Line data Source code
1 : #ifndef HEADER_fd_src_ballet_secp256r1_fd_secp256r1_h
2 : #define HEADER_fd_src_ballet_secp256r1_fd_secp256r1_h
3 :
4 : /* fd_secp256r1 provides APIs for secp256r1 signature verification. */
5 :
6 : #include "../fd_ballet_base.h"
7 : #include "../sha256/fd_sha256.h"
8 :
9 9287 : #define FD_SECP256R1_SUCCESS 1
10 11181 : #define FD_SECP256R1_FAILURE 0
11 :
12 : FD_PROTOTYPES_BEGIN
13 :
14 : /* fd_secp256r1_public_key_compress validates and compresses an SEC1
15 : uncompressed public key. In particular, this validates both canonical
16 : coordinates and the curve equation before discarding the y coordinate.
17 : Returns FD_SECP256R1_SUCCESS on success and FD_SECP256R1_FAILURE on
18 : failure. */
19 :
20 : int
21 : fd_secp256r1_public_key_compress( uchar compressed[ 33 ],
22 : uchar const uncompressed[ 65 ] );
23 :
24 : /* fd_secp256r1_verify verifies a SECP256r1 signature.
25 : Enforces low-S malleability check (s <= (n-1)/2). */
26 : int
27 : fd_secp256r1_verify( uchar const msg[], /* msg_sz */
28 : ulong msg_sz,
29 : uchar const sig[ 64 ],
30 : uchar const public_key[ 33 ],
31 : fd_sha256_t * sha );
32 :
33 : /* fd_secp256r1_verify_allow_high_s verifies a SECP256r1 signature the
34 : same way as fd_secp256r1_verify() but skips the low-S malleability
35 : check, thus additionally accepting high-S signatures (any s in
36 : (0, n)). */
37 : int
38 : fd_secp256r1_verify_allow_high_s( uchar const msg[], /* msg_sz */
39 : ulong msg_sz,
40 : uchar const sig[ 64 ],
41 : uchar const public_key[ 33 ],
42 : fd_sha256_t * sha );
43 :
44 : /* secp256r1 Syscalls.
45 :
46 : The functions fd_secp256r1_*_syscall are all designed to be invoked
47 : by fd_vm_syscall* and they all follow the same structure.
48 :
49 : Parameters are unaligned byte arrays:
50 : - Point: 64 bytes (coordinates x, y, each 32 bytes), 64 zero bytes
51 : is the point at infinity
52 : - Compressed point: 33 bytes (0x02 or 0x03 prefix, x)
53 : - Scalar: 32 bytes
54 :
55 : The big_endian parameter determines how the byte arrays are read
56 : and written: 1 for big endian, 0 for little endian.
57 :
58 : Return value is 0 on success, -1 on failure.
59 : For *_validate_syscall functions, return value is 1 if the point is valid, 0 otherwise. */
60 :
61 : /* fd_secp256r1_decompress_syscall decompresses the point `a` into `r`.
62 : Input and output are expected to be big endian if big_endian==1,
63 : or little endian if big_endian==0.
64 : The function returns 0 on success, -1 if `a` is not a valid
65 : compressed point. */
66 : int
67 : fd_secp256r1_decompress_syscall( uchar r[ 64 ], /* Point */
68 : uchar const a[ 33 ], /* Compressed point */
69 : int big_endian );
70 :
71 : /* fd_secp256r1_validate_syscall validates the point `a`.
72 : Input is expected to be big endian if big_endian==1,
73 : or little endian if big_endian==0.
74 : The function returns 1 if `a` is a valid point, 0 otherwise. */
75 : int
76 : fd_secp256r1_validate_syscall( uchar const a[ 64 ], /* Point */
77 : int big_endian );
78 :
79 : /* fd_secp256r1_add_syscall computes r = a + b.
80 : Inputs and output are expected to be big endian if big_endian==1,
81 : or little endian if big_endian==0.
82 : The function returns 0 on success, -1 if `a` or `b` are not valid
83 : points. */
84 : int
85 : fd_secp256r1_add_syscall( uchar r[ 64 ], /* Point */
86 : uchar const a[ 64 ], /* Point */
87 : uchar const b[ 64 ], /* Point */
88 : int big_endian );
89 :
90 : /* fd_secp256r1_sub_syscall computes r = a - b.
91 : Inputs and output are expected to be big endian if big_endian==1,
92 : or little endian if big_endian==0.
93 : The function returns 0 on success, -1 if `a` or `b` are not valid
94 : points. */
95 : int
96 : fd_secp256r1_sub_syscall( uchar r[ 64 ], /* Point */
97 : uchar const a[ 64 ], /* Point */
98 : uchar const b[ 64 ], /* Point */
99 : int big_endian );
100 :
101 : /* fd_secp256r1_mul_syscall computes r = n * a.
102 : Inputs and output are expected to be big endian if big_endian==1,
103 : or little endian if big_endian==0.
104 : The function returns 0 on success, -1 if `a` is not a valid point
105 : or `n` is not a valid scalar. */
106 : int
107 : fd_secp256r1_mul_syscall( uchar r[ 64 ], /* Point */
108 : uchar const n[ 32 ], /* Scalar */
109 : uchar const a[ 64 ], /* Point */
110 : int big_endian );
111 :
112 : /* fd_secp256r1_msm_syscall computes r = sum_i n[i] * a[i], over cnt
113 : scalars and points. cnt==0 returns the point at infinity.
114 : Inputs and output are expected to be big endian if big_endian==1,
115 : or little endian if big_endian==0.
116 : The function returns 0 on success, -1 if any `a[i]` is not a valid
117 : point or any `n[i]` is not a valid scalar. */
118 : int
119 : fd_secp256r1_msm_syscall( uchar r[ 64 ], /* Point */
120 : uchar const n[], /* 32*cnt bytes, Scalars */
121 : uchar const a[], /* 64*cnt bytes, Points */
122 : ulong cnt,
123 : int big_endian );
124 :
125 : FD_PROTOTYPES_END
126 :
127 : #endif /* HEADER_fd_src_ballet_secp256r1_fd_secp256r1_h */
|
