Bitcoin ABC 0.33.6
P2P Digital Currency
tests_impl.h
Go to the documentation of this file.
1/***********************************************************************
2 * Copyright (c) 2018-2020 Andrew Poelstra, Jonas Nick *
3 * Distributed under the MIT software license, see the accompanying *
4 * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
5 ***********************************************************************/
6
7#ifndef SECP256K1_MODULE_SCHNORRSIG_TESTS_H
8#define SECP256K1_MODULE_SCHNORRSIG_TESTS_H
9
10#include "../../../include/secp256k1_schnorrsig.h"
11
12/* Checks that a bit flip in the n_flip-th argument (that has n_bytes many
13 * bytes) changes the hash function
14 */
15static void nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes, size_t msglen, size_t algolen) {
16 unsigned char nonces[2][32];
17 CHECK(nonce_function_bip340(nonces[0], args[0], msglen, args[1], args[2], args[3], algolen, args[4]) == 1);
18 secp256k1_testrand_flip(args[n_flip], n_bytes);
19 CHECK(nonce_function_bip340(nonces[1], args[0], msglen, args[1], args[2], args[3], algolen, args[4]) == 1);
20 CHECK(secp256k1_memcmp_var(nonces[0], nonces[1], 32) != 0);
21}
22
23static void run_nonce_function_bip340_tests(void) {
24 unsigned char tag[] = {'B', 'I', 'P', '0', '3', '4', '0', '/', 'n', 'o', 'n', 'c', 'e'};
25 unsigned char aux_tag[] = {'B', 'I', 'P', '0', '3', '4', '0', '/', 'a', 'u', 'x'};
26 unsigned char algo[] = {'B', 'I', 'P', '0', '3', '4', '0', '/', 'n', 'o', 'n', 'c', 'e'};
27 size_t algolen = sizeof(algo);
28 secp256k1_sha256 sha;
29 secp256k1_sha256 sha_optimized;
30 unsigned char nonce[32], nonce_z[32];
31 unsigned char msg[32];
32 size_t msglen = sizeof(msg);
33 unsigned char key[32];
34 unsigned char pk[32];
35 unsigned char aux_rand[32];
36 unsigned char *args[5];
37 int i;
38
39 /* Check that hash initialized by
40 * secp256k1_nonce_function_bip340_sha256_tagged has the expected
41 * state. */
42 secp256k1_sha256_initialize_tagged(&sha, tag, sizeof(tag));
43 secp256k1_nonce_function_bip340_sha256_tagged(&sha_optimized);
44 test_sha256_eq(&sha, &sha_optimized);
45
46 /* Check that hash initialized by
47 * secp256k1_nonce_function_bip340_sha256_tagged_aux has the expected
48 * state. */
49 secp256k1_sha256_initialize_tagged(&sha, aux_tag, sizeof(aux_tag));
50 secp256k1_nonce_function_bip340_sha256_tagged_aux(&sha_optimized);
51 test_sha256_eq(&sha, &sha_optimized);
52
53 secp256k1_testrand256(msg);
54 secp256k1_testrand256(key);
55 secp256k1_testrand256(pk);
56 secp256k1_testrand256(aux_rand);
57
58 /* Check that a bitflip in an argument results in different nonces. */
59 args[0] = msg;
60 args[1] = key;
61 args[2] = pk;
62 args[3] = algo;
63 args[4] = aux_rand;
64 for (i = 0; i < COUNT; i++) {
65 nonce_function_bip340_bitflip(args, 0, 32, msglen, algolen);
66 nonce_function_bip340_bitflip(args, 1, 32, msglen, algolen);
67 nonce_function_bip340_bitflip(args, 2, 32, msglen, algolen);
68 /* Flip algo special case "BIP0340/nonce" */
69 nonce_function_bip340_bitflip(args, 3, algolen, msglen, algolen);
70 /* Flip algo again */
71 nonce_function_bip340_bitflip(args, 3, algolen, msglen, algolen);
72 nonce_function_bip340_bitflip(args, 4, 32, msglen, algolen);
73 }
74
75 /* NULL algo is disallowed */
76 CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, NULL, 0, NULL) == 0);
77 CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
78 /* Other algo is fine */
79 secp256k1_testrand_bytes_test(algo, algolen);
80 CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
81
82 for (i = 0; i < COUNT; i++) {
83 unsigned char nonce2[32];
84 uint32_t offset = secp256k1_testrand_int(msglen - 1);
85 size_t msglen_tmp = (msglen + offset) % msglen;
86 size_t algolen_tmp;
87
88 /* Different msglen gives different nonce */
89 CHECK(nonce_function_bip340(nonce2, msg, msglen_tmp, key, pk, algo, algolen, NULL) == 1);
90 CHECK(secp256k1_memcmp_var(nonce, nonce2, 32) != 0);
91
92 /* Different algolen gives different nonce */
93 offset = secp256k1_testrand_int(algolen - 1);
94 algolen_tmp = (algolen + offset) % algolen;
95 CHECK(nonce_function_bip340(nonce2, msg, msglen, key, pk, algo, algolen_tmp, NULL) == 1);
96 CHECK(secp256k1_memcmp_var(nonce, nonce2, 32) != 0);
97 }
98
99 /* NULL aux_rand argument is allowed, and identical to passing all zero aux_rand. */
100 memset(aux_rand, 0, 32);
101 CHECK(nonce_function_bip340(nonce_z, msg, msglen, key, pk, algo, algolen, &aux_rand) == 1);
102 CHECK(nonce_function_bip340(nonce, msg, msglen, key, pk, algo, algolen, NULL) == 1);
103 CHECK(secp256k1_memcmp_var(nonce_z, nonce, 32) == 0);
104}
105
106static void test_schnorrsig_api(void) {
107 unsigned char sk1[32];
108 unsigned char sk2[32];
109 unsigned char sk3[32];
110 unsigned char msg[32];
111 secp256k1_keypair keypairs[3];
112 secp256k1_keypair invalid_keypair = {{ 0 }};
113 secp256k1_xonly_pubkey pk[3];
114 secp256k1_xonly_pubkey zero_pk;
115 unsigned char sig[64];
116 secp256k1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
117 secp256k1_schnorrsig_extraparams invalid_extraparams = {{ 0 }, NULL, NULL};
118
119 secp256k1_testrand256(sk1);
120 secp256k1_testrand256(sk2);
121 secp256k1_testrand256(sk3);
122 secp256k1_testrand256(msg);
123 CHECK(secp256k1_keypair_create(CTX, &keypairs[0], sk1) == 1);
124 CHECK(secp256k1_keypair_create(CTX, &keypairs[1], sk2) == 1);
125 CHECK(secp256k1_keypair_create(CTX, &keypairs[2], sk3) == 1);
126 CHECK(secp256k1_keypair_xonly_pub(CTX, &pk[0], NULL, &keypairs[0]) == 1);
127 CHECK(secp256k1_keypair_xonly_pub(CTX, &pk[1], NULL, &keypairs[1]) == 1);
128 CHECK(secp256k1_keypair_xonly_pub(CTX, &pk[2], NULL, &keypairs[2]) == 1);
129 memset(&zero_pk, 0, sizeof(zero_pk));
130
132 CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, &keypairs[0], NULL) == 1);
133 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign32(CTX, NULL, msg, &keypairs[0], NULL));
134 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign32(CTX, sig, NULL, &keypairs[0], NULL));
135 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign32(CTX, sig, msg, NULL, NULL));
136 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign32(CTX, sig, msg, &invalid_keypair, NULL));
137 CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorrsig_sign32(STATIC_CTX, sig, msg, &keypairs[0], NULL));
138
139 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
140 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, NULL, msg, sizeof(msg), &keypairs[0], &extraparams));
141 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, sig, NULL, sizeof(msg), &keypairs[0], &extraparams));
142 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, NULL, 0, &keypairs[0], &extraparams) == 1);
143 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), NULL, &extraparams));
144 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &invalid_keypair, &extraparams));
145 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], NULL) == 1);
146 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], &invalid_extraparams));
147 CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorrsig_sign_custom(STATIC_CTX, sig, msg, sizeof(msg), &keypairs[0], &extraparams));
148
149 CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, &keypairs[0], NULL) == 1);
150 CHECK(secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &pk[0]) == 1);
151 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_verify(CTX, NULL, msg, sizeof(msg), &pk[0]));
152 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_verify(CTX, sig, NULL, sizeof(msg), &pk[0]));
153 CHECK(secp256k1_schnorrsig_verify(CTX, sig, NULL, 0, &pk[0]) == 0);
154 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), NULL));
155 CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &zero_pk));
156}
157
158/* Checks that hash initialized by secp256k1_schnorrsig_sha256_tagged has the
159 * expected state. */
160static void test_schnorrsig_sha256_tagged(void) {
161 unsigned char tag[] = {'B', 'I', 'P', '0', '3', '4', '0', '/', 'c', 'h', 'a', 'l', 'l', 'e', 'n', 'g', 'e'};
162 secp256k1_sha256 sha;
163 secp256k1_sha256 sha_optimized;
164
165 secp256k1_sha256_initialize_tagged(&sha, (unsigned char *) tag, sizeof(tag));
166 secp256k1_schnorrsig_sha256_tagged(&sha_optimized);
167 test_sha256_eq(&sha, &sha_optimized);
168}
169
170/* Helper function for schnorrsig_bip_vectors
171 * Signs the message and checks that it's the same as expected_sig. */
172static void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *expected_sig) {
173 unsigned char sig[64];
174 secp256k1_keypair keypair;
175 secp256k1_xonly_pubkey pk, pk_expected;
176
177 CHECK(secp256k1_keypair_create(CTX, &keypair, sk));
178 CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg32, &keypair, aux_rand));
179 CHECK(secp256k1_memcmp_var(sig, expected_sig, 64) == 0);
180
181 CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk_expected, pk_serialized));
182 CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair));
183 CHECK(secp256k1_memcmp_var(&pk, &pk_expected, sizeof(pk)) == 0);
184 CHECK(secp256k1_schnorrsig_verify(CTX, sig, msg32, 32, &pk));
185}
186
187/* Helper function for schnorrsig_bip_vectors
188 * Checks that both verify and verify_batch (TODO) return the same value as expected. */
189static void test_schnorrsig_bip_vectors_check_verify(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, int expected) {
190 secp256k1_xonly_pubkey pk;
191
192 CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk, pk_serialized));
193 CHECK(expected == secp256k1_schnorrsig_verify(CTX, sig, msg32, 32, &pk));
194}
195
196/* Test vectors according to BIP-340 ("Schnorr Signatures for secp256k1"). See
197 * https://github.com/bitcoin/bips/blob/master/bip-0340/test-vectors.csv. */
198static void test_schnorrsig_bip_vectors(void) {
199 {
200 /* Test vector 0 */
201 const unsigned char sk[32] = {
202 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
203 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
204 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
205 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03
206 };
207 const unsigned char pk[32] = {
208 0xF9, 0x30, 0x8A, 0x01, 0x92, 0x58, 0xC3, 0x10,
209 0x49, 0x34, 0x4F, 0x85, 0xF8, 0x9D, 0x52, 0x29,
210 0xB5, 0x31, 0xC8, 0x45, 0x83, 0x6F, 0x99, 0xB0,
211 0x86, 0x01, 0xF1, 0x13, 0xBC, 0xE0, 0x36, 0xF9
212 };
213 unsigned char aux_rand[32] = {
214 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
215 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
216 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
217 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
218 };
219 const unsigned char msg[32] = {
220 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
221 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
222 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
223 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
224 };
225 const unsigned char sig[64] = {
226 0xE9, 0x07, 0x83, 0x1F, 0x80, 0x84, 0x8D, 0x10,
227 0x69, 0xA5, 0x37, 0x1B, 0x40, 0x24, 0x10, 0x36,
228 0x4B, 0xDF, 0x1C, 0x5F, 0x83, 0x07, 0xB0, 0x08,
229 0x4C, 0x55, 0xF1, 0xCE, 0x2D, 0xCA, 0x82, 0x15,
230 0x25, 0xF6, 0x6A, 0x4A, 0x85, 0xEA, 0x8B, 0x71,
231 0xE4, 0x82, 0xA7, 0x4F, 0x38, 0x2D, 0x2C, 0xE5,
232 0xEB, 0xEE, 0xE8, 0xFD, 0xB2, 0x17, 0x2F, 0x47,
233 0x7D, 0xF4, 0x90, 0x0D, 0x31, 0x05, 0x36, 0xC0
234 };
235 test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
236 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
237 }
238 {
239 /* Test vector 1 */
240 const unsigned char sk[32] = {
241 0xB7, 0xE1, 0x51, 0x62, 0x8A, 0xED, 0x2A, 0x6A,
242 0xBF, 0x71, 0x58, 0x80, 0x9C, 0xF4, 0xF3, 0xC7,
243 0x62, 0xE7, 0x16, 0x0F, 0x38, 0xB4, 0xDA, 0x56,
244 0xA7, 0x84, 0xD9, 0x04, 0x51, 0x90, 0xCF, 0xEF
245 };
246 const unsigned char pk[32] = {
247 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
248 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
249 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
250 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
251 };
252 unsigned char aux_rand[32] = {
253 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
254 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
255 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
256 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
257 };
258 const unsigned char msg[32] = {
259 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
260 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
261 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
262 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
263 };
264 const unsigned char sig[64] = {
265 0x68, 0x96, 0xBD, 0x60, 0xEE, 0xAE, 0x29, 0x6D,
266 0xB4, 0x8A, 0x22, 0x9F, 0xF7, 0x1D, 0xFE, 0x07,
267 0x1B, 0xDE, 0x41, 0x3E, 0x6D, 0x43, 0xF9, 0x17,
268 0xDC, 0x8D, 0xCF, 0x8C, 0x78, 0xDE, 0x33, 0x41,
269 0x89, 0x06, 0xD1, 0x1A, 0xC9, 0x76, 0xAB, 0xCC,
270 0xB2, 0x0B, 0x09, 0x12, 0x92, 0xBF, 0xF4, 0xEA,
271 0x89, 0x7E, 0xFC, 0xB6, 0x39, 0xEA, 0x87, 0x1C,
272 0xFA, 0x95, 0xF6, 0xDE, 0x33, 0x9E, 0x4B, 0x0A
273 };
274 test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
275 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
276 }
277 {
278 /* Test vector 2 */
279 const unsigned char sk[32] = {
280 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
281 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
282 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
283 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x14, 0xE5, 0xC9
284 };
285 const unsigned char pk[32] = {
286 0xDD, 0x30, 0x8A, 0xFE, 0xC5, 0x77, 0x7E, 0x13,
287 0x12, 0x1F, 0xA7, 0x2B, 0x9C, 0xC1, 0xB7, 0xCC,
288 0x01, 0x39, 0x71, 0x53, 0x09, 0xB0, 0x86, 0xC9,
289 0x60, 0xE1, 0x8F, 0xD9, 0x69, 0x77, 0x4E, 0xB8
290 };
291 unsigned char aux_rand[32] = {
292 0xC8, 0x7A, 0xA5, 0x38, 0x24, 0xB4, 0xD7, 0xAE,
293 0x2E, 0xB0, 0x35, 0xA2, 0xB5, 0xBB, 0xBC, 0xCC,
294 0x08, 0x0E, 0x76, 0xCD, 0xC6, 0xD1, 0x69, 0x2C,
295 0x4B, 0x0B, 0x62, 0xD7, 0x98, 0xE6, 0xD9, 0x06
296 };
297 const unsigned char msg[32] = {
298 0x7E, 0x2D, 0x58, 0xD8, 0xB3, 0xBC, 0xDF, 0x1A,
299 0xBA, 0xDE, 0xC7, 0x82, 0x90, 0x54, 0xF9, 0x0D,
300 0xDA, 0x98, 0x05, 0xAA, 0xB5, 0x6C, 0x77, 0x33,
301 0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C
302 };
303 const unsigned char sig[64] = {
304 0x58, 0x31, 0xAA, 0xEE, 0xD7, 0xB4, 0x4B, 0xB7,
305 0x4E, 0x5E, 0xAB, 0x94, 0xBA, 0x9D, 0x42, 0x94,
306 0xC4, 0x9B, 0xCF, 0x2A, 0x60, 0x72, 0x8D, 0x8B,
307 0x4C, 0x20, 0x0F, 0x50, 0xDD, 0x31, 0x3C, 0x1B,
308 0xAB, 0x74, 0x58, 0x79, 0xA5, 0xAD, 0x95, 0x4A,
309 0x72, 0xC4, 0x5A, 0x91, 0xC3, 0xA5, 0x1D, 0x3C,
310 0x7A, 0xDE, 0xA9, 0x8D, 0x82, 0xF8, 0x48, 0x1E,
311 0x0E, 0x1E, 0x03, 0x67, 0x4A, 0x6F, 0x3F, 0xB7
312 };
313 test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
314 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
315 }
316 {
317 /* Test vector 3 */
318 const unsigned char sk[32] = {
319 0x0B, 0x43, 0x2B, 0x26, 0x77, 0x93, 0x73, 0x81,
320 0xAE, 0xF0, 0x5B, 0xB0, 0x2A, 0x66, 0xEC, 0xD0,
321 0x12, 0x77, 0x30, 0x62, 0xCF, 0x3F, 0xA2, 0x54,
322 0x9E, 0x44, 0xF5, 0x8E, 0xD2, 0x40, 0x17, 0x10
323 };
324 const unsigned char pk[32] = {
325 0x25, 0xD1, 0xDF, 0xF9, 0x51, 0x05, 0xF5, 0x25,
326 0x3C, 0x40, 0x22, 0xF6, 0x28, 0xA9, 0x96, 0xAD,
327 0x3A, 0x0D, 0x95, 0xFB, 0xF2, 0x1D, 0x46, 0x8A,
328 0x1B, 0x33, 0xF8, 0xC1, 0x60, 0xD8, 0xF5, 0x17
329 };
330 unsigned char aux_rand[32] = {
331 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
332 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
333 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
334 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
335 };
336 const unsigned char msg[32] = {
337 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
338 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
339 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
340 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
341 };
342 const unsigned char sig[64] = {
343 0x7E, 0xB0, 0x50, 0x97, 0x57, 0xE2, 0x46, 0xF1,
344 0x94, 0x49, 0x88, 0x56, 0x51, 0x61, 0x1C, 0xB9,
345 0x65, 0xEC, 0xC1, 0xA1, 0x87, 0xDD, 0x51, 0xB6,
346 0x4F, 0xDA, 0x1E, 0xDC, 0x96, 0x37, 0xD5, 0xEC,
347 0x97, 0x58, 0x2B, 0x9C, 0xB1, 0x3D, 0xB3, 0x93,
348 0x37, 0x05, 0xB3, 0x2B, 0xA9, 0x82, 0xAF, 0x5A,
349 0xF2, 0x5F, 0xD7, 0x88, 0x81, 0xEB, 0xB3, 0x27,
350 0x71, 0xFC, 0x59, 0x22, 0xEF, 0xC6, 0x6E, 0xA3
351 };
352 test_schnorrsig_bip_vectors_check_signing(sk, pk, aux_rand, msg, sig);
353 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
354 }
355 {
356 /* Test vector 4 */
357 const unsigned char pk[32] = {
358 0xD6, 0x9C, 0x35, 0x09, 0xBB, 0x99, 0xE4, 0x12,
359 0xE6, 0x8B, 0x0F, 0xE8, 0x54, 0x4E, 0x72, 0x83,
360 0x7D, 0xFA, 0x30, 0x74, 0x6D, 0x8B, 0xE2, 0xAA,
361 0x65, 0x97, 0x5F, 0x29, 0xD2, 0x2D, 0xC7, 0xB9
362 };
363 const unsigned char msg[32] = {
364 0x4D, 0xF3, 0xC3, 0xF6, 0x8F, 0xCC, 0x83, 0xB2,
365 0x7E, 0x9D, 0x42, 0xC9, 0x04, 0x31, 0xA7, 0x24,
366 0x99, 0xF1, 0x78, 0x75, 0xC8, 0x1A, 0x59, 0x9B,
367 0x56, 0x6C, 0x98, 0x89, 0xB9, 0x69, 0x67, 0x03
368 };
369 const unsigned char sig[64] = {
370 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
371 0x00, 0x00, 0x00, 0x3B, 0x78, 0xCE, 0x56, 0x3F,
372 0x89, 0xA0, 0xED, 0x94, 0x14, 0xF5, 0xAA, 0x28,
373 0xAD, 0x0D, 0x96, 0xD6, 0x79, 0x5F, 0x9C, 0x63,
374 0x76, 0xAF, 0xB1, 0x54, 0x8A, 0xF6, 0x03, 0xB3,
375 0xEB, 0x45, 0xC9, 0xF8, 0x20, 0x7D, 0xEE, 0x10,
376 0x60, 0xCB, 0x71, 0xC0, 0x4E, 0x80, 0xF5, 0x93,
377 0x06, 0x0B, 0x07, 0xD2, 0x83, 0x08, 0xD7, 0xF4
378 };
379 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 1);
380 }
381 {
382 /* Test vector 5 */
383 const unsigned char pk[32] = {
384 0xEE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, 0x50,
385 0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF, 0x21,
386 0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76, 0x87,
387 0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A, 0x34
388 };
389 secp256k1_xonly_pubkey pk_parsed;
390 /* No need to check the signature of the test vector as parsing the pubkey already fails */
391 CHECK(!secp256k1_xonly_pubkey_parse(CTX, &pk_parsed, pk));
392 }
393 {
394 /* Test vector 6 */
395 const unsigned char pk[32] = {
396 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
397 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
398 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
399 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
400 };
401 const unsigned char msg[32] = {
402 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
403 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
404 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
405 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
406 };
407 const unsigned char sig[64] = {
408 0xFF, 0xF9, 0x7B, 0xD5, 0x75, 0x5E, 0xEE, 0xA4,
409 0x20, 0x45, 0x3A, 0x14, 0x35, 0x52, 0x35, 0xD3,
410 0x82, 0xF6, 0x47, 0x2F, 0x85, 0x68, 0xA1, 0x8B,
411 0x2F, 0x05, 0x7A, 0x14, 0x60, 0x29, 0x75, 0x56,
412 0x3C, 0xC2, 0x79, 0x44, 0x64, 0x0A, 0xC6, 0x07,
413 0xCD, 0x10, 0x7A, 0xE1, 0x09, 0x23, 0xD9, 0xEF,
414 0x7A, 0x73, 0xC6, 0x43, 0xE1, 0x66, 0xBE, 0x5E,
415 0xBE, 0xAF, 0xA3, 0x4B, 0x1A, 0xC5, 0x53, 0xE2
416 };
417 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
418 }
419 {
420 /* Test vector 7 */
421 const unsigned char pk[32] = {
422 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
423 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
424 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
425 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
426 };
427 const unsigned char msg[32] = {
428 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
429 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
430 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
431 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
432 };
433 const unsigned char sig[64] = {
434 0x1F, 0xA6, 0x2E, 0x33, 0x1E, 0xDB, 0xC2, 0x1C,
435 0x39, 0x47, 0x92, 0xD2, 0xAB, 0x11, 0x00, 0xA7,
436 0xB4, 0x32, 0xB0, 0x13, 0xDF, 0x3F, 0x6F, 0xF4,
437 0xF9, 0x9F, 0xCB, 0x33, 0xE0, 0xE1, 0x51, 0x5F,
438 0x28, 0x89, 0x0B, 0x3E, 0xDB, 0x6E, 0x71, 0x89,
439 0xB6, 0x30, 0x44, 0x8B, 0x51, 0x5C, 0xE4, 0xF8,
440 0x62, 0x2A, 0x95, 0x4C, 0xFE, 0x54, 0x57, 0x35,
441 0xAA, 0xEA, 0x51, 0x34, 0xFC, 0xCD, 0xB2, 0xBD
442 };
443 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
444 }
445 {
446 /* Test vector 8 */
447 const unsigned char pk[32] = {
448 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
449 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
450 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
451 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
452 };
453 const unsigned char msg[32] = {
454 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
455 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
456 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
457 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
458 };
459 const unsigned char sig[64] = {
460 0x6C, 0xFF, 0x5C, 0x3B, 0xA8, 0x6C, 0x69, 0xEA,
461 0x4B, 0x73, 0x76, 0xF3, 0x1A, 0x9B, 0xCB, 0x4F,
462 0x74, 0xC1, 0x97, 0x60, 0x89, 0xB2, 0xD9, 0x96,
463 0x3D, 0xA2, 0xE5, 0x54, 0x3E, 0x17, 0x77, 0x69,
464 0x96, 0x17, 0x64, 0xB3, 0xAA, 0x9B, 0x2F, 0xFC,
465 0xB6, 0xEF, 0x94, 0x7B, 0x68, 0x87, 0xA2, 0x26,
466 0xE8, 0xD7, 0xC9, 0x3E, 0x00, 0xC5, 0xED, 0x0C,
467 0x18, 0x34, 0xFF, 0x0D, 0x0C, 0x2E, 0x6D, 0xA6
468 };
469 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
470 }
471 {
472 /* Test vector 9 */
473 const unsigned char pk[32] = {
474 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
475 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
476 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
477 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
478 };
479 const unsigned char msg[32] = {
480 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
481 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
482 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
483 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
484 };
485 const unsigned char sig[64] = {
486 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
487 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
488 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
489 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
490 0x12, 0x3D, 0xDA, 0x83, 0x28, 0xAF, 0x9C, 0x23,
491 0xA9, 0x4C, 0x1F, 0xEE, 0xCF, 0xD1, 0x23, 0xBA,
492 0x4F, 0xB7, 0x34, 0x76, 0xF0, 0xD5, 0x94, 0xDC,
493 0xB6, 0x5C, 0x64, 0x25, 0xBD, 0x18, 0x60, 0x51
494 };
495 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
496 }
497 {
498 /* Test vector 10 */
499 const unsigned char pk[32] = {
500 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
501 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
502 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
503 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
504 };
505 const unsigned char msg[32] = {
506 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
507 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
508 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
509 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
510 };
511 const unsigned char sig[64] = {
512 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
513 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
514 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
515 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
516 0x76, 0x15, 0xFB, 0xAF, 0x5A, 0xE2, 0x88, 0x64,
517 0x01, 0x3C, 0x09, 0x97, 0x42, 0xDE, 0xAD, 0xB4,
518 0xDB, 0xA8, 0x7F, 0x11, 0xAC, 0x67, 0x54, 0xF9,
519 0x37, 0x80, 0xD5, 0xA1, 0x83, 0x7C, 0xF1, 0x97
520 };
521 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
522 }
523 {
524 /* Test vector 11 */
525 const unsigned char pk[32] = {
526 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
527 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
528 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
529 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
530 };
531 const unsigned char msg[32] = {
532 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
533 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
534 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
535 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
536 };
537 const unsigned char sig[64] = {
538 0x4A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
539 0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
540 0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
541 0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
542 0x69, 0xE8, 0x9B, 0x4C, 0x55, 0x64, 0xD0, 0x03,
543 0x49, 0x10, 0x6B, 0x84, 0x97, 0x78, 0x5D, 0xD7,
544 0xD1, 0xD7, 0x13, 0xA8, 0xAE, 0x82, 0xB3, 0x2F,
545 0xA7, 0x9D, 0x5F, 0x7F, 0xC4, 0x07, 0xD3, 0x9B
546 };
547 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
548 }
549 {
550 /* Test vector 12 */
551 const unsigned char pk[32] = {
552 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
553 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
554 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
555 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
556 };
557 const unsigned char msg[32] = {
558 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
559 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
560 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
561 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
562 };
563 const unsigned char sig[64] = {
564 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
565 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
566 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
567 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x2F,
568 0x69, 0xE8, 0x9B, 0x4C, 0x55, 0x64, 0xD0, 0x03,
569 0x49, 0x10, 0x6B, 0x84, 0x97, 0x78, 0x5D, 0xD7,
570 0xD1, 0xD7, 0x13, 0xA8, 0xAE, 0x82, 0xB3, 0x2F,
571 0xA7, 0x9D, 0x5F, 0x7F, 0xC4, 0x07, 0xD3, 0x9B
572 };
573 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
574 }
575 {
576 /* Test vector 13 */
577 const unsigned char pk[32] = {
578 0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
579 0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
580 0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
581 0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59
582 };
583 const unsigned char msg[32] = {
584 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
585 0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
586 0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
587 0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89
588 };
589 const unsigned char sig[64] = {
590 0x6C, 0xFF, 0x5C, 0x3B, 0xA8, 0x6C, 0x69, 0xEA,
591 0x4B, 0x73, 0x76, 0xF3, 0x1A, 0x9B, 0xCB, 0x4F,
592 0x74, 0xC1, 0x97, 0x60, 0x89, 0xB2, 0xD9, 0x96,
593 0x3D, 0xA2, 0xE5, 0x54, 0x3E, 0x17, 0x77, 0x69,
594 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
595 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,
596 0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,
597 0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41
598 };
599 test_schnorrsig_bip_vectors_check_verify(pk, msg, sig, 0);
600 }
601 {
602 /* Test vector 14 */
603 const unsigned char pk[32] = {
604 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
605 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
606 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
607 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x30
608 };
609 secp256k1_xonly_pubkey pk_parsed;
610 /* No need to check the signature of the test vector as parsing the pubkey already fails */
611 CHECK(!secp256k1_xonly_pubkey_parse(CTX, &pk_parsed, pk));
612 }
613}
614
615/* Nonce function that returns constant 0 */
616static int nonce_function_failing(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) {
617 (void) msg;
618 (void) msglen;
619 (void) key32;
620 (void) xonly_pk32;
621 (void) algo;
622 (void) algolen;
623 (void) data;
624 (void) nonce32;
625 return 0;
626}
627
628/* Nonce function that sets nonce to 0 */
629static int nonce_function_0(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) {
630 (void) msg;
631 (void) msglen;
632 (void) key32;
633 (void) xonly_pk32;
634 (void) algo;
635 (void) algolen;
636 (void) data;
637
638 memset(nonce32, 0, 32);
639 return 1;
640}
641
642/* Nonce function that sets nonce to 0xFF...0xFF */
643static int nonce_function_overflowing(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data) {
644 (void) msg;
645 (void) msglen;
646 (void) key32;
647 (void) xonly_pk32;
648 (void) algo;
649 (void) algolen;
650 (void) data;
651
652 memset(nonce32, 0xFF, 32);
653 return 1;
654}
655
656static void test_schnorrsig_sign(void) {
657 unsigned char sk[32];
658 secp256k1_xonly_pubkey pk;
659 secp256k1_keypair keypair;
660 const unsigned char msg[] = {'t', 'h', 'i', 's', ' ', 'i', 's', ' ', 'a', ' ', 'm', 's', 'g', ' ', 'f', 'o', 'r', ' ', 'a', ' ', 's', 'c', 'h', 'n', 'o', 'r', 'r', 's', 'i', 'g', '.', '.'};
661 unsigned char sig[64];
662 unsigned char sig2[64];
663 unsigned char zeros64[64] = { 0 };
664 secp256k1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
665 unsigned char aux_rand[32];
666
667 secp256k1_testrand256(sk);
668 secp256k1_testrand256(aux_rand);
669 CHECK(secp256k1_keypair_create(CTX, &keypair, sk));
670 CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair));
671 CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, &keypair, NULL) == 1);
672 CHECK(secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &pk));
673 /* Check that deprecated alias gives the same result */
674 CHECK(secp256k1_schnorrsig_sign(CTX, sig2, msg, &keypair, NULL) == 1);
675 CHECK(secp256k1_memcmp_var(sig, sig2, sizeof(sig)) == 0);
676
677 /* Test different nonce functions */
678 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
679 CHECK(secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &pk));
680 memset(sig, 1, sizeof(sig));
681 extraparams.noncefp = nonce_function_failing;
682 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 0);
683 CHECK(secp256k1_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
684 memset(&sig, 1, sizeof(sig));
685 extraparams.noncefp = nonce_function_0;
686 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 0);
687 CHECK(secp256k1_memcmp_var(sig, zeros64, sizeof(sig)) == 0);
688 memset(&sig, 1, sizeof(sig));
689 extraparams.noncefp = nonce_function_overflowing;
690 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
691 CHECK(secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &pk));
692
693 /* When using the default nonce function, schnorrsig_sign_custom produces
694 * the same result as schnorrsig_sign with aux_rand = extraparams.ndata */
695 extraparams.noncefp = NULL;
696 extraparams.ndata = aux_rand;
697 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypair, &extraparams) == 1);
698 CHECK(secp256k1_schnorrsig_sign32(CTX, sig2, msg, &keypair, extraparams.ndata) == 1);
699 CHECK(secp256k1_memcmp_var(sig, sig2, sizeof(sig)) == 0);
700}
701
702#define N_SIGS 3
703/* Creates N_SIGS valid signatures and verifies them with verify and
704 * verify_batch (TODO). Then flips some bits and checks that verification now
705 * fails. */
706static void test_schnorrsig_sign_verify(void) {
707 unsigned char sk[32];
708 unsigned char msg[N_SIGS][32];
709 unsigned char sig[N_SIGS][64];
710 size_t i;
711 secp256k1_keypair keypair;
712 secp256k1_xonly_pubkey pk;
713 secp256k1_scalar s;
714
715 secp256k1_testrand256(sk);
716 CHECK(secp256k1_keypair_create(CTX, &keypair, sk));
717 CHECK(secp256k1_keypair_xonly_pub(CTX, &pk, NULL, &keypair));
718
719 for (i = 0; i < N_SIGS; i++) {
720 secp256k1_testrand256(msg[i]);
721 CHECK(secp256k1_schnorrsig_sign32(CTX, sig[i], msg[i], &keypair, NULL));
722 CHECK(secp256k1_schnorrsig_verify(CTX, sig[i], msg[i], sizeof(msg[i]), &pk));
723 }
724
725 {
726 /* Flip a few bits in the signature and in the message and check that
727 * verify and verify_batch (TODO) fail */
728 size_t sig_idx = secp256k1_testrand_int(N_SIGS);
729 size_t byte_idx = secp256k1_testrand_bits(5);
730 unsigned char xorbyte = secp256k1_testrand_int(254)+1;
731 sig[sig_idx][byte_idx] ^= xorbyte;
732 CHECK(!secp256k1_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
733 sig[sig_idx][byte_idx] ^= xorbyte;
734
735 byte_idx = secp256k1_testrand_bits(5);
736 sig[sig_idx][32+byte_idx] ^= xorbyte;
737 CHECK(!secp256k1_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
738 sig[sig_idx][32+byte_idx] ^= xorbyte;
739
740 byte_idx = secp256k1_testrand_bits(5);
741 msg[sig_idx][byte_idx] ^= xorbyte;
742 CHECK(!secp256k1_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
743 msg[sig_idx][byte_idx] ^= xorbyte;
744
745 /* Check that above bitflips have been reversed correctly */
746 CHECK(secp256k1_schnorrsig_verify(CTX, sig[sig_idx], msg[sig_idx], sizeof(msg[sig_idx]), &pk));
747 }
748
749 /* Test overflowing s */
750 CHECK(secp256k1_schnorrsig_sign32(CTX, sig[0], msg[0], &keypair, NULL));
751 CHECK(secp256k1_schnorrsig_verify(CTX, sig[0], msg[0], sizeof(msg[0]), &pk));
752 memset(&sig[0][32], 0xFF, 32);
753 CHECK(!secp256k1_schnorrsig_verify(CTX, sig[0], msg[0], sizeof(msg[0]), &pk));
754
755 /* Test negative s */
756 CHECK(secp256k1_schnorrsig_sign32(CTX, sig[0], msg[0], &keypair, NULL));
757 CHECK(secp256k1_schnorrsig_verify(CTX, sig[0], msg[0], sizeof(msg[0]), &pk));
758 secp256k1_scalar_set_b32(&s, &sig[0][32], NULL);
759 secp256k1_scalar_negate(&s, &s);
760 secp256k1_scalar_get_b32(&sig[0][32], &s);
761 CHECK(!secp256k1_schnorrsig_verify(CTX, sig[0], msg[0], sizeof(msg[0]), &pk));
762
763 /* The empty message can be signed & verified */
764 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig[0], NULL, 0, &keypair, NULL) == 1);
765 CHECK(secp256k1_schnorrsig_verify(CTX, sig[0], NULL, 0, &pk) == 1);
766
767 {
768 /* Test varying message lengths */
769 unsigned char msg_large[32 * 8];
770 uint32_t msglen = secp256k1_testrand_int(sizeof(msg_large));
771 for (i = 0; i < sizeof(msg_large); i += 32) {
772 secp256k1_testrand256(&msg_large[i]);
773 }
774 CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig[0], msg_large, msglen, &keypair, NULL) == 1);
775 CHECK(secp256k1_schnorrsig_verify(CTX, sig[0], msg_large, msglen, &pk) == 1);
776 /* Verification for a random wrong message length fails */
777 msglen = (msglen + (sizeof(msg_large) - 1)) % sizeof(msg_large);
778 CHECK(secp256k1_schnorrsig_verify(CTX, sig[0], msg_large, msglen, &pk) == 0);
779 }
780}
781#undef N_SIGS
782
783static void test_schnorrsig_taproot(void) {
784 unsigned char sk[32];
785 secp256k1_keypair keypair;
786 secp256k1_xonly_pubkey internal_pk;
787 unsigned char internal_pk_bytes[32];
788 secp256k1_xonly_pubkey output_pk;
789 unsigned char output_pk_bytes[32];
790 unsigned char tweak[32];
791 int pk_parity;
792 unsigned char msg[32];
793 unsigned char sig[64];
794
795 /* Create output key */
796 secp256k1_testrand256(sk);
797 CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
798 CHECK(secp256k1_keypair_xonly_pub(CTX, &internal_pk, NULL, &keypair) == 1);
799 /* In actual taproot the tweak would be hash of internal_pk */
800 CHECK(secp256k1_xonly_pubkey_serialize(CTX, tweak, &internal_pk) == 1);
801 CHECK(secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
802 CHECK(secp256k1_keypair_xonly_pub(CTX, &output_pk, &pk_parity, &keypair) == 1);
803 CHECK(secp256k1_xonly_pubkey_serialize(CTX, output_pk_bytes, &output_pk) == 1);
804
805 /* Key spend */
806 secp256k1_testrand256(msg);
807 CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, &keypair, NULL) == 1);
808 /* Verify key spend */
809 CHECK(secp256k1_xonly_pubkey_parse(CTX, &output_pk, output_pk_bytes) == 1);
810 CHECK(secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &output_pk) == 1);
811
812 /* Script spend */
813 CHECK(secp256k1_xonly_pubkey_serialize(CTX, internal_pk_bytes, &internal_pk) == 1);
814 /* Verify script spend */
815 CHECK(secp256k1_xonly_pubkey_parse(CTX, &internal_pk, internal_pk_bytes) == 1);
816 CHECK(secp256k1_xonly_pubkey_tweak_add_check(CTX, output_pk_bytes, pk_parity, &internal_pk, tweak) == 1);
817}
818
819static void run_schnorrsig_tests(void) {
820 int i;
821 run_nonce_function_bip340_tests();
822
823 test_schnorrsig_api();
824 test_schnorrsig_sha256_tagged();
825 test_schnorrsig_bip_vectors();
826 for (i = 0; i < COUNT; i++) {
827 test_schnorrsig_sign();
828 test_schnorrsig_sign_verify();
829 }
830 test_schnorrsig_taproot();
831}
832
833#endif
secp256k1_sha256_initialize_tagged
static void secp256k1_sha256_initialize_tagged(secp256k1_sha256 *hash, const unsigned char *tag, size_t taglen)
Definition: hash_impl.h:163
tests_wycheproof_generate.msg
def msg
Definition: tests_wycheproof_generate.py:56
tests_wycheproof_generate.pk
def pk
Definition: tests_wycheproof_generate.py:69
sig
SchnorrSig sig
Definition: processor.cpp:537
secp256k1_scalar_set_b32
static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *bin, int *overflow)
Set a scalar from a big endian byte array.
secp256k1_scalar_get_b32
static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar *a)
Convert a scalar to a byte array.
secp256k1_scalar_negate
static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a)
Compute the complement of a scalar (modulo the group order).
nonce_function_bip340
static int nonce_function_bip340(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data)
Definition: main_impl.h:52
secp256k1_nonce_function_bip340_sha256_tagged_aux
static void secp256k1_nonce_function_bip340_sha256_tagged_aux(secp256k1_sha256 *sha)
Definition: main_impl.h:32
secp256k1_nonce_function_bip340_sha256_tagged
static void secp256k1_nonce_function_bip340_sha256_tagged(secp256k1_sha256 *sha)
Definition: main_impl.h:16
secp256k1_schnorrsig_sha256_tagged
static void secp256k1_schnorrsig_sha256_tagged(secp256k1_sha256 *sha)
Definition: main_impl.h:103
test_schnorrsig_sign_verify
static void test_schnorrsig_sign_verify(void)
Definition: tests_impl.h:706
run_nonce_function_bip340_tests
static void run_nonce_function_bip340_tests(void)
Definition: tests_impl.h:23
nonce_function_overflowing
static int nonce_function_overflowing(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data)
Definition: tests_impl.h:643
test_schnorrsig_sign
static void test_schnorrsig_sign(void)
Definition: tests_impl.h:656
test_schnorrsig_api
static void test_schnorrsig_api(void)
Definition: tests_impl.h:106
nonce_function_0
static int nonce_function_0(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data)
Definition: tests_impl.h:629
test_schnorrsig_taproot
static void test_schnorrsig_taproot(void)
Definition: tests_impl.h:783
test_schnorrsig_bip_vectors
static void test_schnorrsig_bip_vectors(void)
Definition: tests_impl.h:198
test_schnorrsig_bip_vectors_check_verify
static void test_schnorrsig_bip_vectors_check_verify(const unsigned char *pk_serialized, const unsigned char *msg32, const unsigned char *sig, int expected)
Definition: tests_impl.h:189
test_schnorrsig_bip_vectors_check_signing
static void test_schnorrsig_bip_vectors_check_signing(const unsigned char *sk, const unsigned char *pk_serialized, const unsigned char *aux_rand, const unsigned char *msg32, const unsigned char *expected_sig)
Definition: tests_impl.h:172
run_schnorrsig_tests
static void run_schnorrsig_tests(void)
Definition: tests_impl.h:819
N_SIGS
#define N_SIGS
Definition: tests_impl.h:702
nonce_function_failing
static int nonce_function_failing(unsigned char *nonce32, const unsigned char *msg, size_t msglen, const unsigned char *key32, const unsigned char *xonly_pk32, const unsigned char *algo, size_t algolen, void *data)
Definition: tests_impl.h:616
test_schnorrsig_sha256_tagged
static void test_schnorrsig_sha256_tagged(void)
Definition: tests_impl.h:160
nonce_function_bip340_bitflip
static void nonce_function_bip340_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes, size_t msglen, size_t algolen)
Definition: tests_impl.h:15
secp256k1_memcmp_var
static SECP256K1_INLINE int secp256k1_memcmp_var(const void *s1, const void *s2, size_t n)
Semantics like memcmp.
Definition: util.h:217
CHECK
#define CHECK(cond)
Definition: util.h:128
secp256k1_xonly_pubkey_serialize
SECP256K1_API int secp256k1_xonly_pubkey_serialize(const secp256k1_context *ctx, unsigned char *output32, const secp256k1_xonly_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Serialize an xonly_pubkey object into a 32-byte sequence.
Definition: main_impl.h:44
secp256k1_xonly_pubkey_tweak_add_check
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_tweak_add_check(const secp256k1_context *ctx, const unsigned char *tweaked_pubkey32, int tweaked_pk_parity, const secp256k1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5)
Checks that a tweaked pubkey is the result of calling secp256k1_xonly_pubkey_tweak_add with internal_...
Definition: main_impl.h:135
secp256k1_keypair_create
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_create(const secp256k1_context *ctx, secp256k1_keypair *keypair, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute the keypair for a secret key.
Definition: main_impl.h:196
secp256k1_keypair_xonly_tweak_add
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_tweak_add(const secp256k1_context *ctx, secp256k1_keypair *keypair, const unsigned char *tweak32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a keypair by adding tweak32 to the secret key and updating the public key accordingly.
Definition: main_impl.h:255
secp256k1_keypair_xonly_pub
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_pub(const secp256k1_context *ctx, secp256k1_xonly_pubkey *pubkey, int *pk_parity, const secp256k1_keypair *keypair) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4)
Get the x-only public key from a keypair.
Definition: main_impl.h:234
secp256k1_xonly_pubkey_parse
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_xonly_pubkey_parse(const secp256k1_context *ctx, secp256k1_xonly_pubkey *pubkey, const unsigned char *input32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Parse a 32-byte sequence into a xonly_pubkey object.
Definition: main_impl.h:22
secp256k1_schnorrsig_sign32
SECP256K1_API int secp256k1_schnorrsig_sign32(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *aux_rand32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create a Schnorr signature.
Definition: main_impl.h:195
SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT
#define SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT
Definition: secp256k1_schnorrsig.h:89
secp256k1_schnorrsig_sign
SECP256K1_API int secp256k1_schnorrsig_sign(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *aux_rand32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_DEPRECATED("Use secp256k1_schnorrsig_sign32 instead")
Same as secp256k1_schnorrsig_sign32, but DEPRECATED.
Definition: main_impl.h:200
secp256k1_schnorrsig_sign_custom
SECP256K1_API int secp256k1_schnorrsig_sign_custom(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_keypair *keypair, secp256k1_schnorrsig_extraparams *extraparams) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5)
Create a Schnorr signature with a more flexible API.
Definition: main_impl.h:204
secp256k1_schnorrsig_verify
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_verify(const secp256k1_context *ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_xonly_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5)
Verify a Schnorr signature.
Definition: main_impl.h:219
secp256k1_keypair
Opaque data structure that holds a keypair consisting of a secret and a public key.
Definition: secp256k1_extrakeys.h:33
secp256k1_scalar
A scalar modulo the group order of the secp256k1 curve.
Definition: scalar_4x64.h:13
secp256k1_schnorrsig_extraparams
Data structure that contains additional arguments for schnorrsig_sign_custom.
Definition: secp256k1_schnorrsig.h:82
secp256k1_schnorrsig_extraparams::noncefp
secp256k1_nonce_function_hardened noncefp
Definition: secp256k1_schnorrsig.h:84
secp256k1_schnorrsig_extraparams::ndata
void * ndata
Definition: secp256k1_schnorrsig.h:85
secp256k1_sha256
Definition: hash.h:13
secp256k1_xonly_pubkey
Opaque data structure that holds a parsed and valid "x-only" public key.
Definition: secp256k1_extrakeys.h:22
secp256k1_testrand_int
static uint32_t secp256k1_testrand_int(uint32_t range)
Generate a pseudorandom number in the range [0..range-1].
secp256k1_testrand_flip
static void secp256k1_testrand_flip(unsigned char *b, size_t len)
Flip a single random bit in a byte array.
secp256k1_testrand_bytes_test
static void secp256k1_testrand_bytes_test(unsigned char *bytes, size_t len)
Generate pseudorandom bytes with long sequences of zero and one bits.
secp256k1_testrand256
static void secp256k1_testrand256(unsigned char *b32)
Generate a pseudorandom 32-byte array.
secp256k1_testrand_bits
static SECP256K1_INLINE uint64_t secp256k1_testrand_bits(int bits)
Generate a pseudorandom number in the range [0..2**bits-1].
COUNT
static int COUNT
Definition: tests.c:40
CHECK_ILLEGAL
#define CHECK_ILLEGAL(ctx, expr)
Definition: tests.c:78
CTX
static secp256k1_context * CTX
Definition: tests.c:41
test_sha256_eq
static void test_sha256_eq(const secp256k1_sha256 *sha1, const secp256k1_sha256 *sha2)
Definition: tests.c:729
STATIC_CTX
static secp256k1_context * STATIC_CTX
Definition: tests.c:42
Generated on Wed Jun 24 2026 07:08:05 for Bitcoin ABC by doxygen 1.9.4