github.com/arieschain/arieschain@v0.0.0-20191023063405-37c074544356/crypto/signature_nocgo.go (about) 1 // +build nacl js nocgo 2 3 package crypto 4 5 import ( 6 "crypto/ecdsa" 7 "crypto/elliptic" 8 "errors" 9 "fmt" 10 "math/big" 11 12 "github.com/btcsuite/btcd/btcec" 13 ) 14 15 // Ecrecover returns the uncompressed public key that created the given signature. 16 func Ecrecover(hash, sig []byte) ([]byte, error) { 17 pub, err := SigToPub(hash, sig) 18 if err != nil { 19 return nil, err 20 } 21 bytes := (*btcec.PublicKey)(pub).SerializeUncompressed() 22 return bytes, err 23 } 24 25 // SigToPub returns the public key that created the given signature. 26 func SigToPub(hash, sig []byte) (*ecdsa.PublicKey, error) { 27 // Convert to btcec input format with 'recovery id' v at the beginning. 28 btcsig := make([]byte, 65) 29 btcsig[0] = sig[64] + 27 30 copy(btcsig[1:], sig) 31 32 pub, _, err := btcec.RecoverCompact(btcec.S256(), btcsig, hash) 33 return (*ecdsa.PublicKey)(pub), err 34 } 35 36 // Sign calculates an ECDSA signature. 37 // 38 // This function is susceptible to chosen plaintext attacks that can leak 39 // information about the private key that is used for signing. Callers must 40 // be aware that the given hash cannot be chosen by an adversery. Common 41 // solution is to hash any input before calculating the signature. 42 // 43 // The produced signature is in the [R || S || V] format where V is 0 or 1. 44 func Sign(hash []byte, prv *ecdsa.PrivateKey) ([]byte, error) { 45 if len(hash) != 32 { 46 return nil, fmt.Errorf("hash is required to be exactly 32 bytes (%d)", len(hash)) 47 } 48 if prv.Curve != btcec.S256() { 49 return nil, fmt.Errorf("private key curve is not secp256k1") 50 } 51 sig, err := btcec.SignCompact(btcec.S256(), (*btcec.PrivateKey)(prv), hash, false) 52 if err != nil { 53 return nil, err 54 } 55 // Convert to Ethereum signature format with 'recovery id' v at the end. 56 v := sig[0] - 27 57 copy(sig, sig[1:]) 58 sig[64] = v 59 return sig, nil 60 } 61 62 // VerifySignature checks that the given public key created signature over hash. 63 // The public key should be in compressed (33 bytes) or uncompressed (65 bytes) format. 64 // The signature should have the 64 byte [R || S] format. 65 func VerifySignature(pubkey, hash, signature []byte) bool { 66 if len(signature) != 64 { 67 return false 68 } 69 sig := &btcec.Signature{R: new(big.Int).SetBytes(signature[:32]), S: new(big.Int).SetBytes(signature[32:])} 70 key, err := btcec.ParsePubKey(pubkey, btcec.S256()) 71 if err != nil { 72 return false 73 } 74 // Reject malleable signatures. libsecp256k1 does this check but btcec doesn't. 75 if sig.S.Cmp(secp256k1_halfN) > 0 { 76 return false 77 } 78 return sig.Verify(hash, key) 79 } 80 81 // DecompressPubkey parses a public key in the 33-byte compressed format. 82 func DecompressPubkey(pubkey []byte) (*ecdsa.PublicKey, error) { 83 if len(pubkey) != 33 { 84 return nil, errors.New("invalid compressed public key length") 85 } 86 key, err := btcec.ParsePubKey(pubkey, btcec.S256()) 87 if err != nil { 88 return nil, err 89 } 90 return key.ToECDSA(), nil 91 } 92 93 // CompressPubkey encodes a public key to the 33-byte compressed format. 94 func CompressPubkey(pubkey *ecdsa.PublicKey) []byte { 95 return (*btcec.PublicKey)(pubkey).SerializeCompressed() 96 } 97 98 // S256 returns an instance of the secp256k1 curve. 99 func S256() elliptic.Curve { 100 return btcec.S256() 101 }