bip-schnorr 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62086f5dc865721a602e4ac25f1c58920eba47d0e7bb5ab59d389af297095750
-  data.tar.gz: 3e6ddfbc75956f04e84f01412b034974cb592ef1adea72775acdc949946d2ebf
+  metadata.gz: 1ee1e80d49aa7b7ef61e0d2b03894a6f5bc81f6cef32cb08cad62e88c2c42d91
+  data.tar.gz: 99f5898f8c5726dd88138c03febce6787a0bb8eff18f97b180a5af82ae52aef4
 SHA512:
-  metadata.gz: 4f599b83ba35a76df8425eb7eb436740f690ec011dcfc6eac65af1591bb748d1421dd71d2cf15c480e44302bd821ffda6f385799549a37f2a8159a592c510482
-  data.tar.gz: f7cb59f75a709bb05509697a55bd3864944a82d4a9768bc34db84da0b6a215b9060fa875722ebb597731f3df6a4155e738b419c413b5ef06278378f2b3055627
+  metadata.gz: 800862f45dbc98f9b82da03777b9373d5b910f3b8bf503741935851294e536fcccd3738c349e848424775e19d9b7661dc1b31b73c8394769ed76daace0e1b280
+  data.tar.gz: 54c26354859fe49d2d56e91c3895b11077aee81c97d47ce17aef0a24a6bd97ecf6f6771a22c04fcf738a59c28e37aaf8e194b9af8223116d39ab76932587f829

data/.github/workflows/ruby.yml

@@ -20,11 +20,12 @@ jobs:
     strategy:
       matrix:
         ruby:
-          - '3.0.6'
-          - '3.1.4'
-          - '3.2.2'
+          - '3.2'
+          - '3.3'
+          - '3.4'
+          - '4.0'
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:

data/.ruby-version

@@ -1 +1 @@
-ruby-3.2.0
+ruby-4.0.0

data/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [Unreleased]
+
+## [0.8.0] - 2026-11-01
+
+### Fixed
+
+- Signatures, secret nonces, public nonces and aggregated nonces are now sliced by bytes (`byteslice`).
+  Previously a binary string tagged as UTF-8 (e.g. read without binmode) could be split by characters and decoded incorrectly.
+- Non-hex inputs are normalized to ASCII-8BIT, so signing a UTF-8 message containing non-ASCII characters no longer raises `Encoding::CompatibilityError`.
+- `Schnorr.sign` now applies the same hex detection to the message as verification and MuSig2 do, so a hex-encoded message can be signed and verified consistently.
+- `Schnorr.check_sig!` raises `Schnorr::InvalidSignatureError` instead of `ECDSA::Format::DecodeError` when the public key is not on the curve.
+- `Schnorr::MuSig2.sort_pubkeys` sorts by raw bytes, so the order no longer depends on the letter case of hex input.
+- `Schnorr::MuSig2.deterministic_sign` reduces the nonces modulo the group order and rejects zero, and `gen_nonce` stores the reduced nonces in the secret nonce, as specified in BIP-327.
+- `Schnorr::MuSig2.aggregate` fails when the aggregate public key is the point at infinity, as specified in BIP-327.
+- Fixed wrong or empty error messages in `gen_nonce` and `aggregate_nonce`.
+
+### Added
+
+- Length validation for `agg_nonce` (66 bytes), secret nonces (97 bytes), public nonces (66 bytes), secret keys (32 bytes) and `rand` (32 bytes) in the MuSig2 API, and range validation of `signer_index` in `SessionContext#valid_partial_sig?`. Invalid inputs raise `ArgumentError` instead of obscure errors.
+- `gemspec` declares `required_ruby_version >= 3.2`.
+- This CHANGELOG.
+
+### Changed
+
+- `Schnorr.sign` raises `ArgumentError` (instead of `RuntimeError`) for an invalid `private_key` or `aux_rand`.
+- `SessionContext` keeps only SHA-256 digests of used secret nonces to detect reuse and no longer exposes `used_secnonces`.
+- `SessionContext#sign` no longer performs two unnecessary scalar multiplications per partial signature.
+- The challenge hash in `SessionContext` is computed once per session.
+- Bumped `ecdsa_ext` to 0.6.0.
+
+### Removed
+
+- The dead `Integer#method_missing` / `Integer#mod_pow` shim for Ruby 2.4 and the unused `Integer#to_hex`.
+
+### Notes
+
+- Omitting `aux_rand` in `Schnorr.sign` still yields a deterministic signature (all-zero auxiliary data) for backward compatibility. Passing fresh randomness is recommended, as described in BIP-340.

data/Gemfile

@@ -4,3 +4,5 @@ git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
 
 # Specify your gem's dependencies in bip-schnorrrb.gemspec
 gemspec
+
+gem 'csv'

data/README.md

@@ -1,4 +1,4 @@
-# bip-schnorrrb [![Build Status](https://github.com/chaintope/bip-schnorrrb/actions/workflows/ruby.yml/badge.svg?branch=master)](https://travis-ci.org/chaintope/bip-schnorrrb) [![Gem Version](https://badge.fury.io/rb/bip-schnorr.svg)](https://badge.fury.io/rb/bip-schnorr) [![MIT License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](LICENSE) 
+# bip-schnorrrb [![Build Status](https://github.com/chaintope/bip-schnorrrb/actions/workflows/ruby.yml/badge.svg?branch=master)](https://github.com/chaintope/bip-schnorrrb/actions/workflows/ruby.yml) [![Gem Version](https://badge.fury.io/rb/bip-schnorr.svg)](https://badge.fury.io/rb/bip-schnorr) [![MIT License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](LICENSE) 
 
 This is a Ruby implementation of the Schnorr signature scheme over the elliptic curve. 
 This implementation relies on the [ecdsa gem](https://github.com/DavidEGrayson/ruby_ecdsa) for operate elliptic curves.
@@ -33,6 +33,8 @@ private_key = ['B7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF
 message = ['5E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C'].pack('H*')
 
 # create signature
+# NOTE: if aux_rand is omitted, it is treated as 32 zero bytes and the signature is deterministic.
+# It is recommended to pass fresh randomness as the 3rd argument (see BIP-340 "Default Signing").
 signature = Schnorr.sign(message, private_key)
 # if use auxiliary random data, specify it to the 3rd arguments.
 aux_rand = SecureRandom.bytes(32) # aux_rand must be a 32-byte binary.
@@ -108,8 +110,8 @@ sec_nonce1, pub_nonce1 = Schnorr::MuSig2.gen_nonce(
 )
 
 ## for stateless signer.
-agg_other_nonce = described_class.aggregate_nonce([pub_nonce1])
-pub_nonce2, sig2 = described_class.deterministic_sign(
+agg_other_nonce = Schnorr::MuSig2.aggregate_nonce([pub_nonce1])
+pub_nonce2, sig2 = Schnorr::MuSig2.deterministic_sign(
         sk2, agg_other_nonce, pubkeys, msg, 
         tweaks: tweaks, # optional
         modes: modes, # optional

data/bip-schnorrrb.gemspec

@@ -20,7 +20,8 @@ Gem::Specification.new do |spec|
   spec.bindir        = "exe"
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
-  spec.add_runtime_dependency "ecdsa_ext", "~> 0.5.0"
+  spec.required_ruby_version = ">= 3.2"
+  spec.add_runtime_dependency "ecdsa_ext", "~> 0.6.0"
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake", ">= 12.3.3"

data/lib/schnorr/ec_point_ext.rb

@@ -54,6 +54,7 @@ module ECDSA
       end
 
       # decode from x coordinate.
+      # NOTE: This assumes secp256k1 (y^2 = x^3 + 7 and p = 3 mod 4), as used by BIP-340.
       # @param (String) x_string X-coordinate binary string
       # @param (ECDSA::Group) group A group of elliptic curves to use.
       # @return (ECDSA::Point) decoded point.

data/lib/schnorr/musig2/context/session.rb

@@ -2,16 +2,17 @@ module Schnorr
   module MuSig2
     class SessionContext
       include Schnorr::Util
-      attr_reader :agg_nonce, :pubkeys, :tweaks, :modes, :msg, :r, :agg_ctx, :b, :used_secnonces
+      attr_reader :agg_nonce, :pubkeys, :tweaks, :modes, :msg, :r, :agg_ctx, :b
 
       # @param [String] agg_nonce
       # @param [Array(String)] pubkeys An array of public keys.
-      # @param [String] msg A message to be signed.
+      # @param [String] msg A message to be signed(binary format or hex format).
       # @param [Array(String)] tweaks An array of tweaks(32 bytes).
       # @param [Array(Boolean)] modes An array of tweak mode(Boolean).
       def initialize(agg_nonce, pubkeys, msg, tweaks = [], modes = [])
-        @used_secnonces = []
+        @used_secnonce_digests = []
         @agg_nonce = hex2bin(agg_nonce)
+        raise ArgumentError, 'agg_nonce must be 66 bytes' unless @agg_nonce.bytesize == 66
         @pubkeys = pubkeys.map do |pubkey|
           pubkey = hex2bin(pubkey)
           raise ArgumentError, 'pubkey must be 33 bytes' unless pubkey.bytesize == 33
@@ -26,8 +27,8 @@ module Schnorr
         @agg_ctx = MuSig2.aggregate_with_tweaks(@pubkeys, @tweaks, @modes)
         @b = Schnorr.tagged_hash('MuSig/noncecoef', @agg_nonce + agg_ctx.q.encode(true) + @msg).bti
         begin
-          r1 = string2point(@agg_nonce[0...33]).to_jacobian
-          r2 = string2point(@agg_nonce[33...66]).to_jacobian
+          r1 = string2point(@agg_nonce.byteslice(0, 33)).to_jacobian
+          r2 = string2point(@agg_nonce.byteslice(33, 33)).to_jacobian
         rescue ECDSA::Format::DecodeError
           raise ArgumentError, 'Invalid agg_nonce'
         end
@@ -38,7 +39,7 @@ module Schnorr
       # Get message digest.
       # @return [Integer]
       def e
-        Schnorr.tagged_hash('BIP0340/challenge', r.encode(true) + agg_ctx.q.encode(true) + msg).bti
+        @e ||= Schnorr.tagged_hash('BIP0340/challenge', r.encode(true) + agg_ctx.q.encode(true) + msg).bti
       end
 
       # Create partial signature.
@@ -47,27 +48,27 @@ module Schnorr
       # @return [String] Partial signature with hex format.
       def sign(nonce, sk)
         nonce = hex2bin(nonce)
-        raise ArgumentError, 'Same nonce already used.' if used_secnonces.include?(nonce)
+        raise ArgumentError, 'nonce must be 97 bytes.' unless nonce.bytesize == 97
+        nonce_digest = Digest::SHA256.digest(nonce)
+        raise ArgumentError, 'Same nonce already used.' if @used_secnonce_digests.include?(nonce_digest)
         sk = hex2bin(sk)
-        k1 = nonce[0...32].bti
-        k2 = nonce[32...64].bti
+        raise ArgumentError, 'sk must be 32 bytes.' unless sk.bytesize == 32
+        k1 = nonce.byteslice(0, 32).bti
+        k2 = nonce.byteslice(32, 32).bti
         raise ArgumentError, 'first nonce value is out of range.' if k1 <= 0 || GROUP.order <= k1
         raise ArgumentError, 'second nonce value is out of range.' if k2 <= 0 || GROUP.order <= k2
         k1 = r.has_even_y? ? k1 : GROUP.order - k1
         k2 = r.has_even_y? ? k2 : GROUP.order - k2
         d = sk.bti
         raise ArgumentError, 'secret key value is out of range.' if d <= 0 || GROUP.order <= d
-        p = (GROUP.generator.to_jacobian * d).to_affine.encode
-        raise ArgumentError, 'Public key does not match nonce_gen argument' unless p == nonce[64...97]
+        p = (GROUP.generator.to_jacobian * pad_scalar(d)).to_affine.encode
+        raise ArgumentError, 'Public key does not match nonce_gen argument' unless p == nonce.byteslice(64, 33)
         a = key_agg_coeff(pubkeys, p)
         g = agg_ctx.q.has_even_y? ? 1 : GROUP.order - 1
         d = (g * agg_ctx.gacc * d)  % GROUP.order
         s = (k1 + b * k2 + e * a * d) % GROUP.order
-        r1 = (GROUP.generator.to_jacobian * k1).to_affine
-        r2 = (GROUP.generator.to_jacobian * k2).to_affine
-        raise ArgumentError, 'R1 can not be infinity.' if r1.infinity?
-        raise ArgumentError, 'R2 can not be infinity.' if r2.infinity?
-        used_secnonces << nonce
+        # Only a digest is kept so that the secret nonce itself is not retained in memory.
+        @used_secnonce_digests << nonce_digest
         ECDSA::Format::IntegerOctetString.encode(s, GROUP.byte_length).unpack1('H*')
       end
 
@@ -77,13 +78,17 @@ module Schnorr
       # @param [Integer] signer_index The index of signer.
       # @return [Boolean]
       def valid_partial_sig?(partial_sig, pub_nonce, signer_index)
+        unless signer_index.is_a?(Integer) && signer_index >= 0 && signer_index < pubkeys.length
+          raise ArgumentError, 'signer_index is out of range.'
+        end
         begin
           partial_sig = hex2bin(partial_sig)
           pub_nonce = hex2bin(pub_nonce)
+          raise ArgumentError, 'pub_nonce must be 66 bytes.' unless pub_nonce.bytesize == 66
           s = partial_sig.bti
           return false if s >= GROUP.order
-          r1 = string2point(pub_nonce[0...33]).to_jacobian
-          r2 = string2point(pub_nonce[33...66]).to_jacobian
+          r1 = string2point(pub_nonce.byteslice(0, 33)).to_jacobian
+          r2 = string2point(pub_nonce.byteslice(33, 33)).to_jacobian
           r_s = (r1 + r2 * b).to_affine
           r_s = r.has_even_y? ? r_s : r_s.negate
           pk = string2point(pubkeys[signer_index])
@@ -91,8 +96,8 @@ module Schnorr
           g = agg_ctx.q.has_even_y? ? 1 : GROUP.order - 1
           g = (g * agg_ctx.gacc) % GROUP.order
           GROUP.generator.to_jacobian * s == r_s.to_jacobian + pk.to_jacobian * (e * a * g % GROUP.order)
-        rescue ECDSA::Format::DecodeError => e
-          raise ArgumentError, e
+        rescue ECDSA::Format::DecodeError => err
+          raise ArgumentError, err.message
         end
       end
 

data/lib/schnorr/musig2.rb

@@ -14,13 +14,15 @@ module Schnorr
     # @param [Array(String)] pubkeys An array of public keys.
     # @return [Array(String)] Sorted public keys with hex format.
     def sort_pubkeys(pubkeys)
-      pubkeys.map{|p| hex_string?(p) ? p : p.unpack1('H*')}.sort
+      # Sort by the raw bytes so that the result does not depend on the letter case of hex input.
+      pubkeys.map{|p| hex_string?(p) ? p : p.unpack1('H*')}.sort_by{|p| [p].pack('H*')}
     end
 
     # Compute aggregate public key.
     # @param [Array[String]] pubkeys An array of public keys.
     # @return [Schnorr::MuSig2::KeyAggContext]
     def aggregate(pubkeys)
+      raise ArgumentError, 'pubkeys must not be empty.' if pubkeys.empty?
       pubkeys = pubkeys.map do |p|
         pubkey = hex2bin(p)
         raise ArgumentError, "Public key must be 33 bytes." unless pubkey.bytesize == 33
@@ -38,6 +40,7 @@ module Schnorr
         coeff = p == pk2 ? 1 : Schnorr.tagged_hash('KeyAgg coefficient', l + p).bti
         q += point * coeff
       end
+      raise ArgumentError, 'The aggregate public key must not be infinity.' if q.infinity?
       KeyAggContext.new(q.to_affine, 1, 0)
     end
 
@@ -61,7 +64,7 @@ module Schnorr
     # @param [String] pk The public key (33 bytes).
     # @param [String] sk (Optional) The secret key string (32 bytes).
     # @param [String] agg_pubkey (Optional) The aggregated public key (32 bytes).
-    # @param [String] msg (Optional) The message to be signed.
+    # @param [String] msg (Optional) The message to be signed(binary format or hex format).
     # @param [String] extra_in (Optional) The auxiliary input.
     # @param [String] rand (Optional) A 32-byte array freshly drawn uniformly at random.
     # @return [Array(String)] The array of sec nonce and pub nonce with hex format.
@@ -81,7 +84,7 @@ module Schnorr
              end
       agg_pubkey = if agg_pubkey
                      agg_pubkey = hex2bin(agg_pubkey)
-                     raise ArgumentError, 'The agg_pubkey must be 33 bytes.' unless agg_pubkey.bytesize == 32
+                     raise ArgumentError, 'The agg_pubkey must be 32 bytes.' unless agg_pubkey.bytesize == 32
                      agg_pubkey
                    else
                      ''
@@ -101,10 +104,11 @@ module Schnorr
       raise ArgumentError, 'k1 must not be zero.' if k1_i.zero?
       raise ArgumentError, 'k2 must not be zero.' if k2_i.zero?
 
-      r1 = (GROUP.generator.to_jacobian * k1_i).to_affine
-      r2 = (GROUP.generator.to_jacobian * k2_i).to_affine
+      r1 = (GROUP.generator.to_jacobian * pad_scalar(k1_i)).to_affine
+      r2 = (GROUP.generator.to_jacobian * pad_scalar(k2_i)).to_affine
       pub_nonce = r1.encode + r2.encode
-      sec_nonce = k1 + k2 + pk
+      sec_nonce = ECDSA::Format::IntegerOctetString.encode(k1_i, GROUP.byte_length) +
+        ECDSA::Format::IntegerOctetString.encode(k2_i, GROUP.byte_length) + pk
       [sec_nonce.unpack1('H*'), pub_nonce.unpack1('H*')]
     end
 
@@ -114,11 +118,11 @@ module Schnorr
     def aggregate_nonce(pub_nonces)
       2.times.map do |i|
         r = GROUP.generator.to_jacobian.infinity_point
-        pub_nonces = pub_nonces.each do |nonce|
+        pub_nonces.each do |nonce|
           nonce = hex2bin(nonce)
-          raise ArgumentError, "" unless nonce.bytesize == 66
+          raise ArgumentError, 'Public nonce must be 66 bytes.' unless nonce.bytesize == 66
           begin
-            p = string2point(nonce[(i * 33)...(i + 1)*33]).to_jacobian
+            p = string2point(nonce.byteslice(i * 33, 33)).to_jacobian
             raise ArgumentError, 'Public nonce is infinity' if p.infinity?
           rescue ECDSA::Format::DecodeError
             raise ArgumentError, "Invalid public nonce."
@@ -133,7 +137,7 @@ module Schnorr
     # @param [String] sk The secret key string (32 bytes).
     # @param [String] agg_other_nonce Other aggregated nonce.
     # @param [Array] pubkeys An array of public keys.
-    # @param [String] msg The message to be signed.
+    # @param [String] msg The message to be signed(binary format or hex format).
     # @param [Array(String)] tweaks (Optional) An array of tweak value.
     # @param [Array(Boolean)] modes (Optional) An array of tweak mode.
     # @param [String] rand (Optional) A 32-byte array freshly drawn uniformly at random.
@@ -141,19 +145,25 @@ module Schnorr
     def deterministic_sign(sk, agg_other_nonce, pubkeys, msg, tweaks: [], modes: [], rand: nil)
       raise ArgumentError, 'The tweaks and modes arrays must have the same length.' unless tweaks.length == modes.length
       sk = hex2bin(sk)
+      raise ArgumentError, 'The sk must be 32 bytes.' unless sk.bytesize == 32
       msg = hex2bin(msg)
       agg_other_nonce = hex2bin(agg_other_nonce)
-      sk_ = rand ? gen_aux(sk, hex2bin(rand)) : sk
+      raise ArgumentError, 'The agg_other_nonce must be 66 bytes.' unless agg_other_nonce.bytesize == 66
+      if rand
+        rand = hex2bin(rand)
+        raise ArgumentError, 'The rand must be 32 bytes.' unless rand.bytesize == 32
+      end
+      sk_ = rand ? gen_aux(sk, rand) : sk
       agg_ctx = aggregate_with_tweaks(pubkeys, tweaks, modes)
       agg_pk = [agg_ctx.x_only_pubkey].pack("H*")
-      k1 = deterministic_nonce_hash(sk_, agg_other_nonce, agg_pk, msg, 0).bti
-      k2 = deterministic_nonce_hash(sk_, agg_other_nonce, agg_pk, msg, 1).bti
-      r1 = (GROUP.generator.to_jacobian * k1).to_affine
-      r2 = (GROUP.generator.to_jacobian * k2).to_affine
-      raise ArgumentError, 'R1 must not be infinity.' if r1.infinity?
-      raise ArgumentError, 'R2 must not be infinity.' if r2.infinity?
+      k1 = deterministic_nonce_hash(sk_, agg_other_nonce, agg_pk, msg, 0).bti % GROUP.order
+      k2 = deterministic_nonce_hash(sk_, agg_other_nonce, agg_pk, msg, 1).bti % GROUP.order
+      raise ArgumentError, 'k1 must not be zero.' if k1.zero?
+      raise ArgumentError, 'k2 must not be zero.' if k2.zero?
+      r1 = (GROUP.generator.to_jacobian * pad_scalar(k1)).to_affine
+      r2 = (GROUP.generator.to_jacobian * pad_scalar(k2)).to_affine
       pub_nonce = r1.encode + r2.encode
-      pk = (GROUP.generator.to_jacobian * sk.bti).to_affine
+      pk = (GROUP.generator.to_jacobian * pad_scalar(sk.bti)).to_affine
       sec_nonce = ECDSA::Format::IntegerOctetString.encode(k1, GROUP.byte_length) +
         ECDSA::Format::IntegerOctetString.encode(k2, GROUP.byte_length) + pk.encode
       agg_nonce = aggregate_nonce([pub_nonce, agg_other_nonce])

data/lib/schnorr/signature.rb

@@ -22,8 +22,8 @@ module Schnorr
     # @return (Signature) signature instance.
     def self.decode(string)
       raise InvalidSignatureError, 'Invalid schnorr signature length.' unless string.bytesize == 64
-      r = string[0...32].bti
-      s = string[32..-1].bti
+      r = string.byteslice(0, 32).bti
+      s = string.byteslice(32, 32).bti
       new(r, s)
     end
 

data/lib/schnorr/util.rb

@@ -11,11 +11,11 @@ module Schnorr
       hex_chars.all? { |c| c =~ /[0-9a-fA-F]/ }
     end
 
-    # If +str+ is a hex value, it is converted to binary. Otherwise, it is returned as is.
+    # If +str+ is a hex value, it is converted to binary. Otherwise, it is returned as a binary (ASCII-8BIT) string.
     # @param [String] str
     # @return [String]
     def hex2bin(str)
-      hex_string?(str) ? [str].pack('H*') : str
+      hex_string?(str) ? [str].pack('H*') : str.b
     end
 
     # Convert +str+ to the point of elliptic curve.
@@ -24,5 +24,17 @@ module Schnorr
     def string2point(str)
       ECDSA::Format::PointOctetString.decode(str, GROUP)
     end
+
+    # Pad +scalar+ with the group order so that its bit length is fixed,
+    # mitigating a timing leak of the bit length of a secret scalar.
+    # Since (k + i * n)G = kG, this does not change the resulting point.
+    # Only use this for secret scalars; padding a public scalar just costs an extra doubling.
+    # @param [Integer] scalar A secret scalar.
+    # @return [Integer] The padded scalar.
+    def pad_scalar(scalar)
+      k = scalar + GROUP.order
+      k += GROUP.order if k.bit_length == GROUP.order.bit_length
+      k
+    end
   end
 end

data/lib/schnorr/version.rb

@@ -1,3 +1,3 @@
 module Schnorr
-  VERSION = "0.7.0"
+  VERSION = "0.8.0"
 end

data/lib/schnorr.rb

@@ -13,34 +13,32 @@ module Schnorr
   DEFAULT_AUX = ([0x00] * 32).pack('C*')
 
   # Generate schnorr signature.
-  # @param [String] message A message to be signed with binary format.
+  # @param [String] message A message to be signed(binary format or hex format).
   # @param [String] private_key The private key(binary format or hex format).
   # @param [String] aux_rand The auxiliary random data(binary format or hex format).
-  # If aux_rand is nil, it is treated the same as an all-zero one.
+  # If aux_rand is nil, it is treated the same as an all-zero one, which makes the signature deterministic.
+  # It is recommended to pass 32 bytes of fresh randomness (e.g. SecureRandom.bytes(32)).
   # See BIP-340 "Default Signing" for a full explanation of this argument and for guidance if randomness is expensive.
   # @return [Schnorr::Signature]
   def sign(message, private_key, aux_rand = nil)
+    message = hex2bin(message)
     private_key = private_key.unpack1('H*') unless hex_string?(private_key)
 
     d0 = private_key.to_i(16)
-    raise 'private_key must be an integer in the range 1..n-1.' unless 0 < d0 && d0 <= (GROUP.order - 1)
-    if aux_rand
-      aux_rand = [aux_rand].pack("H*") if hex_string?(aux_rand)
-      raise 'aux_rand must be 32 bytes.' unless aux_rand.bytesize == 32
-    else
-      aux_rand = DEFAULT_AUX
-    end
+    raise ArgumentError, 'private_key must be an integer in the range 1..n-1.' unless 0 < d0 && d0 <= (GROUP.order - 1)
+    aux_rand = aux_rand ? hex2bin(aux_rand) : DEFAULT_AUX
+    raise ArgumentError, 'aux_rand must be 32 bytes.' unless aux_rand.bytesize == 32
 
-    p = (GROUP.generator.to_jacobian * d0).to_affine
+    p = (GROUP.generator.to_jacobian * pad_scalar(d0)).to_affine
     d = p.has_even_y? ? d0 : GROUP.order - d0
 
-    t = aux_rand.nil? ? d : d ^ tagged_hash('BIP0340/aux', aux_rand).bti
+    t = d ^ tagged_hash('BIP0340/aux', aux_rand).bti
     t = ECDSA::Format::IntegerOctetString.encode(t, GROUP.byte_length)
 
     k0 = ECDSA::Format::IntegerOctetString.decode(tagged_hash('BIP0340/nonce', t + p.encode(true) + message)) % GROUP.order
     raise 'Creation of signature failed. k is zero' if k0.zero?
 
-    r = (GROUP.generator.to_jacobian * k0).to_affine
+    r = (GROUP.generator.to_jacobian * pad_scalar(k0)).to_affine
     k = r.has_even_y? ? k0 : GROUP.order - k0
     e = create_challenge(r.x, p, message)
 
@@ -51,7 +49,7 @@ module Schnorr
   end
 
   # Verifies the given {Signature} and returns true if it is valid.
-  # @param [String] message A message to be signed with binary format.
+  # @param [String] message A message to be signed(binary format or hex format).
   # @param [String] public_key The public key with binary format.
   # @param [String] signature The signature with binary format.
   # @return [Boolean] whether signature is valid.
@@ -62,18 +60,21 @@ module Schnorr
   end
 
   # Verifies the given {Signature} and raises an {InvalidSignatureError} if it is invalid.
-  # @param [String] message A message to be signed with binary format.
+  # @param [String] message A message to be signed(binary format or hex format).
   # @param [String] public_key The public key with binary format.
   # @param [String] signature The signature with binary format.
   # @return [Boolean]
   def check_sig!(message, public_key, signature)
     message = hex2bin(message)
     public_key = hex2bin(public_key)
-    public_key = [public_key].pack('H*') if hex_string?(public_key)
     raise InvalidSignatureError, 'The public key must be a 32-byte array.' unless public_key.bytesize == 32
 
     sig = Schnorr::Signature.decode(signature)
-    pubkey = ECDSA::Format::PointOctetString.decode_from_x(public_key, GROUP)
+    pubkey = begin
+      ECDSA::Format::PointOctetString.decode_from_x(public_key, GROUP)
+    rescue ECDSA::Format::DecodeError => e
+      raise InvalidSignatureError, "Invalid public key: #{e.message}"
+    end
     field = GROUP.field
 
     raise Schnorr::InvalidSignatureError, 'Invalid signature: r is zero.' if sig.r.zero?
@@ -118,30 +119,4 @@ module Schnorr
     end
 
   end
-
-  class ::Integer
-    def to_hex
-      hex = to_s(16)
-      hex.rjust((hex.length / 2.0).ceil * 2, '0')
-    end
-
-    def method_missing(method, *args)
-      return mod_pow(args[0], args[1]) if method == :pow && args.length < 3
-      super
-    end
-
-    # alternative implementation of Integer#pow for ruby 2.4 and earlier.
-    def mod_pow(x, y)
-      return self**x unless y
-
-      b = self
-      result = 1
-      while x > 0
-        result = (result * b) % y if (x & 1) == 1
-        x >>= 1
-        b = (b * b) % y
-      end
-      result
-    end
-  end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bip-schnorr
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.8.0
 platform: ruby
 authors:
 - azuchi
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-12-22 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ecdsa_ext
@@ -16,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -78,6 +77,7 @@ files:
 - ".rspec"
 - ".ruby-gemset"
 - ".ruby-version"
+- CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - LICENSE.txt
@@ -98,7 +98,6 @@ homepage: https://github.com/chaintope/bip-schnorrrb
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -106,15 +105,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.1
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: The ruby implementation of bip-schnorr.
 test_files: []