1 /***********************************************************************
2  * Copyright (c) 2018-2020 Andrew Poelstra, Jonas Nick                 *
3  * Distributed under the MIT software license, see the accompanying    *
4  * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
5  ***********************************************************************/
6 
7 #ifndef _SECP256K1_MODULE_SCHNORRSIG_TESTS_
8 #define _SECP256K1_MODULE_SCHNORRSIG_TESTS_
9 
10 #include "secp256k1_schnorrsig.h"
11 
12 /* Checks that a bit flip in the n_flip-th argument (that has n_bytes many
13  * bytes) changes the hash function
14  */
nonce_function_bip340_bitflip(unsigned char ** args,size_t n_flip,size_t n_bytes)15 void nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes) {
16     unsigned char nonces[2][32];
17     CHECK(nonce_function_bip340(nonces[0], args[0], args[1], args[2], args[3], args[4]) == 1);
18     secp256k1_testrand_flip(args[n_flip], n_bytes);
19     CHECK(nonce_function_bip340(nonces[1], args[0], args[1], args[2], args[3], args[4]) == 1);
20     CHECK(secp256k1_memcmp_var(nonces[0], nonces[1], 32) != 0);
21 }
22 
23 /* Tests for the equality of two sha256 structs. This function only produces a
24  * correct result if an integer multiple of 64 many bytes have been written
25  * into the hash functions. */
test_sha256_eq(const secp256k1_sha256 * sha1,const secp256k1_sha256 * sha2)26 void test_sha256_eq(const secp256k1_sha256 *sha1, const secp256k1_sha256 *sha2) {
27     /* Is buffer fully consumed? */
28     CHECK((sha1->bytes & 0x3F) == 0);
29 
30     CHECK(sha1->bytes == sha2->bytes);
31     CHECK(secp256k1_memcmp_var(sha1->s, sha2->s, sizeof(sha1->s)) == 0);
32 }
33 
run_nonce_function_bip340_tests(void)34 void run_nonce_function_bip340_tests(void) {
35     unsigned char tag[13] = "BIP0340/nonce";
36     unsigned char aux_tag[11] = "BIP0340/aux";
37     unsigned char algo16[16] = "BIP0340/nonce\0\0\0";
38     secp256k1_sha256 sha;
39     secp256k1_sha256 sha_optimized;
40     unsigned char nonce[32];
41     unsigned char msg[32];
42     unsigned char key[32];
43     unsigned char pk[32];
44     unsigned char aux_rand[32];
45     unsigned char *args[5];
46     int i;
47 
48     /* Check that hash initialized by
49      * secp256k1_nonce_function_bip340_sha256_tagged has the expected
50      * state. */
51     secp256k1_sha256_initialize_tagged(&sha, tag, sizeof(tag));
52     secp256k1_nonce_function_bip340_sha256_tagged(&sha_optimized);
53     test_sha256_eq(&sha, &sha_optimized);
54 
55    /* Check that hash initialized by
56     * secp256k1_nonce_function_bip340_sha256_tagged_aux has the expected
57     * state. */
58     secp256k1_sha256_initialize_tagged(&sha, aux_tag, sizeof(aux_tag));
59     secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha_optimized);
60     test_sha256_eq(&sha, &sha_optimized);
61 
62     secp256k1_testrand256(msg);
63     secp256k1_testrand256(key);
64     secp256k1_testrand256(pk);
65     secp256k1_testrand256(aux_rand);
66 
67     /* Check that a bitflip in an argument results in different nonces. */
68     args[0] = msg;
69     args[1] = key;
70     args[2] = pk;
71     args[3] = algo16;
72     args[4] = aux_rand;
73     for (i = 0; i < count; i++) {
74         nonce_function_bip340_bitflip(args, 0, 32);
75         nonce_function_bip340_bitflip(args, 1, 32);
76         nonce_function_bip340_bitflip(args, 2, 32);
77         /* Flip algo16 special case "BIP0340/nonce" */
78         nonce_function_bip340_bitflip(args, 3, 16);
79         /* Flip algo16 again */
80         nonce_function_bip340_bitflip(args, 3, 16);
81         nonce_function_bip340_bitflip(args, 4, 32);
82     }
83 
84     /* NULL algo16 is disallowed */
85     CHECK(nonce_function_bip340(nonce, msg, key, pk, NULL, NULL) == 0);
86     /* Empty algo16 is fine */
87     memset(algo16, 0x00, 16);
88     CHECK(nonce_function_bip340(nonce, msg, key, pk, algo16, NULL) == 1);
89     /* algo16 with terminating null bytes is fine */
90     algo16[1] = 65;
91     CHECK(nonce_function_bip340(nonce, msg, key, pk, algo16, NULL) == 1);
92     /* Other algo16 is fine */
93     memset(algo16, 0xFF, 16);
94     CHECK(nonce_function_bip340(nonce, msg, key, pk, algo16, NULL) == 1);
95 
96     /* NULL aux_rand argument is allowed. */
97     CHECK(nonce_function_bip340(nonce, msg, key, pk, algo16, NULL) == 1);
98 }
99 
test_schnorrsig_api(void)100 void test_schnorrsig_api(void) {
101     unsigned char sk1[32];
102     unsigned char sk2[32];
103     unsigned char sk3[32];
104     unsigned char msg[32];
105     secp256k1_keypair keypairs[3];
106     secp256k1_keypair invalid_keypair = { 0 };
107     secp256k1_xonly_pubkey pk[3];
108     secp256k1_xonly_pubkey zero_pk;
109     unsigned char sig[64];
110 
111     /** setup **/
112     secp256k1_context *none = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
113     secp256k1_context *sign = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
114     secp256k1_context *vrfy = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
115     secp256k1_context *both = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
116     int ecount;
117 
118     secp256k1_context_set_error_callback(none, counting_illegal_callback_fn, &ecount);
119     secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, &ecount);
120     secp256k1_context_set_error_callback(vrfy, counting_illegal_callback_fn, &ecount);
121     secp256k1_context_set_error_callback(both, counting_illegal_callback_fn, &ecount);
122     secp256k1_context_set_illegal_callback(none, counting_illegal_callback_fn, &ecount);
123     secp256k1_context_set_illegal_callback(sign, counting_illegal_callback_fn, &ecount);
124     secp256k1_context_set_illegal_callback(vrfy, counting_illegal_callback_fn, &ecount);
125     secp256k1_context_set_illegal_callback(both, counting_illegal_callback_fn, &ecount);
126 
127     secp256k1_testrand256(sk1);
128     secp256k1_testrand256(sk2);
129     secp256k1_testrand256(sk3);
130     secp256k1_testrand256(msg);
131     CHECK(secp256k1_keypair_create(ctx, &keypairs[0], sk1) == 1);
132     CHECK(secp256k1_keypair_create(ctx, &keypairs[1], sk2) == 1);
133     CHECK(secp256k1_keypair_create(ctx, &keypairs[2], sk3) == 1);
134     CHECK(secp256k1_keypair_xonly_pub(ctx, &pk[0], NULL, &keypairs[0]) == 1);
135     CHECK(secp256k1_keypair_xonly_pub(ctx, &pk[1], NULL, &keypairs[1]) == 1);
136     CHECK(secp256k1_keypair_xonly_pub(ctx, &pk[2], NULL, &keypairs[2]) == 1);
137     memset(&zero_pk, 0, sizeof(zero_pk));
138 
139     /** main test body **/
140     ecount = 0;
141     CHECK(secp256k1_schnorrsig_sign(none, sig, msg, &keypairs[0], NULL, NULL) == 0);
142     CHECK(ecount == 1);
143     CHECK(secp256k1_schnorrsig_sign(vrfy, sig, msg, &keypairs[0], NULL, NULL) == 0);
144     CHECK(ecount == 2);
145     CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL, NULL) == 1);
146     CHECK(ecount == 2);
147     CHECK(secp256k1_schnorrsig_sign(sign, NULL, msg, &keypairs[0], NULL, NULL) == 0);
148     CHECK(ecount == 3);
149     CHECK(secp256k1_schnorrsig_sign(sign, sig, NULL, &keypairs[0], NULL, NULL) == 0);
150     CHECK(ecount == 4);
151     CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, NULL, NULL, NULL) == 0);
152     CHECK(ecount == 5);
153     CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &invalid_keypair, NULL, NULL) == 0);
154     CHECK(ecount == 6);
155 
156     ecount = 0;
157     CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL, NULL) == 1);
158     CHECK(secp256k1_schnorrsig_verify(none, sig, msg, &pk[0]) == 0);
159     CHECK(ecount == 1);
160     CHECK(secp256k1_schnorrsig_verify(sign, sig, msg, &pk[0]) == 0);
161     CHECK(ecount == 2);
162     CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, &pk[0]) == 1);
163     CHECK(ecount == 2);
164     CHECK(secp256k1_schnorrsig_verify(vrfy, NULL, msg, &pk[0]) == 0);
165     CHECK(ecount == 3);
166     CHECK(secp256k1_schnorrsig_verify(vrfy, sig, NULL, &pk[0]) == 0);
167     CHECK(ecount == 4);
168     CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, NULL) == 0);
169     CHECK(ecount == 5);
170     CHECK(secp256k1_schnorrsig_verify(vrfy, sig, msg, &zero_pk) == 0);
171     CHECK(ecount == 6);
172 
173     secp256k1_context_destroy(none);
174     secp256k1_context_destroy(sign);
175     secp256k1_context_destroy(vrfy);
176     secp256k1_context_destroy(both);
177 }
178 
179 /* Checks that hash initialized by secp256k1_schnorrsig_sha256_tagged has the
180  * expected state. */
test_schnorrsig_sha256_tagged(void)181 void test_schnorrsig_sha256_tagged(void) {
182     char tag[17] = "BIP0340/challenge";
183     secp256k1_sha256 sha;
184     secp256k1_sha256 sha_optimized;
185 
186     secp256k1_sha256_initialize_tagged(&sha, (unsigned char *) tag, sizeof(tag));
187     secp256k1_schnorrsig_sha256_tagged(&sha_optimized);
188     test_sha256_eq(&sha, &sha_optimized);
189 }
190 
191 /* Helper function for schnorrsig_bip_vectors
192  * Signs the message and checks that it's the same as expected_sig. */
test_schnorrsig_bip_vectors_check_signing(const unsigned char * sk,const unsigned char * pk_serialized,unsigned char * aux_rand,const unsigned char * msg,const unsigned char * expected_sig)193 void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const unsigned char *pk_serialized, unsigned char *aux_rand, const unsigned char *msg, const unsigned char *expected_sig) {
194     unsigned char sig[64];
195     secp256k1_keypair keypair;
196     secp256k1_xonly_pubkey pk, pk_expected;
197 
198     CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
199     CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, aux_rand));
200     CHECK(secp256k1_memcmp_var(sig, expected_sig, 64) == 0);
201 
202     CHECK(secp256k1_xonly_pubkey_parse(ctx, &pk_expected, pk_serialized));
203     CHECK(secp256k1_keypair_xonly_pub(ctx, &pk, NULL, &keypair));
204     CHECK(secp256k1_memcmp_var(&pk, &pk_expected, sizeof(pk)) == 0);
205     CHECK(secp256k1_schnorrsig_verify(ctx, sig, msg, &pk));
206 }
207 
208 /* Helper function for schnorrsig_bip_vectors
209  * Checks that both verify and verify_batch (TODO) return the same value as expected. */
test_schnorrsig_bip_vectors_check_verify(const unsigned char * pk_serialized,const unsigned char * msg32,const unsigned char * sig,int expected)210 void test_schnorrsig_bip_vectors_check_verify(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, int expected) {
211     secp256k1_xonly_pubkey pk;
212 
213     CHECK(secp256k1_xonly_pubkey_parse(ctx, &pk, pk_serialized));
214     CHECK(expected == secp256k1_schnorrsig_verify(ctx, sig, msg32, &pk));
215 }
216 
217 /* Test vectors according to BIP-340 ("Schnorr Signatures for secp256k1"). See
218  * https://github.com/bitcoin/bips/blob/master/bip-0340/test-vectors.csv. */
test_schnorrsig_bip_vectors(void)219 void test_schnorrsig_bip_vectors(void) {
220     {
221         /* Test vector 0 */
222         const unsigned char sk[32] = {
223             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
224             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
225             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
226             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03
227         };
228         const unsigned char pk[32] = {
229             0xF9, 0x30, 0x8A, 0x01, 0x92, 0x58, 0xC3, 0x10,
230             0x49, 0x34, 0x4F, 0x85, 0xF8, 0x9D, 0x52, 0x29,
231             0xB5, 0x31, 0xC8, 0x45, 0x83, 0x6F, 0x99, 0xB0,
232             0x86, 0x01, 0xF1, 0x13, 0xBC, 0xE0, 0x36, 0xF9
233         };
234         unsigned char aux_rand[32] = {
235             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
236             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
237             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
238             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
239         };
240         const unsigned char msg[32] = {
241             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
242             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
243             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
244             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
245         };
246         const unsigned char sig[64] = {
247             0xE9, 0x07, 0x83, 0x1F, 0x80, 0x84, 0x8D, 0x10,
248             0x69, 0xA5, 0x37, 0x1B, 0x40, 0x24, 0x10, 0x36,
249             0x4B, 0xDF, 0x1C, 0x5F, 0x83, 0x07, 0xB0, 0x08,
250             0x4C, 0x55, 0xF1, 0xCE, 0x2D, 0xCA, 0x82, 0x15,
251             0x25, 0xF6, 0x6A, 0x4A, 0x85, 0xEA, 0x8B, 0x71,
252             0xE4, 0x82, 0xA7, 0x4F, 0x38, 0x2D, 0x2C, 0xE5,
253             0xEB, 0xEE, 0xE8, 0xFD, 0xB2, 0x17, 0x2F, 0x47,
254             0x7D, 0xF4, 0x90, 0x0D, 0x31, 0x05, 0x36, 0xC0
255         };
256         test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
257         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
258     }
259     {
260         /* Test vector 1 */
261         const unsigned char sk[32] = {
262             0xB7, 0xE1, 0x51, 0x62, 0x8A, 0xED, 0x2A, 0x6A,
263             0xBF, 0x71, 0x58, 0x80, 0x9C, 0xF4, 0xF3, 0xC7,
264             0x62, 0xE7, 0x16, 0x0F, 0x38, 0xB4, 0xDA, 0x56,
265             0xA7, 0x84, 0xD9, 0x04, 0x51, 0x90, 0xCF, 0xEF
266         };
267         const unsigned char pk[32] = {
268             0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
269             0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
270             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
271             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
272         };
273         unsigned char aux_rand[32] = {
274             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
275             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
276             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
277             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
278         };
279         const unsigned char msg[32] = {
280             0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
281             0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
282             0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
283             0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
284         };
285         const unsigned char sig[64] = {
286             0x68, 0x96, 0xBD, 0x60, 0xEE, 0xAE, 0x29, 0x6D,
287             0xB4, 0x8A, 0x22, 0x9F, 0xF7, 0x1D, 0xFE, 0x07,
288             0x1B, 0xDE, 0x41, 0x3E, 0x6D, 0x43, 0xF9, 0x17,
289             0xDC, 0x8D, 0xCF, 0x8C, 0x78, 0xDE, 0x33, 0x41,
290             0x89, 0x06, 0xD1, 0x1A, 0xC9, 0x76, 0xAB, 0xCC,
291             0xB2, 0x0B, 0x09, 0x12, 0x92, 0xBF, 0xF4, 0xEA,
292             0x89, 0x7E, 0xFC, 0xB6, 0x39, 0xEA, 0x87, 0x1C,
293             0xFA, 0x95, 0xF6, 0xDE, 0x33, 0x9E, 0x4B, 0x0A
294         };
295         test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
296         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
297     }
298     {
299         /* Test vector 2 */
300         const unsigned char sk[32] = {
301             0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
302             0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
303             0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
304             0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x14, 0xE5, 0xC9
305         };
306         const unsigned char pk[32] = {
307             0xDD, 0x30, 0x8A, 0xFE, 0xC5, 0x77, 0x7E, 0x13,
308             0x12, 0x1F, 0xA7, 0x2B, 0x9C, 0xC1, 0xB7, 0xCC,
309             0x01, 0x39, 0x71, 0x53, 0x09, 0xB0, 0x86, 0xC9,
310             0x60, 0xE1, 0x8F, 0xD9, 0x69, 0x77, 0x4E, 0xB8
311         };
312         unsigned char aux_rand[32] = {
313             0xC8, 0x7A, 0xA5, 0x38, 0x24, 0xB4, 0xD7, 0xAE,
314             0x2E, 0xB0, 0x35, 0xA2, 0xB5, 0xBB, 0xBC, 0xCC,
315             0x08, 0x0E, 0x76, 0xCD, 0xC6, 0xD1, 0x69, 0x2C,
316             0x4B, 0x0B, 0x62, 0xD7, 0x98, 0xE6, 0xD9, 0x06
317         };
318         const unsigned char msg[32] = {
319             0x7E, 0x2D, 0x58, 0xD8, 0xB3, 0xBC, 0xDF, 0x1A,
320             0xBA, 0xDE, 0xC7, 0x82, 0x90, 0x54, 0xF9, 0x0D,
321             0xDA, 0x98, 0x05, 0xAA, 0xB5, 0x6C, 0x77, 0x33,
322             0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C
323         };
324         const unsigned char sig[64] = {
325             0x58, 0x31, 0xAA, 0xEE, 0xD7, 0xB4, 0x4B, 0xB7,
326             0x4E, 0x5E, 0xAB, 0x94, 0xBA, 0x9D, 0x42, 0x94,
327             0xC4, 0x9B, 0xCF, 0x2A, 0x60, 0x72, 0x8D, 0x8B,
328             0x4C, 0x20, 0x0F, 0x50, 0xDD, 0x31, 0x3C, 0x1B,
329             0xAB, 0x74, 0x58, 0x79, 0xA5, 0xAD, 0x95, 0x4A,
330             0x72, 0xC4, 0x5A, 0x91, 0xC3, 0xA5, 0x1D, 0x3C,
331             0x7A, 0xDE, 0xA9, 0x8D, 0x82, 0xF8, 0x48, 0x1E,
332             0x0E, 0x1E, 0x03, 0x67, 0x4A, 0x6F, 0x3F, 0xB7
333         };
334         test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
335         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
336     }
337     {
338         /* Test vector 3 */
339         const unsigned char sk[32] = {
340             0x0B, 0x43, 0x2B, 0x26, 0x77, 0x93, 0x73, 0x81,
341             0xAE, 0xF0, 0x5B, 0xB0, 0x2A, 0x66, 0xEC, 0xD0,
342             0x12, 0x77, 0x30, 0x62, 0xCF, 0x3F, 0xA2, 0x54,
343             0x9E, 0x44, 0xF5, 0x8E, 0xD2, 0x40, 0x17, 0x10
344         };
345         const unsigned char pk[32] = {
346             0x25, 0xD1, 0xDF, 0xF9, 0x51, 0x05, 0xF5, 0x25,
347             0x3C, 0x40, 0x22, 0xF6, 0x28, 0xA9, 0x96, 0xAD,
348             0x3A, 0x0D, 0x95, 0xFB, 0xF2, 0x1D, 0x46, 0x8A,
349             0x1B, 0x33, 0xF8, 0xC1, 0x60, 0xD8, 0xF5, 0x17
350         };
351         unsigned char aux_rand[32] = {
352             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
353             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
354             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
355             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
356         };
357         const unsigned char msg[32] = {
358             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
359             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
360             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
361             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
362         };
363         const unsigned char sig[64] = {
364             0x7E, 0xB0, 0x50, 0x97, 0x57, 0xE2, 0x46, 0xF1,
365             0x94, 0x49, 0x88, 0x56, 0x51, 0x61, 0x1C, 0xB9,
366             0x65, 0xEC, 0xC1, 0xA1, 0x87, 0xDD, 0x51, 0xB6,
367             0x4F, 0xDA, 0x1E, 0xDC, 0x96, 0x37, 0xD5, 0xEC,
368             0x97, 0x58, 0x2B, 0x9C, 0xB1, 0x3D, 0xB3, 0x93,
369             0x37, 0x05, 0xB3, 0x2B, 0xA9, 0x82, 0xAF, 0x5A,
370             0xF2, 0x5F, 0xD7, 0x88, 0x81, 0xEB, 0xB3, 0x27,
371             0x71, 0xFC, 0x59, 0x22, 0xEF, 0xC6, 0x6E, 0xA3
372         };
373         test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
374         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
375     }
376     {
377         /* Test vector 4 */
378         const unsigned char pk[32] = {
379             0xD6, 0x9C, 0x35, 0x09, 0xBB, 0x99, 0xE4, 0x12,
380             0xE6, 0x8B, 0x0F, 0xE8, 0x54, 0x4E, 0x72, 0x83,
381             0x7D, 0xFA, 0x30, 0x74, 0x6D, 0x8B, 0xE2, 0xAA,
382             0x65, 0x97, 0x5F, 0x29, 0xD2, 0x2D, 0xC7, 0xB9
383         };
384         const unsigned char msg[32] = {
385             0x4D, 0xF3, 0xC3, 0xF6, 0x8F, 0xCC, 0x83, 0xB2,
386             0x7E, 0x9D, 0x42, 0xC9, 0x04, 0x31, 0xA7, 0x24,
387             0x99, 0xF1, 0x78, 0x75, 0xC8, 0x1A, 0x59, 0x9B,
388             0x56, 0x6C, 0x98, 0x89, 0xB9, 0x69, 0x67, 0x03
389         };
390         const unsigned char sig[64] = {
391             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
392             0x00, 0x00, 0x00, 0x3B, 0x78, 0xCE, 0x56, 0x3F,
393             0x89, 0xA0, 0xED, 0x94, 0x14, 0xF5, 0xAA, 0x28,
394             0xAD, 0x0D, 0x96, 0xD6, 0x79, 0x5F, 0x9C, 0x63,
395             0x76, 0xAF, 0xB1, 0x54, 0x8A, 0xF6, 0x03, 0xB3,
396             0xEB, 0x45, 0xC9, 0xF8, 0x20, 0x7D, 0xEE, 0x10,
397             0x60, 0xCB, 0x71, 0xC0, 0x4E, 0x80, 0xF5, 0x93,
398             0x06, 0x0B, 0x07, 0xD2, 0x83, 0x08, 0xD7, 0xF4
399         };
400         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
401     }
402     {
403         /* Test vector 5 */
404         const unsigned char pk[32] = {
405             0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, 0x50,
406             0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF, 0x21,
407             0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76, 0x87,
408             0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A, 0x34
409         };
410         secp256k1_xonly_pubkey pk_parsed;
411         /* No need to check the signature of the test vector as parsing the pubkey already fails */
412         CHECK(!secp256k1_xonly_pubkey_parse(ctx, &pk_parsed, pk));
413     }
414     {
415         /* Test vector 6 */
416         const unsigned char pk[32] = {
417             0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
418             0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
419             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
420             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
421         };
422         const unsigned char msg[32] = {
423             0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
424             0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
425             0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
426             0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
427         };
428         const unsigned char sig[64] = {
429             0xFF, 0xF9, 0x7B, 0xD5, 0x75, 0x5E, 0xEE, 0xA4,
430             0x20, 0x45, 0x3A, 0x14, 0x35, 0x52, 0x35, 0xD3,
431             0x82, 0xF6, 0x47, 0x2F, 0x85, 0x68, 0xA1, 0x8B,
432             0x2F, 0x05, 0x7A, 0x14, 0x60, 0x29, 0x75, 0x56,
433             0x3C, 0xC2, 0x79, 0x44, 0x64, 0x0A, 0xC6, 0x07,
434             0xCD, 0x10, 0x7A, 0xE1, 0x09, 0x23, 0xD9, 0xEF,
435             0x7A, 0x73, 0xC6, 0x43, 0xE1, 0x66, 0xBE, 0x5E,
436             0xBE, 0xAF, 0xA3, 0x4B, 0x1A, 0xC5, 0x53, 0xE2
437         };
438         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
439     }
440     {
441         /* Test vector 7 */
442         const unsigned char pk[32] = {
443             0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
444             0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
445             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
446             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
447         };
448         const unsigned char msg[32] = {
449             0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
450             0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
451             0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
452             0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
453         };
454         const unsigned char sig[64] = {
455             0x1F, 0xA6, 0x2E, 0x33, 0x1E, 0xDB, 0xC2, 0x1C,
456             0x39, 0x47, 0x92, 0xD2, 0xAB, 0x11, 0x00, 0xA7,
457             0xB4, 0x32, 0xB0, 0x13, 0xDF, 0x3F, 0x6F, 0xF4,
458             0xF9, 0x9F, 0xCB, 0x33, 0xE0, 0xE1, 0x51, 0x5F,
459             0x28, 0x89, 0x0B, 0x3E, 0xDB, 0x6E, 0x71, 0x89,
460             0xB6, 0x30, 0x44, 0x8B, 0x51, 0x5C, 0xE4, 0xF8,
461             0x62, 0x2A, 0x95, 0x4C, 0xFE, 0x54, 0x57, 0x35,
462             0xAA, 0xEA, 0x51, 0x34, 0xFC, 0xCD, 0xB2, 0xBD
463         };
464         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
465     }
466     {
467         /* Test vector 8 */
468         const unsigned char pk[32] = {
469             0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
470             0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
471             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
472             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
473         };
474         const unsigned char msg[32] = {
475             0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
476             0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
477             0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
478             0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
479         };
480         const unsigned char sig[64] = {
481             0x6C, 0xFF, 0x5C, 0x3B, 0xA8, 0x6C, 0x69, 0xEA,
482             0x4B, 0x73, 0x76, 0xF3, 0x1A, 0x9B, 0xCB, 0x4F,
483             0x74, 0xC1, 0x97, 0x60, 0x89, 0xB2, 0xD9, 0x96,
484             0x3D, 0xA2, 0xE5, 0x54, 0x3E, 0x17, 0x77, 0x69,
485             0x96, 0x17, 0x64, 0xB3, 0xAA, 0x9B, 0x2F, 0xFC,
486             0xB6, 0xEF, 0x94, 0x7B, 0x68, 0x87, 0xA2, 0x26,
487             0xE8, 0xD7, 0xC9, 0x3E, 0x00, 0xC5, 0xED, 0x0C,
488             0x18, 0x34, 0xFF, 0x0D, 0x0C, 0x2E, 0x6D, 0xA6
489         };
490         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
491     }
492     {
493         /* Test vector 9 */
494         const unsigned char pk[32] = {
495             0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
496             0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
497             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
498             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
499         };
500         const unsigned char msg[32] = {
501             0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
502             0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
503             0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
504             0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
505         };
506         const unsigned char sig[64] = {
507             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
508             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
509             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
510             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
511             0x12, 0x3D, 0xDA, 0x83, 0x28, 0xAF, 0x9C, 0x23,
512             0xA9, 0x4C, 0x1F, 0xEE, 0xCF, 0xD1, 0x23, 0xBA,
513             0x4F, 0xB7, 0x34, 0x76, 0xF0, 0xD5, 0x94, 0xDC,
514             0xB6, 0x5C, 0x64, 0x25, 0xBD, 0x18, 0x60, 0x51
515         };
516         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
517     }
518     {
519         /* Test vector 10 */
520         const unsigned char pk[32] = {
521             0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
522             0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
523             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
524             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
525         };
526         const unsigned char msg[32] = {
527             0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
528             0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
529             0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
530             0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
531         };
532         const unsigned char sig[64] = {
533             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
534             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
535             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
536             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
537             0x76, 0x15, 0xFB, 0xAF, 0x5A, 0xE2, 0x88, 0x64,
538             0x01, 0x3C, 0x09, 0x97, 0x42, 0xDE, 0xAD, 0xB4,
539             0xDB, 0xA8, 0x7F, 0x11, 0xAC, 0x67, 0x54, 0xF9,
540             0x37, 0x80, 0xD5, 0xA1, 0x83, 0x7C, 0xF1, 0x97
541         };
542         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
543     }
544     {
545         /* Test vector 11 */
546         const unsigned char pk[32] = {
547             0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
548             0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
549             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
550             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
551         };
552         const unsigned char msg[32] = {
553             0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
554             0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
555             0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
556             0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
557         };
558         const unsigned char sig[64] = {
559             0x4A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
560             0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
561             0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
562             0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
563             0x69, 0xE8, 0x9B, 0x4C, 0x55, 0x64, 0xD0, 0x03,
564             0x49, 0x10, 0x6B, 0x84, 0x97, 0x78, 0x5D, 0xD7,
565             0xD1, 0xD7, 0x13, 0xA8, 0xAE, 0x82, 0xB3, 0x2F,
566             0xA7, 0x9D, 0x5F, 0x7F, 0xC4, 0x07, 0xD3, 0x9B
567         };
568         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
569     }
570     {
571         /* Test vector 12 */
572         const unsigned char pk[32] = {
573             0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
574             0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
575             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
576             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
577         };
578         const unsigned char msg[32] = {
579             0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
580             0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
581             0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
582             0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
583         };
584         const unsigned char sig[64] = {
585             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
586             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
587             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
588             0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x2F,
589             0x69, 0xE8, 0x9B, 0x4C, 0x55, 0x64, 0xD0, 0x03,
590             0x49, 0x10, 0x6B, 0x84, 0x97, 0x78, 0x5D, 0xD7,
591             0xD1, 0xD7, 0x13, 0xA8, 0xAE, 0x82, 0xB3, 0x2F,
592             0xA7, 0x9D, 0x5F, 0x7F, 0xC4, 0x07, 0xD3, 0x9B
593         };
594         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
595     }
596     {
597         /* Test vector 13 */
598         const unsigned char pk[32] = {
599             0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
600             0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
601             0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
602             0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
603         };
604         const unsigned char msg[32] = {
605             0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
606             0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
607             0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
608             0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
609         };
610         const unsigned char sig[64] = {
611             0x6C, 0xFF, 0x5C, 0x3B, 0xA8, 0x6C, 0x69, 0xEA,
612             0x4B, 0x73, 0x76, 0xF3, 0x1A, 0x9B, 0xCB, 0x4F,
613             0x74, 0xC1, 0x97, 0x60, 0x89, 0xB2, 0xD9, 0x96,
614             0x3D, 0xA2, 0xE5, 0x54, 0x3E, 0x17, 0x77, 0x69,
615             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
616             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,
617             0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,
618             0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41
619         };
620         test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
621     }
622     {
623         /* Test vector 14 */
624         const unsigned char pk[32] = {
625             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
626             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
627             0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
628             0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x30
629         };
630         secp256k1_xonly_pubkey pk_parsed;
631         /* No need to check the signature of the test vector as parsing the pubkey already fails */
632         CHECK(!secp256k1_xonly_pubkey_parse(ctx, &pk_parsed, pk));
633     }
634 }
635 
636 /* Nonce function that returns constant 0 */
nonce_function_failing(unsigned char * nonce32,const unsigned char * msg32,const unsigned char * key32,const unsigned char * xonly_pk32,const unsigned char * algo16,void * data)637 static int nonce_function_failing(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo16, void *data) {
638     (void) msg32;
639     (void) key32;
640     (void) xonly_pk32;
641     (void) algo16;
642     (void) data;
643     (void) nonce32;
644     return 0;
645 }
646 
647 /* Nonce function that sets nonce to 0 */
nonce_function_0(unsigned char * nonce32,const unsigned char * msg32,const unsigned char * key32,const unsigned char * xonly_pk32,const unsigned char * algo16,void * data)648 static int nonce_function_0(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo16, void *data) {
649     (void) msg32;
650     (void) key32;
651     (void) xonly_pk32;
652     (void) algo16;
653     (void) data;
654 
655     memset(nonce32, 0, 32);
656     return 1;
657 }
658 
659 /* Nonce function that sets nonce to 0xFF...0xFF */
nonce_function_overflowing(unsigned char * nonce32,const unsigned char * msg32,const unsigned char * key32,const unsigned char * xonly_pk32,const unsigned char * algo16,void * data)660 static int nonce_function_overflowing(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo16, void *data) {
661     (void) msg32;
662     (void) key32;
663     (void) xonly_pk32;
664     (void) algo16;
665     (void) data;
666 
667     memset(nonce32, 0xFF, 32);
668     return 1;
669 }
670 
test_schnorrsig_sign(void)671 void test_schnorrsig_sign(void) {
672     unsigned char sk[32];
673     secp256k1_keypair keypair;
674     const unsigned char msg[32] = "this is a msg for a schnorrsig..";
675     unsigned char sig[64];
676     unsigned char zeros64[64] = { 0 };
677 
678     secp256k1_testrand256(sk);
679     CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
680     CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, NULL) == 1);
681 
682     /* Test different nonce functions */
683     memset(sig, 1, sizeof(sig));
684     CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, nonce_function_failing, NULL) == 0);
685     CHECK(secp256k1_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
686     memset(&sig, 1, sizeof(sig));
687     CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, nonce_function_0, NULL) == 0);
688     CHECK(secp256k1_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
689     CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, nonce_function_overflowing, NULL) == 1);
690     CHECK(secp256k1_memcmp_var(sig, zeros64, sizeof(sig)) != 0);
691 }
692 
693 #define N_SIGS 3
694 /* Creates N_SIGS valid signatures and verifies them with verify and
695  * verify_batch (TODO). Then flips some bits and checks that verification now
696  * fails. */
test_schnorrsig_sign_verify(void)697 void test_schnorrsig_sign_verify(void) {
698     unsigned char sk[32];
699     unsigned char msg[N_SIGS][32];
700     unsigned char sig[N_SIGS][64];
701     size_t i;
702     secp256k1_keypair keypair;
703     secp256k1_xonly_pubkey pk;
704     secp256k1_scalar s;
705 
706     secp256k1_testrand256(sk);
707     CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
708     CHECK(secp256k1_keypair_xonly_pub(ctx, &pk, NULL, &keypair));
709 
710     for (i = 0; i < N_SIGS; i++) {
711         secp256k1_testrand256(msg[i]);
712         CHECK(secp256k1_schnorrsig_sign(ctx, sig[i], msg[i], &keypair, NULL, NULL));
713         CHECK(secp256k1_schnorrsig_verify(ctx, sig[i], msg[i], &pk));
714     }
715 
716     {
717         /* Flip a few bits in the signature and in the message and check that
718          * verify and verify_batch (TODO) fail */
719         size_t sig_idx = secp256k1_testrand_int(N_SIGS);
720         size_t byte_idx = secp256k1_testrand_int(32);
721         unsigned char xorbyte = secp256k1_testrand_int(254)+1;
722         sig[sig_idx][byte_idx] ^= xorbyte;
723         CHECK(!secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], &pk));
724         sig[sig_idx][byte_idx] ^= xorbyte;
725 
726         byte_idx = secp256k1_testrand_int(32);
727         sig[sig_idx][32+byte_idx] ^= xorbyte;
728         CHECK(!secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], &pk));
729         sig[sig_idx][32+byte_idx] ^= xorbyte;
730 
731         byte_idx = secp256k1_testrand_int(32);
732         msg[sig_idx][byte_idx] ^= xorbyte;
733         CHECK(!secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], &pk));
734         msg[sig_idx][byte_idx] ^= xorbyte;
735 
736         /* Check that above bitflips have been reversed correctly */
737         CHECK(secp256k1_schnorrsig_verify(ctx, sig[sig_idx], msg[sig_idx], &pk));
738     }
739 
740     /* Test overflowing s */
741     CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL, NULL));
742     CHECK(secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
743     memset(&sig[0][32], 0xFF, 32);
744     CHECK(!secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
745 
746     /* Test negative s */
747     CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL, NULL));
748     CHECK(secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
749     secp256k1_scalar_set_b32(&s, &sig[0][32], NULL);
750     secp256k1_scalar_negate(&s, &s);
751     secp256k1_scalar_get_b32(&sig[0][32], &s);
752     CHECK(!secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
753 }
754 #undef N_SIGS
755 
test_schnorrsig_taproot(void)756 void test_schnorrsig_taproot(void) {
757     unsigned char sk[32];
758     secp256k1_keypair keypair;
759     secp256k1_xonly_pubkey internal_pk;
760     unsigned char internal_pk_bytes[32];
761     secp256k1_xonly_pubkey output_pk;
762     unsigned char output_pk_bytes[32];
763     unsigned char tweak[32];
764     int pk_parity;
765     unsigned char msg[32];
766     unsigned char sig[64];
767 
768     /* Create output key */
769     secp256k1_testrand256(sk);
770     CHECK(secp256k1_keypair_create(ctx, &keypair, sk) == 1);
771     CHECK(secp256k1_keypair_xonly_pub(ctx, &internal_pk, NULL, &keypair) == 1);
772     /* In actual taproot the tweak would be hash of internal_pk */
773     CHECK(secp256k1_xonly_pubkey_serialize(ctx, tweak, &internal_pk) == 1);
774     CHECK(secp256k1_keypair_xonly_tweak_add(ctx, &keypair, tweak) == 1);
775     CHECK(secp256k1_keypair_xonly_pub(ctx, &output_pk, &pk_parity, &keypair) == 1);
776     CHECK(secp256k1_xonly_pubkey_serialize(ctx, output_pk_bytes, &output_pk) == 1);
777 
778     /* Key spend */
779     secp256k1_testrand256(msg);
780     CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, NULL) == 1);
781     /* Verify key spend */
782     CHECK(secp256k1_xonly_pubkey_parse(ctx, &output_pk, output_pk_bytes) == 1);
783     CHECK(secp256k1_schnorrsig_verify(ctx, sig, msg, &output_pk) == 1);
784 
785     /* Script spend */
786     CHECK(secp256k1_xonly_pubkey_serialize(ctx, internal_pk_bytes, &internal_pk) == 1);
787     /* Verify script spend */
788     CHECK(secp256k1_xonly_pubkey_parse(ctx, &internal_pk, internal_pk_bytes) == 1);
789     CHECK(secp256k1_xonly_pubkey_tweak_add_check(ctx, output_pk_bytes, pk_parity, &internal_pk, tweak) == 1);
790 }
791 
run_schnorrsig_tests(void)792 void run_schnorrsig_tests(void) {
793     int i;
794     run_nonce_function_bip340_tests();
795 
796     test_schnorrsig_api();
797     test_schnorrsig_sha256_tagged();
798     test_schnorrsig_bip_vectors();
799     for (i = 0; i < count; i++) {
800         test_schnorrsig_sign();
801         test_schnorrsig_sign_verify();
802     }
803     test_schnorrsig_taproot();
804 }
805 
806 #endif
807