@smartledger/bsv 8.3.0 → 8.3.1

package/test/notaryhash/batch_leaf.js

@@ -0,0 +1,140 @@
+'use strict'
+
+/* global describe, it */
+
+// BRC-220 batch mode: what is in a Merkle leaf.
+//
+// The spec writes `leaf = SHA256(0x00 ‖ d)` and never binds `d`. That is RFC 6962's own
+// generic notation for the construction, quoted to identify WHICH tree — domain
+// separation, the power-of-two split, no duplicated last leaf — not to define the leaf's
+// contents. `canonicalBytes` appears once in the whole document, in the proofHash
+// definition, and nowhere in the batch text.
+//
+// This library reads `d` as proofHash. The alternative reading, d = canonicalBytes, is
+// equally sound cryptographically and produces a DIFFERENT root — so the two do not
+// interoperate, and the failure is silent: the fold just does not reach the root.
+//
+// These tests pin the choice, and pin the divergence too. A comment saying "we use
+// proofHash" would not fail if someone changed it; this does.
+//
+// Reasoning and proposed spec text: docs/BRC220_BATCH_LEAF_AMENDMENT.md
+
+require('chai').should()
+var NotaryHash = require('../../lib/notaryhash')
+var Merkle = require('../../lib/notaryhash/merkle')
+var Hash = require('../../lib/crypto/hash')
+var NotaryScript = require('../../lib/notaryhash/script')
+
+// Four fixed proofHash values, standing in for a four-proof batch.
+var PROOF_HASHES = [
+  '00'.repeat(31) + '01',
+  '00'.repeat(31) + '02',
+  'ab'.repeat(32),
+  'ff'.repeat(32)
+].map(function (h) { return Buffer.from(h, 'hex') })
+
+function batchCertificate (index, leaves) {
+  return {
+    mode: NotaryScript.MODE.BATCH,
+    proofHash: leaves[index].toString('hex'),
+    merkle: {
+      root: Merkle.root(leaves).toString('hex'),
+      leafIndex: index,
+      leafCount: leaves.length,
+      path: Merkle.path(leaves, index).map(function (n) { return n.toString('hex') })
+    }
+  }
+}
+
+describe('BRC-220 batch leaf', function () {
+  describe('the leaf datum is proofHash', function () {
+    it('a leaf is SHA-256(0x00 || proofHash)', function () {
+      var proofHash = PROOF_HASHES[0]
+      Merkle.hashLeaf(proofHash).toString('hex').should.equal(
+        Hash.sha256(Buffer.concat([Buffer.from([0x00]), proofHash])).toString('hex')
+      )
+    })
+
+    // Stated the long way round, because this is the identity the spec leaves open.
+    it('is therefore SHA-256(0x00 || SHA-256(canonicalBytes))', function () {
+      var canonicalBytes = Buffer.from('any canonical proof bytes at all')
+      var proofHash = Hash.sha256(canonicalBytes)
+      Merkle.hashLeaf(proofHash).toString('hex').should.equal(
+        Hash.sha256(Buffer.concat([
+          Buffer.from([0x00]), Hash.sha256(canonicalBytes)
+        ])).toString('hex')
+      )
+    })
+
+    it('verifies inclusion for every leaf of a four-proof batch', function () {
+      for (var i = 0; i < PROOF_HASHES.length; i++) {
+        var report = NotaryHash.verifyBatchInclusion(batchCertificate(i, PROOF_HASHES))
+        report.valid.should.equal(true, 'leaf ' + i + ' should verify')
+        report.errors.should.deep.equal([])
+      }
+    })
+  })
+
+  describe('the two readings of `d` are not interchangeable', function () {
+    var canonicalBytesSet = [
+      Buffer.from('proof one canonical bytes'),
+      Buffer.from('proof two canonical bytes'),
+      Buffer.from('proof three canonical bytes'),
+      Buffer.from('proof four canonical bytes')
+    ]
+    var proofHashes = canonicalBytesSet.map(function (b) { return Hash.sha256(b) })
+
+    it('produces a different root under each reading', function () {
+      Merkle.root(proofHashes).toString('hex')
+        .should.not.equal(Merkle.root(canonicalBytesSet).toString('hex'))
+    })
+
+    // The interoperability failure, made concrete. This is what a batch built by an
+    // implementation using the other reading would look like to this verifier.
+    it('REJECTS a certificate whose tree was built over canonicalBytes', function () {
+      var certificate = {
+        mode: NotaryScript.MODE.BATCH,
+        proofHash: proofHashes[1].toString('hex'),
+        merkle: {
+          // Root and path from the canonicalBytes tree — the other reading.
+          root: Merkle.root(canonicalBytesSet).toString('hex'),
+          leafIndex: 1,
+          leafCount: 4,
+          path: Merkle.path(canonicalBytesSet, 1).map(function (n) { return n.toString('hex') })
+        }
+      }
+      var report = NotaryHash.verifyBatchInclusion(certificate)
+      report.valid.should.equal(false)
+      report.errors.should.deep.equal(['merkle inclusion proof does not fold to the batch root'])
+    })
+
+    // Both are sound; neither is being called wrong. The point is only that a choice had
+    // to be made and that it is checkable.
+    it('both readings are domain-separated and second-preimage resistant', function () {
+      var leafBytes = Buffer.alloc(64, 7)
+      Merkle.hashLeaf(leafBytes).toString('hex')
+        .should.not.equal(Merkle.hashNode(Buffer.alloc(32, 7), Buffer.alloc(32, 7)).toString('hex'))
+    })
+  })
+
+  describe('the verdict is a strict report, not a truthy object', function () {
+    it('reports valid:false rather than throwing on a malformed merkle object', function () {
+      var report = NotaryHash.verifyBatchInclusion({
+        mode: NotaryScript.MODE.BATCH,
+        proofHash: PROOF_HASHES[0].toString('hex'),
+        merkle: { root: 'not-hex', leafIndex: 0, leafCount: 1, path: [] }
+      })
+      report.valid.should.equal(false)
+      report.errors.length.should.be.above(0)
+    })
+
+    it('rejects a non-batch certificate by mode', function () {
+      var report = NotaryHash.verifyBatchInclusion({
+        mode: NotaryScript.MODE.FULL,
+        proofHash: PROOF_HASHES[0].toString('hex')
+      })
+      report.valid.should.equal(false)
+      report.errors.should.deep.equal(['certificate is not in batch mode'])
+    })
+  })
+})

package/test/notaryhash/interop.js

@@ -0,0 +1,112 @@
+'use strict'
+
+/* global describe, it */
+
+// BRC-220 signature interoperability.
+//
+// Every other test in this directory signs with `lib/crypto/ecdsa.js` and verifies
+// through `lib/notaryhash/suites.js`, which also uses `lib/crypto/ecdsa.js`. That
+// proves the module agrees with itself. It cannot prove the module agrees with the
+// spec, and in 8.3.0 it did not: the suite set `endian: 'little'` before verifying,
+// so it rejected any signature produced the way BRC-220 describes and accepted only
+// signatures made with bsv's own byte-reversed convention. Twenty-odd passing tests
+// said nothing about it, because they all signed the same wrong way.
+//
+// So this file verifies against `@noble/curves` instead — a separate implementation
+// that shares no verification code with ours. It is the only test here that can fail
+// when our code and our tests are wrong together.
+//
+// One trap worth naming, because it cost real time when this was diagnosed: noble v2
+// PREHASHES by default. `secp256k1.sign(digest, key)` signs `sha256(digest)`, and
+// `secp256k1.verify` prehashes to match, so noble looks self-consistent while
+// disagreeing with everyone. BRC-220 signs the payloadHash itself, so every call
+// below passes `{ prehash: false }`. Omit it and these tests compare the wrong things
+// and "pass" for the wrong reason.
+
+require('chai').should()
+var bsv = require('../..')
+var Suites = require('../../lib/notaryhash/suites')
+var Hash = require('../../lib/crypto/hash')
+var { secp256k1 } = require('@noble/curves/secp256k1.js')
+
+var PAYLOAD_HASH = Hash.sha256(Buffer.from('the document nobody sees'))
+
+// A fixed key, so a failure is reproducible rather than one-in-N flaky.
+var SECRET = Buffer.from('c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee01', 'hex')
+var PUBLIC_KEY = Buffer.from(secp256k1.getPublicKey(SECRET, true))
+
+function rawSig (sig) {
+  return Buffer.concat([
+    sig.r.toArrayLike(Buffer, 'be', 32),
+    sig.s.toArrayLike(Buffer, 'be', 32)
+  ])
+}
+
+describe('BRC-220 signature interop', function () {
+  it('agrees with @noble/curves on the public key for a given secret', function () {
+    // If this fails nothing below means anything — the two libraries would be
+    // signing under different keys.
+    var ours = bsv.PrivateKey.fromBuffer(SECRET).toPublicKey().toBuffer()
+    ours.toString('hex').should.equal(PUBLIC_KEY.toString('hex'))
+  })
+
+  it('ACCEPTS a signature made the way the spec describes', function () {
+    // This is the regression. Under 8.3.0 this assertion fails.
+    var conformant = Buffer.from(secp256k1.sign(PAYLOAD_HASH, SECRET, { prehash: false }))
+    Suites.verify('ECDSA-secp256k1', PAYLOAD_HASH, conformant, PUBLIC_KEY)
+      .should.equal(true, 'a conformant BRC-220 signature must verify')
+  })
+
+  it('emits signatures an independent implementation accepts', function () {
+    var key = bsv.PrivateKey.fromBuffer(SECRET)
+    var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: PAYLOAD_HASH, privkey: key })
+    ecdsa.sign()
+    secp256k1.verify(rawSig(ecdsa.sig), PAYLOAD_HASH, PUBLIC_KEY, { prehash: false })
+      .should.equal(true, 'our signature must verify under @noble/curves')
+  })
+
+  it('REJECTS a signature over the byte-reversed digest', function () {
+    // The 8.3.0 convention. It must now fail: accepting both would mean two valid
+    // signatures exist for one signing act, and both are inside proofHash.
+    var key = bsv.PrivateKey.fromBuffer(SECRET)
+    var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: PAYLOAD_HASH, endian: 'little', privkey: key })
+    ecdsa.sign()
+    Suites.verify('ECDSA-secp256k1', PAYLOAD_HASH, rawSig(ecdsa.sig), PUBLIC_KEY)
+      .should.equal(false, 'the pre-8.3.1 little-endian convention must not verify')
+  })
+
+  it('round-trips both ways over many payloads, not just one', function () {
+    // A single vector can pass by coincidence — the reversal of a digest whose bytes
+    // happen to be near-palindromic still differs, but a lucky scalar could mask a
+    // subtler bug. Twenty payloads with distinct digests makes that implausible.
+    var key = bsv.PrivateKey.fromBuffer(SECRET)
+    for (var i = 0; i < 20; i++) {
+      var h = Hash.sha256(Buffer.from('payload ' + i))
+
+      var theirs = Buffer.from(secp256k1.sign(h, SECRET, { prehash: false }))
+      Suites.verify('ECDSA-secp256k1', h, theirs, PUBLIC_KEY)
+        .should.equal(true, 'noble sig ' + i + ' rejected by our suite')
+
+      var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: h, privkey: key })
+      ecdsa.sign()
+      secp256k1.verify(rawSig(ecdsa.sig), h, PUBLIC_KEY, { prehash: false })
+        .should.equal(true, 'our sig ' + i + ' rejected by noble')
+    }
+  })
+
+  it('still rejects a signature over a DIFFERENT payload', function () {
+    // Guards against the fix degenerating into "accept anything". A verifier that
+    // returns true unconditionally would pass every test above.
+    var other = Hash.sha256(Buffer.from('a different document'))
+    var sig = Buffer.from(secp256k1.sign(other, SECRET, { prehash: false }))
+    Suites.verify('ECDSA-secp256k1', PAYLOAD_HASH, sig, PUBLIC_KEY)
+      .should.equal(false)
+  })
+
+  it('still rejects a signature from a DIFFERENT key', function () {
+    var otherSecret = Buffer.from('a11ce00a11ce00a11ce00a11ce00a11ce00a11ce00a11ce00a11ce00a11ce001', 'hex')
+    var sig = Buffer.from(secp256k1.sign(PAYLOAD_HASH, otherSecret, { prehash: false }))
+    Suites.verify('ECDSA-secp256k1', PAYLOAD_HASH, sig, PUBLIC_KEY)
+      .should.equal(false)
+  })
+})

package/test/notaryhash/verify.js

@@ -41,8 +41,11 @@ describe('BRC-220 verification', function () {
     publicKey = key.toPublicKey().toBuffer()
     payloadHash = Hash.sha256(Buffer.from('the document nobody sees'))
 
-    // The signer signs the 32-byte payloadHash DIRECTLY — spec §Algorithms.
-    var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: payloadHash, endian: 'little', privkey: key })
+    // The signer signs the 32-byte payloadHash DIRECTLY — spec §Algorithms. No endian
+    // option: the digest IS the scalar, big-endian. Until 8.3.1 this line passed
+    // `endian: 'little'` while the comment above it said "directly", and the suite
+    // reversed to match, so the two agreed with each other and with nothing else.
+    var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: payloadHash, privkey: key })
     ecdsa.sign()
     signature = rawSig(ecdsa.sig)
 

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '8.3.0'
+module.exports = '8.3.1'