1 | var createHmac = require('create-hmac')
|
2 | var typeforce = require('typeforce')
|
3 | var types = require('./types')
|
4 |
|
5 | var BigInteger = require('bigi')
|
6 | var ECSignature = require('./ecsignature')
|
7 |
|
8 | var ZERO = new Buffer([0])
|
9 | var ONE = new Buffer([1])
|
10 |
|
11 | var ecurve = require('ecurve')
|
12 | var secp256k1 = ecurve.getCurveByName('secp256k1')
|
13 |
|
14 |
|
15 | function deterministicGenerateK (hash, x, checkSig) {
|
16 | typeforce(types.tuple(
|
17 | types.Hash256bit,
|
18 | types.Buffer256bit,
|
19 | types.Function
|
20 | ), arguments)
|
21 |
|
22 | var k = new Buffer(32)
|
23 | var v = new Buffer(32)
|
24 |
|
25 |
|
26 |
|
27 | v.fill(1)
|
28 |
|
29 |
|
30 | k.fill(0)
|
31 |
|
32 |
|
33 | k = createHmac('sha256', k)
|
34 | .update(v)
|
35 | .update(ZERO)
|
36 | .update(x)
|
37 | .update(hash)
|
38 | .digest()
|
39 |
|
40 |
|
41 | v = createHmac('sha256', k).update(v).digest()
|
42 |
|
43 |
|
44 | k = createHmac('sha256', k)
|
45 | .update(v)
|
46 | .update(ONE)
|
47 | .update(x)
|
48 | .update(hash)
|
49 | .digest()
|
50 |
|
51 |
|
52 | v = createHmac('sha256', k).update(v).digest()
|
53 |
|
54 |
|
55 |
|
56 | v = createHmac('sha256', k).update(v).digest()
|
57 |
|
58 | var T = BigInteger.fromBuffer(v)
|
59 |
|
60 |
|
61 | while (T.signum() <= 0 || T.compareTo(secp256k1.n) >= 0 || !checkSig(T)) {
|
62 | k = createHmac('sha256', k)
|
63 | .update(v)
|
64 | .update(ZERO)
|
65 | .digest()
|
66 |
|
67 | v = createHmac('sha256', k).update(v).digest()
|
68 |
|
69 |
|
70 |
|
71 | v = createHmac('sha256', k).update(v).digest()
|
72 | T = BigInteger.fromBuffer(v)
|
73 | }
|
74 |
|
75 | return T
|
76 | }
|
77 |
|
78 | var N_OVER_TWO = secp256k1.n.shiftRight(1)
|
79 |
|
80 | function sign (hash, d) {
|
81 | typeforce(types.tuple(types.Hash256bit, types.BigInt), arguments)
|
82 |
|
83 | var x = d.toBuffer(32)
|
84 | var e = BigInteger.fromBuffer(hash)
|
85 | var n = secp256k1.n
|
86 | var G = secp256k1.G
|
87 |
|
88 | var r, s
|
89 | deterministicGenerateK(hash, x, function (k) {
|
90 | var Q = G.multiply(k)
|
91 |
|
92 | if (secp256k1.isInfinity(Q)) return false
|
93 |
|
94 | r = Q.affineX.mod(n)
|
95 | if (r.signum() === 0) return false
|
96 |
|
97 | s = k.modInverse(n).multiply(e.add(d.multiply(r))).mod(n)
|
98 | if (s.signum() === 0) return false
|
99 |
|
100 | return true
|
101 | })
|
102 |
|
103 |
|
104 | if (s.compareTo(N_OVER_TWO) > 0) {
|
105 | s = n.subtract(s)
|
106 | }
|
107 |
|
108 | return new ECSignature(r, s)
|
109 | }
|
110 |
|
111 | function verify (hash, signature, Q) {
|
112 | typeforce(types.tuple(
|
113 | types.Hash256bit,
|
114 | types.ECSignature,
|
115 | types.ECPoint
|
116 | ), arguments)
|
117 |
|
118 | var n = secp256k1.n
|
119 | var G = secp256k1.G
|
120 |
|
121 | var r = signature.r
|
122 | var s = signature.s
|
123 |
|
124 |
|
125 | if (r.signum() <= 0 || r.compareTo(n) >= 0) return false
|
126 | if (s.signum() <= 0 || s.compareTo(n) >= 0) return false
|
127 |
|
128 |
|
129 |
|
130 | var e = BigInteger.fromBuffer(hash)
|
131 |
|
132 |
|
133 | var sInv = s.modInverse(n)
|
134 |
|
135 |
|
136 |
|
137 | var u1 = e.multiply(sInv).mod(n)
|
138 | var u2 = r.multiply(sInv).mod(n)
|
139 |
|
140 |
|
141 |
|
142 | var R = G.multiplyTwo(u1, Q, u2)
|
143 |
|
144 |
|
145 | if (secp256k1.isInfinity(R)) return false
|
146 |
|
147 |
|
148 | var xR = R.affineX
|
149 |
|
150 |
|
151 | var v = xR.mod(n)
|
152 |
|
153 |
|
154 | return v.equals(r)
|
155 | }
|
156 |
|
157 | module.exports = {
|
158 | deterministicGenerateK: deterministicGenerateK,
|
159 | sign: sign,
|
160 | verify: verify,
|
161 |
|
162 |
|
163 | __curve: secp256k1
|
164 | }
|