1 /***********************************************************************
2 * Copyright (c) 2020 Jonas Nick *
3 * Distributed under the MIT software license, see the accompanying *
4 * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
5 ***********************************************************************/
6
7 #ifndef SECP256K1_MODULE_EXTRAKEYS_MAIN_H
8 #define SECP256K1_MODULE_EXTRAKEYS_MAIN_H
9
10 #include "include/secp256k1.h"
11 #include "include/secp256k1_extrakeys.h"
12
secp256k1_xonly_pubkey_load(const secp256k1_context * ctx,secp256k1_ge * ge,const secp256k1_xonly_pubkey * pubkey)13 static SECP256K1_INLINE int secp256k1_xonly_pubkey_load(const secp256k1_context* ctx, secp256k1_ge *ge, const secp256k1_xonly_pubkey *pubkey) {
14 return secp256k1_pubkey_load(ctx, ge, (const secp256k1_pubkey *) pubkey);
15 }
16
secp256k1_xonly_pubkey_save(secp256k1_xonly_pubkey * pubkey,secp256k1_ge * ge)17 static SECP256K1_INLINE void secp256k1_xonly_pubkey_save(secp256k1_xonly_pubkey *pubkey, secp256k1_ge *ge) {
18 secp256k1_pubkey_save((secp256k1_pubkey *) pubkey, ge);
19 }
20
secp256k1_xonly_pubkey_parse(const secp256k1_context * ctx,secp256k1_xonly_pubkey * pubkey,const unsigned char * input32)21 int secp256k1_xonly_pubkey_parse(const secp256k1_context* ctx, secp256k1_xonly_pubkey *pubkey, const unsigned char *input32) {
22 secp256k1_ge pk;
23 secp256k1_fe x;
24
25 VERIFY_CHECK(ctx != NULL);
26 ARG_CHECK(pubkey != NULL);
27 memset(pubkey, 0, sizeof(*pubkey));
28 ARG_CHECK(input32 != NULL);
29
30 if (!secp256k1_fe_set_b32(&x, input32)) {
31 return 0;
32 }
33 if (!secp256k1_ge_set_xo_var(&pk, &x, 0)) {
34 return 0;
35 }
36 if (!secp256k1_ge_is_in_correct_subgroup(&pk)) {
37 return 0;
38 }
39 secp256k1_xonly_pubkey_save(pubkey, &pk);
40 return 1;
41 }
42
secp256k1_xonly_pubkey_serialize(const secp256k1_context * ctx,unsigned char * output32,const secp256k1_xonly_pubkey * pubkey)43 int secp256k1_xonly_pubkey_serialize(const secp256k1_context* ctx, unsigned char *output32, const secp256k1_xonly_pubkey *pubkey) {
44 secp256k1_ge pk;
45
46 VERIFY_CHECK(ctx != NULL);
47 ARG_CHECK(output32 != NULL);
48 memset(output32, 0, 32);
49 ARG_CHECK(pubkey != NULL);
50
51 if (!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) {
52 return 0;
53 }
54 secp256k1_fe_get_b32(output32, &pk.x);
55 return 1;
56 }
57
58 /** Keeps a group element as is if it has an even Y and otherwise negates it.
59 * y_parity is set to 0 in the former case and to 1 in the latter case.
60 * Requires that the coordinates of r are normalized. */
secp256k1_extrakeys_ge_even_y(secp256k1_ge * r)61 static int secp256k1_extrakeys_ge_even_y(secp256k1_ge *r) {
62 int y_parity = 0;
63 VERIFY_CHECK(!secp256k1_ge_is_infinity(r));
64
65 if (secp256k1_fe_is_odd(&r->y)) {
66 secp256k1_fe_negate(&r->y, &r->y, 1);
67 y_parity = 1;
68 }
69 return y_parity;
70 }
71
secp256k1_xonly_pubkey_from_pubkey(const secp256k1_context * ctx,secp256k1_xonly_pubkey * xonly_pubkey,int * pk_parity,const secp256k1_pubkey * pubkey)72 int secp256k1_xonly_pubkey_from_pubkey(const secp256k1_context* ctx, secp256k1_xonly_pubkey *xonly_pubkey, int *pk_parity, const secp256k1_pubkey *pubkey) {
73 secp256k1_ge pk;
74 int tmp;
75
76 VERIFY_CHECK(ctx != NULL);
77 ARG_CHECK(xonly_pubkey != NULL);
78 ARG_CHECK(pubkey != NULL);
79
80 if (!secp256k1_pubkey_load(ctx, &pk, pubkey)) {
81 return 0;
82 }
83 tmp = secp256k1_extrakeys_ge_even_y(&pk);
84 if (pk_parity != NULL) {
85 *pk_parity = tmp;
86 }
87 secp256k1_xonly_pubkey_save(xonly_pubkey, &pk);
88 return 1;
89 }
90
secp256k1_xonly_pubkey_tweak_add(const secp256k1_context * ctx,secp256k1_pubkey * output_pubkey,const secp256k1_xonly_pubkey * internal_pubkey,const unsigned char * tweak32)91 int secp256k1_xonly_pubkey_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *output_pubkey, const secp256k1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
92 secp256k1_ge pk;
93
94 VERIFY_CHECK(ctx != NULL);
95 ARG_CHECK(output_pubkey != NULL);
96 memset(output_pubkey, 0, sizeof(*output_pubkey));
97 ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
98 ARG_CHECK(internal_pubkey != NULL);
99 ARG_CHECK(tweak32 != NULL);
100
101 if (!secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
102 || !secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &pk, tweak32)) {
103 return 0;
104 }
105 secp256k1_pubkey_save(output_pubkey, &pk);
106 return 1;
107 }
108
secp256k1_xonly_pubkey_tweak_add_check(const secp256k1_context * ctx,const unsigned char * tweaked_pubkey32,int tweaked_pk_parity,const secp256k1_xonly_pubkey * internal_pubkey,const unsigned char * tweak32)109 int secp256k1_xonly_pubkey_tweak_add_check(const secp256k1_context* ctx, const unsigned char *tweaked_pubkey32, int tweaked_pk_parity, const secp256k1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
110 secp256k1_ge pk;
111 unsigned char pk_expected32[32];
112
113 VERIFY_CHECK(ctx != NULL);
114 ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
115 ARG_CHECK(internal_pubkey != NULL);
116 ARG_CHECK(tweaked_pubkey32 != NULL);
117 ARG_CHECK(tweak32 != NULL);
118
119 if (!secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
120 || !secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &pk, tweak32)) {
121 return 0;
122 }
123 secp256k1_fe_normalize_var(&pk.x);
124 secp256k1_fe_normalize_var(&pk.y);
125 secp256k1_fe_get_b32(pk_expected32, &pk.x);
126
127 return secp256k1_memcmp_var(&pk_expected32, tweaked_pubkey32, 32) == 0
128 && secp256k1_fe_is_odd(&pk.y) == tweaked_pk_parity;
129 }
130
secp256k1_keypair_save(secp256k1_keypair * keypair,const secp256k1_scalar * sk,secp256k1_ge * pk)131 static void secp256k1_keypair_save(secp256k1_keypair *keypair, const secp256k1_scalar *sk, secp256k1_ge *pk) {
132 secp256k1_scalar_get_b32(&keypair->data[0], sk);
133 secp256k1_pubkey_save((secp256k1_pubkey *)&keypair->data[32], pk);
134 }
135
136
secp256k1_keypair_seckey_load(const secp256k1_context * ctx,secp256k1_scalar * sk,const secp256k1_keypair * keypair)137 static int secp256k1_keypair_seckey_load(const secp256k1_context* ctx, secp256k1_scalar *sk, const secp256k1_keypair *keypair) {
138 int ret;
139
140 ret = secp256k1_scalar_set_b32_seckey(sk, &keypair->data[0]);
141 /* We can declassify ret here because sk is only zero if a keypair function
142 * failed (which zeroes the keypair) and its return value is ignored. */
143 secp256k1_declassify(ctx, &ret, sizeof(ret));
144 ARG_CHECK(ret);
145 return ret;
146 }
147
148 /* Load a keypair into pk and sk (if non-NULL). This function declassifies pk
149 * and ARG_CHECKs that the keypair is not invalid. It always initializes sk and
150 * pk with dummy values. */
secp256k1_keypair_load(const secp256k1_context * ctx,secp256k1_scalar * sk,secp256k1_ge * pk,const secp256k1_keypair * keypair)151 static int secp256k1_keypair_load(const secp256k1_context* ctx, secp256k1_scalar *sk, secp256k1_ge *pk, const secp256k1_keypair *keypair) {
152 int ret;
153 const secp256k1_pubkey *pubkey = (const secp256k1_pubkey *)&keypair->data[32];
154
155 /* Need to declassify the pubkey because pubkey_load ARG_CHECKs if it's
156 * invalid. */
157 secp256k1_declassify(ctx, pubkey, sizeof(*pubkey));
158 ret = secp256k1_pubkey_load(ctx, pk, pubkey);
159 if (sk != NULL) {
160 ret = ret && secp256k1_keypair_seckey_load(ctx, sk, keypair);
161 }
162 if (!ret) {
163 *pk = secp256k1_ge_const_g;
164 if (sk != NULL) {
165 *sk = secp256k1_scalar_one;
166 }
167 }
168 return ret;
169 }
170
secp256k1_keypair_create(const secp256k1_context * ctx,secp256k1_keypair * keypair,const unsigned char * seckey32)171 int secp256k1_keypair_create(const secp256k1_context* ctx, secp256k1_keypair *keypair, const unsigned char *seckey32) {
172 secp256k1_scalar sk;
173 secp256k1_ge pk;
174 int ret = 0;
175 VERIFY_CHECK(ctx != NULL);
176 ARG_CHECK(keypair != NULL);
177 memset(keypair, 0, sizeof(*keypair));
178 ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
179 ARG_CHECK(seckey32 != NULL);
180
181 ret = secp256k1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &sk, &pk, seckey32);
182 secp256k1_keypair_save(keypair, &sk, &pk);
183 secp256k1_memczero(keypair, sizeof(*keypair), !ret);
184
185 secp256k1_scalar_clear(&sk);
186 return ret;
187 }
188
secp256k1_keypair_sec(const secp256k1_context * ctx,unsigned char * seckey,const secp256k1_keypair * keypair)189 int secp256k1_keypair_sec(const secp256k1_context* ctx, unsigned char *seckey, const secp256k1_keypair *keypair) {
190 VERIFY_CHECK(ctx != NULL);
191 ARG_CHECK(seckey != NULL);
192 memset(seckey, 0, 32);
193 ARG_CHECK(keypair != NULL);
194
195 memcpy(seckey, &keypair->data[0], 32);
196 return 1;
197 }
198
secp256k1_keypair_pub(const secp256k1_context * ctx,secp256k1_pubkey * pubkey,const secp256k1_keypair * keypair)199 int secp256k1_keypair_pub(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const secp256k1_keypair *keypair) {
200 VERIFY_CHECK(ctx != NULL);
201 ARG_CHECK(pubkey != NULL);
202 memset(pubkey, 0, sizeof(*pubkey));
203 ARG_CHECK(keypair != NULL);
204
205 memcpy(pubkey->data, &keypair->data[32], sizeof(*pubkey));
206 return 1;
207 }
208
secp256k1_keypair_xonly_pub(const secp256k1_context * ctx,secp256k1_xonly_pubkey * pubkey,int * pk_parity,const secp256k1_keypair * keypair)209 int secp256k1_keypair_xonly_pub(const secp256k1_context* ctx, secp256k1_xonly_pubkey *pubkey, int *pk_parity, const secp256k1_keypair *keypair) {
210 secp256k1_ge pk;
211 int tmp;
212
213 VERIFY_CHECK(ctx != NULL);
214 ARG_CHECK(pubkey != NULL);
215 memset(pubkey, 0, sizeof(*pubkey));
216 ARG_CHECK(keypair != NULL);
217
218 if (!secp256k1_keypair_load(ctx, NULL, &pk, keypair)) {
219 return 0;
220 }
221 tmp = secp256k1_extrakeys_ge_even_y(&pk);
222 if (pk_parity != NULL) {
223 *pk_parity = tmp;
224 }
225 secp256k1_xonly_pubkey_save(pubkey, &pk);
226
227 return 1;
228 }
229
secp256k1_keypair_xonly_tweak_add(const secp256k1_context * ctx,secp256k1_keypair * keypair,const unsigned char * tweak32)230 int secp256k1_keypair_xonly_tweak_add(const secp256k1_context* ctx, secp256k1_keypair *keypair, const unsigned char *tweak32) {
231 secp256k1_ge pk;
232 secp256k1_scalar sk;
233 int y_parity;
234 int ret;
235
236 VERIFY_CHECK(ctx != NULL);
237 ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
238 ARG_CHECK(keypair != NULL);
239 ARG_CHECK(tweak32 != NULL);
240
241 ret = secp256k1_keypair_load(ctx, &sk, &pk, keypair);
242 memset(keypair, 0, sizeof(*keypair));
243
244 y_parity = secp256k1_extrakeys_ge_even_y(&pk);
245 if (y_parity == 1) {
246 secp256k1_scalar_negate(&sk, &sk);
247 }
248
249 ret &= secp256k1_ec_seckey_tweak_add_helper(&sk, tweak32);
250 ret &= secp256k1_ec_pubkey_tweak_add_helper(&ctx->ecmult_ctx, &pk, tweak32);
251
252 secp256k1_declassify(ctx, &ret, sizeof(ret));
253 if (ret) {
254 secp256k1_keypair_save(keypair, &sk, &pk);
255 }
256
257 secp256k1_scalar_clear(&sk);
258 return ret;
259 }
260
261 #endif
262