starkbank-ecdsa 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d4a76bc728ec00f073424e79a9e72d75d39aa863074fff03fd5c35694d221f2
-  data.tar.gz: d8612f17a0eb7b9d7e5d735f7fc164ee288e770ba5d2b4bc62c35fcbda97088e
+  metadata.gz: 9b661f1bd378387d7c6466e9271adba268c3e85e7cc3a65ed71bb4e26a6e26d5
+  data.tar.gz: 9f815e7c6c4a95f302b12a0458eb6ab24596ff0df5a8cfcb51a608f463ee1b42
 SHA512:
-  metadata.gz: 88d83c16ca1e416998cf5411dd45ca4cd9e62af3841dcea5981a2fa8dedbc86ea74a8ef91ceb44db6e5192e36af65c5877f32d373ccffd154c4472951d379fcf
-  data.tar.gz: 4332d9b28484fe4c09708147494ea33c3caa48f263824a72ef846888a32cd27bad585a98560a8f7883c5be88394da72318e44a144e0b1b4ecfbde148812de058
+  metadata.gz: 62071d28e66c906ee70a2a3fe8bc5de2c4174cee49e0d90eb1f19b76014573462ad14035941717f162486dc33780b14e8fbddefff415249d70ba8a16fe79e75a
+  data.tar.gz: c1c599e3c8d5bb1f998fe91fdebf54f8b5efd43fb9644fac8425e5f9a20f3dab29b5a430763777b40800e27c7eba106d20c47195caa0ba27520bb5549a2ea3ea

data/lib/curve.rb

@@ -6,17 +6,23 @@ module EllipticCurve
     #
     module Curve
         class CurveFp
-            attr_accessor :a, :b, :p, :n, :g, :name, :oid, :nistName
+            attr_accessor :a, :b, :p, :n, :g, :name, :oid, :nistName, :nBitLength, :glvParams
+            attr_accessor :_generatorPowersTable
 
-            def initialize(a, b, p, n, gx, gy, name, oid, nistName=nil)
+            def initialize(a, b, p, n, gx, gy, name, oid, nistName=nil, glvParams=nil)
                 @a = a
                 @b = b
                 @p = p
                 @n = n
+                @nBitLength = n.bit_length
                 @g = Point.new(gx, gy)
                 @name = name
                 @oid = oid
                 @nistName = nistName
+                # GLV endomorphism parameters (only for curves that support one,
+                # e.g. secp256k1). nil means no endomorphism; fall back to Shamir+JSF.
+                @glvParams = glvParams
+                @_generatorPowersTable = nil
             end
             
             def contains(p)
@@ -71,7 +77,19 @@ module EllipticCurve
             0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,
             0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8,
             "secp256k1",
-            [1, 3, 132, 0, 10]
+            [1, 3, 132, 0, 10],
+            nil,
+            # GLV endomorphism phi((x,y)) = (beta*x, y), equivalent to lambda*P.
+            # Basis vectors from Gauss reduction; used to split a 256-bit scalar k
+            # into two ~128-bit scalars (k1, k2) with k == k1 + k2*lambda (mod N).
+            {
+                :beta   => 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee,
+                :lambda => 0x5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72,
+                :a1     => 0x3086d221a7d46bcde86c90e49284eb15,
+                :b1     => -0xe4437ed6010e88286f547fa90abfe4c3,
+                :a2     => 0x114ca50f7a8e2f3f657c1108d9d44cfd8,
+                :b2     => 0x3086d221a7d46bcde86c90e49284eb15,
+            }
         )
 
         PRIME256V1 = CurveFp.new(

data/lib/ecdsa.rb

@@ -4,15 +4,16 @@ require 'digest'
 module EllipticCurve
     module Ecdsa
         def self.sign(message, privateKey, hashfunc=nil)
-            if hashfunc.nil? then hashfunc = lambda{ |x| Digest::SHA256.digest(x) } end            
-            byteMessage = hashfunc.call(message)
-            numberMessage = Utils::Binary.numberFromByteString(byteMessage)
+            if hashfunc.nil? then hashfunc = lambda{ |x| Digest::SHA256.digest(x) } end
             curve = privateKey.curve
+            byteMessage = hashfunc.call(message)
+            numberMessage = Utils::Binary.numberFromByteString(byteMessage, curve.nBitLength)
 
             r, s, randSignPoint = 0, 0, nil
+            kIterator = Utils::RandomInteger.rfc6979(byteMessage, privateKey.secret, curve, hashfunc)
             while r == 0 or s == 0
-                randNum = Utils::RandomInteger.between(1, curve.n - 1)
-                randSignPoint = Math.multiply(curve.g, randNum, curve.n, curve.a, curve.p)
+                randNum = kIterator.next
+                randSignPoint = Math.multiplyGenerator(curve, randNum)
                 r = randSignPoint.x % curve.n
                 s = ((numberMessage + r * privateKey.secret) * (Math.inv(randNum, curve.n))) % curve.n
             end
@@ -20,27 +21,38 @@ module EllipticCurve
             if randSignPoint.y > curve.n
                 recoveryId += 2
             end
+            if s > curve.n / 2
+                s = curve.n - s
+                recoveryId ^= 1
+            end
+
             return Signature.new(r, s, recoveryId)
         end
 
         def self.verify(message, signature, publicKey, hashfunc=nil)
-            if hashfunc.nil? then hashfunc = lambda{ |x| Digest::SHA256.digest(x) } end            
+            if hashfunc.nil? then hashfunc = lambda{ |x| Digest::SHA256.digest(x) } end
+            curve = publicKey.curve
             byteMessage = hashfunc.call(message)
-            numberMessage = Utils::Binary.numberFromByteString(byteMessage)
+            numberMessage = Utils::Binary.numberFromByteString(byteMessage, curve.nBitLength)
 
-            curve = publicKey.curve
             r = signature.r
             s = signature.s
+
             if not (1 <= r and r <= curve.n - 1)
                 return false
             end
             if not (1 <= s and s <= curve.n - 1)
                 return false
             end
+            if not curve.contains(publicKey.point)
+                return false
+            end
             inv = Math.inv(s, curve.n)
-            u1 = Math.multiply(curve.g, (numberMessage * inv) % curve.n, curve.n, curve.a, curve.p)
-            u2 = Math.multiply(publicKey.point, (r * inv) % curve.n, curve.n, curve.a, curve.p)
-            v = Math.add(u1, u2, curve.a, curve.p)
+            v = Math.multiplyAndAdd(
+                curve.g, (numberMessage * inv) % curve.n,
+                publicKey.point, (r * inv) % curve.n,
+                curve.n, curve.a, curve.p, curve,
+            )
             if v.isAtInfinity
                 return false
             end

data/lib/math.rb

@@ -1,21 +1,129 @@
 module EllipticCurve
     class Math
         def self.modularSquareRoot(value, prime)
-            # :param value: Value to calculate the square root
-            # :param prime: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
-            # :return: Square root of the value
-            return value.pow((prime + 1).div(4), prime)
+            # Tonelli-Shanks algorithm for modular square root. Works for all odd primes.
+            if value == 0
+                return 0
+            end
+            if prime == 2
+                return value % 2
+            end
+
+            # Factor out powers of 2: prime - 1 = Q * 2^S
+            q = prime - 1
+            s = 0
+            while q % 2 == 0
+                q /= 2
+                s += 1
+            end
+
+            if s == 1  # prime = 3 (mod 4)
+                return value.pow((prime + 1) / 4, prime)
+            end
+
+            # Find a quadratic non-residue z
+            z = 2
+            while z.pow((prime - 1) / 2, prime) != prime - 1
+                z += 1
+            end
+
+            m = s
+            c = z.pow(q, prime)
+            t = value.pow(q, prime)
+            r = value.pow((q + 1) / 2, prime)
+
+            while true
+                if t == 1
+                    return r
+                end
+
+                # Find the least i such that t^(2^i) = 1 (mod prime)
+                i = 1
+                temp = (t * t) % prime
+                while temp != 1
+                    temp = (temp * temp) % prime
+                    i += 1
+                end
+
+                b = c.pow(1 << (m - i - 1), prime)
+                m = i
+                c = (b * b) % prime
+                t = (t * c) % prime
+                r = (r * b) % prime
+            end
         end
 
-        def self.multiply(p, n, order, coeff, prime) 
-            # Fast way to multiply point and scalar in elliptic curves
+        def self.multiplyGenerator(curve, n)
+            # Fast scalar multiplication n*G using a precomputed affine table of
+            # powers-of-two multiples of G and the width-2 NAF of n. Every non-zero
+            # NAF digit triggers one mixed add and zero doublings, trading the ~256
+            # doublings of a windowed method for ~86 adds on average - a large net
+            # reduction in field multiplications for 256-bit scalars.
+            if n < 0 or n >= curve.n
+                n = n % curve.n
+            end
+            if n == 0
+                return Point.new(0, 0, 0)
+            end
 
-            # :param p: First Point to mutiply
-            # :param n: Scalar to mutiply
-            # :param N: Order of the elliptic curve
-            # :param A: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
-            # :param P: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
-            # :return: Point that represents the sum of First and Second Point
+            table = self._generatorPowersTable(curve)
+            coeff = curve.a
+            prime = curve.p
+
+            r = Point.new(0, 0, 1)
+            i = 0
+            k = n
+            while k > 0
+                if (k & 1) != 0
+                    digit = 2 - (k & 3)  # -1 or +1
+                    k -= digit
+                    g = table[i]
+                    if digit == 1
+                        r = self._jacobianAdd(r, g, coeff, prime)
+                    else
+                        r = self._jacobianAdd(r, Point.new(g.x, prime - g.y, 1), coeff, prime)
+                    end
+                end
+                k >>= 1
+                i += 1
+            end
+            return self._fromJacobian(r, prime)
+        end
+
+        def self._generatorPowersTable(curve)
+            # Build [G, 2G, 4G, ..., 2^nBitLength * G] in affine (z=1) form, so each
+            # add in multiplyGenerator hits the mixed-add fast path.
+            return curve._generatorPowersTable unless curve._generatorPowersTable.nil?
+            coeff = curve.a
+            prime = curve.p
+            current = Point.new(curve.g.x, curve.g.y, 1)
+            table = [current]
+            # NAF of an nBitLength-bit scalar can be up to nBitLength+1 digits.
+            curve.nBitLength.times do
+                doubled = self._jacobianDouble(current, coeff, prime)
+                if doubled.y == 0
+                    current = doubled
+                else
+                    zInv = self.inv(doubled.z, prime)
+                    zInv2 = (zInv * zInv) % prime
+                    zInv3 = (zInv2 * zInv) % prime
+                    current = Point.new((doubled.x * zInv2) % prime, (doubled.y * zInv3) % prime, 1)
+                end
+                table << current
+            end
+            curve._generatorPowersTable = table
+            return table
+        end
+
+        def self.multiply(p, n, order, coeff, prime)
+            # Fast way to multiply point and scalar in elliptic curves
+            #
+            # :param p: First Point to multiply
+            # :param n: Scalar to multiply
+            # :param order: Order of the elliptic curve
+            # :param coeff: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param prime: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :return: Point that represents the scalar multiplication
             return self._fromJacobian(
                 self._jacobianMultiply(self._toJacobian(p), n, order, coeff, prime), prime
             )
@@ -23,45 +131,138 @@ module EllipticCurve
 
         def self.add(p, q, coeff, prime)
             # Fast way to add two points in elliptic curves
-
+            #
             # :param p: First Point you want to add
             # :param q: Second Point you want to add
-            # :param P: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
-            # :param A: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param coeff: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param prime: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
             # :return: Point that represents the sum of First and Second Point
             return self._fromJacobian(
                 self._jacobianAdd(self._toJacobian(p), self._toJacobian(q), coeff, prime), prime
             )
         end
 
-        def self.inv(x, n)
-            # Extended Euclidean Algorithm. It's the 'division' in elliptic curves
+        def self.multiplyAndAdd(p1, n1, p2, n2, order, coeff, prime, curve=nil)
+            # Compute n1*p1 + n2*p2. If `curve` is given and exposes `glvParams`
+            # (e.g. secp256k1), uses the GLV endomorphism to split both scalars
+            # into ~128-bit halves and run a 4-scalar simultaneous multi-
+            # exponentiation. Otherwise falls back to Shamir's trick with JSF.
+            # Not constant-time - use only with public scalars (e.g. verification).
+            #
+            # :param p1: First point
+            # :param n1: First scalar
+            # :param p2: Second point
+            # :param n2: Second scalar
+            # :param order: Order of the elliptic curve (ignored when `curve` is given)
+            # :param coeff: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p) (ignored when `curve` is given)
+            # :param prime: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p) (ignored when `curve` is given)
+            # :param curve: Optional curve object; enables GLV if `curve.glvParams` is set
+            # :return: Point n1*p1 + n2*p2
+            if not curve.nil?
+                order, coeff, prime = curve.n, curve.a, curve.p
+                if not curve.glvParams.nil?
+                    return self._glvMultiplyAndAdd(p1, n1, p2, n2, curve)
+                end
+            end
+            return self._fromJacobian(
+                self._shamirMultiply(
+                    self._toJacobian(p1), n1,
+                    self._toJacobian(p2), n2,
+                    order, coeff, prime,
+                ), prime,
+            )
+        end
+
+        def self._glvMultiplyAndAdd(p1, n1, p2, n2, curve)
+            # Compute n1*p1 + n2*p2 using the GLV endomorphism. Splits each 256-bit
+            # scalar into two ~128-bit scalars via k == k1 + k2*lambda (mod N), then
+            # runs a 4-scalar simultaneous double-and-add over (p1, phi(p1), p2,
+            # phi(p2)) with a 16-entry precomputed table of subset sums. Halves the
+            # loop length versus the plain Shamir path.
+            glv = curve.glvParams
+            order, coeff, prime = curve.n, curve.a, curve.p
+            beta = glv[:beta]
+
+            k1, k2 = self._glvDecompose(n1 % order, glv, order)
+            k3, k4 = self._glvDecompose(n2 % order, glv, order)
+
+            # Base points (affine, z=1) - phi((x,y)) = (beta*x mod P, y).
+            bases = [
+                Point.new(p1.x, p1.y, 1),
+                Point.new((beta * p1.x) % prime, p1.y, 1),
+                Point.new(p2.x, p2.y, 1),
+                Point.new((beta * p2.x) % prime, p2.y, 1),
+            ]
+            scalars = [k1, k2, k3, k4]
+            (0...4).each do |i|
+                if scalars[i] < 0
+                    scalars[i] = -scalars[i]
+                    bases[i] = Point.new(bases[i].x, prime - bases[i].y, 1)
+                end
+            end
+
+            # Precompute table[idx] = sum of bases[i] selected by bits of idx.
+            table = Array.new(16, Point.new(0, 0, 1))
+            (1...16).each do |idx|
+                low = idx & -idx
+                i = low.bit_length - 1
+                table[idx] = self._jacobianAdd(table[idx ^ low], bases[i], coeff, prime)
+            end
+
+            maxLen = scalars.map(&:bit_length).max
+            r = Point.new(0, 0, 1)
+            s0, s1, s2, s3 = scalars
+            (maxLen - 1).downto(0) do |bit|
+                r = self._jacobianDouble(r, coeff, prime)
+                idx = ((s0 >> bit) & 1) | (((s1 >> bit) & 1) << 1) \
+                    | (((s2 >> bit) & 1) << 2) | (((s3 >> bit) & 1) << 3)
+                if idx != 0
+                    r = self._jacobianAdd(r, table[idx], coeff, prime)
+                end
+            end
+
+            return self._fromJacobian(r, prime)
+        end
+
+        def self._glvDecompose(k, glv, order)
+            # Decompose k into (k1, k2) with k == k1 + k2*lambda (mod N) and
+            # |k1|, |k2| ~ sqrt(N). Babai rounding against the precomputed basis
+            # {(a1, b1), (a2, b2)}; k1 and k2 may be negative.
+            a1, b1, a2, b2 = glv[:a1], glv[:b1], glv[:a2], glv[:b2]
+            halfN = order / 2
+            c1 = (b2 * k + halfN) / order
+            c2 = (-b1 * k + halfN) / order
+            k1 = k - c1 * a1 - c2 * a2
+            k2 = -c1 * b1 - c2 * b2
+            return k1, k2
+        end
 
-            # :param x: Divisor
+        def self.inv(x, n)
+            # Modular inverse via extended Euclidean algorithm.
+            # Roughly 2-3x faster than Fermat's little theorem for 256-bit operands.
+            #
+            # :param x: Divisor (must be coprime to n)
             # :param n: Mod for division
-            # :return: Value representing the division
-            if x == 0 then return 0 end
-            
-            lm = 1
-            hm = 0
-            low = x % n
-            high = n
-
-            while low > 1
-                r = high.div(low)
-                nm = hm - lm * r
-                nw = high - low * r
-                high = low
-                hm = lm
-                low = nw
-                lm = nm
-            end
-            return lm % n 
+            # :return: Value representing the modular inverse
+            if x % n == 0
+                raise ArgumentError, "0 has no modular inverse"
+            end
+
+            a = x % n
+            b = n
+            x0 = 1
+            x1 = 0
+            while b != 0
+                q = a / b
+                a, b = b, a - q * b
+                x0, x1 = x1, x0 - q * x1
+            end
+            return x0 % n
         end
 
         def self._toJacobian(p)
             # Convert point to Jacobian coordinates
-
+            #
             # :param p: First Point you want to add
             # :return: Point in Jacobian coordinates
             return Point.new(p.x, p.y, 1)
@@ -69,10 +270,14 @@ module EllipticCurve
 
         def self._fromJacobian(p, prime)
             # Convert point back from Jacobian coordinates
-
+            #
             # :param p: First Point you want to add
-            # :param P: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param prime: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
             # :return: Point in default coordinates
+            if p.y == 0
+                return Point.new(0, 0, 0)
+            end
+
             z = self.inv(p.z, prime)
             x = (p.x * z ** 2) % prime
             y = (p.y * z ** 3) % prime
@@ -82,41 +287,70 @@ module EllipticCurve
 
         def self._jacobianDouble(p, coeff, prime)
             # Double a point in elliptic curves
-
+            #
             # :param p: Point you want to double
-            # :param A: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
-            # :param P: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param coeff: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param prime: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
             # :return: Point that represents the sum of First and Second Point
-            if p.y == 0 then return Point.new(0, 0, 0) end
+            py = p.y
+            if py == 0
+                return Point.new(0, 0, 0)
+            end
 
-            ysq = (p.y ** 2) % prime
-            s = (4 * p.x * ysq) % prime
-            m = (3 * p.x ** 2 + coeff * p.z ** 4) % prime
-            nx = (m ** 2 - 2 * s) % prime
-            ny = (m * (s - nx) - 8 * ysq ** 2) % prime
-            nz = (2 * p.y * p.z) % prime
+            px, pz = p.x, p.z
+            ysq = (py * py) % prime
+            s = (4 * px * ysq) % prime
+            pz2 = (pz * pz) % prime
+            if coeff == 0
+                m = (3 * px * px) % prime
+            elsif coeff == prime - 3
+                m = (3 * (px - pz2) * (px + pz2)) % prime
+            else
+                m = (3 * px * px + coeff * pz2 * pz2) % prime
+            end
+            nx = (m * m - 2 * s) % prime
+            ny = (m * (s - nx) - 8 * ysq * ysq) % prime
+            nz = (2 * py * pz) % prime
 
             return Point.new(nx, ny, nz)
         end
 
         def self._jacobianAdd(p, q, coeff, prime)
             # Add two points in elliptic curves
-
+            #
             # :param p: First Point you want to add
             # :param q: Second Point you want to add
-            # :param A: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
-            # :param P: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param coeff: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param prime: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
             # :return: Point that represents the sum of First and Second Point
-            if p.y == 0 then return q end
-            if q.y == 0 then return p end
+            if p.y == 0
+                return q
+            end
+            if q.y == 0
+                return p
+            end
 
-            u1 = (p.x * q.z ** 2) % prime
-            u2 = (q.x * p.z ** 2) % prime
-            s1 = (p.y * q.z ** 3) % prime
-            s2 = (q.y * p.z ** 3) % prime
+            px, py, pz = p.x, p.y, p.z
+            qx, qy, qz = q.x, q.y, q.z
+
+            pz2 = (pz * pz) % prime
+            u2 = (qx * pz2) % prime
+            s2 = (qy * pz2 * pz) % prime
+
+            if qz == 1
+                # Mixed affine+Jacobian add: qz^2=qz^3=1 saves four multiplications.
+                u1 = px
+                s1 = py
+            else
+                qz2 = (qz * qz) % prime
+                u1 = (px * qz2) % prime
+                s1 = (py * qz2 * qz) % prime
+            end
 
             if u1 == u2
-                if s1 != s2 then return Point.new(0, 0, 1) end
+                if s1 != s2
+                    return Point.new(0, 0, 1)
+                end
                 return self._jacobianDouble(p, coeff, prime)
             end
 
@@ -125,43 +359,141 @@ module EllipticCurve
             h2 = (h * h) % prime
             h3 = (h * h2) % prime
             u1h2 = (u1 * h2) % prime
-            nx = (r ** 2 - h3 - 2 * u1h2) % prime
+            nx = (r * r - h3 - 2 * u1h2) % prime
             ny = (r * (u1h2 - nx) - s1 * h3) % prime
-            nz = (h * p.z * q.z) % prime
+            nz = qz == 1 ? (h * pz) % prime : (h * pz * qz) % prime
 
             return Point.new(nx, ny, nz)
         end
 
         def self._jacobianMultiply(p, n, order, coeff, prime)
-            # Multiply point and scalar in elliptic curves
-
-            # :param p: First Point to mutiply
-            # :param n: Scalar to mutiply
-            # :param N: Order of the elliptic curve
-            # :param P: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
-            # :param A: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
-            # :return: Point that represents the sum of First and Second Point
+            # Multiply point and scalar in elliptic curves using Montgomery ladder
+            # for constant-time execution.
+            #
+            # :param p: First Point to multiply
+            # :param n: Scalar to multiply
+            # :param order: Order of the elliptic curve
+            # :param coeff: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param prime: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :return: Point that represents the scalar multiplication
             if p.y == 0 or n == 0
                 return Point.new(0, 0, 1)
             end
 
-            if n == 1
-                return p
+            if n < 0 or n >= order
+                n = n % order
             end
 
-            if n < 0 or n >= order
-                return self._jacobianMultiply(p, n % order, order, coeff, prime)
+            if n == 0
+                return Point.new(0, 0, 1)
             end
 
-            if (n % 2) == 0
-                return self._jacobianDouble(
-                    self._jacobianMultiply(p, n.div(2), order, coeff, prime), coeff, prime
-                )
+            # Montgomery ladder: always performs one add and one double per bit
+            r0 = Point.new(0, 0, 1)
+            r1 = Point.new(p.x, p.y, p.z)
+
+            (n.bit_length - 1).downto(0) do |i|
+                if (n >> i) & 1 == 0
+                    r1 = self._jacobianAdd(r0, r1, coeff, prime)
+                    r0 = self._jacobianDouble(r0, coeff, prime)
+                else
+                    r0 = self._jacobianAdd(r0, r1, coeff, prime)
+                    r1 = self._jacobianDouble(r1, coeff, prime)
+                end
             end
 
-            return self._jacobianAdd(
-                self._jacobianDouble(self._jacobianMultiply(p, n.div(2), order, coeff, prime), coeff, prime), p, coeff, prime
-            )
+            return r0
+        end
+
+        def self._shamirMultiply(jp1, n1, jp2, n2, order, coeff, prime)
+            # Compute n1*p1 + n2*p2 using Shamir's trick with Joint Sparse Form
+            # (Solinas 2001). JSF picks signed digits in {-1, 0, 1} so at most ~l/2
+            # digit pairs are non-zero, versus ~3l/4 for the raw binary form. Not
+            # constant-time - use only with public scalars (e.g. verification).
+            #
+            # :param jp1: First point in Jacobian coordinates
+            # :param n1: First scalar
+            # :param jp2: Second point in Jacobian coordinates
+            # :param n2: Second scalar
+            # :param order: Order of the elliptic curve
+            # :param coeff: Coefficient of the first-order term of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :param prime: Prime number in the module of the equation Y^2 = X^3 + A*X + B (mod p)
+            # :return: Point n1*p1 + n2*p2 in Jacobian coordinates
+            if n1 < 0 or n1 >= order
+                n1 = n1 % order
+            end
+            if n2 < 0 or n2 >= order
+                n2 = n2 % order
+            end
+
+            if n1 == 0 and n2 == 0
+                return Point.new(0, 0, 1)
+            end
+
+            neg = lambda { |pt| Point.new(pt.x, pt.y == 0 ? 0 : prime - pt.y, pt.z) }
+
+            jp1p2 = self._jacobianAdd(jp1, jp2, coeff, prime)
+            jp1mp2 = self._jacobianAdd(jp1, neg.call(jp2), coeff, prime)
+            addTable = {
+                [1, 0]   => jp1,
+                [-1, 0]  => neg.call(jp1),
+                [0, 1]   => jp2,
+                [0, -1]  => neg.call(jp2),
+                [1, 1]   => jp1p2,
+                [-1, -1] => neg.call(jp1p2),
+                [1, -1]  => jp1mp2,
+                [-1, 1]  => neg.call(jp1mp2),
+            }
+
+            digits = self._jsfDigits(n1, n2)
+            r = Point.new(0, 0, 1)
+            digits.each do |u0, u1|
+                r = self._jacobianDouble(r, coeff, prime)
+                if u0 != 0 or u1 != 0
+                    r = self._jacobianAdd(r, addTable[[u0, u1]], coeff, prime)
+                end
+            end
+
+            return r
+        end
+
+        def self._jsfDigits(k0, k1)
+            # Joint Sparse Form of (k0, k1): list of signed-digit pairs (u0, u1) in
+            # {-1, 0, 1}, ordered MSB-first. At most one of any two consecutive pairs
+            # is non-zero, giving density ~1/2 instead of ~3/4 from raw binary.
+            digits = []
+            d0 = 0
+            d1 = 0
+            while k0 + d0 != 0 or k1 + d1 != 0
+                a0 = k0 + d0
+                a1 = k1 + d1
+                if (a0 & 1) != 0
+                    u0 = (a0 & 3) == 1 ? 1 : -1
+                    if [3, 5].include?(a0 & 7) and (a1 & 3) == 2
+                        u0 = -u0
+                    end
+                else
+                    u0 = 0
+                end
+                if (a1 & 1) != 0
+                    u1 = (a1 & 3) == 1 ? 1 : -1
+                    if [3, 5].include?(a1 & 7) and (a0 & 3) == 2
+                        u1 = -u1
+                    end
+                else
+                    u1 = 0
+                end
+                digits << [u0, u1]
+                if 2 * d0 == 1 + u0
+                    d0 = 1 - d0
+                end
+                if 2 * d1 == 1 + u1
+                    d1 = 1 - d1
+                end
+                k0 >>= 1
+                k1 >>= 1
+            end
+            digits.reverse
         end
     end
 end

data/lib/utils/binary.rb

@@ -24,8 +24,15 @@ module EllipticCurve
                 return [hexadecimal].pack("H*")
             end
 
-            def self.numberFromByteString(bytes)
-                return bytes.unpack("C*").reduce(0) { |number, byte| number * 256 + byte }
+            def self.numberFromByteString(bytes, bitLength=nil)
+                number = bytes.unpack("C*").reduce(0) { |n, byte| n * 256 + byte }
+                if !bitLength.nil?
+                    hashBitLen = bytes.bytesize * 8
+                    if hashBitLen > bitLength
+                        number >>= (hashBitLen - bitLength)
+                    end
+                end
+                return number
             end
 
             def self.base64FromByteString(byteString)

data/lib/utils/der.rb

@@ -140,7 +140,7 @@ module EllipticCurve
                     raise Exception.new("indefinite length encoding located in DER")
                 end
                 lengthBytes += 2 * lengthLength
-                length = Utils::Binary.intFromHex(hexadecimal[2, lengthBytes]) * 2
+                length = Utils::Binary.intFromHex(hexadecimal[2...lengthBytes]) * 2
                 return length, lengthBytes
             end
 

data/lib/utils/integer.rb

@@ -1,13 +1,14 @@
 require('securerandom')
+require('openssl')
 
 module EllipticCurve
     module Utils
         class RandomInteger
             # Return integer x in the range: min <= x <= max
-
+            #
             # Parameters (required):
             # :param min: minimum value of the integer
-            # :param max: maximum value of the integer 
+            # :param max: maximum value of the integer
             # :return: A random number between min and max
             def self.between(min, max)
                 if (max - min) < 0 then
@@ -18,6 +19,71 @@ module EllipticCurve
                 end
                 return min
             end
+
+            def self.rfc6979(hashBytes, secret, curve, hashfunc)
+                # Generate nonce values per hedged RFC 6979: deterministic k derivation
+                # with fresh random entropy mixed into K-init (RFC 6979 §3.6). Same message
+                # and key yield different signatures, while preserving RFC 6979's protection
+                # against RNG failures.
+                orderBitLen = curve.nBitLength
+                orderByteLen = (orderBitLen + 7) / 8
+
+                secretHex = Binary.hexFromInt(secret).rjust(orderByteLen * 2, "0")
+                secretBytes = Binary.byteStringFromHex(secretHex)
+
+                hashReduced = Binary.numberFromByteString(hashBytes, orderBitLen) % curve.n
+                hashHex = Binary.hexFromInt(hashReduced).rjust(orderByteLen * 2, "0")
+                hashOctets = Binary.byteStringFromHex(hashHex)
+
+                extraEntropyHex = Binary.hexFromInt(between(0, (1 << (orderByteLen * 8)) - 1)).rjust(orderByteLen * 2, "0")
+                extraEntropy = Binary.byteStringFromHex(extraEntropyHex)
+
+                hLen = hashfunc.call("").bytesize
+                digestName = _digestNameFromLength(hLen)
+                v = "\x01".b * hLen
+                k = "\x00".b * hLen
+
+                k = OpenSSL::HMAC.digest(digestName, k, v + "\x00".b + secretBytes + hashOctets + extraEntropy)
+                v = OpenSSL::HMAC.digest(digestName, k, v)
+                k = OpenSSL::HMAC.digest(digestName, k, v + "\x01".b + secretBytes + hashOctets + extraEntropy)
+                v = OpenSSL::HMAC.digest(digestName, k, v)
+
+                Enumerator.new do |yielder|
+                    loop do
+                        t = "".b
+                        while t.bytesize * 8 < orderBitLen
+                            v = OpenSSL::HMAC.digest(digestName, k, v)
+                            t += v
+                        end
+
+                        kCandidate = Binary.numberFromByteString(t, orderBitLen)
+
+                        if kCandidate >= 1 && kCandidate <= curve.n - 1
+                            yielder.yield kCandidate
+                        end
+
+                        k = OpenSSL::HMAC.digest(digestName, k, v + "\x00".b)
+                        v = OpenSSL::HMAC.digest(digestName, k, v)
+                    end
+                end
+            end
+
+            private
+
+            def self._digestNameFromLength(hLen)
+                case hLen
+                when 32
+                    "SHA256"
+                when 48
+                    "SHA384"
+                when 64
+                    "SHA512"
+                when 20
+                    "SHA1"
+                else
+                    "SHA256"
+                end
+            end
         end
     end
 end

metadata

@@ -1,11 +1,10 @@
 --- !ruby/object:Gem::Specification
 name: starkbank-ecdsa
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - starkbank
-autorequire: 
 bindir: bin
 cert_chain: []
 date: 2019-11-21 00:00:00.000000000 Z
@@ -38,8 +37,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 5.14.1
-description: 
-email: 
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -62,7 +59,6 @@ homepage: https://github.com/starkbank/ecdsa-ruby
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -77,8 +73,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 4.0.6
 specification_version: 4
 summary: fast openSSL-compatible implementation of the Elliptic Curve Digital Signature
   Algorithm (ECDSA)