@smartledger/bsv 7.0.2 → 7.1.0

package/test/crypto/ecdsa.js

@@ -117,6 +117,79 @@ describe('ECDSA', function () {
     })
   })
 
+  describe('nonce reuse', function () {
+    // Signing two different messages under one nonce reveals the private key.
+    var N = point.getN()
+    var h1 = Hash.sha256(Buffer.from('pay alice 1 coin'))
+    var h2 = Hash.sha256(Buffer.from('pay bob 2 coins'))
+
+    var freshSigner = function () {
+      return ECDSA().set({
+        privkey: new Privkey(BN.fromBuffer(Buffer.from(
+          'fee0a1f7afebf9d2a5a80c0c98a31c709681cce195cbcd06342b517970c0be1e', 'hex')))
+      })
+    }
+
+    it('does not reuse k when one instance signs two different messages', function () {
+      var e = freshSigner()
+      var sig1 = e.set({ hashbuf: h1 }).sign().sig
+      var k1 = e.k
+      var sig2 = e.set({ hashbuf: h2 }).sign().sig
+      var k2 = e.k;
+      (k1.cmp(k2) === 0).should.equal(false)
+      sig1.r.eq(sig2.r).should.equal(false)
+    })
+
+    it('does not reuse k across signRandomK calls on one instance', function () {
+      var e = freshSigner()
+      var sig1 = e.set({ hashbuf: h1 }).signRandomK().sig
+      var sig2 = e.set({ hashbuf: h2 }).sign().sig
+      sig1.r.eq(sig2.r).should.equal(false)
+    })
+
+    it('does not leak the private key from two signatures by one instance', function () {
+      var e = freshSigner()
+      var d = e.privkey.bn
+      var sig1 = e.set({ hashbuf: h1 }).sign().sig
+      var sig2 = e.set({ hashbuf: h2 }).sign().sig
+
+      // toLowS may have flipped either s, so try every sign combination.
+      var red = BN.red(N)
+      var inv = function (x) { return x.toRed(red).redInvm().fromRed() }
+      var mul = function (a, b) { return a.toRed(red).redMul(b.toRed(red)).fromRed() }
+      var e1 = BN.fromBuffer(h1)
+      var e2 = BN.fromBuffer(h2)
+      var recovered = false
+      ;[1, -1].forEach(function (f1) {
+        ;[1, -1].forEach(function (f2) {
+          var S1 = f1 === 1 ? sig1.s : N.sub(sig1.s)
+          var S2 = f2 === 1 ? sig2.s : N.sub(sig2.s)
+          var diff = S1.sub(S2).umod(N)
+          if (diff.isZero()) return
+          var k = mul(e1.sub(e2).umod(N), inv(diff))
+          var guess = mul(S1.mul(k).umod(N).sub(e1).umod(N), inv(sig1.r))
+          if (guess.toString(16) === d.toString(16)) recovered = true
+        })
+      })
+      recovered.should.equal(false)
+    })
+
+    it('still honours an explicitly supplied k for a single signature', function () {
+      var k = new BN('114860389168127852803919605627759231199925249596762615988727970217268189974335', 10)
+      var a = freshSigner().set({ hashbuf: h1, k: k })
+      var b = freshSigner().set({ hashbuf: h1, k: k })
+      a.sign().sig.r.eq(b.sign().sig.r).should.equal(true)
+      a.k.eq(k).should.equal(true)
+    })
+
+    it('signs the same message deterministically across instances', function () {
+      var a = freshSigner().set({ hashbuf: h1 }).sign().sig
+      var b = freshSigner().set({ hashbuf: h1 }).sign().sig
+      a.r.eq(b.r).should.equal(true)
+      a.s.eq(b.s).should.equal(true)
+    })
+  })
+
   describe('#toPublicKey', function () {
     it('should calculate the correct public key', function () {
       ecdsa.k = new BN('114860389168127852803919605627759231199925249596762615988727970217268189974335', 10)

package/test/crypto/security.js

@@ -69,6 +69,52 @@ describe('SmartLedger Security Patches', function () {
       // change which key/message the signature is valid for.
       canonical.r.cmp(highS.r).should.equal(0)
     })
+
+    it('toCanonical() returns a new signature and leaves the original alone', function () {
+      var sig = ECDSA.sign(hash, privateKey)
+      var n = Point.getN()
+      var lowS = sig.s.lte(n.shrn(1)) ? sig.s : n.sub(sig.s)
+      var highS = new Signature({ r: sig.r, s: n.sub(lowS) })
+      var before = highS.s.toString()
+
+      var canonical = highS.toCanonical()
+      canonical.should.not.equal(highS)
+      highS.s.toString().should.equal(before)
+    })
+  })
+
+  describe('applySecurityPatches', function () {
+    var highSig = function () {
+      var sig = ECDSA.sign(hash, privateKey)
+      var n = Point.getN()
+      var lowS = sig.s.lte(n.shrn(1)) ? sig.s : n.sub(sig.s)
+      return new Signature({ r: sig.r, s: n.sub(lowS) })
+    }
+
+    it('accepts a canonical signature and returns it for chaining', function () {
+      var sig = ECDSA.sign(hash, privateKey)
+      sig.applySecurityPatches().should.equal(sig)
+    })
+
+    it('rejects a non-canonical (high-S) signature rather than rewriting it', function () {
+      // Rewriting s to n-s cannot protect against malleability: the rewritten
+      // signature verifies exactly as the original, so silently normalizing only
+      // hides from the caller that the signature was malleated.
+      var highS = highSig()
+      var before = highS.s.toString()
+
+      expect(function () { highS.applySecurityPatches() }).to.throw(/non-canonical/)
+      highS.s.toString().should.equal(before)
+    })
+
+    it('rejects zero and out-of-range components', function () {
+      expect(function () {
+        new Signature({ r: new BN(0), s: new BN(1) }).applySecurityPatches()
+      }).to.throw(/zero r or s/)
+      expect(function () {
+        new Signature({ r: new BN(1), s: Point.getN() }).applySecurityPatches()
+      }).to.throw(/out of range/)
+    })
   })
 
   describe('SmartVerify Enhanced Validation', function () {
@@ -77,12 +123,15 @@ describe('SmartLedger Security Patches', function () {
       SmartVerify.smartVerify(hash, sig, publicKey).should.equal(true)
     })
 
-    it('accepts a malleated (high-S) signature as valid but canonicalizes it', function () {
+    it('rejects a malleated (high-S) signature', function () {
       var sig = ECDSA.sign(hash, privateKey)
       var n = Point.getN()
       var lowS = sig.s.lte(n.shrn(1)) ? sig.s : n.sub(sig.s)
       var highS = new Signature({ r: sig.r, s: n.sub(lowS) })
-      SmartVerify.smartVerify(hash, highS, publicKey).should.equal(true)
+      SmartVerify.isCanonical(highS).should.equal(false)
+      SmartVerify.smartVerify(hash, highS, publicKey).should.equal(false)
+      // ...while the canonical form of the same signature still verifies.
+      SmartVerify.smartVerify(hash, new Signature({ r: sig.r, s: lowS }), publicKey).should.equal(true)
     })
 
     it('throws on an invalid (non-32-byte) message hash', function () {

package/test/crypto/signature.js

@@ -2,9 +2,13 @@
 
 var _ = require('../../lib/util/_')
 var should = require('chai').should()
+var expect = require('chai').expect
 var bsv = require('../..')
 var BN = bsv.crypto.BN
 var Signature = bsv.crypto.Signature
+var ECDSA = bsv.crypto.ECDSA
+var Hash = bsv.crypto.Hash
+var PrivateKey = bsv.PrivateKey
 var JSUtil = bsv.util.js
 var Interpreter = bsv.Script.Interpreter
 
@@ -189,6 +193,83 @@ describe('Signature', function () {
       var parsed = Signature.parseDER(sig, false)
       should.exist(parsed)
     })
+
+    it('reports sneg for a padded s', function () {
+      // 02 21 00ab.. — s carries the pad that clears its high bit.
+      var sighex = '304502203e4516da7253cf068effec6b95c41221c0cf3a8e6ccb8cbf1725b562e9afde2c' +
+        '022100ab1e3da73d67e32045a20e0b999e049978ea8d6ee5480d485fcf2ce0d03b2ef0'
+      var parsed = Signature.parseDER(Buffer.from(sighex, 'hex'))
+      parsed.sbuf[0].should.equal(0x00)
+      parsed.sneg.should.equal(true)
+      parsed.rneg.should.equal(false)
+    })
+  })
+
+  describe('#parseDER canonicality', function () {
+    // A non-canonical INTEGER is a second encoding of the same number, i.e. a
+    // malleable signature. Strict (the default, used by fromDER/fromString and
+    // so by credential/proof verification) rejects them; non-strict must keep
+    // accepting them, because signatures already on chain are not canonical and
+    // fromTxFormat has to parse them.
+    var cases = [
+      { name: 'r negative (high bit set, unpadded)', hex: '3006' + '0201ff' + '020101', err: /Value of r is negative/ },
+      { name: 's negative (high bit set, unpadded)', hex: '3006' + '020101' + '0201ff', err: /Value of s is negative/ },
+      { name: 'r excessively padded', hex: '3007' + '02020011' + '020101', err: /Value of r is excessively padded/ },
+      { name: 's excessively padded', hex: '3007' + '020101' + '02020011', err: /Value of s is excessively padded/ },
+      { name: 'r zero-length', hex: '3005' + '0200' + '020101', err: /Length of r is zero/ },
+      { name: 's zero-length', hex: '3005' + '020101' + '0200', err: /Length of s is zero/ }
+    ]
+
+    cases.forEach(function (c) {
+      it('strict rejects ' + c.name, function () {
+        expect(function () {
+          Signature.parseDER(Buffer.from(c.hex, 'hex'))
+        }).to.throw(c.err)
+      })
+
+      it('non-strict still accepts ' + c.name + ' (chain compatibility)', function () {
+        should.exist(Signature.parseDER(Buffer.from(c.hex, 'hex'), false))
+      })
+    })
+
+    it('strict accepts a minimally padded integer', function () {
+      // 0x00ff is canonical: the pad is required to clear the high bit.
+      should.exist(Signature.parseDER(Buffer.from('3008020200ff020200ff', 'hex')))
+    })
+
+    it('strict accepts a canonical zero integer', function () {
+      should.exist(Signature.parseDER(Buffer.from('3006020100020100', 'hex')))
+    })
+
+    it('rejects a malleated re-encoding while the original still verifies', function () {
+      var privkey = new PrivateKey()
+      var hashbuf = Hash.sha256(Buffer.from('der canonicality'))
+      var sig = ECDSA.sign(hashbuf, privkey)
+      var der = sig.toDER()
+
+      ECDSA.verify(hashbuf, Signature.fromDER(der), privkey.toPublicKey()).should.equal(true)
+
+      // Re-encode r with one pad byte more than DER allows: same r, different
+      // bytes. The extra zero goes on top of the canonical encoding, so this is
+      // excess padding whether or not r needed a pad to begin with.
+      var canonical = function (nbuf) {
+        return (nbuf[0] & 0x80) ? Buffer.concat([Buffer.from([0x00]), nbuf]) : nbuf
+      }
+      var padded = Buffer.concat([Buffer.from([0x00]), canonical(sig.r.toBuffer())])
+      var sEnc = canonical(sig.s.toBuffer())
+      var body = Buffer.concat([
+        Buffer.from([0x02, padded.length]), padded,
+        Buffer.from([0x02, sEnc.length]), sEnc
+      ])
+      var malleated = Buffer.concat([Buffer.from([0x30, body.length]), body])
+
+      malleated.toString('hex').should.not.equal(der.toString('hex'))
+      expect(function () {
+        Signature.fromDER(malleated)
+      }).to.throw(/excessively padded/)
+      // The same bytes remain parseable on the non-strict (chain) path.
+      Signature.parseDER(malleated, false).r.eq(sig.r).should.equal(true)
+    })
   })
 
   describe('#toDER', function () {

package/test/ltp/ids.js

@@ -0,0 +1,74 @@
+'use strict'
+
+/* global describe, it */
+
+require('chai').should()
+var expect = require('chai').expect
+
+var bsv = require('../../index.js')
+
+var UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+
+// A token id is covered by the credential's signature, keys the registry's
+// registration/revocation maps, and feeds proof material — so it must be
+// unpredictable, not merely distinct.
+describe('LTP identifiers', function () {
+  var generators = [
+    { name: 'Right._generateUUID', fn: function () { return bsv.LTP.Right._generateUUID() }, format: UUID_V4 },
+    { name: 'Obligation._generateUUID', fn: function () { return bsv.LTP.Obligation._generateUUID() }, format: UUID_V4 },
+    { name: 'Registry._generateRegistryId', fn: function () { return bsv.LTP.Registry._generateRegistryId() }, format: /^reg_[0-9a-f]{16}$/ },
+    { name: 'Registry._generateAuditId', fn: function () { return bsv.LTP.Registry._generateAuditId() }, format: /^audit_[0-9a-f]{32}$/ },
+    { name: 'Claim._generateBatchId', fn: function () { return bsv.LTP.Claim._generateBatchId() }, format: /^[0-9a-f]{16}$/ }
+  ]
+
+  var withFrozenMathRandom = function (fn) {
+    var original = Math.random
+    Math.random = function () { return 0.5 }
+    try { return fn() } finally { Math.random = original }
+  }
+
+  generators.forEach(function (g) {
+    describe(g.name, function () {
+      it('keeps its documented format', function () {
+        g.fn().should.match(g.format)
+      })
+
+      it('does not repeat', function () {
+        var seen = {}
+        for (var i = 0; i < 500; i++) {
+          var id = g.fn()
+          expect(seen[id], 'duplicate id: ' + id).to.equal(undefined)
+          seen[id] = true
+        }
+      })
+
+      it('does not draw from the engine PRNG', function () {
+        withFrozenMathRandom(function () {
+          var seen = {}
+          for (var i = 0; i < 100; i++) {
+            var id = g.fn()
+            expect(seen[id], 'id is predictable from the engine PRNG: ' + id).to.equal(undefined)
+            seen[id] = true
+          }
+        })
+      })
+    })
+  })
+
+  it('issues unpredictable ids on real tokens', function () {
+    var type = Object.values(bsv.LTP.Right.RightTypes)[0]
+    var ids = {}
+    for (var i = 0; i < 25; i++) {
+      var token = bsv.LTP.Right.create(
+        type,
+        'did:example:issuer',
+        'did:example:subject',
+        { description: 'test right' }
+      )
+      token.id.should.match(/^urn:uuid:/)
+      token.id.replace('urn:uuid:', '').should.match(UUID_V4)
+      expect(ids[token.id], 'duplicate token id').to.equal(undefined)
+      ids[token.id] = true
+    }
+  })
+})

package/test/script/script.js

@@ -1237,8 +1237,10 @@ describe('Script', function () {
       Script(s2).getSignatureOperationsCount(false).should.equal(20)
     })
     it('should handle P2SH-multisig-in scripts from utility', function () {
-      // create a well-formed signature, does not need to match pubkeys
-      var signature = bsv.crypto.Signature.fromString('30060201FF0201FF')
+      // create a well-formed signature, does not need to match pubkeys.
+      // r and s are 0x00ff: the pad is required, as a bare 0xff would have its
+      // high bit set and so would not be a canonical DER integer.
+      var signature = bsv.crypto.Signature.fromString('3008020200FF020200FF')
       var signatures = [ signature.toBuffer() ]
       var p2sh = Script.buildP2SHMultisigIn(pubKeyHexes, 1, signatures, {})
       p2sh.getSignatureOperationsCount(true).should.equal(0)

package/test/util/id.js

@@ -0,0 +1,72 @@
+'use strict'
+
+/* global describe, it */
+
+require('chai').should()
+var expect = require('chai').expect
+
+var Id = require('../../lib/util/id')
+
+var UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+
+describe('util/id', function () {
+  describe('#uuid4', function () {
+    it('produces a well-formed RFC 4122 v4 uuid', function () {
+      Id.uuid4().should.match(UUID_V4)
+    })
+
+    it('sets the version and variant bits on every draw', function () {
+      for (var i = 0; i < 200; i++) {
+        Id.uuid4().should.match(UUID_V4)
+      }
+    })
+
+    it('does not repeat', function () {
+      var seen = {}
+      for (var i = 0; i < 2000; i++) {
+        var id = Id.uuid4()
+        expect(seen[id], 'duplicate uuid: ' + id).to.equal(undefined)
+        seen[id] = true
+      }
+    })
+  })
+
+  describe('#randomHex', function () {
+    it('returns the requested number of hex characters', function () {
+      Id.randomHex(16).should.match(/^[0-9a-f]{16}$/)
+      Id.randomHex(12).should.match(/^[0-9a-f]{12}$/)
+      Id.randomHex(1).should.match(/^[0-9a-f]$/)
+    })
+
+    it('does not repeat', function () {
+      var seen = {}
+      for (var i = 0; i < 2000; i++) {
+        var id = Id.randomHex(16)
+        expect(seen[id], 'duplicate id: ' + id).to.equal(undefined)
+        seen[id] = true
+      }
+    })
+  })
+
+  describe('entropy source', function () {
+    // Identifiers must come from the CSPRNG. Freezing the engine PRNG must not
+    // affect them; if it does, they are predictable from observed output.
+    var withFrozenMathRandom = function (fn) {
+      var original = Math.random
+      Math.random = function () { return 0.5 }
+      try { return fn() } finally { Math.random = original }
+    }
+
+    it('uuid4 is unaffected by the engine PRNG', function () {
+      withFrozenMathRandom(function () {
+        Id.uuid4().should.not.equal(Id.uuid4())
+      })
+    })
+
+    it('randomHex is unaffected by the engine PRNG', function () {
+      withFrozenMathRandom(function () {
+        Id.randomHex(16).should.not.equal(Id.randomHex(16))
+      })
+    })
+  })
+})

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '7.0.2'
+module.exports = '7.1.0'