Bitcoin Core  0.18.99
P2P Digital Currency
pubkey.cpp
Go to the documentation of this file.
1 // Copyright (c) 2009-2018 The Bitcoin Core developers
2 // Copyright (c) 2017 The Zcash developers
3 // Distributed under the MIT software license, see the accompanying
4 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
5 
6 #include <pubkey.h>
7 
8 #include <secp256k1.h>
9 #include <secp256k1_recovery.h>
10 
11 namespace
12 {
13 /* Global secp256k1_context object used for verification. */
14 secp256k1_context* secp256k1_context_verify = nullptr;
15 } // namespace
16 
27 static int ecdsa_signature_parse_der_lax(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
28  size_t rpos, rlen, spos, slen;
29  size_t pos = 0;
30  size_t lenbyte;
31  unsigned char tmpsig[64] = {0};
32  int overflow = 0;
33 
34  /* Hack to initialize sig with a correctly-parsed but invalid signature. */
36 
37  /* Sequence tag byte */
38  if (pos == inputlen || input[pos] != 0x30) {
39  return 0;
40  }
41  pos++;
42 
43  /* Sequence length bytes */
44  if (pos == inputlen) {
45  return 0;
46  }
47  lenbyte = input[pos++];
48  if (lenbyte & 0x80) {
49  lenbyte -= 0x80;
50  if (lenbyte > inputlen - pos) {
51  return 0;
52  }
53  pos += lenbyte;
54  }
55 
56  /* Integer tag byte for R */
57  if (pos == inputlen || input[pos] != 0x02) {
58  return 0;
59  }
60  pos++;
61 
62  /* Integer length for R */
63  if (pos == inputlen) {
64  return 0;
65  }
66  lenbyte = input[pos++];
67  if (lenbyte & 0x80) {
68  lenbyte -= 0x80;
69  if (lenbyte > inputlen - pos) {
70  return 0;
71  }
72  while (lenbyte > 0 && input[pos] == 0) {
73  pos++;
74  lenbyte--;
75  }
76  static_assert(sizeof(size_t) >= 4, "size_t too small");
77  if (lenbyte >= 4) {
78  return 0;
79  }
80  rlen = 0;
81  while (lenbyte > 0) {
82  rlen = (rlen << 8) + input[pos];
83  pos++;
84  lenbyte--;
85  }
86  } else {
87  rlen = lenbyte;
88  }
89  if (rlen > inputlen - pos) {
90  return 0;
91  }
92  rpos = pos;
93  pos += rlen;
94 
95  /* Integer tag byte for S */
96  if (pos == inputlen || input[pos] != 0x02) {
97  return 0;
98  }
99  pos++;
100 
101  /* Integer length for S */
102  if (pos == inputlen) {
103  return 0;
104  }
105  lenbyte = input[pos++];
106  if (lenbyte & 0x80) {
107  lenbyte -= 0x80;
108  if (lenbyte > inputlen - pos) {
109  return 0;
110  }
111  while (lenbyte > 0 && input[pos] == 0) {
112  pos++;
113  lenbyte--;
114  }
115  static_assert(sizeof(size_t) >= 4, "size_t too small");
116  if (lenbyte >= 4) {
117  return 0;
118  }
119  slen = 0;
120  while (lenbyte > 0) {
121  slen = (slen << 8) + input[pos];
122  pos++;
123  lenbyte--;
124  }
125  } else {
126  slen = lenbyte;
127  }
128  if (slen > inputlen - pos) {
129  return 0;
130  }
131  spos = pos;
132 
133  /* Ignore leading zeroes in R */
134  while (rlen > 0 && input[rpos] == 0) {
135  rlen--;
136  rpos++;
137  }
138  /* Copy R value */
139  if (rlen > 32) {
140  overflow = 1;
141  } else {
142  memcpy(tmpsig + 32 - rlen, input + rpos, rlen);
143  }
144 
145  /* Ignore leading zeroes in S */
146  while (slen > 0 && input[spos] == 0) {
147  slen--;
148  spos++;
149  }
150  /* Copy S value */
151  if (slen > 32) {
152  overflow = 1;
153  } else {
154  memcpy(tmpsig + 64 - slen, input + spos, slen);
155  }
156 
157  if (!overflow) {
158  overflow = !secp256k1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
159  }
160  if (overflow) {
161  /* Overwrite the result again with a correctly-parsed but invalid
162  signature if parsing failed. */
163  memset(tmpsig, 0, 64);
164  secp256k1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
165  }
166  return 1;
167 }
168 
169 bool CPubKey::Verify(const uint256 &hash, const std::vector<unsigned char>& vchSig) const {
170  if (!IsValid())
171  return false;
172  secp256k1_pubkey pubkey;
174  if (!secp256k1_ec_pubkey_parse(secp256k1_context_verify, &pubkey, vch, size())) {
175  return false;
176  }
177  if (!ecdsa_signature_parse_der_lax(secp256k1_context_verify, &sig, vchSig.data(), vchSig.size())) {
178  return false;
179  }
180  /* libsecp256k1's ECDSA verification requires lower-S signatures, which have
181  * not historically been enforced in Bitcoin, so normalize them first. */
182  secp256k1_ecdsa_signature_normalize(secp256k1_context_verify, &sig, &sig);
183  return secp256k1_ecdsa_verify(secp256k1_context_verify, &sig, hash.begin(), &pubkey);
184 }
185 
186 bool CPubKey::RecoverCompact(const uint256 &hash, const std::vector<unsigned char>& vchSig) {
187  if (vchSig.size() != COMPACT_SIGNATURE_SIZE)
188  return false;
189  int recid = (vchSig[0] - 27) & 3;
190  bool fComp = ((vchSig[0] - 27) & 4) != 0;
191  secp256k1_pubkey pubkey;
193  if (!secp256k1_ecdsa_recoverable_signature_parse_compact(secp256k1_context_verify, &sig, &vchSig[1], recid)) {
194  return false;
195  }
196  if (!secp256k1_ecdsa_recover(secp256k1_context_verify, &pubkey, &sig, hash.begin())) {
197  return false;
198  }
199  unsigned char pub[PUBLIC_KEY_SIZE];
200  size_t publen = PUBLIC_KEY_SIZE;
201  secp256k1_ec_pubkey_serialize(secp256k1_context_verify, pub, &publen, &pubkey, fComp ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
202  Set(pub, pub + publen);
203  return true;
204 }
205 
206 bool CPubKey::IsFullyValid() const {
207  if (!IsValid())
208  return false;
209  secp256k1_pubkey pubkey;
210  return secp256k1_ec_pubkey_parse(secp256k1_context_verify, &pubkey, vch, size());
211 }
212 
214  if (!IsValid())
215  return false;
216  secp256k1_pubkey pubkey;
217  if (!secp256k1_ec_pubkey_parse(secp256k1_context_verify, &pubkey, vch, size())) {
218  return false;
219  }
220  unsigned char pub[PUBLIC_KEY_SIZE];
221  size_t publen = PUBLIC_KEY_SIZE;
222  secp256k1_ec_pubkey_serialize(secp256k1_context_verify, pub, &publen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
223  Set(pub, pub + publen);
224  return true;
225 }
226 
227 bool CPubKey::Derive(CPubKey& pubkeyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc) const {
228  assert(IsValid());
229  assert((nChild >> 31) == 0);
230  assert(size() == COMPRESSED_PUBLIC_KEY_SIZE);
231  unsigned char out[64];
232  BIP32Hash(cc, nChild, *begin(), begin()+1, out);
233  memcpy(ccChild.begin(), out+32, 32);
234  secp256k1_pubkey pubkey;
235  if (!secp256k1_ec_pubkey_parse(secp256k1_context_verify, &pubkey, vch, size())) {
236  return false;
237  }
238  if (!secp256k1_ec_pubkey_tweak_add(secp256k1_context_verify, &pubkey, out)) {
239  return false;
240  }
241  unsigned char pub[COMPRESSED_PUBLIC_KEY_SIZE];
242  size_t publen = COMPRESSED_PUBLIC_KEY_SIZE;
243  secp256k1_ec_pubkey_serialize(secp256k1_context_verify, pub, &publen, &pubkey, SECP256K1_EC_COMPRESSED);
244  pubkeyChild.Set(pub, pub + publen);
245  return true;
246 }
247 
248 void CExtPubKey::Encode(unsigned char code[BIP32_EXTKEY_SIZE]) const {
249  code[0] = nDepth;
250  memcpy(code+1, vchFingerprint, 4);
251  code[5] = (nChild >> 24) & 0xFF; code[6] = (nChild >> 16) & 0xFF;
252  code[7] = (nChild >> 8) & 0xFF; code[8] = (nChild >> 0) & 0xFF;
253  memcpy(code+9, chaincode.begin(), 32);
254  assert(pubkey.size() == CPubKey::COMPRESSED_PUBLIC_KEY_SIZE);
255  memcpy(code+41, pubkey.begin(), CPubKey::COMPRESSED_PUBLIC_KEY_SIZE);
256 }
257 
258 void CExtPubKey::Decode(const unsigned char code[BIP32_EXTKEY_SIZE]) {
259  nDepth = code[0];
260  memcpy(vchFingerprint, code+1, 4);
261  nChild = (code[5] << 24) | (code[6] << 16) | (code[7] << 8) | code[8];
262  memcpy(chaincode.begin(), code+9, 32);
263  pubkey.Set(code+41, code+BIP32_EXTKEY_SIZE);
264 }
265 
266 bool CExtPubKey::Derive(CExtPubKey &out, unsigned int _nChild) const {
267  out.nDepth = nDepth + 1;
268  CKeyID id = pubkey.GetID();
269  memcpy(&out.vchFingerprint[0], &id, 4);
270  out.nChild = _nChild;
271  return pubkey.Derive(out.pubkey, out.chaincode, _nChild, chaincode);
272 }
273 
274 /* static */ bool CPubKey::CheckLowS(const std::vector<unsigned char>& vchSig) {
276  if (!ecdsa_signature_parse_der_lax(secp256k1_context_verify, &sig, vchSig.data(), vchSig.size())) {
277  return false;
278  }
279  return (!secp256k1_ecdsa_signature_normalize(secp256k1_context_verify, nullptr, &sig));
280 }
281 
282 /* static */ int ECCVerifyHandle::refcount = 0;
283 
285 {
286  if (refcount == 0) {
287  assert(secp256k1_context_verify == nullptr);
288  secp256k1_context_verify = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
289  assert(secp256k1_context_verify != nullptr);
290  }
291  refcount++;
292 }
293 
295 {
296  refcount--;
297  if (refcount == 0) {
298  assert(secp256k1_context_verify != nullptr);
299  secp256k1_context_destroy(secp256k1_context_verify);
300  secp256k1_context_verify = nullptr;
301  }
302 }
unsigned char vch[PUBLIC_KEY_SIZE]
see www.keylength.com script supports up to 75 for single byte push
Definition: pubkey.h:46
SECP256K1_API int secp256k1_ecdsa_recoverable_signature_parse_compact(const secp256k1_context *ctx, secp256k1_ecdsa_recoverable_signature *sig, const unsigned char *input64, int recid) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Parse a compact ECDSA signature (64 bytes + recovery id).
Definition: main_impl.h:38
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_tweak_add(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const unsigned char *tweak) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a public key by adding tweak times the generator to it.
Definition: secp256k1.c:477
unsigned char vchFingerprint[4]
Definition: pubkey.h:208
SECP256K1_API int secp256k1_ecdsa_signature_normalize(const secp256k1_context *ctx, secp256k1_ecdsa_signature *sigout, const secp256k1_ecdsa_signature *sigin) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3)
Convert a signature to a normalized lower-S form.
Definition: secp256k1.c:274
static constexpr unsigned int PUBLIC_KEY_SIZE
secp256k1:
Definition: pubkey.h:36
Opaque data structured that holds a parsed ECDSA signature, supporting pubkey recovery.
unsigned char data[64]
Definition: secp256k1.h:67
void Set(const T pbegin, const T pend)
Initialize a public key using begin/end iterators to byte data.
Definition: pubkey.h:86
static int refcount
Definition: pubkey.h:256
unsigned char nDepth
Definition: pubkey.h:207
static bool CheckLowS(const std::vector< unsigned char > &vchSig)
Check whether a signature is normalized (lower-S).
Definition: pubkey.cpp:274
bool Derive(CPubKey &pubkeyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode &cc) const
Derive BIP32 child pubkey.
Definition: pubkey.cpp:227
SECP256K1_API int secp256k1_ec_pubkey_serialize(const secp256k1_context *ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey *pubkey, unsigned int flags) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize a pubkey object into a serialized byte sequence.
Definition: secp256k1.c:165
ChainCode chaincode
Definition: pubkey.h:210
unsigned char * begin()
Definition: uint256.h:55
unsigned int nChild
Definition: pubkey.h:209
const unsigned char * begin() const
Definition: pubkey.h:111
static constexpr unsigned int COMPRESSED_PUBLIC_KEY_SIZE
Definition: pubkey.h:37
SECP256K1_API void secp256k1_context_destroy(secp256k1_context *ctx)
Destroy a secp256k1 context object.
Definition: secp256k1.c:92
#define SECP256K1_EC_UNCOMPRESSED
Definition: secp256k1.h:160
#define SECP256K1_EC_COMPRESSED
Flag to pass to secp256k1_ec_pubkey_serialize and secp256k1_ec_privkey_export.
Definition: secp256k1.h:159
void Encode(unsigned char code[BIP32_EXTKEY_SIZE]) const
Definition: pubkey.cpp:248
void Decode(const unsigned char code[BIP32_EXTKEY_SIZE])
Definition: pubkey.cpp:258
bool IsFullyValid() const
fully validate whether this is a valid public key (more expensive than IsValid()) ...
Definition: pubkey.cpp:206
bool RecoverCompact(const uint256 &hash, const std::vector< unsigned char > &vchSig)
Recover a public key from a compact signature.
Definition: pubkey.cpp:186
void BIP32Hash(const ChainCode &chainCode, unsigned int nChild, unsigned char header, const unsigned char data[32], unsigned char output[64])
Definition: hash.cpp:71
bool IsValid() const
Definition: pubkey.h:171
An encapsulated public key.
Definition: pubkey.h:30
unsigned int size() const
Simple read-only vector-like interface to the pubkey data.
Definition: pubkey.h:109
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_parse(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const unsigned char *input, size_t inputlen) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Parse a variable-length public key into the pubkey object.
Definition: secp256k1.c:150
Opaque data structured that holds a parsed ECDSA signature.
Definition: secp256k1.h:66
static constexpr unsigned int COMPACT_SIGNATURE_SIZE
Definition: pubkey.h:39
#define SECP256K1_CONTEXT_VERIFY
Flags to pass to secp256k1_context_create.
Definition: secp256k1.h:154
256-bit opaque blob.
Definition: uint256.h:121
bool Derive(CExtPubKey &out, unsigned int nChild) const
Definition: pubkey.cpp:266
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_recover(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const secp256k1_ecdsa_recoverable_signature *sig, const unsigned char *msg32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Recover an ECDSA public key from a signature.
Definition: main_impl.h:170
SECP256K1_API int secp256k1_ecdsa_signature_parse_compact(const secp256k1_context *ctx, secp256k1_ecdsa_signature *sig, const unsigned char *input64) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Parse an ECDSA signature in compact (64 bytes) format.
Definition: secp256k1.c:228
bool Verify(const uint256 &hash, const std::vector< unsigned char > &vchSig) const
Verify a DER signature (~72 bytes).
Definition: pubkey.cpp:169
void * memcpy(void *a, const void *b, size_t c)
const unsigned int BIP32_EXTKEY_SIZE
Definition: pubkey.h:17
A reference to a CKey: the Hash160 of its serialized public key.
Definition: pubkey.h:20
CPubKey pubkey
Definition: pubkey.h:211
SECP256K1_API secp256k1_context * secp256k1_context_create(unsigned int flags) SECP256K1_WARN_UNUSED_RESULT
Create a secp256k1 context object.
Definition: secp256k1.c:58
bool Decompress()
Turn this public key into an uncompressed public key.
Definition: pubkey.cpp:213
Opaque data structure that holds a parsed and valid public key.
Definition: secp256k1.h:53
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_verify(const secp256k1_context *ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msg32, const secp256k1_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Verify an ECDSA signature.
Definition: secp256k1.c:293