bip-schnorr 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c22da99e3fed7eea60436b7007532b752066996c9f2dd87f1f71028d7eaec357
-  data.tar.gz: 87bf98d7796bb6a31aad59e12914dd2f67584b852d45a7561e505061b3876284
+  metadata.gz: e68ad5d5ccf6213171279052ddef947229a8eab7597cc93ca2b8cc312d0e7254
+  data.tar.gz: b77fed1e8cc5dba386dcf6ce81bfe3d36c20985bd246b5c5d5e6f9ce45db6177
 SHA512:
-  metadata.gz: aa3263695c27d8453971bb881c19f5b05c5d69bea52770823de956fc5cfe8d65fdd5393790fbd282eb8a78a13f56fbde3046f0222d9bbfefc668fedb099d150d
-  data.tar.gz: f828993f5d2c149aebc61dbd51c3569bf3ba97fe71aaab5e5aafbf1c7742d880e55b2db6dfa698e7dae521c50eea5d43c7ace1eb1e750b389ab11e8c2a0d9991
+  metadata.gz: 0d2a1ffd174074375af26fe2e4dfae18d6a72e9e44e76861d09e3724d3d13c4b90e182b2dc7533cefb93fbc44317cd92f4941716ae3e0fe549dc4e950e09b710
+  data.tar.gz: ebeba83783283f328b321ab19a5c3cebf4f74aa0d56c9f491283a502367a4baf29ea78f905b335f547f1cd8b6215395260c72981776d9e2743d3b4d03d408d7f

data/README.md

@@ -3,7 +3,7 @@
 This is a Ruby implementation of the Schnorr signature scheme over the elliptic curve. 
 This implementation relies on the [ecdsa gem](https://github.com/DavidEGrayson/ruby_ecdsa) for operate elliptic curves.
 
-The code is based upon the initial proposal of Pieter Wuille's [bip-schnorr](https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki).
+The code is based upon the [BIP340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
 
 ## Installation
 
@@ -28,7 +28,7 @@ Or install it yourself as:
 ```ruby
 require 'schnorr'
 
-private_key = 0xB7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF
+private_key = ['B7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF'].pack("H*")
 
 message = ['5E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C'].pack('H*')
 
@@ -55,9 +55,9 @@ require 'schnorr'
 # public key does not start with 02 or 03.
 public_key = ['DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659'].pack('H*')
 
-signature = ['e7758e20e67a0607433cf8a1f0383a02c7b56792aab71763173ab7085cab8768082aae167787bc3572d15176dc26c073d9b03726aed0b59c728aa6538dc03d57'].pack('H*')
+signature = ['0E12B8C520948A776753A96F21ABD7FDC2D7D0C0DDC90851BE17B04E75EF86A47EF0DA46C4DC4D0D1BCB8668C2CE16C54C7C23A6716EDE303AF86774917CF928'].pack('H*')
 
-message = ['5E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C'].pack('H*')
+message = ['243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89'].pack('H*')
 
 # verify signature.(result is true or false)
 result = Schnorr.valid_sig?(message, public_key, signature) 
@@ -73,4 +73,6 @@ This library changes the following functions of `ecdsa` gem in `lib/schnorr/ec_p
 * `ECDSA::Point` class has following two instance methods.
     * `#has_square_y?` check this point does not infinity and square?(y coordinate)
     * `#square?(x)` check whether `x` is a quadratic residue modulo p.
+    * `#has_even_y?` check the y-coordinate of this point is an even.
+    * `#encode(only_x = false)` encode this point into a binary string.
 * `ECDSA::Format::PointOctetString#decode` supports decoding only from x coordinate.

data/bip-schnorrrb.gemspec

@@ -23,6 +23,6 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency "ecdsa", "~> 1.2.0"
 
   spec.add_development_dependency "bundler"
-  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "rake", ">= 12.3.3"
   spec.add_development_dependency "rspec", "~> 3.0"
 end

data/lib/schnorr.rb

@@ -11,25 +11,32 @@ module Schnorr
 
   # Generate schnorr signature.
   # @param message (String) A message to be signed with binary format.
-  # @param private_key (Integer) The private key.
+  # @param private_key (String) The private key with binary format.
+  # @param aux_rand (String) The auxiliary random data with binary format. If not specified, SecureRandom is used to generate a random value.
   # (The number of times to add the generator point to itself to get the public key.)
   # @return (Schnorr::Signature)
-  def sign(message, private_key)
+  def sign(message, private_key, aux_rand = SecureRandom.bytes(32))
     raise 'The message must be a 32-byte array.' unless message.bytesize == 32
-    p = GROUP.new_point(private_key)
-    seckey = p.has_square_y? ? private_key : GROUP.order - private_key
-    secret = ECDSA::Format::IntegerOctetString.encode(seckey, GROUP.byte_length)
+    d0 = private_key.unpack('H*').first.to_i(16)
+    raise 'private_key must be an integer in the range 1..n-1.' unless 0 < d0 && d0 <= (GROUP.order - 1)
+    raise 'aux_rand must be 32 bytes.' unless aux_rand.bytesize == 32
 
-    k0 = ECDSA::Format::IntegerOctetString.decode(tagged_hash('BIPSchnorrDerive', secret + message)) % GROUP.order
+    p = GROUP.new_point(d0)
+    d = p.has_even_y? ? d0 : GROUP.order - d0
+
+    t = d ^ tagged_hash('BIP340/aux', aux_rand).unpack('H*').first.to_i(16)
+    t = ECDSA::Format::IntegerOctetString.encode(t, GROUP.byte_length)
+
+    k0 = ECDSA::Format::IntegerOctetString.decode(tagged_hash('BIP340/nonce', t + p.encode(true) + message)) % GROUP.order
     raise 'Creation of signature failed. k is zero' if k0.zero?
 
     r = GROUP.new_point(k0)
-
     k = r.has_square_y? ? k0 : GROUP.order - k0
+    e = create_challenge(r.x, p, message)
 
-    e = create_challenge(r.x, p, message, GROUP)
-
-    Schnorr::Signature.new(r.x, (k + e * seckey) % GROUP.order)
+    sig = Schnorr::Signature.new(r.x, (k + e * d) % GROUP.order)
+    raise 'The created signature does not pass verification.' unless valid_sig?(message, p.encode(true), sig.encode)
+    sig
   end
 
   # Verifies the given {Signature} and returns true if it is valid.
@@ -49,18 +56,20 @@ module Schnorr
   # @param signature (String) The signature with binary format.
   # @return (Boolean)
   def check_sig!(message, public_key, signature)
+    raise InvalidSignatureError, 'The message must be a 32-byte array.' unless message.bytesize == 32
+    raise InvalidSignatureError, 'The public key must be a 32-byte array.' unless public_key.bytesize == 32
+
+
     sig = Schnorr::Signature.decode(signature)
     pubkey = ECDSA::Format::PointOctetString.decode(public_key, GROUP)
     field = GROUP.field
 
-    raise Schnorr::InvalidSignatureError, 'Invalid signature: r is not in the field.' unless field.include?(sig.r)
-    raise Schnorr::InvalidSignatureError, 'Invalid signature: s is not in the field.' unless field.include?(sig.s)
     raise Schnorr::InvalidSignatureError, 'Invalid signature: r is zero.' if sig.r.zero?
     raise Schnorr::InvalidSignatureError, 'Invalid signature: s is zero.' if sig.s.zero?
     raise Schnorr::InvalidSignatureError, 'Invalid signature: r is larger than field size.' if sig.r >= field.prime
     raise Schnorr::InvalidSignatureError, 'Invalid signature: s is larger than group order.' if sig.s >= GROUP.order
 
-    e = create_challenge(sig.r, pubkey, message, GROUP)
+    e = create_challenge(sig.r, pubkey, message)
 
     r = GROUP.new_point(sig.s) + pubkey.multiply_by_scalar(GROUP.order - e)
 
@@ -74,15 +83,16 @@ module Schnorr
   # create signature digest.
   # @param (Integer) x a x coordinate for R.
   # @param (ECDSA::Point) p a public key.
-  # @param (ECDSA::Group) group the group of elliptic curve.
   # @return (Integer) digest e.
-  def create_challenge(x, p, message, group)
-    r_x = ECDSA::Format::IntegerOctetString.encode(x, group.byte_length)
-    p_x = ECDSA::Format::IntegerOctetString.encode(p.x, group.byte_length)
-    (ECDSA.normalize_digest(tagged_hash('BIPSchnorr', r_x + p_x + message), group.bit_length)) % group.order
+  def create_challenge(x, p, message)
+    r_x = ECDSA::Format::IntegerOctetString.encode(x, GROUP.byte_length)
+    (ECDSA.normalize_digest(tagged_hash('BIP340/challenge', r_x + p.encode(true) + message), GROUP.bit_length)) % GROUP.order
   end
 
   # Generate tagged hash value.
+  # @param (String) tag tag value.
+  # @param (String) msg the message to be hashed.
+  # @return (String) the hash value with binary format.
   def tagged_hash(tag, msg)
     tag_hash = Digest::SHA256.digest(tag)
     Digest::SHA256.digest(tag_hash + tag_hash + msg)

data/lib/schnorr/ec_point_ext.rb

@@ -8,6 +8,12 @@ module ECDSA
       !infinity? && square?(y)
     end
 
+    # Check the y-coordinate of this point is an even.
+    # @return (Boolean) if even, return true.
+    def has_even_y?
+      y.even?
+    end
+
     # Check whether +x+ is a quadratic residue modulo p.
     # @param x (Integer)
     # @return (Boolean)
@@ -15,6 +21,16 @@ module ECDSA
       x.pow((group.field.prime - 1) / 2, group.field.prime) == 1
     end
 
+    # Encode this point into a binary string.
+    # @param (Boolean) only_x whether or not to encode only X-coordinate. default is false.
+    def encode(only_x = false)
+      if only_x
+        ECDSA::Format::FieldElementOctetString.encode(x, group.field)
+      else
+        ECDSA::Format::PointOctetString.encode(self, {compression: true})
+      end
+    end
+
   end
 
   module Format
@@ -43,12 +59,15 @@ module ECDSA
       end
 
       # decode from x coordinate.
+      # @param (String) x_string X-coordinate binary string
+      # @param (ECDSA::Group) group A group of elliptic curves to use.
+      # @return (ECDSA::Point) decoded point.
       def self.decode_from_x(x_string, group)
         x = ECDSA::Format::FieldElementOctetString.decode(x_string, group.field)
         y_sq = group.field.mod(x.pow(3, group.field.prime) + 7)
         y = y_sq.pow((group.field.prime + 1)/4, group.field.prime)
         raise DecodeError, 'Public key not on the curve.' unless y.pow(2, group.field.prime) == y_sq
-        finish_decode(x, y, group)
+        finish_decode(x, y.even? ? y : group.field.prime - y, group)
       end
 
     end

data/lib/schnorr/version.rb

@@ -1,3 +1,3 @@
 module Schnorr
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bip-schnorr
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - azuchi
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-01-22 00:00:00.000000000 Z
+date: 2020-05-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ecdsa
@@ -42,16 +42,16 @@ dependencies:
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -109,7 +109,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: The ruby implementation of bip-schnorr.