Skip to content

Commit 1bb025a

Browse files
sipasipa
authored
Merge pull request bitcoin#116 from jonasnick/test-vec-terminology
Adjust reference code and test vectors to latest bip
2 parents 2f1c4d8 + 0ec01e9 commit 1bb025a

File tree

3 files changed

+26
-20
lines changed

3 files changed

+26
-20
lines changed

‎bip-schnorr/reference.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33

44
p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
55
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
6+
7+
# Points are tuples of X and Y coordinates and the point at infinity is
8+
# represented by the None keyword.
69
G = (0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798, 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8)
710

811
# This implementation can be sped up by storing the midstate after hashing

‎bip-schnorr/test-vectors.csv

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ index,secret key,public key,message,signature,verification result,comment
55
3,0B432B2677937381AEF05BB02A66ECD012773062CF3FA2549E44F58ED2401710,25D1DFF95105F5253C4022F628A996AD3A0D95FBF21D468A1B33F8C160D8F517,FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF,8BD2C11604B0A87A443FCC2E5D90E5328F934161B18864FB48CE10CB59B45FB9B5B2A0F129BD88F5BDC05D5C21E5C57176B913002335784F9777A24BD317CD36,TRUE,test fails if msg is reduced modulo p or n
66
4,,D69C3509BB99E412E68B0FE8544E72837DFA30746D8BE2AA65975F29D22DC7B9,4DF3C3F68FCC83B27E9D42C90431A72499F17875C81A599B566C9889B9696703,00000000000000000000003B78CE563F89A0ED9414F5AA28AD0D96D6795F9C63EE374AC7FAE927D334CCB190F6FB8FD27A2DDC639CCEE46D43F113A4035A2C7F,TRUE,
77
5,,EEFDEA4CDB677750A420FEE807EACF21EB9898AE79B9768766E4FAA04A2D4A34,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,667C2F778E0616E611BD0C14B8A600C5884551701A949EF0EBFD72D452D64E844160BCFC3F466ECB8FACD19ADE57D8699D74E7207D78C6AEDC3799B52A8E0598,FALSE,public key not on the curve
8-
6,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9935554D1AA5F0374E5CDAACB3925035C7C169B27C4426DF0A6B19AF3BAEAB138,FALSE,incorrect R residuosity
8+
6,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9935554D1AA5F0374E5CDAACB3925035C7C169B27C4426DF0A6B19AF3BAEAB138,FALSE,has_square_y(R) is false
99
7,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,10AC49A6A2EBF604189C5F40FC75AF2D42D77DE9A2782709B1EB4EAF1CFE9108D7003B703A3499D5E29529D39BA040A44955127140F81A8A89A96F992AC0FE79,FALSE,negated message
1010
8,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,667C2F778E0616E611BD0C14B8A600C5884551701A949EF0EBFD72D452D64E84BE9F4303C0B9913470532E6521A827951D39F5C631CFD98CE39AC4D7A5A83BA9,FALSE,negated s value
11-
9,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,000000000000000000000000000000000000000000000000000000000000000099D2F0EBC2996808208633CD9926BF7EC3DAB73DAAD36E85B3040A698E6D1CE0,FALSE,sG - eP is infinite. Test fails in single verification if jacobi(y(inf)) is defined as 1 and x(inf) as 0
12-
10,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,000000000000000000000000000000000000000000000000000000000000000124E81D89F01304695CE943F7D5EBD00EF726A0864B4FF33895B4E86BEADC5456,FALSE,sG - eP is infinite. Test fails in single verification if jacobi(y(inf)) is defined as 1 and x(inf) as 1
11+
9,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,000000000000000000000000000000000000000000000000000000000000000099D2F0EBC2996808208633CD9926BF7EC3DAB73DAAD36E85B3040A698E6D1CE0,FALSE,sG - eP is infinite. Test fails in single verification if has_square_y(inf) is defined as true and x(inf) as 0
12+
10,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,000000000000000000000000000000000000000000000000000000000000000124E81D89F01304695CE943F7D5EBD00EF726A0864B4FF33895B4E86BEADC5456,FALSE,sG - eP is infinite. Test fails in single verification if has_square_y(inf) is defined as true and x(inf) as 1
1313
11,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,4A298DACAE57395A15D0795DDBFD1DCB564DA82B0F269BC70A74F8220429BA1D4160BCFC3F466ECB8FACD19ADE57D8699D74E7207D78C6AEDC3799B52A8E0598,FALSE,sig[0:32] is not an X coordinate on the curve
1414
12,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F4160BCFC3F466ECB8FACD19ADE57D8699D74E7207D78C6AEDC3799B52A8E0598,FALSE,sig[0:32] is equal to field size
1515
13,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,667C2F778E0616E611BD0C14B8A600C5884551701A949EF0EBFD72D452D64E84FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141,FALSE,sig[32:64] is equal to curve order

‎bip-schnorr/test-vectors.py

Lines changed: 20 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
from reference import *
33

44
def vector0():
5-
seckey = 1
5+
seckey = bytes_from_int(1)
66
msg = bytes_from_int(0)
77
sig = schnorr_sign(msg, seckey)
88
pubkey = pubkey_gen(seckey)
@@ -11,10 +11,10 @@ def vector0():
1111
pubkey_point = point_from_bytes(pubkey)
1212
assert(pubkey_point[1] & 1 == 0)
1313

14-
return (bytes_from_int(seckey), pubkey, msg, sig, "TRUE", None)
14+
return (seckey, pubkey, msg, sig, "TRUE", None)
1515

1616
def vector1():
17-
seckey = 0xB7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF
17+
seckey = bytes_from_int(0xB7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF)
1818
msg = bytes_from_int(0x243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89)
1919
sig = schnorr_sign(msg, seckey)
2020
pubkey = pubkey_gen(seckey)
@@ -23,10 +23,10 @@ def vector1():
2323
pubkey_point = point_from_bytes(pubkey)
2424
assert(pubkey_point[1] & 1 == 1)
2525

26-
return (bytes_from_int(seckey), pubkey, msg, sig, "TRUE", None)
26+
return (seckey, pubkey, msg, sig, "TRUE", None)
2727

2828
def vector2():
29-
seckey = 0xC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B14E5C9
29+
seckey = bytes_from_int(0xC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B14E5C9)
3030
msg = bytes_from_int(0x5E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C)
3131
sig = schnorr_sign(msg, seckey)
3232

@@ -35,18 +35,21 @@ def vector2():
3535
R = point_from_bytes(sig[0:32])
3636
assert(not is_square(R[0]))
3737

38-
return (bytes_from_int(seckey), pubkey_gen(seckey), msg, sig, "TRUE", None)
38+
return (seckey, pubkey_gen(seckey), msg, sig, "TRUE", None)
3939

4040
def vector3():
41-
seckey = 0x0B432B2677937381AEF05BB02A66ECD012773062CF3FA2549E44F58ED2401710
41+
seckey = bytes_from_int(0x0B432B2677937381AEF05BB02A66ECD012773062CF3FA2549E44F58ED2401710)
4242
msg = bytes_from_int(0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF)
4343
sig = schnorr_sign(msg, seckey)
44-
return (bytes_from_int(seckey), pubkey_gen(seckey), msg, sig, "TRUE", "test fails if msg is reduced modulo p or n")
44+
return (seckey, pubkey_gen(seckey), msg, sig, "TRUE", "test fails if msg is reduced modulo p or n")
4545

46-
# Signs with a given nonce. Results in an invalid signature if y(kG) is not a square
47-
def schnorr_sign_fixed_nonce(msg, seckey0, k):
46+
# Signs with a given nonce. This can be INSECURE and is only INTENDED FOR
47+
# GENERATING TEST VECTORS. Results in an invalid signature if y(kG) is not
48+
# square.
49+
def insecure_schnorr_sign_fixed_nonce(msg, seckey0, k):
4850
if len(msg) != 32:
4951
raise ValueError('The message must be a 32-byte array.')
52+
seckey0 = int_from_bytes(seckey0)
5053
if not (1 <= seckey0 <= n - 1):
5154
raise ValueError('The secret key must be an integer in the range 1..n-1.')
5255
P = point_mul(G, seckey0)
@@ -58,12 +61,12 @@ def schnorr_sign_fixed_nonce(msg, seckey0, k):
5861
# Creates a singature with a small x(R) by using k = 1/2
5962
def vector4():
6063
one_half = 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0
61-
seckey = 0x763758E5CBEEDEE4F7D3FC86F531C36578933228998226672F13C4F0EBE855EB
64+
seckey = bytes_from_int(0x763758E5CBEEDEE4F7D3FC86F531C36578933228998226672F13C4F0EBE855EB)
6265
msg = bytes_from_int(0x4DF3C3F68FCC83B27E9D42C90431A72499F17875C81A599B566C9889B9696703)
63-
sig = schnorr_sign_fixed_nonce(msg, seckey, one_half)
66+
sig = insecure_schnorr_sign_fixed_nonce(msg, seckey, one_half)
6467
return (None, pubkey_gen(seckey), msg, sig, "TRUE", None)
6568

66-
default_seckey = 0xB7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF
69+
default_seckey = bytes_from_int(0xB7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF)
6770
default_msg = bytes_from_int(0x243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89)
6871

6972
def vector5():
@@ -81,13 +84,13 @@ def vector6():
8184
seckey = default_seckey
8285
msg = default_msg
8386
k = 3
84-
sig = schnorr_sign_fixed_nonce(msg, seckey, k)
87+
sig = insecure_schnorr_sign_fixed_nonce(msg, seckey, k)
8588

8689
# Y coordinate of R is not a square
8790
R = point_mul(G, k)
8891
assert(not has_square_y(R))
8992

90-
return (None, pubkey_gen(seckey), msg, sig, "FALSE", "incorrect R residuosity")
93+
return (None, pubkey_gen(seckey), msg, sig, "FALSE", "has_square_y(R) is false")
9194

9295
def vector7():
9396
seckey = default_seckey
@@ -117,7 +120,7 @@ def vector9():
117120
k = 0
118121
bytes_from_point_tmp = bytes_from_point.__code__
119122
bytes_from_point.__code__ = bytes_from_point_inf0.__code__
120-
sig = schnorr_sign_fixed_nonce(msg, seckey, k)
123+
sig = insecure_schnorr_sign_fixed_nonce(msg, seckey, k)
121124
bytes_from_point.__code__ = bytes_from_point_tmp
122125

123126
return (None, pubkey_gen(seckey), msg, sig, "FALSE", "sG - eP is infinite. Test fails in single verification if has_square_y(inf) is defined as true and x(inf) as 0")
@@ -136,7 +139,7 @@ def vector10():
136139
k = 0
137140
bytes_from_point_tmp = bytes_from_point.__code__
138141
bytes_from_point.__code__ = bytes_from_point_inf1.__code__
139-
sig = schnorr_sign_fixed_nonce(msg, seckey, k)
142+
sig = insecure_schnorr_sign_fixed_nonce(msg, seckey, k)
140143
bytes_from_point.__code__ = bytes_from_point_tmp
141144

142145
return (None, pubkey_gen(seckey), msg, sig, "FALSE", "sG - eP is infinite. Test fails in single verification if has_square_y(inf) is defined as true and x(inf) as 1")

0 commit comments

Comments
 (0)