frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge bitcoin-core/secp256k1#1245: tests: Add Wycheproof ECDSA vectors

Browse Source 
e5de454609 tests: Add Wycheproof ECDSA vectors (RandomLattice)

Pull request description:

  This PR adds a test using the Wycheproof vectors as outlined in #1106. We add all 463 ECDSA test vectors. These vectors cover:
  - edge cases in arithmetic operations
  - signatures with special values for (r,s) that should be rejected
  - special cases of public keys

  The vectors are pulled from the Wycheproof project using a python script to emit C code.

  All the new ECDSA Wycheproof vectors pass.

ACKs for top commit:
  sipa:
    ACK e5de454609
  real-or-random:
    ACK e5de454609

Tree-SHA512: e9684f14ff3f5225a4a4949b490e07527d559c28aa61ed03c03bc52ea64785f0b80b9e1b1628665eacf24006526271ea0fb108629c9c3c1d758e52d214a056f1
This commit is contained in:
Pieter Wuille
2023-04-10 09:27:16 -04:00
parent 145078c418 e5de454609
commit 7b7503dac5
7 changed files with 8308 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
src/tests.c
View File

@@ -7369,6 +7369,44 @@ static void run_ecdsa_edge_cases(void) {
test_ecdsa_edge_cases();
}
/** Wycheproof tests
The tests check for known attacks (range checks in (r,s), arithmetic errors, malleability).
*/
static void test_ecdsa_wycheproof(void) {
#include "wycheproof/ecdsa_secp256k1_sha256_bitcoin_test.h"
int t;
for (t = 0; t < SECP256K1_ECDSA_WYCHEPROOF_NUMBER_TESTVECTORS; t++) {
secp256k1_ecdsa_signature signature;
secp256k1_sha256 hasher;
secp256k1_pubkey pubkey;
const unsigned char *msg, *sig, *pk;
unsigned char out[32] = {0};
int actual_verify = 0;
memset(&pubkey, 0, sizeof(pubkey));
pk = &wycheproof_ecdsa_public_keys[testvectors[t].pk_offset];
CHECK(secp256k1_ec_pubkey_parse(CTX, &pubkey, pk, 65) == 1);
secp256k1_sha256_initialize(&hasher);
msg = &wycheproof_ecdsa_messages[testvectors[t].msg_offset];
secp256k1_sha256_write(&hasher, msg, testvectors[t].msg_len);
secp256k1_sha256_finalize(&hasher, out);
sig = &wycheproof_ecdsa_signatures[testvectors[t].sig_offset];
if (secp256k1_ecdsa_signature_parse_der(CTX, &signature, sig, testvectors[t].sig_len) == 1) {
actual_verify = secp256k1_ecdsa_verify(CTX, (const secp256k1_ecdsa_signature *)&signature, out, &pubkey);
}
CHECK(testvectors[t].expected_verify == actual_verify);
}
}
/* Tests cases from Wycheproof test suite. */
static void run_ecdsa_wycheproof(void) {
test_ecdsa_wycheproof();
}
#ifdef ENABLE_MODULE_ECDH
# include "modules/ecdh/tests_impl.h"
#endif
@@ -7701,6 +7739,7 @@ int main(int argc, char **argv) {
run_ecdsa_sign_verify();
run_ecdsa_end_to_end();
run_ecdsa_edge_cases();
run_ecdsa_wycheproof();
#ifdef ENABLE_MODULE_RECOVERY
/* ECDSA pubkey recovery tests */