2019-10-17 13:11:58 +00:00
|
|
|
package crypto
|
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/ecdsa"
|
|
|
|
"crypto/elliptic"
|
|
|
|
"crypto/rand"
|
2019-11-12 13:00:27 +00:00
|
|
|
"crypto/sha512"
|
2019-10-17 13:11:58 +00:00
|
|
|
"crypto/x509"
|
|
|
|
"math/big"
|
|
|
|
|
|
|
|
"github.com/nspcc-dev/neofs-crypto/internal"
|
|
|
|
"github.com/pkg/errors"
|
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
2019-11-12 08:13:12 +00:00
|
|
|
// ErrEmptyPublicKey when PK passed to Verify method is nil.
|
2019-10-17 13:11:58 +00:00
|
|
|
ErrEmptyPublicKey = internal.Error("empty public key")
|
|
|
|
|
2019-11-12 08:13:12 +00:00
|
|
|
// ErrInvalidSignature when signature passed to Verify method is mismatch.
|
2019-10-17 13:11:58 +00:00
|
|
|
ErrInvalidSignature = internal.Error("invalid signature")
|
|
|
|
|
|
|
|
// ErrCannotUnmarshal when signature ([]byte) passed to Verify method has wrong format
|
|
|
|
// and cannot be parsed.
|
|
|
|
ErrCannotUnmarshal = internal.Error("could not unmarshal signature")
|
|
|
|
|
|
|
|
// PrivateKeyCompressedSize is constant with compressed size of private key (SK).
|
|
|
|
// D coordinate stored, recover PK by formula x, y = curve.ScalarBaseMul(d,bytes).
|
|
|
|
PrivateKeyCompressedSize = 32
|
|
|
|
|
|
|
|
// PublicKeyCompressedSize is constant with compressed size of public key (PK).
|
|
|
|
PublicKeyCompressedSize = 33
|
|
|
|
|
|
|
|
// PublicKeyUncompressedSize is constant with uncompressed size of public key (PK).
|
|
|
|
// First byte always should be 0x4 other 64 bytes is X and Y (32 bytes per coordinate).
|
2019-11-12 08:13:12 +00:00
|
|
|
// 2 * 32 + 1
|
2019-10-17 13:11:58 +00:00
|
|
|
PublicKeyUncompressedSize = 65
|
|
|
|
)
|
|
|
|
|
2019-11-12 08:13:12 +00:00
|
|
|
// P256 is base elliptic curve.
|
2019-10-17 13:11:58 +00:00
|
|
|
var curve = elliptic.P256()
|
|
|
|
|
|
|
|
// Marshal converts a points into the uncompressed form specified in section 4.3.6 of ANSI X9.62.
|
|
|
|
func marshalXY(x, y *big.Int) []byte {
|
|
|
|
return elliptic.Marshal(curve, x, y)
|
|
|
|
}
|
|
|
|
|
|
|
|
// unmarshalXY converts a point, serialized by Marshal, into an x, y pair.
|
|
|
|
// It is an error if the point is not in uncompressed form.
|
|
|
|
// On error, x,y = nil.
|
|
|
|
// Unlike the original version of the code, we ignore that x or y not on the curve
|
|
|
|
// --------------
|
|
|
|
// It's copy-paste elliptic.Unmarshal(curve, data) stdlib function, without last line
|
2019-11-12 08:13:12 +00:00
|
|
|
// of code.
|
2019-10-17 13:11:58 +00:00
|
|
|
// Link - https://golang.org/pkg/crypto/elliptic/#Unmarshal
|
|
|
|
func unmarshalXY(data []byte) (x *big.Int, y *big.Int) {
|
|
|
|
if len(data) != PublicKeyUncompressedSize {
|
|
|
|
return
|
|
|
|
} else if data[0] != 4 { // uncompressed form
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
p := curve.Params().P
|
|
|
|
x = new(big.Int).SetBytes(data[1:PublicKeyCompressedSize])
|
|
|
|
y = new(big.Int).SetBytes(data[PublicKeyCompressedSize:])
|
|
|
|
|
|
|
|
if x.Cmp(p) >= 0 || y.Cmp(p) >= 0 {
|
|
|
|
x, y = nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-11-12 08:13:12 +00:00
|
|
|
// MarshalPublicKey to bytes.
|
2019-10-17 13:11:58 +00:00
|
|
|
func MarshalPublicKey(key *ecdsa.PublicKey) []byte {
|
|
|
|
if key == nil || key.X == nil || key.Y == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return encodePoint(key.X, key.Y)
|
|
|
|
}
|
|
|
|
|
2019-11-12 08:13:12 +00:00
|
|
|
// UnmarshalPublicKey from bytes.
|
2019-10-17 13:11:58 +00:00
|
|
|
func UnmarshalPublicKey(data []byte) *ecdsa.PublicKey {
|
2021-02-12 09:07:39 +00:00
|
|
|
if x, y := decodePoint(data); x != nil && y != nil {
|
2019-10-17 13:11:58 +00:00
|
|
|
return &ecdsa.PublicKey{
|
|
|
|
Curve: curve,
|
|
|
|
X: x,
|
|
|
|
Y: y,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-11-12 08:13:12 +00:00
|
|
|
// UnmarshalPrivateKey from bytes.
|
|
|
|
// It is similar to `ecdsa.Generate()` but uses pre-defined big.Int and
|
|
|
|
// curve for NEO Blockchain (elliptic.P256)
|
2019-10-17 13:11:58 +00:00
|
|
|
// Link - https://golang.org/pkg/crypto/ecdsa/#GenerateKey
|
|
|
|
func UnmarshalPrivateKey(data []byte) (*ecdsa.PrivateKey, error) {
|
|
|
|
if len(data) == PrivateKeyCompressedSize { // todo: consider using only NEO blockchain private keys
|
|
|
|
d := new(big.Int).SetBytes(data)
|
|
|
|
priv := new(ecdsa.PrivateKey)
|
|
|
|
priv.PublicKey.Curve = curve
|
|
|
|
priv.D = d
|
|
|
|
priv.PublicKey.X, priv.PublicKey.Y = curve.ScalarBaseMult(data)
|
|
|
|
|
|
|
|
return priv, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return x509.ParseECPrivateKey(data)
|
|
|
|
}
|
|
|
|
|
2019-11-12 08:13:12 +00:00
|
|
|
// MarshalPrivateKey to bytes.
|
2019-10-17 13:11:58 +00:00
|
|
|
func MarshalPrivateKey(key *ecdsa.PrivateKey) []byte {
|
|
|
|
return key.D.Bytes()
|
|
|
|
}
|
|
|
|
|
2019-11-12 13:00:27 +00:00
|
|
|
// hashBytes returns the sha512 sum.
|
2019-10-17 13:11:58 +00:00
|
|
|
func hashBytes(data []byte) []byte {
|
2019-11-12 13:00:27 +00:00
|
|
|
buf := sha512.Sum512(data)
|
2019-10-17 13:11:58 +00:00
|
|
|
return buf[:]
|
|
|
|
}
|
|
|
|
|
2019-11-12 08:13:12 +00:00
|
|
|
// Verify verifies the signature of msg using the public key pub. It returns
|
|
|
|
// nil only if signature is valid.
|
2019-11-12 12:52:13 +00:00
|
|
|
func Verify(pub *ecdsa.PublicKey, msg, sig []byte) error {
|
2021-03-23 07:51:53 +00:00
|
|
|
return VerifyHash(pub, hashBytes(msg), sig)
|
|
|
|
}
|
|
|
|
|
|
|
|
// VerifyHash verifies the signature of msg using it's hash the public key pub.
|
|
|
|
// It returns nil only if signature is valid.
|
|
|
|
func VerifyHash(pub *ecdsa.PublicKey, msgHash, sig []byte) error {
|
|
|
|
if pub == nil {
|
2019-10-17 13:11:58 +00:00
|
|
|
return ErrEmptyPublicKey
|
2021-03-23 07:51:53 +00:00
|
|
|
} else if r, s := unmarshalXY(sig); r == nil || s == nil {
|
|
|
|
return ErrCannotUnmarshal
|
|
|
|
} else if !ecdsa.Verify(pub, msgHash, r, s) {
|
2019-10-17 13:11:58 +00:00
|
|
|
return errors.Wrapf(ErrInvalidSignature, "%0x : %0x", r, s)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-11-12 13:00:27 +00:00
|
|
|
// Sign signs a message using the private key. If the sha512 hash of msg
|
2019-11-12 08:13:12 +00:00
|
|
|
// is longer than the bit-length of the private key's curve order, the hash
|
|
|
|
// will be truncated to that length. It returns the signature as slice bytes.
|
2019-10-17 13:11:58 +00:00
|
|
|
// The security of the private key depends on the entropy of rand.
|
2019-11-12 08:13:12 +00:00
|
|
|
func Sign(key *ecdsa.PrivateKey, msg []byte) ([]byte, error) {
|
2021-03-23 07:51:53 +00:00
|
|
|
return SignHash(key, hashBytes(msg))
|
|
|
|
}
|
|
|
|
|
|
|
|
// SignHash signs message using it's hash and private key.
|
|
|
|
func SignHash(key *ecdsa.PrivateKey, msgHash []byte) ([]byte, error) {
|
|
|
|
x, y, err := ecdsa.Sign(rand.Reader, key, msgHash)
|
2019-10-17 13:11:58 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return marshalXY(x, y), nil
|
|
|
|
}
|