment-1227505189 |
|
||||||
tested_libversions = [2, 1, 0, ] # try latest version first |
|
||||||
libnames = [] |
|
||||||
if sys.platform == 'darwin': |
|
||||||
for v in tested_libversions: |
|
||||||
libnames.append(f"libsecp256k1.{v}.dylib") |
|
||||||
elif sys.platform in ('windows', 'win32'): |
|
||||||
for v in tested_libversions: |
|
||||||
libnames.append(f"libsecp256k1-{v}.dll") |
|
||||||
elif 'ANDROID_DATA' in os.environ: |
|
||||||
libnames = ['libsecp256k1.so', ] # don't care about version number. we built w/e is available. |
|
||||||
else: # desktop Linux and similar |
|
||||||
for v in tested_libversions: |
|
||||||
libnames.append(f"libsecp256k1.so.{v}") |
|
||||||
# maybe we could fall back to trying "any" version? maybe guarded with an env var? |
|
||||||
#libnames.append(f"libsecp256k1.so") |
|
||||||
library_paths = [] |
|
||||||
for libname in libnames: # try local files in repo dir first |
|
||||||
library_paths.append(os.path.join(os.path.dirname(__file__), libname)) |
|
||||||
for libname in libnames: |
|
||||||
library_paths.append(libname) |
|
||||||
|
|
||||||
exceptions = [] |
|
||||||
secp256k1 = None |
|
||||||
for libpath in library_paths: |
|
||||||
try: |
|
||||||
secp256k1 = ctypes.cdll.LoadLibrary(libpath) |
|
||||||
except BaseException as e: |
|
||||||
exceptions.append(e) |
|
||||||
else: |
|
||||||
break |
|
||||||
if not secp256k1: |
|
||||||
_logger.error(f'libsecp256k1 library failed to load. exceptions: {repr(exceptions)}') |
|
||||||
return None |
|
||||||
|
|
||||||
try: |
|
||||||
secp256k1.secp256k1_context_create.argtypes = [c_uint] |
|
||||||
secp256k1.secp256k1_context_create.restype = c_void_p |
|
||||||
|
|
||||||
secp256k1.secp256k1_context_randomize.argtypes = [c_void_p, c_char_p] |
|
||||||
secp256k1.secp256k1_context_randomize.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ec_pubkey_create.argtypes = [c_void_p, c_void_p, c_char_p] |
|
||||||
secp256k1.secp256k1_ec_pubkey_create.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ecdsa_sign.argtypes = [c_void_p, c_char_p, c_char_p, c_char_p, c_void_p, c_void_p] |
|
||||||
secp256k1.secp256k1_ecdsa_sign.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ecdsa_verify.argtypes = [c_void_p, c_char_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_ecdsa_verify.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ec_pubkey_parse.argtypes = [c_void_p, c_char_p, c_char_p, c_size_t] |
|
||||||
secp256k1.secp256k1_ec_pubkey_parse.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ec_pubkey_serialize.argtypes = [c_void_p, c_char_p, c_void_p, c_char_p, c_uint] |
|
||||||
secp256k1.secp256k1_ec_pubkey_serialize.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ecdsa_signature_parse_compact.argtypes = [c_void_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_ecdsa_signature_parse_compact.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ecdsa_signature_normalize.argtypes = [c_void_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_ecdsa_signature_normalize.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ecdsa_signature_serialize_compact.argtypes = [c_void_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_ecdsa_signature_serialize_compact.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ecdsa_signature_parse_der.argtypes = [c_void_p, c_char_p, c_char_p, c_size_t] |
|
||||||
secp256k1.secp256k1_ecdsa_signature_parse_der.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ecdsa_signature_serialize_der.argtypes = [c_void_p, c_char_p, c_void_p, c_char_p] |
|
||||||
secp256k1.secp256k1_ecdsa_signature_serialize_der.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ec_pubkey_tweak_mul.argtypes = [c_void_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_ec_pubkey_tweak_mul.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ec_pubkey_combine.argtypes = [c_void_p, c_char_p, c_void_p, c_size_t] |
|
||||||
secp256k1.secp256k1_ec_pubkey_combine.restype = c_int |
|
||||||
|
|
||||||
# --enable-module-recovery |
|
||||||
try: |
|
||||||
secp256k1.secp256k1_ecdsa_recover.argtypes = [c_void_p, c_char_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_ecdsa_recover.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_ecdsa_recoverable_signature_parse_compact.argtypes = [c_void_p, c_char_p, c_char_p, c_int] |
|
||||||
secp256k1.secp256k1_ecdsa_recoverable_signature_parse_compact.restype = c_int |
|
||||||
except (OSError, AttributeError): |
|
||||||
raise LibModuleMissing('libsecp256k1 library found but it was built ' |
|
||||||
'without required module (--enable-module-recovery)') |
|
||||||
|
|
||||||
# --enable-module-schnorrsig |
|
||||||
try: |
|
||||||
secp256k1.secp256k1_schnorrsig_sign32.argtypes = [c_void_p, c_char_p, c_char_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_schnorrsig_sign32.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_schnorrsig_verify.argtypes = [c_void_p, c_char_p, c_char_p, c_size_t, c_char_p] |
|
||||||
secp256k1.secp256k1_schnorrsig_verify.restype = c_int |
|
||||||
except (OSError, AttributeError): |
|
||||||
_logger.warning(f"libsecp256k1 library found but it was built without desired module (--enable-module-schnorrsig)") |
|
||||||
HAS_SCHNORR = False |
|
||||||
# raise LibModuleMissing('libsecp256k1 library found but it was built ' |
|
||||||
# 'without required module (--enable-module-schnorrsig)') |
|
||||||
|
|
||||||
# --enable-module-extrakeys |
|
||||||
try: |
|
||||||
secp256k1.secp256k1_xonly_pubkey_parse.argtypes = [c_void_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_xonly_pubkey_parse.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_xonly_pubkey_serialize.argtypes = [c_void_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_xonly_pubkey_serialize.restype = c_int |
|
||||||
|
|
||||||
secp256k1.secp256k1_keypair_create.argtypes = [c_void_p, c_char_p, c_char_p] |
|
||||||
secp256k1.secp256k1_keypair_create.restype = c_int |
|
||||||
except (OSError, AttributeError): |
|
||||||
_logger.warning(f"libsecp256k1 library found but it was built without desired module (--enable-module-extrakeys)") |
|
||||||
HAS_SCHNORR = False |
|
||||||
# raise LibModuleMissing('libsecp256k1 library found but it was built ' |
|
||||||
# 'without required module (--enable-module-extrakeys)') |
|
||||||
|
|
||||||
secp256k1.ctx = secp256k1.secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY) |
|
||||||
ret = secp256k1.secp256k1_context_randomize(secp256k1.ctx, os.urandom(32)) |
|
||||||
if not ret: |
|
||||||
_logger.error('secp256k1_context_randomize failed') |
|
||||||
return None |
|
||||||
|
|
||||||
return secp256k1 |
|
||||||
except (OSError, AttributeError) as e: |
|
||||||
_logger.error(f'libsecp256k1 library was found and loaded but there was an error when using it: {repr(e)}') |
|
||||||
return None |
|
||||||
|
|
||||||
|
|
||||||
_libsecp256k1 = None |
|
||||||
HAS_SCHNORR = True |
|
||||||
try: |
|
||||||
_libsecp256k1 = load_library() |
|
||||||
except BaseException as e: |
|
||||||
_logger.error(f'failed to load libsecp256k1: {repr(e)}') |
|
||||||
|
|
||||||
|
|
||||||
if _libsecp256k1 is None: |
|
||||||
# hard fail: |
|
||||||
raise ImportError("Failed to load libsecp256k1") |
|
||||||
|
|
||||||
|
|
||||||
def version_info() -> dict: |
|
||||||
return { |
|
||||||
"libsecp256k1.path": _libsecp256k1._name if _libsecp256k1 else None, |
|
||||||
} |
|
||||||
Loading…
Reference in new issue