Inside Bitcoin

251    if P is None:
252        return False
253    r = int.from_bytes(sig[0:32], 'big')
254    if r >= secp256k1.FE.SIZE:
255        return False
256    s = int.from_bytes(sig[32:64], 'big')
257    if s >= ORDER:
258        return False
259    e = int.from_bytes(TaggedHash("BIP0340/challenge", sig[0:32] + key + msg), 'big') % ORDER
260    R = secp256k1.GE.mul((s, secp256k1.G), (-e, P))
261    if R.infinity or not R.y.is_even():
262        return False
263    if r != R.x:
264        return False
265    return True
266
267def sign_schnorr(key, msg, aux=None, flip_p=False, flip_r=False):
268    """Create a Schnorr signature (see BIP 340)."""
269
270    if aux is None:
271        aux = bytes(32)
272
273    assert_equal(len(key), 32)
274    assert_equal(len(aux), 32)
275
276    sec = int.from_bytes(key, 'big')
277    if sec == 0 or sec >= ORDER:
278        return None
279    P = sec * secp256k1.G
280    if P.y.is_even() == flip_p:
281        sec = ORDER - sec
282    t = (sec ^ int.from_bytes(TaggedHash("BIP0340/aux", aux), 'big')).to_bytes(32, 'big')
283    kp = int.from_bytes(TaggedHash("BIP0340/nonce", t + P.to_bytes_xonly() + msg), 'big') % ORDER
284    assert_not_equal(kp, 0)
285    R = kp * secp256k1.G
286    k = kp if R.y.is_even() != flip_r else ORDER - kp
287    e = int.from_bytes(TaggedHash("BIP0340/challenge", R.to_bytes_xonly() + P.to_bytes_xonly() + msg), 'big') % ORDER
288    return R.to_bytes_xonly() + ((k + e * sec) % ORDER).to_bytes(32, 'big')
289
290
291class TestFrameworkKey(unittest.TestCase):
292    def test_ecdsa_and_schnorr(self):
293        """Test the Python ECDSA and Schnorr implementations."""
294        byte_arrays = [generate_privkey() for _ in range(3)] + [v.to_bytes(32, 'big') for v in [0, ORDER - 1, ORDER, 2**256 - 1]]
295        keys = {}
296        for privkey_bytes in byte_arrays:  # build array of key/pubkey pairs
297            privkey = ECKey()
298            privkey.set(privkey_bytes, compressed=True)
299            if privkey.is_valid:
300                keys[privkey] = privkey.get_pubkey()
301        for msg in byte_arrays:  # test every combination of message, signing key, verification key
302            for sign_privkey, _ in keys.items():
303                sig_ecdsa = sign_privkey.sign_ecdsa(msg)
304                sig_schnorr = sign_schnorr(sign_privkey.get_bytes(), msg)
305                for verify_privkey, verify_pubkey in keys.items():
306                    verify_xonly_pubkey = verify_pubkey.get_bytes()[1:]
307                    if verify_privkey == sign_privkey:
308                        self.assertTrue(verify_pubkey.verify_ecdsa(sig_ecdsa, msg))
309                        self.assertTrue(verify_schnorr(verify_xonly_pubkey, sig_schnorr, msg))
310                        sig_ecdsa = random_bitflip(sig_ecdsa)  # damaging signature should break things
311                        sig_schnorr = random_bitflip(sig_schnorr)
312                    self.assertFalse(verify_pubkey.verify_ecdsa(sig_ecdsa, msg))
313                    self.assertFalse(verify_schnorr(verify_xonly_pubkey, sig_schnorr, msg))
314
315    def test_schnorr_testvectors(self):
316        """Implement the BIP340 test vectors (read from bip340_test_vectors.csv)."""
317        num_tests = 0
318        vectors_file = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'bip340_test_vectors.csv')
319        with open(vectors_file, newline='') as csvfile:
320            reader = csv.reader(csvfile)
321            next(reader)
322            for row in reader:
323                (i_str, seckey_hex, pubkey_hex, aux_rand_hex, msg_hex, sig_hex, result_str, comment) = row
324                i = int(i_str)
325                pubkey = bytes.fromhex(pubkey_hex)
326                msg = bytes.fromhex(msg_hex)
327                sig = bytes.fromhex(sig_hex)
328                result = result_str == 'TRUE'
329                if seckey_hex != '':
330                    seckey = bytes.fromhex(seckey_hex)
331                    pubkey_actual = compute_xonly_pubkey(seckey)[0]
332                    self.assertEqual(pubkey.hex(), pubkey_actual.hex(), "BIP340 test vector %i (%s): pubkey mismatch" % (i, comment))
333                    aux_rand = bytes.fromhex(aux_rand_hex)
334                    try:
335                        sig_actual = sign_schnorr(seckey, msg, aux_rand)
336                        self.assertEqual(sig.hex(), sig_actual.hex(), "BIP340 test vector %i (%s): sig mismatch" % (i, comment))
337                    except RuntimeError as e:
338                        self.fail("BIP340 test vector %i (%s): signing raised exception %s" % (i, comment, e))
339                result_actual = verify_schnorr(pubkey, sig, msg)
340                if result:
341                    self.assertEqual(result, result_actual, "BIP340 test vector %i (%s): verification failed" % (i, comment))
342                else:
343                    self.assertEqual(result, result_actual, "BIP340 test vector %i (%s): verification succeeded unexpectedly" % (i, comment))
344                num_tests += 1
345        self.assertTrue(num_tests >= 15) # expect at least 15 test vectors
346