1 /*************************************************************************
2 * Written in 2020-2022 by Elichai Turkel *
3 * To the extent possible under law, the author(s) have dedicated all *
4 * copyright and related and neighboring rights to the software in this *
5 * file to the public domain worldwide. This software is distributed *
6 * without any warranty. For the CC0 Public Domain Dedication, see *
7 * EXAMPLES_COPYING or https://creativecommons.org/publicdomain/zero/1.0 *
8 *************************************************************************/
9 10 #include <stdio.h>
11 #include <assert.h>
12 #include <string.h>
13 14 #include <secp256k1.h>
15 16 #include "examples_util.h"
17 18 int main(void) {
19 /* Instead of signing the message directly, we must sign a 32-byte hash.
20 * Here the message is "Hello, world!" and the hash function was SHA-256.
21 * An actual implementation should just call SHA-256, but this example
22 * hardcodes the output to avoid depending on an additional library.
23 * See https://bitcoin.stackexchange.com/questions/81115/if-someone-wanted-to-pretend-to-be-satoshi-by-posting-a-fake-signature-to-defrau/81116#81116 */
24 unsigned char msg_hash[32] = {
25 0x31, 0x5F, 0x5B, 0xDB, 0x76, 0xD0, 0x78, 0xC4,
26 0x3B, 0x8A, 0xC0, 0x06, 0x4E, 0x4A, 0x01, 0x64,
27 0x61, 0x2B, 0x1F, 0xCE, 0x77, 0xC8, 0x69, 0x34,
28 0x5B, 0xFC, 0x94, 0xC7, 0x58, 0x94, 0xED, 0xD3,
29 };
30 unsigned char seckey[32];
31 unsigned char randomize[32];
32 unsigned char compressed_pubkey[33];
33 unsigned char serialized_signature[64];
34 size_t len;
35 int is_signature_valid, is_signature_valid2;
36 int return_val;
37 secp256k1_pubkey pubkey;
38 secp256k1_ecdsa_signature sig;
39 /* Before we can call actual API functions, we need to create a "context". */
40 secp256k1_context* ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
41 if (!fill_random(randomize, sizeof(randomize))) {
42 printf("Failed to generate randomness\n");
43 return 1;
44 }
45 /* Randomizing the context is recommended to protect against side-channel
46 * leakage See `secp256k1_context_randomize` in secp256k1.h for more
47 * information about it. This should never fail. */
48 return_val = secp256k1_context_randomize(ctx, randomize);
49 assert(return_val);
50 51 /*** Key Generation ***/
52 if (!fill_random(seckey, sizeof(seckey))) {
53 printf("Failed to generate randomness\n");
54 return 1;
55 }
56 /* If the secret key is zero or out of range (greater than secp256k1's
57 * order), we fail. Note that the probability of this occurring is negligible
58 * with a properly functioning random number generator. */
59 if (!secp256k1_ec_seckey_verify(ctx, seckey)) {
60 printf("Generated secret key is invalid. This indicates an issue with the random number generator.\n");
61 return 1;
62 }
63 64 /* Public key creation using a valid context with a verified secret key should never fail */
65 return_val = secp256k1_ec_pubkey_create(ctx, &pubkey, seckey);
66 assert(return_val);
67 68 /* Serialize the pubkey in a compressed form(33 bytes). Should always return 1. */
69 len = sizeof(compressed_pubkey);
70 return_val = secp256k1_ec_pubkey_serialize(ctx, compressed_pubkey, &len, &pubkey, SECP256K1_EC_COMPRESSED);
71 assert(return_val);
72 /* Should be the same size as the size of the output, because we passed a 33 byte array. */
73 assert(len == sizeof(compressed_pubkey));
74 75 /*** Signing ***/
76 77 /* Generate an ECDSA signature `noncefp` and `ndata` allows you to pass a
78 * custom nonce function, passing `NULL` will use the RFC-6979 safe default.
79 * Signing with a valid context, verified secret key
80 * and the default nonce function should never fail. */
81 return_val = secp256k1_ecdsa_sign(ctx, &sig, msg_hash, seckey, NULL, NULL);
82 assert(return_val);
83 84 /* Serialize the signature in a compact form. Should always return 1
85 * according to the documentation in secp256k1.h. */
86 return_val = secp256k1_ecdsa_signature_serialize_compact(ctx, serialized_signature, &sig);
87 assert(return_val);
88 89 90 /*** Verification ***/
91 92 /* Deserialize the signature. This will return 0 if the signature can't be parsed correctly. */
93 if (!secp256k1_ecdsa_signature_parse_compact(ctx, &sig, serialized_signature)) {
94 printf("Failed parsing the signature\n");
95 return 1;
96 }
97 98 /* Deserialize the public key. This will return 0 if the public key can't be parsed correctly. */
99 if (!secp256k1_ec_pubkey_parse(ctx, &pubkey, compressed_pubkey, sizeof(compressed_pubkey))) {
100 printf("Failed parsing the public key\n");
101 return 1;
102 }
103 104 /* Verify a signature. This will return 1 if it's valid and 0 if it's not. */
105 is_signature_valid = secp256k1_ecdsa_verify(ctx, &sig, msg_hash, &pubkey);
106 107 printf("Is the signature valid? %s\n", is_signature_valid ? "true" : "false");
108 printf("Secret Key: ");
109 print_hex(seckey, sizeof(seckey));
110 printf("Public Key: ");
111 print_hex(compressed_pubkey, sizeof(compressed_pubkey));
112 printf("Signature: ");
113 print_hex(serialized_signature, sizeof(serialized_signature));
114 115 /* This will clear everything from the context and free the memory */
116 secp256k1_context_destroy(ctx);
117 118 /* Bonus example: if all we need is signature verification (and no key
119 generation or signing), we don't need to use a context created via
120 secp256k1_context_create(). We can simply use the static (i.e., global)
121 context secp256k1_context_static. See its description in
122 include/secp256k1.h for details. */
123 is_signature_valid2 = secp256k1_ecdsa_verify(secp256k1_context_static,
124 &sig, msg_hash, &pubkey);
125 assert(is_signature_valid2 == is_signature_valid);
126 127 /* It's best practice to try to clear secrets from memory after using them.
128 * This is done because some bugs can allow an attacker to leak memory, for
129 * example through "out of bounds" array access (see Heartbleed), or the OS
130 * swapping them to disk. Hence, we overwrite the secret key buffer with zeros.
131 *
132 * Here we are preventing these writes from being optimized out, as any good compiler
133 * will remove any writes that aren't used. */
134 secure_erase(seckey, sizeof(seckey));
135 136 return 0;
137 }
138