peoplecoin

  1package sig
  2
  3import (
  4	"crypto/ed25519"
  5	"crypto/sha256"
  6	"math/big"
  7	"testing"
  8)
  9
 10func TestSignVerify(t *testing.T) {
 11	kp := FromSeed(sha256.Sum256([]byte("seed")))
 12	msg := sha256.Sum256([]byte("hello"))
 13	s := kp.Sign(msg[:])
 14	if !Verify(kp.Public, msg[:], s) {
 15		t.Fatal("valid signature rejected")
 16	}
 17	if !s.Valid() {
 18		t.Fatal("library signature should be canonical")
 19	}
 20	other := sha256.Sum256([]byte("hellp"))
 21	if Verify(kp.Public, other[:], s) {
 22		t.Fatal("wrong message accepted")
 23	}
 24	s2 := s
 25	s2[5] ^= 1
 26	if Verify(kp.Public, msg[:], s2) {
 27		t.Fatal("tampered signature accepted")
 28	}
 29	kp2 := FromSeed(sha256.Sum256([]byte("seed2")))
 30	if Verify(kp2.Public, msg[:], s) {
 31		t.Fatal("wrong key accepted")
 32	}
 33	g, err := Generate()
 34	if err != nil {
 35		t.Fatal(err)
 36	}
 37	if !Verify(g.Public, msg[:], g.Sign(msg[:])) {
 38		t.Fatal("generated key")
 39	}
 40}
 41
 42func intToLE(x *big.Int) [32]byte {
 43	var out [32]byte
 44	be := x.FillBytes(make([]byte, 32))
 45	for i := range be {
 46		out[31-i] = be[i]
 47	}
 48	return out
 49}
 50
 51// s + L is the classic malleable twin of a valid signature.
 52func TestScalarNonCanonicalRejected(t *testing.T) {
 53	kp := FromSeed(sha256.Sum256([]byte("seed")))
 54	msg := sha256.Sum256([]byte("m"))
 55	s := kp.Sign(msg[:])
 56	var sc [32]byte
 57	copy(sc[:], s[32:])
 58	if !ScalarCanonical(sc) {
 59		t.Fatal("library scalar must be < L")
 60	}
 61	sum := new(big.Int).Add(leToInt(sc), groupL)
 62	bad := s
 63	bumped := intToLE(sum)
 64	copy(bad[32:], bumped[:])
 65	if ScalarCanonical(bumped) || bad.Valid() || Verify(kp.Public, msg[:], bad) {
 66		t.Fatal("s + L must be rejected")
 67	}
 68	// Boundary: L − 1 is canonical, L is not.
 69	if !ScalarCanonical(intToLE(new(big.Int).Sub(groupL, big.NewInt(1)))) {
 70		t.Fatal("L−1 should be canonical")
 71	}
 72	if ScalarCanonical(intToLE(groupL)) {
 73		t.Fatal("L should not be canonical")
 74	}
 75}
 76
 77func TestPointCanonical(t *testing.T) {
 78	one := intToLE(big.NewInt(1))
 79	pm1 := intToLE(pMinus1)
 80	setSign := func(b [32]byte) [32]byte { b[31] |= 0x80; return b }
 81
 82	cases := []struct {
 83		name string
 84		enc  [32]byte
 85		want bool
 86	}{
 87		{"identity (y=1)", one, true},
 88		{"y=1 with sign bit (x=0)", setSign(one), false},
 89		{"y=p−1", pm1, true},
 90		{"y=p−1 with sign bit (x=0)", setSign(pm1), false},
 91		{"y=p (unreduced zero)", intToLE(fieldP), false},
 92		{"y=p with sign bit", setSign(intToLE(fieldP)), false},
 93		{"y=p+1 (unreduced one)", intToLE(new(big.Int).Add(fieldP, big.NewInt(1))), false},
 94		{"all 0xff", func() (b [32]byte) {
 95			for i := range b {
 96				b[i] = 0xff
 97			}
 98			return
 99		}(), false},
100		{"y=0", [32]byte{}, true},
101		{"y=2 with sign bit", setSign(intToLE(big.NewInt(2))), true},
102	}
103	for _, c := range cases {
104		if got := PointCanonical(c.enc); got != c.want {
105			t.Errorf("%s: canonical=%v, want %v", c.name, got, c.want)
106		}
107	}
108	// Real public keys are canonical.
109	for i := 0; i < 50; i++ {
110		kp := FromSeed(sha256.Sum256([]byte{byte(i)}))
111		if !PointCanonical(kp.Public) {
112			t.Fatalf("real key %d judged non-canonical", i)
113		}
114	}
115}
116
117// The identity point has a canonical encoding (y=1) and a non-canonical one
118// (y=1+p). The standard library decodes both; the protocol must reject the
119// latter as R even though the signature equation would be the same. A
120// signature with R = identity verifies only when s·B = k·A, which we can
121// construct for the message by choosing the key and s, so this pins the
122// behaviour end to end: same equation, canonical accepted, non-canonical
123// rejected.
124func TestNonCanonicalRRejectedButDecodable(t *testing.T) {
125	// Sanity: the library accepts the non-canonical encoding as a public
126	// key (i.e. decodes it), which is why the explicit check is needed.
127	nonCanonicalIdentity := intToLE(new(big.Int).Add(fieldP, big.NewInt(1)))
128	canonicalIdentity := intToLE(big.NewInt(1))
129	if PointCanonical(nonCanonicalIdentity) || !PointCanonical(canonicalIdentity) {
130		t.Fatal("identity encodings misjudged")
131	}
132	// Both encodings must behave identically inside the library (decoded
133	// as the same point) for the distinction to matter.
134	kp := FromSeed(sha256.Sum256([]byte("r")))
135	msg := []byte("x")
136	var sigA, sigB [64]byte
137	copy(sigA[:32], canonicalIdentity[:])
138	copy(sigB[:32], nonCanonicalIdentity[:])
139	// With s = 0 the equation [s]B = R + [k]A can hold only if R = −[k]A,
140	// which it does not; both fail in the library. What we check is that
141	// the library treats them the same and that our wrapper adds the
142	// canonicity rejection on top for the second.
143	la := ed25519.Verify(ed25519.PublicKey(kp.Public[:]), msg, sigA[:])
144	lb := ed25519.Verify(ed25519.PublicKey(kp.Public[:]), msg, sigB[:])
145	if la != lb {
146		t.Fatalf("library distinguishes identity encodings: %v vs %v", la, lb)
147	}
148	var sb Signature
149	copy(sb[:], sigB[:])
150	if sb.Valid() {
151		t.Fatal("non-canonical R passed Valid")
152	}
153	var pubBad PublicKey
154	copy(pubBad[:], nonCanonicalIdentity[:])
155	if Verify(pubBad, msg, kp.Sign(msg)) {
156		t.Fatal("non-canonical public key accepted")
157	}
158}