diff --git a/Makefile b/Makefile index c2ff2b7..61cb4a5 100644 --- a/Makefile +++ b/Makefile @@ -27,7 +27,7 @@ bench: $(FILES) src/bench.c $(OBJS) $(CC) -fPIC -std=c99 $(CFLAGS) $(CFLAGS_EXTRA) -DNDEBUG -O2 src/bench.c $(OBJS) $(LDFLAGS_EXTRA) -o bench tests: $(FILES) src/tests.c $(OBJS) - $(CC) -std=c99 $(CFLAGS) $(CFLAGS_EXTRA) -DVERIFY -O0 -ggdb3 src/tests.c $(OBJS) $(LDFLAGS_EXTRA) -o tests + $(CC) -std=c99 $(CFLAGS) $(CFLAGS_EXTRA) -DVERIFY -fstack-protector-all -O1 -ggdb3 src/tests.c $(OBJS) $(LDFLAGS_EXTRA) -o tests libsecp256k1.a: obj/secp256k1.o $(OBJS) $(AR) -rs $@ $(OBJS) obj/secp256k1.o diff --git a/src/impl/num_gmp.h b/src/impl/num_gmp.h index a7e0011..52437a2 100644 --- a/src/impl/num_gmp.h +++ b/src/impl/num_gmp.h @@ -42,10 +42,16 @@ int static secp256k1_num_bits(const secp256k1_num_t *a) { void static secp256k1_num_get_bin(unsigned char *r, unsigned int rlen, const secp256k1_num_t *a) { unsigned char tmp[65]; - int len = mpn_get_str(tmp, 256, (mp_limb_t*)a->data, a->limbs); - assert(len <= rlen); - memset(r, 0, rlen - len); - memcpy(r + rlen - len, tmp, len); + int len = 0; + if (a->limbs>1 || a->data[0] != 0) { + len = mpn_get_str(tmp, 256, (mp_limb_t*)a->data, a->limbs); + } + int shift = 0; + while (shift < len && tmp[shift] == 0) shift++; + assert(len-shift <= rlen); + memset(r, 0, rlen - len + shift); + if (len > shift) + memcpy(r + rlen - len + shift, tmp + shift, len - shift); } void static secp256k1_num_set_bin(secp256k1_num_t *r, const unsigned char *a, unsigned int alen) { diff --git a/src/impl/util.h b/src/impl/util.h index a031ed6..881576d 100644 --- a/src/impl/util.h +++ b/src/impl/util.h @@ -15,28 +15,22 @@ static inline uint32_t secp256k1_rand32(void) { static void secp256k1_rand256(unsigned char *b32) { for (int i=0; i<8; i++) { - uint32_t r = secp256k1_rand32(); - b32[i*4 + 0] = (r >> 0) & 0xFF; - b32[i*4 + 1] = (r >> 8) & 0xFF; - b32[i*4 + 2] = (r >> 16) & 0xFF; - b32[i*4 + 3] = (r >> 24) & 0xFF; + uint32_t r1 = secp256k1_rand32(); + b32[i*4 + 0] = (r1 >> 0) & 0xFF; + b32[i*4 + 1] = (r1 >> 8) & 0xFF; + uint32_t r2 = secp256k1_rand32(); + b32[i*4 + 2] = (r2 >> 0) & 0xFF; + b32[i*4 + 3] = (r2 >> 8) & 0xFF; } } static void secp256k1_rand256_test(unsigned char *b32) { int bits=0; - uint32_t ent; - int entbits = 0; memset(b32, 0, 32); while (bits < 256) { - if (entbits < 15) { - ent = secp256k1_rand32(); - entbits = 32; - } + uint32_t ent = secp256k1_rand32(); int now = 1 + ((ent % 64)*((ent >> 6) % 32)+16)/31; uint32_t val = 1 & (ent >> 11); - ent -= 12; - entbits >>= 12; while (now > 0 && bits < 256) { b32[bits / 8] |= val << (bits % 8); now--; diff --git a/src/tests.c b/src/tests.c index 65f0317..8150cb1 100644 --- a/src/tests.c +++ b/src/tests.c @@ -7,10 +7,11 @@ #include "impl/ecdsa.h" #include "impl/util.h" -// #define COUNT 2 -#define COUNT 100 +static int count = 100; -void random_num_order(secp256k1_num_t *num) { +/***** NUM TESTS *****/ + +void random_num_order_test(secp256k1_num_t *num) { do { unsigned char b32[32]; secp256k1_rand256_test(b32); @@ -23,7 +24,110 @@ void random_num_order(secp256k1_num_t *num) { } while(1); } -void test_run_ecmult_chain() { +void random_num_order(secp256k1_num_t *num) { + do { + unsigned char b32[32]; + secp256k1_rand256(b32); + secp256k1_num_set_bin(num, b32, 32); + if (secp256k1_num_is_zero(num)) + continue; + if (secp256k1_num_cmp(num, &secp256k1_ge_consts->order) >= 0) + continue; + break; + } while(1); +} + +void test_num_copy_inc_cmp() { + secp256k1_num_t n1,n2; + secp256k1_num_init(&n1); + secp256k1_num_init(&n2); + random_num_order(&n1); + secp256k1_num_copy(&n2, &n1); + assert(secp256k1_num_cmp(&n1, &n2) == 0); + assert(secp256k1_num_cmp(&n2, &n1) == 0); + secp256k1_num_inc(&n2); + assert(secp256k1_num_cmp(&n1, &n2) != 0); + assert(secp256k1_num_cmp(&n2, &n1) != 0); + secp256k1_num_free(&n1); + secp256k1_num_free(&n2); +} + +void run_num_copy_inc_cmp() { + for (int i=0; i<100*count; i++) + test_num_copy_inc_cmp(); +} + +void test_num_get_set_hex() { + secp256k1_num_t n1,n2; + secp256k1_num_init(&n1); + secp256k1_num_init(&n2); + random_num_order_test(&n1); + char c[64]; + secp256k1_num_get_hex(c, 64, &n1); + secp256k1_num_set_hex(&n2, c, 64); + assert(secp256k1_num_cmp(&n1, &n2) == 0); + for (int i=0; i<64; i++) { + // check whether the lower 4 bits correspond to the last hex character + int low1 = secp256k1_num_shift(&n1, 4); + int lowh = c[63]; + int low2 = (lowh>>6)*9+(lowh-'0')&15; + assert(low1 == low2); + // shift bits off the hex representation, and compare + memmove(c+1, c, 63); + c[0] = '0'; + secp256k1_num_set_hex(&n2, c, 64); + assert(secp256k1_num_cmp(&n1, &n2) == 0); + } + secp256k1_num_free(&n2); + secp256k1_num_free(&n1); +} + +void test_num_get_set_bin() { + secp256k1_num_t n1,n2; + secp256k1_num_init(&n1); + secp256k1_num_init(&n2); + random_num_order_test(&n1); + unsigned char c[32]; + secp256k1_num_get_bin(c, 32, &n1); + secp256k1_num_set_bin(&n2, c, 32); + assert(secp256k1_num_cmp(&n1, &n2) == 0); + for (int i=0; i<32; i++) { + // check whether the lower 8 bits correspond to the last byte + int low1 = secp256k1_num_shift(&n1, 8); + int low2 = c[31]; + assert(low1 == low2); + // shift bits off the byte representation, and compare + memmove(c+1, c, 31); + c[0] = 0; + secp256k1_num_set_bin(&n2, c, 32); + assert(secp256k1_num_cmp(&n1, &n2) == 0); + } + secp256k1_num_free(&n2); + secp256k1_num_free(&n1); +} + +void run_num_get_set() { + for (int i=0; i<100*count; i++) { + test_num_get_set_hex(); + test_num_get_set_bin(); + } +} + +void run_num_int() { + secp256k1_num_t n1; + secp256k1_num_init(&n1); + for (int i=-255; i<256; i++) { + unsigned char c1[3] = {}; + c1[2] = abs(i); + unsigned char c2[3] = {0x11,0x22,0x33}; + secp256k1_num_set_int(&n1, i); + secp256k1_num_get_bin(c2, 3, &n1); + assert(memcmp(c1, c2, 3) == 0); + } + secp256k1_num_free(&n1); +} + +void run_ecmult_chain() { // random starting point A (on the curve) secp256k1_fe_t ax; secp256k1_fe_set_hex(&ax, "8b30bbe9ae2a990696b22f670709dff3727fd8bc04d3362c6c7bf458e2846004", 64); secp256k1_fe_t ay; secp256k1_fe_set_hex(&ay, "a357ae915c4a65281309edf20504740f0eb3343990216b4f81063cb65f2f7e0f", 64); @@ -52,7 +156,7 @@ void test_run_ecmult_chain() { // the point being computed secp256k1_gej_t x = a; const secp256k1_num_t *order = &secp256k1_ge_consts->order; - for (int i=0; i<200*COUNT; i++) { + for (int i=0; i<200*count; i++) { // in each iteration, compute X = xn*X + gn*G; secp256k1_ecmult(&x, &x, &xn, &gn); // also compute ae and ge: the actual accumulated factors for A and G @@ -64,15 +168,19 @@ void test_run_ecmult_chain() { // modify xn and gn secp256k1_num_mod_mul(&xn, &xn, &xf, order); secp256k1_num_mod_mul(&gn, &gn, &gf, order); - } - char res[132]; int resl = 132; - secp256k1_gej_get_hex(res, &resl, &x); - if (COUNT == 100) { - assert(strcmp(res, "(D6E96687F9B10D092A6F35439D86CEBEA4535D0D409F53586440BD74B933E830,B95CBCA2C77DA786539BE8FD53354D2D3B4F566AE658045407ED6015EE1B2A88)") == 0); + + // verify + if (i == 19999) { + char res[132]; int resl = 132; + secp256k1_gej_get_hex(res, &resl, &x); + assert(strcmp(res, "(D6E96687F9B10D092A6F35439D86CEBEA4535D0D409F53586440BD74B933E830,B95CBCA2C77DA786539BE8FD53354D2D3B4F566AE658045407ED6015EE1B2A88)") == 0); + } } // redo the computation, but directly with the resulting ae and ge coefficients: secp256k1_gej_t x2; secp256k1_ecmult(&x2, &a, &ae, &ge); + char res[132]; int resl = 132; char res2[132]; int resl2 = 132; + secp256k1_gej_get_hex(res, &resl, &x); secp256k1_gej_get_hex(res2, &resl2, &x2); assert(strcmp(res, res2) == 0); assert(strlen(res) == 131); @@ -99,7 +207,7 @@ void test_point_times_order(const secp256k1_gej_t *point) { secp256k1_num_free(&zero); } -void test_run_point_times_order() { +void run_point_times_order() { secp256k1_fe_t x; secp256k1_fe_set_hex(&x, "02", 2); for (int i=0; i<500; i++) { secp256k1_gej_t j; secp256k1_gej_set_xo(&j, &x, 1); @@ -143,10 +251,10 @@ void test_wnaf(const secp256k1_num_t *number, int w) { secp256k1_num_free(&t); } -void test_run_wnaf() { +void run_wnaf() { secp256k1_num_t n; secp256k1_num_init(&n); - for (int i=0; i 1) + count = strtol(argv[1], NULL, 0)*50; + + // initialize secp256k1_fe_start(); secp256k1_ge_start(); secp256k1_ecmult_start(); - test_run_wnaf(); - test_run_point_times_order(); - test_run_ecmult_chain(); - test_run_ecdsa_sign_verify(); + // num tests + run_num_copy_inc_cmp(); + run_num_get_set(); + run_num_int(); + // ecmult tests + run_wnaf(); + run_point_times_order(); + run_ecmult_chain(); + + // ecdsa tests + run_ecdsa_sign_verify(); + + // shutdown secp256k1_ecmult_stop(); secp256k1_ge_stop(); secp256k1_fe_stop();