Line data Source code
1 : // Copyright (c) 2009-2019 The Bitcoin Core developers
2 : // Copyright (c) 2017 The Zcash developers
3 : // Distributed under the MIT software license, see the accompanying
4 : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
5 :
6 : #include <pubkey.h>
7 :
8 : #include <secp256k1.h>
9 : #include <secp256k1_recovery.h>
10 :
11 : namespace
12 : {
13 : /* Global secp256k1_context object used for verification. */
14 : secp256k1_context* secp256k1_context_verify = nullptr;
15 : } // namespace
16 :
17 : /** This function is taken from the libsecp256k1 distribution and implements
18 : * DER parsing for ECDSA signatures, while supporting an arbitrary subset of
19 : * format violations.
20 : *
21 : * Supported violations include negative integers, excessive padding, garbage
22 : * at the end, and overly long length descriptors. This is safe to use in
23 : * Bitcoin because since the activation of BIP66, signatures are verified to be
24 : * strict DER before being passed to this module, and we know it supports all
25 : * violations present in the blockchain before that point.
26 : */
27 966962 : int ecdsa_signature_parse_der_lax(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
28 : size_t rpos, rlen, spos, slen;
29 : size_t pos = 0;
30 : size_t lenbyte;
31 966962 : unsigned char tmpsig[64] = {0};
32 : int overflow = 0;
33 :
34 : /* Hack to initialize sig with a correctly-parsed but invalid signature. */
35 966962 : secp256k1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
36 :
37 : /* Sequence tag byte */
38 966962 : if (pos == inputlen || input[pos] != 0x30) {
39 48 : return 0;
40 : }
41 : pos++;
42 :
43 : /* Sequence length bytes */
44 966939 : if (pos == inputlen) {
45 0 : return 0;
46 : }
47 966932 : lenbyte = input[pos++];
48 966932 : if (lenbyte & 0x80) {
49 0 : lenbyte -= 0x80;
50 0 : if (lenbyte > inputlen - pos) {
51 0 : return 0;
52 : }
53 0 : pos += lenbyte;
54 0 : }
55 :
56 : /* Integer tag byte for R */
57 966940 : if (pos == inputlen || input[pos] != 0x02) {
58 0 : return 0;
59 : }
60 966936 : pos++;
61 :
62 : /* Integer length for R */
63 966936 : if (pos == inputlen) {
64 0 : return 0;
65 : }
66 1933868 : lenbyte = input[pos++];
67 966938 : if (lenbyte & 0x80) {
68 0 : lenbyte -= 0x80;
69 0 : if (lenbyte > inputlen - pos) {
70 0 : return 0;
71 : }
72 0 : while (lenbyte > 0 && input[pos] == 0) {
73 0 : pos++;
74 0 : lenbyte--;
75 : }
76 : static_assert(sizeof(size_t) >= 4, "size_t too small");
77 0 : if (lenbyte >= 4) {
78 0 : return 0;
79 : }
80 : rlen = 0;
81 0 : while (lenbyte > 0) {
82 0 : rlen = (rlen << 8) + input[pos];
83 0 : pos++;
84 0 : lenbyte--;
85 : }
86 : } else {
87 : rlen = lenbyte;
88 : }
89 966930 : if (rlen > inputlen - pos) {
90 0 : return 0;
91 : }
92 : rpos = pos;
93 966936 : pos += rlen;
94 :
95 : /* Integer tag byte for S */
96 966936 : if (pos == inputlen || input[pos] != 0x02) {
97 0 : return 0;
98 : }
99 966944 : pos++;
100 :
101 : /* Integer length for S */
102 966944 : if (pos == inputlen) {
103 0 : return 0;
104 : }
105 1933885 : lenbyte = input[pos++];
106 966943 : if (lenbyte & 0x80) {
107 0 : lenbyte -= 0x80;
108 0 : if (lenbyte > inputlen - pos) {
109 0 : return 0;
110 : }
111 0 : while (lenbyte > 0 && input[pos] == 0) {
112 0 : pos++;
113 0 : lenbyte--;
114 : }
115 : static_assert(sizeof(size_t) >= 4, "size_t too small");
116 0 : if (lenbyte >= 4) {
117 0 : return 0;
118 : }
119 : slen = 0;
120 0 : while (lenbyte > 0) {
121 0 : slen = (slen << 8) + input[pos];
122 0 : pos++;
123 0 : lenbyte--;
124 : }
125 : } else {
126 : slen = lenbyte;
127 : }
128 966942 : if (slen > inputlen - pos) {
129 0 : return 0;
130 : }
131 : spos = pos;
132 :
133 : /* Ignore leading zeroes in R */
134 994619 : while (rlen > 0 && input[rpos] == 0) {
135 27682 : rlen--;
136 27682 : rpos++;
137 : }
138 : /* Copy R value */
139 966949 : if (rlen > 32) {
140 : overflow = 1;
141 305 : } else {
142 966639 : memcpy(tmpsig + 32 - rlen, input + rpos, rlen);
143 : }
144 :
145 : /* Ignore leading zeroes in S */
146 967854 : while (slen > 0 && input[spos] == 0) {
147 915 : slen--;
148 915 : spos++;
149 : }
150 : /* Copy S value */
151 966946 : if (slen > 32) {
152 : overflow = 1;
153 0 : } else {
154 966947 : memcpy(tmpsig + 64 - slen, input + spos, slen);
155 : }
156 :
157 966948 : if (!overflow) {
158 966644 : overflow = !secp256k1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
159 966644 : }
160 966950 : if (overflow) {
161 : /* Overwrite the result again with a correctly-parsed but invalid
162 : signature if parsing failed. */
163 305 : memset(tmpsig, 0, 64);
164 305 : secp256k1_ecdsa_signature_parse_compact(ctx, sig, tmpsig);
165 305 : }
166 966949 : return 1;
167 967003 : }
168 :
169 149331 : bool CPubKey::Verify(const uint256 &hash, const std::vector<unsigned char>& vchSig) const {
170 149331 : if (!IsValid())
171 0 : return false;
172 149331 : secp256k1_pubkey pubkey;
173 149331 : secp256k1_ecdsa_signature sig;
174 149331 : assert(secp256k1_context_verify && "secp256k1_context_verify must be initialized to use CPubKey.");
175 149331 : if (!secp256k1_ec_pubkey_parse(secp256k1_context_verify, &pubkey, vch, size())) {
176 0 : return false;
177 : }
178 149289 : if (!ecdsa_signature_parse_der_lax(secp256k1_context_verify, &sig, vchSig.data(), vchSig.size())) {
179 48 : return false;
180 : }
181 : /* libsecp256k1's ECDSA verification requires lower-S signatures, which have
182 : * not historically been enforced in Bitcoin, so normalize them first. */
183 149275 : secp256k1_ecdsa_signature_normalize(secp256k1_context_verify, &sig, &sig);
184 149275 : return secp256k1_ecdsa_verify(secp256k1_context_verify, &sig, hash.begin(), &pubkey);
185 149295 : }
186 :
187 80 : bool CPubKey::RecoverCompact(const uint256 &hash, const std::vector<unsigned char>& vchSig) {
188 80 : if (vchSig.size() != COMPACT_SIGNATURE_SIZE)
189 0 : return false;
190 80 : int recid = (vchSig[0] - 27) & 3;
191 80 : bool fComp = ((vchSig[0] - 27) & 4) != 0;
192 80 : secp256k1_pubkey pubkey;
193 80 : secp256k1_ecdsa_recoverable_signature sig;
194 80 : assert(secp256k1_context_verify && "secp256k1_context_verify must be initialized to use CPubKey.");
195 80 : if (!secp256k1_ecdsa_recoverable_signature_parse_compact(secp256k1_context_verify, &sig, &vchSig[1], recid)) {
196 0 : return false;
197 : }
198 80 : if (!secp256k1_ecdsa_recover(secp256k1_context_verify, &pubkey, &sig, hash.begin())) {
199 1 : return false;
200 : }
201 79 : unsigned char pub[SIZE];
202 79 : size_t publen = SIZE;
203 79 : secp256k1_ec_pubkey_serialize(secp256k1_context_verify, pub, &publen, &pubkey, fComp ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
204 79 : Set(pub, pub + publen);
205 : return true;
206 80 : }
207 :
208 2436 : bool CPubKey::IsFullyValid() const {
209 2436 : if (!IsValid())
210 3 : return false;
211 2433 : secp256k1_pubkey pubkey;
212 2433 : assert(secp256k1_context_verify && "secp256k1_context_verify must be initialized to use CPubKey.");
213 2433 : return secp256k1_ec_pubkey_parse(secp256k1_context_verify, &pubkey, vch, size());
214 2436 : }
215 :
216 26 : bool CPubKey::Decompress() {
217 26 : if (!IsValid())
218 0 : return false;
219 26 : secp256k1_pubkey pubkey;
220 26 : assert(secp256k1_context_verify && "secp256k1_context_verify must be initialized to use CPubKey.");
221 26 : if (!secp256k1_ec_pubkey_parse(secp256k1_context_verify, &pubkey, vch, size())) {
222 0 : return false;
223 : }
224 26 : unsigned char pub[SIZE];
225 26 : size_t publen = SIZE;
226 26 : secp256k1_ec_pubkey_serialize(secp256k1_context_verify, pub, &publen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
227 26 : Set(pub, pub + publen);
228 : return true;
229 26 : }
230 :
231 59103 : bool CPubKey::Derive(CPubKey& pubkeyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc) const {
232 59103 : assert(IsValid());
233 59103 : assert((nChild >> 31) == 0);
234 59103 : assert(size() == COMPRESSED_SIZE);
235 59103 : unsigned char out[64];
236 59103 : BIP32Hash(cc, nChild, *begin(), begin()+1, out);
237 59103 : memcpy(ccChild.begin(), out+32, 32);
238 59103 : secp256k1_pubkey pubkey;
239 59103 : assert(secp256k1_context_verify && "secp256k1_context_verify must be initialized to use CPubKey.");
240 59103 : if (!secp256k1_ec_pubkey_parse(secp256k1_context_verify, &pubkey, vch, size())) {
241 0 : return false;
242 : }
243 59103 : if (!secp256k1_ec_pubkey_tweak_add(secp256k1_context_verify, &pubkey, out)) {
244 0 : return false;
245 : }
246 59103 : unsigned char pub[COMPRESSED_SIZE];
247 59103 : size_t publen = COMPRESSED_SIZE;
248 59103 : secp256k1_ec_pubkey_serialize(secp256k1_context_verify, pub, &publen, &pubkey, SECP256K1_EC_COMPRESSED);
249 59103 : pubkeyChild.Set(pub, pub + publen);
250 : return true;
251 59103 : }
252 :
253 19582 : void CExtPubKey::Encode(unsigned char code[BIP32_EXTKEY_SIZE]) const {
254 19582 : code[0] = nDepth;
255 19582 : memcpy(code+1, vchFingerprint, 4);
256 19582 : code[5] = (nChild >> 24) & 0xFF; code[6] = (nChild >> 16) & 0xFF;
257 19582 : code[7] = (nChild >> 8) & 0xFF; code[8] = (nChild >> 0) & 0xFF;
258 19582 : memcpy(code+9, chaincode.begin(), 32);
259 19582 : assert(pubkey.size() == CPubKey::COMPRESSED_SIZE);
260 19582 : memcpy(code+41, pubkey.begin(), CPubKey::COMPRESSED_SIZE);
261 19582 : }
262 :
263 602 : void CExtPubKey::Decode(const unsigned char code[BIP32_EXTKEY_SIZE]) {
264 602 : nDepth = code[0];
265 602 : memcpy(vchFingerprint, code+1, 4);
266 602 : nChild = (code[5] << 24) | (code[6] << 16) | (code[7] << 8) | code[8];
267 602 : memcpy(chaincode.begin(), code+9, 32);
268 602 : pubkey.Set(code+41, code+BIP32_EXTKEY_SIZE);
269 602 : }
270 :
271 59103 : bool CExtPubKey::Derive(CExtPubKey &out, unsigned int _nChild) const {
272 59103 : out.nDepth = nDepth + 1;
273 59103 : CKeyID id = pubkey.GetID();
274 59103 : memcpy(&out.vchFingerprint[0], &id, 4);
275 59103 : out.nChild = _nChild;
276 118206 : return pubkey.Derive(out.pubkey, out.chaincode, _nChild, chaincode);
277 59103 : }
278 :
279 817681 : /* static */ bool CPubKey::CheckLowS(const std::vector<unsigned char>& vchSig) {
280 817681 : secp256k1_ecdsa_signature sig;
281 817681 : assert(secp256k1_context_verify && "secp256k1_context_verify must be initialized to use CPubKey.");
282 817681 : if (!ecdsa_signature_parse_der_lax(secp256k1_context_verify, &sig, vchSig.data(), vchSig.size())) {
283 0 : return false;
284 : }
285 817681 : return (!secp256k1_ecdsa_signature_normalize(secp256k1_context_verify, nullptr, &sig));
286 817681 : }
287 :
288 : /* static */ int ECCVerifyHandle::refcount = 0;
289 :
290 2236 : ECCVerifyHandle::ECCVerifyHandle()
291 1118 : {
292 1118 : if (refcount == 0) {
293 656 : assert(secp256k1_context_verify == nullptr);
294 656 : secp256k1_context_verify = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
295 656 : assert(secp256k1_context_verify != nullptr);
296 : }
297 1118 : refcount++;
298 2236 : }
299 :
300 2234 : ECCVerifyHandle::~ECCVerifyHandle()
301 1117 : {
302 1117 : refcount--;
303 1117 : if (refcount == 0) {
304 655 : assert(secp256k1_context_verify != nullptr);
305 655 : secp256k1_context_destroy(secp256k1_context_verify);
306 655 : secp256k1_context_verify = nullptr;
307 655 : }
308 2234 : }
|
