Skip to content

Commit b6c0b72

Browse files
jonasnickjonasnick
committed
schnorrsig: remove noncefp args from sign; add sign_custom function
This makes the default sign function easier to use while allowing more granular control through sign_custom. Tests for sign_custom follow in a later commit.
1 parent 442cee5 commit b6c0b72

File tree

6 files changed

+52
-31
lines changed

6 files changed

+52
-31
lines changed

‎include/secp256k1_schnorrsig.h‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -66,22 +66,38 @@ SECP256K1_API extern const secp256k1_nonce_function_hardened secp256k1_nonce_fun
6666
* signature. Instead, you can manually use secp256k1_schnorrsig_verify and
6767
* abort if it fails.
6868
*
69-
* Otherwise BIP-340 compliant if the noncefp argument is NULL or
70-
* secp256k1_nonce_function_bip340 and the ndata argument is 32-byte auxiliary
71-
* randomness.
72-
*
7369
* Returns 1 on success, 0 on failure.
7470
* Args: ctx: pointer to a context object, initialized for signing (cannot be NULL)
7571
* Out: sig64: pointer to a 64-byte array to store the serialized signature (cannot be NULL)
7672
* In: msg32: the 32-byte message being signed (cannot be NULL)
7773
* keypair: pointer to an initialized keypair (cannot be NULL)
78-
* noncefp: pointer to a nonce generation function. If NULL, secp256k1_nonce_function_bip340 is used
79-
* ndata: pointer to arbitrary data used by the nonce generation
80-
* function (can be NULL). If it is non-NULL and
81-
* secp256k1_nonce_function_bip340 is used, then ndata must be a
82-
* pointer to 32-byte auxiliary randomness as per BIP-340.
74+
* aux_rand32: 32 bytes of fresh randomness. While recommended to provide
75+
* this, it is only supplemental to security and can be NULL. See
76+
* BIP-340 "Default Signing" for a full explanation of this
77+
* argument and for guidance if randomness is expensive.
8378
*/
8479
SECP256K1_API int secp256k1_schnorrsig_sign(
80+
const secp256k1_context* ctx,
81+
unsigned char *sig64,
82+
const unsigned char *msg32,
83+
const secp256k1_keypair *keypair,
84+
unsigned char *aux_rand32
85+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
86+
87+
/** Create a Schnorr signature with a more flexible API.
88+
*
89+
* Same arguments as secp256k1_schnorrsig_sign except that it misses aux_rand32
90+
* and instead allows allows providing a different nonce derivation function
91+
* with its own data argument.
92+
*
93+
* In: noncefp: pointer to a nonce generation function. If NULL,
94+
* secp256k1_nonce_function_bip340 is used
95+
* ndata: pointer to arbitrary data used by the nonce generation function
96+
* (can be NULL). If it is non-NULL and
97+
* secp256k1_nonce_function_bip340 is used, then ndata must be a
98+
* pointer to 32-byte auxiliary randomness as per BIP-340.
99+
*/
100+
SECP256K1_API int secp256k1_schnorrsig_sign_custom(
85101
const secp256k1_context* ctx,
86102
unsigned char *sig64,
87103
const unsigned char *msg32,

‎src/bench_schnorrsig.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ void bench_schnorrsig_sign(void* arg, int iters) {
3232
for (i = 0; i < iters; i++) {
3333
msg[0] = i;
3434
msg[1] = i >> 8;
35-
CHECK(secp256k1_schnorrsig_sign(data->ctx, sig, msg, data->keypairs[i], NULL, NULL));
35+
CHECK(secp256k1_schnorrsig_sign(data->ctx, sig, msg, data->keypairs[i], NULL));
3636
}
3737
}
3838

@@ -78,7 +78,7 @@ int main(void) {
7878
data.sigs[i] = sig;
7979

8080
CHECK(secp256k1_keypair_create(data.ctx, keypair, sk));
81-
CHECK(secp256k1_schnorrsig_sign(data.ctx, sig, msg, keypair, NULL, NULL));
81+
CHECK(secp256k1_schnorrsig_sign(data.ctx, sig, msg, keypair, NULL));
8282
CHECK(secp256k1_keypair_xonly_pub(data.ctx, &pk, NULL, keypair));
8383
CHECK(secp256k1_xonly_pubkey_serialize(data.ctx, pk_char, &pk) == 1);
8484
}

‎src/modules/schnorrsig/main_impl.h‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,12 @@ static void secp256k1_schnorrsig_challenge(secp256k1_scalar* e, const unsigned c
120120
secp256k1_scalar_set_b32(e, buf, NULL);
121121
}
122122

123-
int secp256k1_schnorrsig_sign(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_nonce_function_hardened noncefp, void *ndata) {
123+
124+
int secp256k1_schnorrsig_sign(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, unsigned char *aux_rand32) {
125+
return secp256k1_schnorrsig_sign_custom(ctx, sig64, msg32, keypair, NULL, aux_rand32);
126+
}
127+
128+
int secp256k1_schnorrsig_sign_custom(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_nonce_function_hardened noncefp, void *ndata) {
124129
secp256k1_scalar sk;
125130
secp256k1_scalar e;
126131
secp256k1_scalar k;

‎src/modules/schnorrsig/tests_exhaustive_impl.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ static void test_exhaustive_schnorrsig_sign(const secp256k1_context *ctx, unsign
163163
unsigned char expected_s_bytes[32];
164164
secp256k1_scalar_get_b32(expected_s_bytes, &expected_s);
165165
/* Invoke the real function to construct a signature. */
166-
CHECK(secp256k1_schnorrsig_sign(ctx, sig64, msg32, &keypairs[d - 1], secp256k1_hardened_nonce_function_smallint, &k));
166+
CHECK(secp256k1_schnorrsig_sign_custom(ctx, sig64, msg32, &keypairs[d - 1], secp256k1_hardened_nonce_function_smallint, &k));
167167
/* The first 32 bytes must match the xonly pubkey for the specified k. */
168168
CHECK(secp256k1_memcmp_var(sig64, xonly_pubkey_bytes[k - 1], 32) == 0);
169169
/* The last 32 bytes must match the expected s value. */

‎src/modules/schnorrsig/tests_impl.h‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -143,23 +143,23 @@ void test_schnorrsig_api(void) {
143143

144144
/** main test body **/
145145
ecount = 0;
146-
CHECK(secp256k1_schnorrsig_sign(none, sig, msg, &keypairs[0], NULL, NULL) == 0);
146+
CHECK(secp256k1_schnorrsig_sign(none, sig, msg, &keypairs[0], NULL) == 0);
147147
CHECK(ecount == 1);
148-
CHECK(secp256k1_schnorrsig_sign(vrfy, sig, msg, &keypairs[0], NULL, NULL) == 0);
148+
CHECK(secp256k1_schnorrsig_sign(vrfy, sig, msg, &keypairs[0], NULL) == 0);
149149
CHECK(ecount == 2);
150-
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL, NULL) == 1);
150+
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL) == 1);
151151
CHECK(ecount == 2);
152-
CHECK(secp256k1_schnorrsig_sign(sign, NULL, msg, &keypairs[0], NULL, NULL) == 0);
152+
CHECK(secp256k1_schnorrsig_sign(sign, NULL, msg, &keypairs[0], NULL) == 0);
153153
CHECK(ecount == 3);
154-
CHECK(secp256k1_schnorrsig_sign(sign, sig, NULL, &keypairs[0], NULL, NULL) == 0);
154+
CHECK(secp256k1_schnorrsig_sign(sign, sig, NULL, &keypairs[0], NULL) == 0);
155155
CHECK(ecount == 4);
156-
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, NULL, NULL, NULL) == 0);
156+
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, NULL, NULL) == 0);
157157
CHECK(ecount == 5);
158-
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &invalid_keypair, NULL, NULL) == 0);
158+
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &invalid_keypair, NULL) == 0);
159159
CHECK(ecount == 6);
160160

161161
ecount = 0;
162-
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL, NULL) == 1);
162+
CHECK(secp256k1_schnorrsig_sign(sign, sig, msg, &keypairs[0], NULL) == 1);
163163
CHECK(secp256k1_schnorrsig_verify(none, sig, msg, &pk[0]) == 0);
164164
CHECK(ecount == 1);
165165
CHECK(secp256k1_schnorrsig_verify(sign, sig, msg, &pk[0]) == 0);
@@ -201,7 +201,7 @@ void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const un
201201
secp256k1_xonly_pubkey pk, pk_expected;
202202

203203
CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
204-
CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, aux_rand));
204+
CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, aux_rand));
205205
CHECK(secp256k1_memcmp_var(sig, expected_sig, 64) == 0);
206206

207207
CHECK(secp256k1_xonly_pubkey_parse(ctx, &pk_expected, pk_serialized));
@@ -685,16 +685,16 @@ void test_schnorrsig_sign(void) {
685685

686686
secp256k1_testrand256(sk);
687687
CHECK(secp256k1_keypair_create(ctx, &keypair, sk));
688-
CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, NULL) == 1);
688+
CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL) == 1);
689689

690690
/* Test different nonce functions */
691691
memset(sig, 1, sizeof(sig));
692-
CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, nonce_function_failing, NULL) == 0);
692+
CHECK(secp256k1_schnorrsig_sign_custom(ctx, sig, msg, &keypair, nonce_function_failing, NULL) == 0);
693693
CHECK(secp256k1_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
694694
memset(&sig, 1, sizeof(sig));
695-
CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, nonce_function_0, NULL) == 0);
695+
CHECK(secp256k1_schnorrsig_sign_custom(ctx, sig, msg, &keypair, nonce_function_0, NULL) == 0);
696696
CHECK(secp256k1_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
697-
CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, nonce_function_overflowing, NULL) == 1);
697+
CHECK(secp256k1_schnorrsig_sign_custom(ctx, sig, msg, &keypair, nonce_function_overflowing, NULL) == 1);
698698
CHECK(secp256k1_memcmp_var(sig, zeros64, sizeof(sig)) != 0);
699699
}
700700

@@ -717,7 +717,7 @@ void test_schnorrsig_sign_verify(void) {
717717

718718
for (i = 0; i < N_SIGS; i++) {
719719
secp256k1_testrand256(msg[i]);
720-
CHECK(secp256k1_schnorrsig_sign(ctx, sig[i], msg[i], &keypair, NULL, NULL));
720+
CHECK(secp256k1_schnorrsig_sign(ctx, sig[i], msg[i], &keypair, NULL));
721721
CHECK(secp256k1_schnorrsig_verify(ctx, sig[i], msg[i], &pk));
722722
}
723723

@@ -746,13 +746,13 @@ void test_schnorrsig_sign_verify(void) {
746746
}
747747

748748
/* Test overflowing s */
749-
CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL, NULL));
749+
CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL));
750750
CHECK(secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
751751
memset(&sig[0][32], 0xFF, 32);
752752
CHECK(!secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
753753

754754
/* Test negative s */
755-
CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL, NULL));
755+
CHECK(secp256k1_schnorrsig_sign(ctx, sig[0], msg[0], &keypair, NULL));
756756
CHECK(secp256k1_schnorrsig_verify(ctx, sig[0], msg[0], &pk));
757757
secp256k1_scalar_set_b32(&s, &sig[0][32], NULL);
758758
secp256k1_scalar_negate(&s, &s);
@@ -785,7 +785,7 @@ void test_schnorrsig_taproot(void) {
785785

786786
/* Key spend */
787787
secp256k1_testrand256(msg);
788-
CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, NULL) == 1);
788+
CHECK(secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL) == 1);
789789
/* Verify key spend */
790790
CHECK(secp256k1_xonly_pubkey_parse(ctx, &output_pk, output_pk_bytes) == 1);
791791
CHECK(secp256k1_schnorrsig_verify(ctx, sig, msg, &output_pk) == 1);

‎src/valgrind_ctime_test.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ void run_tests(secp256k1_context *ctx, unsigned char *key) {
166166
ret = secp256k1_keypair_create(ctx, &keypair, key);
167167
VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
168168
CHECK(ret == 1);
169-
ret = secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, NULL);
169+
ret = secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL);
170170
VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
171171
CHECK(ret == 1);
172172
#endif

0 commit comments

Comments
 (0)